fix(ui): use distinct provenance and trusted publishing icons

app/components/DepsStats/DependencyList.vue

@@ -241,7 +241,7 @@ useIntersectionObserver(
                       count: getVulnerableInfo(dep)!.counts.total,
                     })
                   "
-                  classicon="i-lucide:shield-check"
+                  classicon="i-lucide:shield-alert"
                 />
                 <LinkBase
                   v-if="getDeprecatedInfo(dep)"

app/components/Package/Card.vue

@@ -78,11 +78,9 @@ const numberFormatter = useNumberFormatter()
       <span v-html="pkgDescription" />
     </p>
     <div class="flex flex-wrap items-center gap-x-3 sm:gap-x-4 gap-y-2 text-xs text-fg-muted">
-      <ProvenanceBadge
+      <TrustedPublishingBadge
         v-if="result.package.publisher?.trustedPublisher"
         :provider="result.package.publisher.trustedPublisher.id"
-        :package-name="result.package.name"
-        :version="result.package.version"
         :linked="false"
         compact
       />

app/components/Package/Dependencies.vue

@@ -215,7 +215,7 @@ const numberFormatter = useNumberFormatter()
                   count: getVulnerableDepInfo(resolveDepName(dep, version))!.counts.total,
                 })
               "
-              classicon="i-lucide:shield-check"
+              classicon="i-lucide:shield-alert"
             />
             <LinkBase
               v-if="getDeprecatedDepInfo(resolveDepName(dep, version))"

app/components/Package/Header.vue

@@ -316,7 +316,7 @@ useShortcuts({
                 variant="button-secondary"
                 :to="packageRoute(packageName, resolvedVersion, '#provenance')"
                 :aria-label="$t('package.provenance_section.view_more_details')"
-                classicon="i-lucide:shield-check"
+                classicon="i-lucide:fingerprint"
                 class="py-1.25 px-2 me-2"
               />
             </TooltipApp>

app/components/PackageProvenanceSection.vue

@@ -16,7 +16,7 @@ defineProps<{
       <div class="space-y-1">
         <p class="flex items-start gap-2 text-sm text-fg m-0">
           <span
-            class="i-lucide:shield-check w-4 h-4 shrink-0 text-emerald-500 mt-0.5"
+            class="i-lucide:fingerprint w-4 h-4 shrink-0 text-emerald-500 mt-0.5"
             aria-hidden="true"
           />
           <i18n-t keypath="package.provenance_section.built_and_signed_on" tag="span">

app/components/ProvenanceBadge.stories.ts

@@ -4,14 +4,7 @@ import ProvenanceBadge from './ProvenanceBadge.vue'
 const meta = {
   component: ProvenanceBadge,
   tags: ['autodocs'],
-  argTypes: {
-    provider: {
-      control: 'select',
-      options: ['github', 'gitlab', undefined],
-    },
-  },
   args: {
-    provider: 'github',
     packageName: 'example-package',
     version: '1.0.0',
   },
@@ -30,23 +23,9 @@ export const Compact: Story = {
   },
 }
 
-/** Built on GitLab CI rather than GitHub Actions. */
-export const GitLab: Story = {
-  args: {
-    provider: 'gitlab',
-  },
-}
-
 /** Rendered as static text (no link) when `linked` is false. */
 export const NotLinked: Story = {
   args: {
     linked: false,
   },
 }
-
-/** Without a provider, it shows a generic "verified" title. */
-export const NoProvider: Story = {
-  args: {
-    provider: undefined,
-  },
-}

app/components/ProvenanceBadge.vue

@@ -1,7 +1,5 @@
 <script setup lang="ts">
-const props = defineProps<{
-  /** Provider ID (e.g., "github", "gitlab") */
-  provider?: string
+defineProps<{
   /** Package name for linking to npmjs.com provenance page */
   packageName?: string
   /** Package version for linking */
@@ -11,19 +9,6 @@ const props = defineProps<{
   /** Whether to render as a link (defaults to true when packageName and version are provided) */
   linked?: boolean
 }>()
-
-const providerLabels: Record<string, string> = {
-  github: 'GitHub Actions',
-  gitlab: 'GitLab CI',
-}
-
-const title = computed(() =>
-  props.provider
-    ? $t('badges.provenance.verified_via', {
-        provider: providerLabels[props.provider] ?? props.provider,
-      })
-    : $t('badges.provenance.verified_title'),
-)
 </script>
 
 <template>
@@ -33,19 +18,27 @@ const title = computed(() =>
     target="_blank"
     rel="noopener noreferrer"
     class="inline-flex items-center justify-center gap-1 text-xs font-mono text-fg-muted hover:text-fg transition-colors duration-200 min-w-6 min-h-6"
-    :title="title"
+    :title="$t('badges.provenance.verified_title')"
   >
-    <span class="i-lucide:shield-check shrink-0" :class="compact ? 'w-3.5 h-3.5' : 'w-4 h-4'" />
+    <span
+      class="i-lucide:fingerprint shrink-0"
+      :class="compact ? 'w-3.5 h-3.5' : 'w-4 h-4'"
+      aria-hidden="true"
+    />
     <span v-if="!compact" class="sr-only sm:not-sr-only">{{
       $t('badges.provenance.verified')
     }}</span>
   </a>
   <span
     v-else
     class="inline-flex items-center gap-1 text-xs font-mono text-fg-muted"
-    :title="title"
+    :title="$t('badges.provenance.verified_title')"
   >
-    <span class="i-lucide:shield-check shrink-0" :class="compact ? 'w-3.5 h-3.5' : 'w-4 h-4'" />
+    <span
+      class="i-lucide:fingerprint shrink-0"
+      :class="compact ? 'w-3.5 h-3.5' : 'w-4 h-4'"
+      aria-hidden="true"
+    />
     <span v-if="!compact" class="sr-only sm:not-sr-only">{{
       $t('badges.provenance.verified')
     }}</span>

app/components/TrustedPublishingBadge.stories.ts

@@ -0,0 +1,50 @@
+import type { Meta, StoryObj } from '@storybook-vue/nuxt'
+import TrustedPublishingBadge from './TrustedPublishingBadge.vue'
+
+const meta = {
+  component: TrustedPublishingBadge,
+  tags: ['autodocs'],
+  argTypes: {
+    provider: {
+      control: 'select',
+      options: ['github', 'gitlab', undefined],
+    },
+  },
+  args: {
+    provider: 'github',
+  },
+} satisfies Meta<typeof TrustedPublishingBadge>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+/** Links to the npm trusted publishing docs. */
+export const Default: Story = {}
+
+/** Icon-only variant for tight spaces, as used on search result cards. */
+export const Compact: Story = {
+  args: {
+    compact: true,
+  },
+}
+
+/** Published from GitLab CI rather than GitHub Actions. */
+export const GitLab: Story = {
+  args: {
+    provider: 'gitlab',
+  },
+}
+
+/** Rendered as static text (no link) when `linked` is false. */
+export const NotLinked: Story = {
+  args: {
+    linked: false,
+  },
+}
+
+/** Without a provider, it shows a generic title. */
+export const NoProvider: Story = {
+  args: {
+    provider: undefined,
+  },
+}

app/components/TrustedPublishingBadge.vue

@@ -0,0 +1,62 @@
+<script setup lang="ts">
+const props = withDefaults(
+  defineProps<{
+    /** Provider ID (e.g., "github", "gitlab") */
+    provider?: string
+    /** Whether to show as compact (icon only) or full (with text) */
+    compact?: boolean
+    /** Whether to render as a link to the npm trusted publishing docs */
+    linked?: boolean
+  }>(),
+  { linked: true },
+)
+
+const trustedPublishingDocs = 'https://docs.npmjs.com/trusted-publishers'
+
+const providerLabels: Record<string, string> = {
+  github: 'GitHub Actions',
+  gitlab: 'GitLab CI',
+}
+
+const title = computed(() =>
+  props.provider
+    ? $t('badges.trusted_publishing.title_via', {
+        provider: providerLabels[props.provider] ?? props.provider,
+      })
+    : $t('badges.trusted_publishing.title'),
+)
+</script>
+
+<template>
+  <a
+    v-if="props.linked !== false"
+    :href="trustedPublishingDocs"
+    target="_blank"
+    rel="noopener noreferrer"
+    class="inline-flex items-center justify-center gap-1 text-xs font-mono text-fg-muted hover:text-fg transition-colors duration-200 min-w-6 min-h-6"
+    :title="title"
+  >
+    <span
+      class="i-lucide:shield-check shrink-0"
+      :class="compact ? 'w-3.5 h-3.5' : 'w-4 h-4'"
+      aria-hidden="true"
+    />
+    <span v-if="!compact" class="sr-only sm:not-sr-only">
+      {{ $t('badges.trusted_publishing.label') }}
+    </span>
+  </a>
+  <span
+    v-else
+    class="inline-flex items-center gap-1 text-xs font-mono text-fg-muted"
+    :title="title"
+  >
+    <span
+      class="i-lucide:shield-check shrink-0"
+      :class="compact ? 'w-3.5 h-3.5' : 'w-4 h-4'"
+      aria-hidden="true"
+    />
+    <span v-if="!compact" class="sr-only sm:not-sr-only">
+      {{ $t('badges.trusted_publishing.label') }}
+    </span>
+  </span>
+</template>

i18n/locales/ar.json

@@ -662,8 +662,7 @@
   "badges": {
     "provenance": {
       "verified": "موثّق",
-      "verified_title": "مصدر موثّق",
-      "verified_via": "موثّق: تم النشر عبر {provider}"
+      "verified_title": "مصدر موثّق"
     },
     "jsr": {
       "title": "متوفر أيضًا على JSR"

i18n/locales/az-AZ.json

@@ -776,8 +776,7 @@
   "badges": {
     "provenance": {
       "verified": "təsdiqlənmiş",
-      "verified_title": "Təsdiqlənmiş mənşə",
-      "verified_via": "Təsdiqlənmiş: {provider} vasitəsilə dərc edilib"
+      "verified_title": "Təsdiqlənmiş mənşə"
     },
     "jsr": {
       "title": "JSR-də də mövcuddur"

i18n/locales/bg-BG.json

@@ -732,8 +732,7 @@
   "badges": {
     "provenance": {
       "verified": "потвърден",
-      "verified_title": "Потвърден произход",
-      "verified_via": "Потвърдено: публикувано чрез {provider}"
+      "verified_title": "Потвърден произход"
     },
     "jsr": {
       "title": "налично също в JSR"

i18n/locales/bn-IN.json

@@ -1081,8 +1081,7 @@
   "badges": {
     "provenance": {
       "verified": "যাচাইকৃত",
-      "verified_title": "যাচাইকৃত প্রোভেন্স",
-      "verified_via": "যাচাইকৃত: {provider} এর মাধ্যমে প্রকাশিত"
+      "verified_title": "যাচাইকৃত প্রোভেন্স"
     },
     "jsr": {
       "title": "JSR-এও উপলব্ধ"

i18n/locales/cs-CZ.json

@@ -1071,8 +1071,7 @@
   "badges": {
     "provenance": {
       "verified": "ověřeno",
-      "verified_title": "Ověřený původ",
-      "verified_via": "Ověřeno: publikováno přes {provider}"
+      "verified_title": "Ověřený původ"
     },
     "jsr": {
       "title": "také dostupné na JSR"

i18n/locales/de.json

@@ -1028,8 +1028,7 @@
   "badges": {
     "provenance": {
       "verified": "verifiziert",
-      "verified_title": "Verifizierter Herkunftsnachweis",
-      "verified_via": "Verifiziert: veröffentlicht via {provider}"
+      "verified_title": "Verifizierter Herkunftsnachweis"
     },
     "jsr": {
       "title": "auch auf JSR verfügbar"

i18n/locales/en.json

@@ -1190,13 +1190,17 @@
   "badges": {
     "provenance": {
       "verified": "verified",
-      "verified_title": "Verified provenance",
-      "verified_via": "Verified: published via {provider}"
+      "verified_title": "Verified provenance"
     },
     "staged_publish": {
       "label": "staged publish",
       "title": "Published through staged publishing with 2FA approval"
     },
+    "trusted_publishing": {
+      "label": "trusted publishing",
+      "title": "Published with trusted publishing",
+      "title_via": "Published with trusted publishing via {provider}"
+    },
     "jsr": {
       "title": "also available on JSR"
     }

i18n/locales/es.json

@@ -1082,8 +1082,7 @@
   "badges": {
     "provenance": {
       "verified": "verificado",
-      "verified_title": "Procedencia verificada",
-      "verified_via": "Verificado: publicado vía {provider}"
+      "verified_title": "Procedencia verificada"
     },
     "jsr": {
       "title": "también disponible en JSR"

i18n/locales/fr-FR.json

@@ -1061,8 +1061,7 @@
   "badges": {
     "provenance": {
       "verified": "vérifié",
-      "verified_title": "Provenance vérifiée",
-      "verified_via": "Vérifié : publié via {provider}"
+      "verified_title": "Provenance vérifiée"
     },
     "jsr": {
       "title": "aussi disponible sur JSR"

i18n/locales/hi-IN.json

@@ -826,8 +826,7 @@
   "badges": {
     "provenance": {
       "verified": "सत्यापित",
-      "verified_title": "सत्यापित प्रोवेनेंस",
-      "verified_via": "सत्यापित: {provider} के माध्यम से प्रकाशित"
+      "verified_title": "सत्यापित प्रोवेनेंस"
     },
     "jsr": {
       "title": "JSR पर भी उपलब्ध"

i18n/locales/hu-HU.json

@@ -732,8 +732,7 @@
   "badges": {
     "provenance": {
       "verified": "ellenőrzött",
-      "verified_title": "Ellenőrzött eredet",
-      "verified_via": "Ellenőrizve: {provider} által közzétéve"
+      "verified_title": "Ellenőrzött eredet"
     },
     "jsr": {
       "title": "a JSR-en is elérhető"

i18n/locales/id-ID.json

@@ -846,8 +846,7 @@
   "badges": {
     "provenance": {
       "verified": "terverifikasi",
-      "verified_title": "Provenans terverifikasi",
-      "verified_via": "Terverifikasi: diterbitkan via {provider}"
+      "verified_title": "Provenans terverifikasi"
     },
     "jsr": {
       "title": "juga tersedia di JSR"