From 72bfc256ebe4962409bff8a2cc6746f26d0b0315 Mon Sep 17 00:00:00 2001
From: btea <2356281422@qq.com>
Date: Mon, 14 Sep 2026 19:27:23 +0800
Subject: [PATCH 1/2] feat: display provenance in version history

---
 app/pages/package/[[org]]/[name]/versions.vue |  8 ++++
 app/utils/npm/api.ts                          |  7 ++-
 test/nuxt/pages/PackageVersionsPage.spec.ts   | 45 +++++++++++++++++--
 3 files changed, 54 insertions(+), 6 deletions(-)

diff --git a/app/pages/package/[[org]]/[name]/versions.vue b/app/pages/package/[[org]]/[name]/versions.vue
index 8687ccec18..fdbe0a0172 100644
--- a/app/pages/package/[[org]]/[name]/versions.vue
+++ b/app/pages/package/[[org]]/[name]/versions.vue
@@ -554,6 +554,14 @@ const flatItems = computed<FlatItem[]>(() => {
                     <span class="text-xs text-fg-muted truncate" :title="item.versions[0]" dir="ltr"
                       >v{{ item.versions[0] }}</span
                     >
+                    <ProvenanceBadge
+                      v-if="fullVersionMap?.get(item.versions[0]!)?.trustStatus?.provenance"
+                      :package-name="packageName"
+                      :version="item.versions[0]!"
+                      compact
+                      :linked="false"
+                      class="relative z-10"
+                    />
                     <span
                       v-if="groupDownloadsMap.has(item.groupKey)"
                       class="ms-auto max-w-32 md:w-32 grid grid-flow-col auto-cols-max items-center justify-end gap-1 text-xs text-fg-muted tabular-nums shrink-0"
diff --git a/app/utils/npm/api.ts b/app/utils/npm/api.ts
index eccb4fbe1b..e6e3b32333 100644
--- a/app/utils/npm/api.ts
+++ b/app/utils/npm/api.ts
@@ -52,8 +52,11 @@ export async function fetchAllPackageVersions(packageName: string): Promise<Pack
       .map(([version, meta]) => ({
         version,
         time: meta.time,
-        hasProvenance: meta.provenance,
-        hasTrustedPublisher: meta.trustedPublisher,
+        trustStatus: {
+          provenance: meta.provenance ?? false,
+          trustedPublisher: meta.trustedPublisher ?? false,
+          stagedPublish: meta.staged ?? false,
+        },
         deprecated: meta.deprecated,
       }))
       .sort((a, b) => compare(b.version, a.version))
diff --git a/test/nuxt/pages/PackageVersionsPage.spec.ts b/test/nuxt/pages/PackageVersionsPage.spec.ts
index 071f5ad692..355da41ee7 100644
--- a/test/nuxt/pages/PackageVersionsPage.spec.ts
+++ b/test/nuxt/pages/PackageVersionsPage.spec.ts
@@ -109,6 +109,27 @@ describe('package versions page', () => {
         expect(component.text()).toContain('beta')
       })
     })
+
+    it('renders provenance badges for versions with provenance metadata', async () => {
+      nextFetchResponse = makeVersionData(['2.0.0', '1.0.0'], { latest: '2.0.0' })
+      mockFetchAllPackageVersions.mockResolvedValue([
+        {
+          version: '2.0.0',
+          time: '2024-01-15T00:00:00.000Z',
+          trustStatus: { provenance: true, trustedPublisher: true, stagedPublish: false },
+        },
+        {
+          version: '1.0.0',
+          time: '2024-01-10T00:00:00.000Z',
+          trustStatus: { provenance: false, trustedPublisher: false, stagedPublish: false },
+        },
+      ])
+      const component = await mountPage()
+
+      await vi.waitFor(() => {
+        expect(component.findAllComponents({ name: 'ProvenanceBadge' })).not.toHaveLength(0)
+      })
+    })
   })
 
   describe('version history groups', () => {
@@ -135,8 +156,16 @@ describe('package versions page', () => {
     it('expands a group and shows version rows on click', async () => {
       nextFetchResponse = makeVersionData(['1.1.0', '1.0.0'], { latest: '1.1.0' })
       mockFetchAllPackageVersions.mockResolvedValue([
-        { version: '1.1.0', time: '2024-01-15T00:00:00.000Z', hasProvenance: false },
-        { version: '1.0.0', time: '2024-01-10T00:00:00.000Z', hasProvenance: false },
+        {
+          version: '1.1.0',
+          time: '2024-01-15T00:00:00.000Z',
+          trustStatus: { provenance: false, trustedPublisher: false, stagedPublish: false },
+        },
+        {
+          version: '1.0.0',
+          time: '2024-01-10T00:00:00.000Z',
+          trustStatus: { provenance: false, trustedPublisher: false, stagedPublish: false },
+        },
       ])
       const component = await mountPage()
       await vi.waitFor(() => expect(component.text()).toContain('1.x'))
@@ -152,8 +181,16 @@ describe('package versions page', () => {
     it('fetches full metadata automatically after phase 1 completes, exactly once', async () => {
       nextFetchResponse = makeVersionData(['2.0.0', '1.0.0'], { latest: '2.0.0' })
       mockFetchAllPackageVersions.mockResolvedValue([
-        { version: '2.0.0', time: '2024-01-15T00:00:00.000Z', hasProvenance: false },
-        { version: '1.0.0', time: '2024-01-10T00:00:00.000Z', hasProvenance: false },
+        {
+          version: '2.0.0',
+          time: '2024-01-15T00:00:00.000Z',
+          trustStatus: { provenance: false, trustedPublisher: false, stagedPublish: false },
+        },
+        {
+          version: '1.0.0',
+          time: '2024-01-10T00:00:00.000Z',
+          trustStatus: { provenance: false, trustedPublisher: false, stagedPublish: false },
+        },
       ])
 
       await mountPage()

From ef1c3f1561a5294d12e6374013b23c26ccea98b8 Mon Sep 17 00:00:00 2001
From: btea <2356281422@qq.com>
Date: Mon, 14 Sep 2026 20:27:01 +0800
Subject: [PATCH 2/2] fix: update

---
 test/nuxt/pages/PackageVersionsPage.spec.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/test/nuxt/pages/PackageVersionsPage.spec.ts b/test/nuxt/pages/PackageVersionsPage.spec.ts
index 355da41ee7..c404017d4f 100644
--- a/test/nuxt/pages/PackageVersionsPage.spec.ts
+++ b/test/nuxt/pages/PackageVersionsPage.spec.ts
@@ -127,7 +127,12 @@ describe('package versions page', () => {
       const component = await mountPage()
 
       await vi.waitFor(() => {
-        expect(component.findAllComponents({ name: 'ProvenanceBadge' })).not.toHaveLength(0)
+        const groupHeader = component
+          .findAll('button[aria-expanded]')
+          .find(button => button.text().includes('2.x'))
+
+        expect(groupHeader).toBeDefined()
+        expect(groupHeader!.findComponent({ name: 'ProvenanceBadge' }).exists()).toBe(true)
       })
     })
   })