From 32cfea461f19feeadb5e192e4c879cab01676c3b Mon Sep 17 00:00:00 2001
From: BittuBarnwal7479 <bk8379903@gmail.com>
Date: Mon, 3 Aug 2026 05:48:06 +0530
Subject: [PATCH 1/3] feat: show staged publishing status

---
 app/components/Package/Header.vue             | 26 ++++++++---
 app/components/Package/Versions.vue           | 15 ++++++-
 app/components/StagedPublishBadge.vue         | 45 +++++++++++++++++++
 app/pages/package/[[org]]/[name]/versions.vue | 15 +++++++
 app/utils/npm/api.ts                          |  7 ++-
 i18n/locales/en.json                          |  4 ++
 i18n/schema.json                              | 12 +++++
 package.json                                  |  2 +-
 pnpm-lock.yaml                                | 12 ++---
 shared/types/npm-registry.ts                  |  6 ++-
 test/nuxt/components/Package/Versions.spec.ts | 37 ++++++++++++++-
 .../composables/use-package-transform.spec.ts | 28 ++++++++++++
 12 files changed, 191 insertions(+), 18 deletions(-)
 create mode 100644 app/components/StagedPublishBadge.vue

diff --git a/app/components/Package/Header.vue b/app/components/Package/Header.vue
index e01e0dc03b..04fa3ee735 100644
--- a/app/components/Package/Header.vue
+++ b/app/components/Package/Header.vue
@@ -80,10 +80,10 @@ const { copied: copiedPkgVersion, copy: copyPkgVersion } = useClipboard({
   copiedDuring: 2000,
 })
 
-function hasProvenance(version: PackumentVersion | null): boolean {
-  if (!version?.dist) return false
-  return !!(version.dist as { attestations?: unknown }).attestations
-}
+const publishTrustStatus = computed(
+  () =>
+    (props.resolvedVersion && props.pkg?.versions[props.resolvedVersion]?.trustStatus) || undefined,
+)
 
 const { announce } = useCommandPalette()
 
@@ -293,7 +293,23 @@ useShortcuts({
           :tabindex="showScrollToTop ? 0 : -1"
         />
         <div class="flex-inline items-center flex-nowrap gap-1 font-mono text-fg-muted">
-          <template v-if="displayVersion && hasProvenance(displayVersion)">
+          <template v-if="publishTrustStatus?.stagedPublish">
+            <TooltipApp
+              :text="$t('badges.staged_publish.title')"
+              position="bottom"
+              strategy="fixed"
+            >
+              <LinkBase
+                variant="button-secondary"
+                to="https://docs.npmjs.com/staged-publishing/"
+                :aria-label="$t('badges.staged_publish.title')"
+                class="py-1.25 px-2 me-2"
+              >
+                <span class="i-lucide:shield-user" aria-hidden="true" />
+              </LinkBase>
+            </TooltipApp>
+          </template>
+          <template v-if="publishTrustStatus?.provenance">
             <TooltipApp
               :text="
                 provenanceData && provenanceStatus !== 'pending'
diff --git a/app/components/Package/Versions.vue b/app/components/Package/Versions.vue
index cd31b75e87..03316aae49 100644
--- a/app/components/Package/Versions.vue
+++ b/app/components/Package/Versions.vue
@@ -271,7 +271,7 @@ function processLoadedVersions(allVersions: PackageVersionInfo[]) {
         version: v.version,
         time: v.time,
         tags: versionToTags.value.get(v.version),
-        trustStatus: v.trustStatus,
+        trustStatus: props.versions[v.version]?.trustStatus ?? v.trustStatus,
         deprecated: v.deprecated,
       }))
 
@@ -298,7 +298,7 @@ function processLoadedVersions(allVersions: PackageVersionInfo[]) {
       version: v.version,
       time: v.time,
       tags: versionToTags.value.get(v.version),
-      trustStatus: v.trustStatus,
+      trustStatus: props.versions[v.version]?.trustStatus ?? v.trustStatus,
       deprecated: v.deprecated,
     })
   }
@@ -641,6 +641,7 @@ function majorGroupContainsCurrent(group: (typeof otherMajorGroups.value)[0]): b
                 day="numeric"
                 class="text-xs text-fg-subtle"
               />
+              <StagedPublishBadge v-if="row.primaryVersion.trustStatus?.stagedPublish" compact />
               <ProvenanceBadge
                 v-if="row.primaryVersion.trustStatus?.provenance"
                 :package-name="packageName"
@@ -695,6 +696,7 @@ function majorGroupContainsCurrent(group: (typeof otherMajorGroups.value)[0]): b
                   month="short"
                   day="numeric"
                 />
+                <StagedPublishBadge v-if="v.trustStatus?.stagedPublish" compact />
                 <ProvenanceBadge
                   v-if="v.trustStatus?.provenance"
                   :package-name="packageName"
@@ -899,6 +901,10 @@ function majorGroupContainsCurrent(group: (typeof otherMajorGroups.value)[0]): b
                       month="short"
                       day="numeric"
                     />
+                    <StagedPublishBadge
+                      v-if="group.versions[0]?.trustStatus?.stagedPublish"
+                      compact
+                    />
                     <ProvenanceBadge
                       v-if="group.versions[0]?.trustStatus?.provenance"
                       :package-name="packageName"
@@ -966,6 +972,10 @@ function majorGroupContainsCurrent(group: (typeof otherMajorGroups.value)[0]): b
                       month="short"
                       day="numeric"
                     />
+                    <StagedPublishBadge
+                      v-if="group.versions[0]?.trustStatus?.stagedPublish"
+                      compact
+                    />
                     <ProvenanceBadge
                       v-if="group.versions[0]?.trustStatus?.provenance"
                       :package-name="packageName"
@@ -1033,6 +1043,7 @@ function majorGroupContainsCurrent(group: (typeof otherMajorGroups.value)[0]): b
                         month="short"
                         day="numeric"
                       />
+                      <StagedPublishBadge v-if="v.trustStatus?.stagedPublish" compact />
                       <ProvenanceBadge
                         v-if="v.trustStatus?.provenance"
                         :package-name="packageName"
diff --git a/app/components/StagedPublishBadge.vue b/app/components/StagedPublishBadge.vue
new file mode 100644
index 0000000000..4bef785eac
--- /dev/null
+++ b/app/components/StagedPublishBadge.vue
@@ -0,0 +1,45 @@
+<script setup lang="ts">
+const props = withDefaults(
+  defineProps<{
+    compact?: boolean
+    linked?: boolean
+  }>(),
+  { linked: true },
+)
+
+const stagedPublishingDocs = 'https://docs.npmjs.com/staged-publishing/'
+</script>
+
+<template>
+  <a
+    v-if="props.linked !== false"
+    :href="stagedPublishingDocs"
+    target="_blank"
+    rel="noopener noreferrer"
+    class="inline-flex items-center justify-center gap-1 text-xs font-mono text-fg-muted hover:text-fg transition-colors duration-200 min-w-6 min-h-6"
+    :title="$t('badges.staged_publish.title')"
+  >
+    <span
+      class="i-lucide:shield-user shrink-0"
+      :class="compact ? 'w-3.5 h-3.5' : 'w-4 h-4'"
+      aria-hidden="true"
+    />
+    <span v-if="!compact" class="sr-only sm:not-sr-only">
+      {{ $t('badges.staged_publish.label') }}
+    </span>
+  </a>
+  <span
+    v-else
+    class="inline-flex items-center gap-1 text-xs font-mono text-fg-muted"
+    :title="$t('badges.staged_publish.title')"
+  >
+    <span
+      class="i-lucide:shield-user shrink-0"
+      :class="compact ? 'w-3.5 h-3.5' : 'w-4 h-4'"
+      aria-hidden="true"
+    />
+    <span v-if="!compact" class="sr-only sm:not-sr-only">
+      {{ $t('badges.staged_publish.label') }}
+    </span>
+  </span>
+</template>
diff --git a/app/pages/package/[[org]]/[name]/versions.vue b/app/pages/package/[[org]]/[name]/versions.vue
index 8687ccec18..a5245b792a 100644
--- a/app/pages/package/[[org]]/[name]/versions.vue
+++ b/app/pages/package/[[org]]/[name]/versions.vue
@@ -329,6 +329,11 @@ const flatItems = computed<FlatItem[]>(() => {
                 dir="ltr"
                 >v{{ latestTagRow!.version }}</LinkBase
               >
+              <StagedPublishBadge
+                v-if="fullVersionMap?.get(latestTagRow!.version)?.trustStatus?.stagedPublish"
+                compact
+                class="relative z-10"
+              />
               <ProvenanceBadge
                 v-if="fullVersionMap?.get(latestTagRow!.version)?.trustStatus?.provenance"
                 :package-name="packageName"
@@ -403,6 +408,11 @@ const flatItems = computed<FlatItem[]>(() => {
               >
                 v{{ row.version }}
               </LinkBase>
+              <StagedPublishBadge
+                v-if="fullVersionMap?.get(row.version)?.trustStatus?.stagedPublish"
+                compact
+                class="relative z-10"
+              />
               <ProvenanceBadge
                 v-if="fullVersionMap?.get(row.version)?.trustStatus?.provenance"
                 :package-name="packageName"
@@ -617,6 +627,11 @@ const flatItems = computed<FlatItem[]>(() => {
                         >
                           v{{ item.version }}
                         </LinkBase>
+                        <StagedPublishBadge
+                          v-if="fullVersionMap?.get(item.version)?.trustStatus?.stagedPublish"
+                          compact
+                          class="relative z-10"
+                        />
                         <ProvenanceBadge
                           v-if="fullVersionMap?.get(item.version)?.trustStatus?.provenance"
                           :package-name="packageName"
diff --git a/app/utils/npm/api.ts b/app/utils/npm/api.ts
index eccb4fbe1b..c63ffedca4 100644
--- a/app/utils/npm/api.ts
+++ b/app/utils/npm/api.ts
@@ -52,8 +52,11 @@ export async function fetchAllPackageVersions(packageName: string): Promise<Pack
       .map(([version, meta]) => ({
         version,
         time: meta.time,
-        hasProvenance: meta.provenance,
-        hasTrustedPublisher: meta.trustedPublisher,
+        trustStatus: {
+          provenance: !!meta.provenance,
+          trustedPublisher: !!meta.trustedPublisher,
+          stagedPublish: !!meta.staged,
+        },
         deprecated: meta.deprecated,
       }))
       .sort((a, b) => compare(b.version, a.version))
diff --git a/i18n/locales/en.json b/i18n/locales/en.json
index a09e22b59f..a1cd666408 100644
--- a/i18n/locales/en.json
+++ b/i18n/locales/en.json
@@ -1100,6 +1100,10 @@
       "verified_title": "Verified provenance",
       "verified_via": "Verified: published via {provider}"
     },
+    "staged_publish": {
+      "label": "staged publish",
+      "title": "Published through staged publishing with 2FA approval"
+    },
     "jsr": {
       "title": "also available on JSR"
     }
diff --git a/i18n/schema.json b/i18n/schema.json
index b7793e498c..035cf92ca9 100644
--- a/i18n/schema.json
+++ b/i18n/schema.json
@@ -3304,6 +3304,18 @@
           },
           "additionalProperties": false
         },
+        "staged_publish": {
+          "type": "object",
+          "properties": {
+            "label": {
+              "type": "string"
+            },
+            "title": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": false
+        },
         "jsr": {
           "type": "object",
           "properties": {
diff --git a/package.json b/package.json
index 68882eb4f5..a98dd5df8e 100644
--- a/package.json
+++ b/package.json
@@ -85,7 +85,7 @@
     "algoliasearch": "5.55.1",
     "defu": "6.1.7",
     "diff": "^9.0.0",
-    "fast-npm-meta": "2.1.0",
+    "fast-npm-meta": "2.2.0",
     "focus-trap": "^8.0.0",
     "gray-matter": "4.0.3",
     "hls.js": "1.6.16",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b78ed99589..098225339d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -188,8 +188,8 @@ importers:
         specifier: ^9.0.0
         version: 9.0.0
       fast-npm-meta:
-        specifier: 2.1.0
-        version: 2.1.0
+        specifier: 2.2.0
+        version: 2.2.0
       focus-trap:
         specifier: ^8.0.0
         version: 8.2.2
@@ -6857,8 +6857,8 @@ packages:
     resolution: {integrity: sha512-tWhw7z4jFuQgZB9tbQyUh5BY9nNd/wimM+fBLfmmJjakkJDNvbJKm0nQ5ruPKC0us1HGg7L6iBk1fxpSzcgSaA==}
     hasBin: true
 
-  fast-npm-meta@2.1.0:
-    resolution: {integrity: sha512-Nfk1zTQvBmvh1XMxh9VkxMfRLHgv61YlIW80s4l/ZQVUbV4k4M5HjuQLlL8TooYD0AsSl19p4DU63wHZqZ0y9Q==}
+  fast-npm-meta@2.2.0:
+    resolution: {integrity: sha512-99jPl8JkCSCa4VlboNU1XuL98ijm74Pm9CGo6H4BoMVoVh1uhguQcvwLgXDT8Vkl2qj/UEQ0J9gD8beHjTFk1w==}
     hasBin: true
 
   fast-string-truncated-width@1.2.1:
@@ -17862,7 +17862,9 @@ snapshots:
 
   fast-npm-meta@1.5.1: {}
 
-  fast-npm-meta@2.1.0: {}
+  fast-npm-meta@2.2.0:
+    dependencies:
+      cac: 7.0.0
 
   fast-string-truncated-width@1.2.1: {}
 
diff --git a/shared/types/npm-registry.ts b/shared/types/npm-registry.ts
index 97c4d99903..1187e612f5 100644
--- a/shared/types/npm-registry.ts
+++ b/shared/types/npm-registry.ts
@@ -20,7 +20,11 @@ export type { Manifest, ManifestVersion, PackageJSON } from '@npm/types'
 type NpmTrustedPublisherEvidence = NpmSearchTrustedPublisher | NpmTrustedPublisher | true
 
 export interface PackumentVersion extends PackumentVersionWithoutAttestations {
-  _npmUser?: Contact & { trustedPublisher?: NpmTrustedPublisherEvidence }
+  _npmUser?: Contact & {
+    trustedPublisher?: NpmTrustedPublisherEvidence
+    /** Present when the version was released through staged publishing. */
+    approver?: Contact
+  }
   dist: PackumentVersionWithoutAttestations['dist'] & { attestations?: NpmVersionAttestations }
 }
 
diff --git a/test/nuxt/components/Package/Versions.spec.ts b/test/nuxt/components/Package/Versions.spec.ts
index ff8220391b..04ecc5026e 100644
--- a/test/nuxt/components/Package/Versions.spec.ts
+++ b/test/nuxt/components/Package/Versions.spec.ts
@@ -18,14 +18,21 @@ function createVersion(
   options: {
     deprecated?: string
     hasProvenance?: boolean
+    hasStagedPublish?: boolean
   } = {},
 ): SlimVersion {
   return {
     version,
     deprecated: options.deprecated,
     tags: undefined,
-    ...(options.hasProvenance
-      ? { trustStatus: { provenance: true, trustedPublisher: false, stagedPublish: false } }
+    ...(options.hasProvenance || options.hasStagedPublish
+      ? {
+          trustStatus: {
+            provenance: !!options.hasProvenance,
+            trustedPublisher: false,
+            stagedPublish: !!options.hasStagedPublish,
+          },
+        }
       : {}),
   } as SlimVersion
 }
@@ -389,6 +396,32 @@ describe('PackageVersions', () => {
       const provenanceBadge = component.findComponent({ name: 'ProvenanceBadge' })
       expect(provenanceBadge.exists()).toBe(false)
     })
+
+    it('shows staged publishing when a version was approved from staging', async () => {
+      const component = await mountSuspended(PackageVersions, {
+        props: {
+          packageName: 'test-package',
+          versions: {
+            '1.0.0': createVersion('1.0.0', {
+              hasProvenance: true,
+              hasStagedPublish: true,
+            }),
+          },
+          distTags: { latest: '1.0.0' },
+          time: { '1.0.0': '2026-08-03T12:00:00.000Z' },
+        },
+      })
+
+      const badge = component.findComponent({ name: 'StagedPublishBadge' })
+      expect(badge.exists()).toBe(true)
+      expect(badge.get('a').attributes()).toMatchObject({
+        href: 'https://docs.npmjs.com/staged-publishing/',
+        target: '_blank',
+        rel: 'noopener noreferrer',
+        title: 'Published through staged publishing with 2FA approval',
+      })
+      expect(component.findComponent({ name: 'ProvenanceBadge' }).exists()).toBe(true)
+    })
   })
 
   describe('datetime display', () => {
diff --git a/test/nuxt/composables/use-package-transform.spec.ts b/test/nuxt/composables/use-package-transform.spec.ts
index a97e1bc0f8..ba13c3dd5c 100644
--- a/test/nuxt/composables/use-package-transform.spec.ts
+++ b/test/nuxt/composables/use-package-transform.spec.ts
@@ -50,6 +50,16 @@ function createTrustedPublisherWithAttestationsVersion(version: string) {
   }
 }
 
+function createStagedPublishVersion(version: string) {
+  return {
+    ...createVersion(version, true),
+    _npmUser: {
+      name: 'publisher',
+      approver: { name: 'approver' },
+    },
+  }
+}
+
 function createPackument(
   versions: Packument['versions'],
   time: Packument['time'],
@@ -80,6 +90,24 @@ function toVersionInfos(packument: ReturnType<typeof transformPackument>): Packa
 }
 
 describe('transformPackument', () => {
+  it('detects versions released through staged publishing', () => {
+    const packument = createPackument(
+      { '1.0.0': createStagedPublishVersion('1.0.0') },
+      {
+        'created': '2026-08-03T00:00:00.000Z',
+        'modified': '2026-08-03T00:00:00.000Z',
+        '1.0.0': '2026-08-03T00:00:00.000Z',
+      },
+      '1.0.0',
+    )
+
+    expect(transformPackument(packument, '1.0.0').versions['1.0.0']?.trustStatus).toEqual({
+      provenance: true,
+      trustedPublisher: false,
+      stagedPublish: true,
+    })
+  })
+
   it('includes requested old version and preserves provenance on it', () => {
     const packument = createPackument(
       {

From 54759d82204c657ab1a19ad184152c8d114d1f4b Mon Sep 17 00:00:00 2001
From: BittuBarnwal7479 <bk8379903@gmail.com>
Date: Mon, 3 Aug 2026 06:02:33 +0530
Subject: [PATCH 2/3] test: cover staged publish badge accessibility

---
 test/nuxt/a11y.spec.ts | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/test/nuxt/a11y.spec.ts b/test/nuxt/a11y.spec.ts
index 0dc102ac11..30d5acd2e1 100644
--- a/test/nuxt/a11y.spec.ts
+++ b/test/nuxt/a11y.spec.ts
@@ -241,6 +241,7 @@ import {
   PaginationControls,
   ProgressBar,
   ProvenanceBadge,
+  StagedPublishBadge,
   Readme,
   ReadmeTocDropdown,
   SearchProviderToggle,
@@ -1006,6 +1007,22 @@ describe('component accessibility audits', () => {
     })
   })
 
+  describe('StagedPublishBadge', () => {
+    it('should have no accessibility violations with link', async () => {
+      const component = await mountSuspended(StagedPublishBadge)
+      const results = await runAxe(component)
+      expect(results.violations).toEqual([])
+    })
+
+    it('should have no accessibility violations without link', async () => {
+      const component = await mountSuspended(StagedPublishBadge, {
+        props: { linked: false },
+      })
+      const results = await runAxe(component)
+      expect(results.violations).toEqual([])
+    })
+  })
+
   describe('PackageSkeleton', () => {
     it('should have no accessibility violations', async () => {
       const component = await mountSuspended(PackageSkeleton)

From 6d5d307675fc6ce30b84f356d50b452013dd8fd3 Mon Sep 17 00:00:00 2001
From: BittuBarnwal7479 <bk8379903@gmail.com>
Date: Mon, 3 Aug 2026 06:20:13 +0530
Subject: [PATCH 3/3] fix: keep staged publish badges clickable

---
 app/components/Package/Versions.vue | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/app/components/Package/Versions.vue b/app/components/Package/Versions.vue
index 03316aae49..2635d051d9 100644
--- a/app/components/Package/Versions.vue
+++ b/app/components/Package/Versions.vue
@@ -641,7 +641,11 @@ function majorGroupContainsCurrent(group: (typeof otherMajorGroups.value)[0]): b
                 day="numeric"
                 class="text-xs text-fg-subtle"
               />
-              <StagedPublishBadge v-if="row.primaryVersion.trustStatus?.stagedPublish" compact />
+              <StagedPublishBadge
+                v-if="row.primaryVersion.trustStatus?.stagedPublish"
+                compact
+                class="relative z-10"
+              />
               <ProvenanceBadge
                 v-if="row.primaryVersion.trustStatus?.provenance"
                 :package-name="packageName"
@@ -696,7 +700,11 @@ function majorGroupContainsCurrent(group: (typeof otherMajorGroups.value)[0]): b
                   month="short"
                   day="numeric"
                 />
-                <StagedPublishBadge v-if="v.trustStatus?.stagedPublish" compact />
+                <StagedPublishBadge
+                  v-if="v.trustStatus?.stagedPublish"
+                  compact
+                  class="relative z-10"
+                />
                 <ProvenanceBadge
                   v-if="v.trustStatus?.provenance"
                   :package-name="packageName"
@@ -904,6 +912,7 @@ function majorGroupContainsCurrent(group: (typeof otherMajorGroups.value)[0]): b
                     <StagedPublishBadge
                       v-if="group.versions[0]?.trustStatus?.stagedPublish"
                       compact
+                      class="relative z-10"
                     />
                     <ProvenanceBadge
                       v-if="group.versions[0]?.trustStatus?.provenance"
@@ -975,6 +984,7 @@ function majorGroupContainsCurrent(group: (typeof otherMajorGroups.value)[0]): b
                     <StagedPublishBadge
                       v-if="group.versions[0]?.trustStatus?.stagedPublish"
                       compact
+                      class="relative z-10"
                     />
                     <ProvenanceBadge
                       v-if="group.versions[0]?.trustStatus?.provenance"
@@ -1043,7 +1053,11 @@ function majorGroupContainsCurrent(group: (typeof otherMajorGroups.value)[0]): b
                         month="short"
                         day="numeric"
                       />
-                      <StagedPublishBadge v-if="v.trustStatus?.stagedPublish" compact />
+                      <StagedPublishBadge
+                        v-if="v.trustStatus?.stagedPublish"
+                        compact
+                        class="relative z-10"
+                      />
                       <ProvenanceBadge
                         v-if="v.trustStatus?.provenance"
                         :package-name="packageName"