antfu · antfu · Aug 9, 2025 · Aug 6, 2025 · Aug 6, 2025 · Aug 6, 2025
diff --git a/packages/node-modules-inspector/src/app/components/panel/PackageDetails.vue b/packages/node-modules-inspector/src/app/components/panel/PackageDetails.vue
@@ -1,13 +1,13 @@
 <script setup lang="ts">
 import type { PackageNode } from 'node-modules-tools'
 import { useRouter } from '#app/composables/router'
-import { Menu as VMenu } from 'floating-vue'
+import { Tooltip, Menu as VMenu } from 'floating-vue'
 import { computed, nextTick, watch } from 'vue'
 import { getBackend } from '../../backends'
 import { selectedNode } from '../../state/current'
 import { fetchPublintMessages, rawPublintMessages } from '../../state/data'
 import { filters } from '../../state/filters'
-import { getDeprecatedInfo, getNpmMetaLatest, getPublishTime, payloads } from '../../state/payload'
+import { getDeprecatedInfo, getNpmMeta, getNpmMetaLatest, getPublishTime, payloads } from '../../state/payload'
 import { query } from '../../state/query'
 import { settings } from '../../state/settings'
 import { getPackageData } from '../../utils/package-json'
@@ -101,6 +101,7 @@ function getShallowestDependents(pkg: PackageNode) {
   return dependents.filter(x => x.depth === minDepth)
 }
 
+const meta = computed(() => getNpmMeta(props.pkg))
 const latestMeta = computed(() => getNpmMetaLatest(props.pkg))
 const deprecation = computed(() => getDeprecatedInfo(props.pkg))
 
@@ -207,11 +208,23 @@ const thirdPartyServices = computed(() => {
     </div>
 
     <div flex="~ col gap-2" p5 pb2>
-      <DisplayPackageName
-        :name="pkg.name"
-        font-mono text-2xl flex="~ wrap items-center gap-2" pr20
-        :class="deprecation?.latest ? deprecation.type === 'future' ? 'text-orange line-through' : 'text-red line-through' : ''"
-      />
+      <div flex gap2 items-center>
+        <DisplayPackageName
+          :name="pkg.name"
+          :provenance="meta?.provenance"
+          font-mono text-2xl flex="~ wrap items-center gap-2"
+          :class="deprecation?.latest ? deprecation.type === 'future' ? 'text-orange line-through' : 'text-red line-through' : ''"
+        />
+
+        <Tooltip v-if="meta?.provenance">
+          <div i-ph:circle-wavy-check-duotone text-primary-400 text-sm />
+          <template #popper>
+            This package is built and signed
+            {{ meta.provenance === 'trustedPublisher' ? 'by trusted publisher' : 'with provenance' }}
+          </template>
+        </Tooltip>
+      </div>
+
       <div text-sm op-fade line-clamp-3 text-ellipsis mt--1 mb1>
         {{ pkg.resolved?.packageJson?.description }}
       </div>

diff --git a/packages/node-modules-inspector/src/app/pages/grid/[...grid].vue b/packages/node-modules-inspector/src/app/pages/grid/[...grid].vue
@@ -3,12 +3,12 @@ import type { PackageModuleType, PackageNode } from 'node-modules-tools'
 import { useRoute } from '#app/composables/router'
 import { computed } from 'vue'
 import SafeImage from '@/components/display/SafeImage.vue'
-import { payloads } from '../../state/payload'
+import { getNpmMeta, payloads } from '../../state/payload'
 import { getModuleType } from '../../utils/module-type'
 import { getAuthors, getPackageData, getRepository } from '../../utils/package-json'
 
 const params = useRoute().params as Record<string, string>
-const tab = computed<'depth' | 'clusters' | 'module-type' | 'authors' | 'licenses' | 'github'>(() => params.grid[0] as any || 'depth')
+const tab = computed<'depth' | 'clusters' | 'module-type' | 'authors' | 'licenses' | 'github' | 'provenance'>(() => params.grid[0] as any || 'depth')
 
 const location = window.location
 
@@ -120,6 +120,28 @@ const groups = computed<Group[]>(() => {
         expanded: false,
       }))
   }
+  else if (tab.value === 'provenance') {
+    const map = new Map<'Trusted Publisher' | 'Provenance' | 'None', PackageNode[]>([
+      ['Trusted Publisher', []],
+      ['Provenance', []],
+      ['None', []],
+    ])
+    for (const pkg of payloads.filtered.packages) {
+      const meta = getNpmMeta(pkg)
+      const provenance = meta?.provenance === 'trustedPublisher'
+        ? 'Trusted Publisher'
+        : meta?.provenance === true ? 'Provenance' : 'None'
+      map.get(provenance)!.push(pkg)
+    }
+
+    return [...map.entries()]
+      .map(([provenance, packages]) => ({
+        name: provenance,
+        provenance,
+        packages,
+        expanded: provenance !== 'None',
+      }))
+  }
   else {
     const map = new Map<number, PackageNode[]>()
 
@@ -173,6 +195,10 @@ const groups = computed<Group[]>(() => {
         <div i-ph-users-duotone />
         GitHub Slug
       </NuxtLink>
+      <NuxtLink btn-action as="button" :to="{ path: '/grid/provenance', hash: location.hash }" active-class="text-primary bg-primary:5">
+        <div i-ph:circle-wavy-check-duotone />
+        Provenance
+      </NuxtLink>
     </div>
 
     <GridExpand

diff --git a/packages/node-modules-inspector/src/shared/version-info.ts b/packages/node-modules-inspector/src/shared/version-info.ts
@@ -77,8 +77,8 @@ export async function getPackagesNpmMeta(
   } = await fetchBatch(unknown, async (r) => {
     const spec = `${r.name}@${r.version}`
     const meta: NpmMeta = {
+      ...r,
       publishedAt: new Date(r.publishedAt!).getTime(),
-      deprecated: r.deprecated,
     }
     map.set(spec, meta)
     await storage.setItem(spec, meta)
@@ -140,6 +140,7 @@ export async function getPackagesNpmMetaLatest(
       publishedAt,
       deprecated: r.deprecated,
       version: r.version!,
+      provenance: r.provenance,
       fetechedAt: Date.now(),
       vaildUntil: Date.now() + ttl,
     }

diff --git a/packages/node-modules-tools/src/types/node.ts b/packages/node-modules-tools/src/types/node.ts
@@ -66,6 +66,7 @@ export interface PackageNode extends PackageNodeBase {
 export interface NpmMeta {
   publishedAt: number
   deprecated?: string
+  provenance?: 'trustedPublisher' | boolean
 }
 
 /**

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
@@ -19,7 +19,7 @@ catalogs:
     ansis: ^4.1.0
     birpc: ^2.4.0
     cac: ^6.7.14
-    fast-npm-meta: ^0.4.3
+    fast-npm-meta: ^0.4.6
     get-port-please: ^3.1.2
     h3: ^1.15.3
     js-yaml: ^4.1.0