feat: show staged publishing status

[BittuBarnwal7479]

🔗 Linked issue

fixes: #3114

🧭 Context

📚 Description

Adds a linked indicator for package versions published through npm’s staged publishing flow. Also updates version metadata handling and adds test coverage.

Recording.2026-08-03.055544.mp4

• Added coverage for detecting staged releases from registry metadata
• Added component coverage for the linked staged-publishing badge
• Ran 66 focused Nuxt tests successfully
• Ran lint and formatting checks

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
npmx.dev	Ready	Preview	Sep 13, 2026 9:29am UTC

2 Skipped Deployments

Project	Deployment	Actions	Updated
docs.npmx.dev	Ignored	Preview	Sep 13, 2026 9:29am UTC
npmx-lunaria	Ignored		Sep 13, 2026 9:29am UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 968dfa8a-242a-4320-86d4-125aead2d07e

📥 Commits

Reviewing files that changed from the base of the PR and between 6d5d307 and 0ac6c3c.

📒 Files selected for processing (5)

• app/components/Package/Header.vue
• i18n/locales/en.json
• i18n/schema.json
• shared/types/npm-registry.ts
• test/nuxt/a11y.spec.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• i18n/locales/en.json

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• New Features

  • Added staged-publishing badges to package headers, version lists and version pages.
  • Badges can link to npm documentation and include accessible labels and titles.
  • Package trust indicators now show provenance, trusted publisher and staged-publishing status together.

• Bug Fixes

  • Trust badges now consistently reflect the selected package version’s metadata.

• Removed

  • Removed the package comparison link and keyboard shortcut from package headers.

Walkthrough

The package metadata model now exposes staged-publishing trust status. Package headers, version lists, and version pages render a reusable staged-publishing badge with translated text and npm documentation links.

Changes

Staged publish visibility

Layer / File(s)	Summary
Trust status data model app/utils/npm/api.ts, shared/types/npm-registry.ts, test/nuxt/composables/use-package-transform.spec.ts	Version metadata now groups provenance, trusted publisher, and staged publishing under trustStatus. Registry types support approver data and string repositories.
Staged publish badge app/components/StagedPublishBadge.vue, i18n/locales/en.json, i18n/schema.json, test/nuxt/a11y.spec.ts	The new badge supports compact, linked, and unlinked rendering. Localised text and accessibility coverage were added.
Package trust rendering app/components/Package/Header.vue, app/components/Package/Versions.vue, app/pages/package/[[org]]/[name]/versions.vue	Package headers and version displays render the badge when trustStatus.stagedPublish is set. Provenance now uses resolved trust status.
Rendering validation test/nuxt/components/Package/Versions.spec.ts	Tests verify staged-publishing badge output, provenance display, and npm documentation link attributes.

Sequence Diagram(s)

sequenceDiagram
  participant PackageMetadata
  participant PackageViews
  participant StagedPublishBadge
  participant NpmDocumentation
  PackageMetadata->>PackageViews: provide trustStatus.stagedPublish
  PackageViews->>StagedPublishBadge: render badge
  StagedPublishBadge->>NpmDocumentation: open documentation link

Loading

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 0ac6c

Requested historical package versions retain their staged-publishing and provenance metadata for badge rendering. No concrete merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	app/components/Package/Header.vue also removes the package comparison keyboard shortcut and link. Issue #3114 does not request this removal, and the change is not required to detect or display stage…	Restore the package comparison keyboard shortcut and link, or move their removal to a separate pull request with its own requirement.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: displaying staged publishing status.
Description check	✅ Passed	The description directly explains the staged publishing indicator, metadata updates, test coverage, and validation performed.
Linked Issues check	✅ Passed	PR #3114 requires detection of staged publishing and display of that information. app/utils/npm/api.ts maps registry meta.staged to trustStatus.stagedPublish. Header.vue, Versions.vue, and t…

Full details: Out of Scope Changes check

Explanation

app/components/Package/Header.vue also removes the package comparison keyboard shortcut and link. Issue #3114 does not request this removal, and the change is not required to detect or display staged publishing. The staged-publishing changes themselves remain within scope.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Lunaria Status Overview

🌕 This pull request will trigger status changes.

Learn more

By default, every PR changing files present in the Lunaria configuration's files property will be considered and trigger status changes accordingly.

You can change this by adding one of the keywords present in the ignoreKeywords property in your Lunaria configuration file in the PR's title (ignoring all files) or by including a tracker directive in the merged commit's description.

Tracked Files

File	Note
i18n/locales/en.json	Source changed, localizations will be marked as outdated.

Warnings reference

Icon	Description
🔄️	The source for this localization has been updated since the creation of this pull request, make sure all changes in the source have been applied.

[codecov]

Codecov Report

❌ Patch coverage is 42.85714% with 4 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
app/components/Package/Header.vue	25.00%	1 Missing and 2 partials ⚠️
app/components/StagedPublishBadge.vue	66.66%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[github-actions]

e18e dependency analysis

No dependency warnings found.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@app/components/Package/Versions.vue`:
- Line 644: Update every StagedPublishBadge occurrence identified in this diff,
including the instances near the current row and the additional listed
locations, to include the relative z-10 classes so the badge remains above the
full-row link hit target and its documentation links stay clickable.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 73d03b63-4e54-4481-bdd8-9834008f4b8d

📥 Commits

Reviewing files that changed from the base of the PR and between ac8e171 and 32cfea4.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (11)

• app/components/Package/Header.vue
• app/components/Package/Versions.vue
• app/components/StagedPublishBadge.vue
• app/pages/package/[[org]]/[name]/versions.vue
• app/utils/npm/api.ts
• i18n/locales/en.json
• i18n/schema.json
• package.json
• shared/types/npm-registry.ts
• test/nuxt/components/Package/Versions.spec.ts
• test/nuxt/composables/use-package-transform.spec.ts

[ghostdevv]

I think that we should show this information in the timeline, as well as the notices on the package homepage that show when a package now has staged publishing. We could also show it in the versions list maybe with an additional badge alongside provenance - wdyt @gameroman?

(This might make sense to do over multiple PRs)

[gameroman]

I think that we should show this information in the timeline, as well as the notices on the package homepage that show when a package now has staged publishing. We could also show it in the versions list maybe with an additional badge alongside provenance - wdyt @gameroman?

(This might make sense to do over multiple PRs)

Yeah, I think we can add it to the timeline in a separate PR

[BittuBarnwal7479]

I think that we should show this information in the timeline, as well as the notices on the package homepage that show when a package now has staged publishing. We could also show it in the versions list maybe with an additional badge alongside provenance - wdyt @gameroman?

(This might make sense to do over multiple PRs)

yep, you’re right. Adding staged publishing information to the timeline is outside the focused scope of this issue. If it sounds good to the other reviewers, I can open a separate PR for it. thanks for review!

[agentscanapp]

Thanks for opening this pull request! 🎉

We really appreciate you taking the time to contribute, @BittuBarnwal7479.

A maintainer will take a look as soon as they can. In the meantime, please make sure that:

• the description explains what changed and why
• any related issues are linked
• existing tests still pass

If anything needs adjusting we'll leave comments here. Thanks again!

[gameroman]

I think the staged indicator is too close to the line below it and that it should be same height as the provenance indicator