feat: add trust/provenance

Aw yeah!

Author: 43081j

app/pages/package-timeline/[[org]]/[packageName].vue

@@ -240,6 +240,40 @@ const versionSubEvents = computed(() => {
       })
     }
 
+    // Trusted publisher changes
+    if (current.hasTrustedPublisher && !previous.hasTrustedPublisher) {
+      events.push({
+        key: 'trustedPublisher',
+        positive: true,
+        icon: 'i-lucide:shield-check',
+        text: t('package.timeline.trusted_publisher_added'),
+      })
+    } else if (!current.hasTrustedPublisher && previous.hasTrustedPublisher) {
+      events.push({
+        key: 'trustedPublisher',
+        positive: false,
+        icon: 'i-lucide:shield-off',
+        text: t('package.timeline.trusted_publisher_removed'),
+      })
+    }
+
+    // Provenance changes
+    if (current.hasProvenance && !previous.hasProvenance) {
+      events.push({
+        key: 'provenance',
+        positive: true,
+        icon: 'i-lucide:fingerprint',
+        text: t('package.timeline.provenance_added'),
+      })
+    } else if (!current.hasProvenance && previous.hasProvenance) {
+      events.push({
+        key: 'provenance',
+        positive: false,
+        icon: 'i-lucide:fingerprint',
+        text: t('package.timeline.provenance_removed'),
+      })
+    }
+
     if (events.length) {
       result.set(current.version, events)
     }

i18n/locales/en.json

@@ -455,7 +455,11 @@
       "esm_added": "Module type changed to ESM",
       "esm_removed": "Module type changed from ESM to CJS",
       "types_added": "TypeScript types added",
-      "types_removed": "TypeScript types removed"
+      "types_removed": "TypeScript types removed",
+      "trusted_publisher_added": "Trusted publishing enabled",
+      "trusted_publisher_removed": "Trusted publishing removed",
+      "provenance_added": "Provenance enabled",
+      "provenance_removed": "Provenance removed"
     },
     "dependencies": {
       "title": "Dependency ({count}) | Dependencies ({count})",

i18n/schema.json

@@ -1371,6 +1371,18 @@
             },
             "types_removed": {
               "type": "string"
+            },
+            "trusted_publisher_added": {
+              "type": "string"
+            },
+            "trusted_publisher_removed": {
+              "type": "string"
+            },
+            "provenance_added": {
+              "type": "string"
+            },
+            "provenance_removed": {
+              "type": "string"
             }
           },
           "additionalProperties": false

server/api/registry/timeline/[...pkg].get.ts

@@ -8,6 +8,8 @@ export interface TimelineVersion {
   license?: string
   type?: string
   hasTypes?: boolean
+  hasTrustedPublisher?: boolean
+  hasProvenance?: boolean
   tags: string[]
 }
 
@@ -71,6 +73,8 @@ export default defineCachedEventHandler(
             license: typeof license === 'string' ? license : undefined,
             type: typeof version.type === 'string' ? version.type : undefined,
             hasTypes: hasBuiltInTypes(version) || undefined,
+            hasTrustedPublisher: version._npmUser?.trustedPublisher ? true : undefined,
+            hasProvenance: version.dist?.attestations ? true : undefined,
             tags: tagsByVersion.get(v) ?? [],
           }
         })