@kb-labs/release-manager-core 2.119.0-canary.e120bc0ee → 2.119.0

package/dist/index.d.ts

@@ -124,6 +124,16 @@ interface CustomCheckConfig {
      * If omitted, check runs in each package directory (original behaviour).
      */
     runIn?: 'repoRoot' | 'scopePath' | 'perPackage';
+    /**
+     * Package name patterns (same matcher as PackagesFilter.exclude) skipped
+     * by this check only — unlike `packages.exclude`, the package still gets
+     * discovered, packed, versioned, and published normally by the rest of
+     * the release. Use this for a check whose assumption doesn't hold for a
+     * specific package (e.g. `pack-install`'s bare top-level import against a
+     * config-only or test-harness-only package), not as a substitute for
+     * excluding the package from the release itself.
+     */
+    skipPackages?: string[];
 }
 interface ReleaseResult {
     ok: boolean;
@@ -664,6 +674,60 @@ declare function resolveFlowFromTag(config: ReleaseConfig, tag: string): {
     channel: ReleaseChannel;
 } | null;
 
+/**
+ * Release status — a read-only "what is actually true right now" view for a
+ * flow, cross-checking the surfaces that the 2026-08-13 release-system audit
+ * found drifting apart independently: the latest stable git tag, and the
+ * real npm dist-tags packages currently resolve to.
+ *
+ * This does not replace the receipt/state-machine model from the breaking
+ * control-plane cutover plan — it is the cheap, non-breaking piece of that
+ * diagnosis that can ship today: make "a tag/npm entry exists" and "this was
+ * actually verified and promoted" visibly different without any new storage.
+ */
+
+interface NpmDistTagInfo {
+    name: string;
+    stableVersion: string | null;
+    canaryVersion: string | null;
+    error?: string;
+}
+interface StableTagInfo {
+    tag: string | null;
+    version: string | null;
+    commit: string | null;
+    committedAt: string | null;
+}
+interface FlowReleaseStatus {
+    flow: string;
+    packages: string[];
+    git: StableTagInfo;
+    npm: {
+        registry: string;
+        stableDistTag: string;
+        canaryDistTag: string;
+        perPackage: NpmDistTagInfo[];
+        /** Agreed version across all sampled packages, or null if they disagree or none resolved. */
+        stableVersion: string | null;
+        canaryVersion: string | null;
+        stableDrift: boolean;
+        canaryDrift: boolean;
+    };
+    verdict: {
+        ok: boolean;
+        warnings: string[];
+    };
+}
+interface ComputeFlowReleaseStatusOptions {
+    cwd: string;
+    config: ReleaseConfig;
+    flow: string;
+    shell: ShellAPI;
+    /** How many of the flow's packages to sample against npm. Lockstep flows only need enough to detect drift. Default 3. */
+    maxPackagesToCheck?: number;
+}
+declare function computeFlowReleaseStatus(opts: ComputeFlowReleaseStatusOptions): Promise<FlowReleaseStatus>;
+
 /**
  * Unified release pipeline — single orchestrator for CLI and REST.
  *
@@ -733,8 +797,11 @@ interface CheckRunnerOptions {
  * the tarball and runs a real `npm install` of it into a throwaway consumer
  * per package. At higher concurrency those installs contend for CPU/disk/npm
  * registry and start blowing their own per-check timeout under load.
+ *
+ * Overridable via KB_RELEASE_CHECKS_CONCURRENCY for profiling/tuning without
+ * a source edit + rebuild; the default (2) is unchanged when unset.
  */
-declare const CHECKS_CONCURRENCY = 2;
+declare const CHECKS_CONCURRENCY: number;
 /**
  * Run all configured checks against packages.
  * Handles: parser evaluation, script path resolution, perPackage/scopePath/repoRoot routing.
@@ -820,6 +887,13 @@ interface VerifyAgainstRegistryOptions {
      * Default: 0 (single attempt, matches pre-existing Verdaccio behavior).
      */
     retries?: number;
+    /**
+     * Total time to wait for npm metadata and tarballs to propagate after a
+     * publish. When provided this supersedes the legacy fixed retry count, so
+     * an idempotent re-run resumes verification of already-published tarballs
+     * instead of requiring a new publish or a workflow-owned sleep.
+     */
+    visibilityDeadlineMs?: number;
     retryDelaysMs?: readonly number[];
     logger?: Pick<PluginLogger, 'info' | 'warn'>;
 }
@@ -853,8 +927,15 @@ interface CleanInstallResult {
  * Install `tarballPath` into a throwaway consumer project (outside the
  * monorepo workspace, so pnpm's workspace resolution can't mask a problem)
  * and confirm `packageName` can actually be imported afterward.
+ *
+ * `registry`, when set, overrides where the consumer resolves ALL
+ * dependencies from (not just `packageName` itself) — used by the
+ * `pack-install` release gate to point at a local staging registry that
+ * carries the release plan's not-yet-published internal sibling versions.
+ * Third-party dependencies still resolve correctly through that registry's
+ * uplink to the real npm registry.
  */
-declare function verifyCleanInstall(tarballPath: string, packageName: string, additionalTarballs?: string[], packageManager?: 'pnpm' | 'npm'): Promise<CleanInstallResult>;
+declare function verifyCleanInstall(tarballPath: string, packageName: string, additionalTarballs?: string[], packageManager?: 'pnpm' | 'npm', registry?: string): Promise<CleanInstallResult>;
 
 /**
  * Scope utilities — resolve scope name to filesystem path.
@@ -880,4 +961,4 @@ declare function verifyCleanInstall(tarballPath: string, packageName: string, ad
  */
 declare function resolveScopePath(repoRoot: string, scope: string): Promise<string>;
 
-export { type AuditSummary, type BuildConfig, type BuildResult, CHECKS_CONCURRENCY, type ChangelogGenerator, type CheckId, type CheckResult, type CheckResultDetails, type CleanInstallResult, type CustomCheckConfig, DEFAULT_ROOT_CHANGELOG_PATH, DEFAULT_TAG_PATTERN, type FlowConfig, type PackagePublisher, type PackageVersion, type PackagesFilter, type PipelineOptions, type PipelineResult, type PlannerOptions, type PluginLogger, type PublishResult, type PublishablePackage, type ReleaseChannel, type ReleaseConfig, type ReleaseContext, type ReleasePlan, type ReleaseReport, type ReleaseResult, type ReleaseShell, type ReleaseStage, type RollbackSnapshot, type StrategyOptions, type VerifyResult, type VersionBump, type VersionStrategy, applyCanarySuffix, applyVersionStrategy, buildPackages, buildReleaseTag, commitAndTagRelease, copyChangelogToPackages, createExecaShellAdapter, discoverCurrentPackages, findForbiddenDependencyProtocols, isBuildCommand, isVersionPublished, matchesPackagePattern, mergeConfigWithFlow, mergeRootChangelog, planRelease, renderJson, renderMarkdown, renderText, resolveFlowFromTag, resolvePublishRegistry, resolvePublishTag, resolveRootChangelogRelPath, resolveScopePath, restoreSnapshot, runReleaseChecks, runReleasePipeline, runSafeBuild, saveSnapshot, updatePackageVersion, updatePackageVersions, verifyAgainstRegistry, verifyCleanInstall, verifyExtractedTarball, verifyPackage, verifyPackages };
+export { type AuditSummary, type BuildConfig, type BuildResult, CHECKS_CONCURRENCY, type ChangelogGenerator, type CheckId, type CheckResult, type CheckResultDetails, type CleanInstallResult, type ComputeFlowReleaseStatusOptions, type CustomCheckConfig, DEFAULT_ROOT_CHANGELOG_PATH, DEFAULT_TAG_PATTERN, type FlowConfig, type FlowReleaseStatus, type NpmDistTagInfo, type PackagePublisher, type PackageVersion, type PackagesFilter, type PipelineOptions, type PipelineResult, type PlannerOptions, type PluginLogger, type PublishResult, type PublishablePackage, type ReleaseChannel, type ReleaseConfig, type ReleaseContext, type ReleasePlan, type ReleaseReport, type ReleaseResult, type ReleaseShell, type ReleaseStage, type RollbackSnapshot, type StableTagInfo, type StrategyOptions, type VerifyResult, type VersionBump, type VersionStrategy, applyCanarySuffix, applyVersionStrategy, buildPackages, buildReleaseTag, commitAndTagRelease, computeFlowReleaseStatus, copyChangelogToPackages, createExecaShellAdapter, discoverCurrentPackages, findForbiddenDependencyProtocols, isBuildCommand, isVersionPublished, matchesPackagePattern, mergeConfigWithFlow, mergeRootChangelog, planRelease, renderJson, renderMarkdown, renderText, resolveFlowFromTag, resolvePublishRegistry, resolvePublishTag, resolveRootChangelogRelPath, resolveScopePath, restoreSnapshot, runReleaseChecks, runReleasePipeline, runSafeBuild, saveSnapshot, updatePackageVersion, updatePackageVersions, verifyAgainstRegistry, verifyCleanInstall, verifyExtractedTarball, verifyPackage, verifyPackages };

package/dist/index.js

@@ -1050,6 +1050,133 @@ function resolvePublishRegistry(config, channel) {
   }
   return config.registry ?? DEFAULT_NPM_REGISTRY;
 }
+
+// src/status.ts
+var SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)/;
+function compareSemver(a, b) {
+  const ma = a.match(SEMVER_RE);
+  const mb = b.match(SEMVER_RE);
+  if (!ma || !mb) {
+    return 0;
+  }
+  for (let i = 1; i <= 3; i++) {
+    const diff = Number(ma[i]) - Number(mb[i]);
+    if (diff !== 0) {
+      return diff;
+    }
+  }
+  return 0;
+}
+function escapeRegex2(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+async function fetchDistTags(name, registry) {
+  try {
+    const encoded = name.startsWith("@") ? `@${encodeURIComponent(name.slice(1))}` : name;
+    const url = `${registry.replace(/\/$/, "")}/${encoded}`;
+    const res = await fetch(url, {
+      headers: { Accept: "application/vnd.npm.install-v1+json" },
+      signal: AbortSignal.timeout(8e3)
+    });
+    if (!res.ok) {
+      return { error: `HTTP ${res.status}` };
+    }
+    const body = await res.json();
+    return body["dist-tags"] ?? {};
+  } catch (err) {
+    return { error: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function findLatestStableTag(shell, cwd, flowName, tagPattern) {
+  const empty = { tag: null, version: null, commit: null, committedAt: null };
+  const prefix = tagPattern.split("{version}")[0]?.replace("{flow}", flowName) ?? `${flowName}-v`;
+  const listRes = await shell.exec("git", ["tag", "-l", `${prefix}*`], { cwd });
+  const tags = listRes.stdout.split("\n").map((t) => t.trim()).filter(Boolean);
+  if (tags.length === 0) {
+    return empty;
+  }
+  const versionRe = new RegExp(`^${escapeRegex2(prefix)}(\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?)$`);
+  const parsed = tags.map((t) => ({ tag: t, version: t.match(versionRe)?.[1] })).filter((t) => Boolean(t.version));
+  if (parsed.length === 0) {
+    return empty;
+  }
+  parsed.sort((a, b) => compareSemver(a.version, b.version));
+  const latest = parsed[parsed.length - 1];
+  const [shaRes, dateRes] = await Promise.all([
+    shell.exec("git", ["rev-list", "-n", "1", latest.tag], { cwd }),
+    shell.exec("git", ["log", "-1", "--format=%cI", latest.tag], { cwd })
+  ]);
+  return {
+    tag: latest.tag,
+    version: latest.version,
+    commit: shaRes.stdout.trim() || null,
+    committedAt: dateRes.stdout.trim() || null
+  };
+}
+async function computeFlowReleaseStatus(opts) {
+  const { cwd, config, flow, shell, maxPackagesToCheck = 3 } = opts;
+  const flowConfig = mergeConfigWithFlow(config, flow);
+  const tagPattern = config.flows?.[flow]?.tagPattern ?? DEFAULT_TAG_PATTERN;
+  const packages = await discoverCurrentPackages(cwd, void 0, flowConfig);
+  const registry = resolvePublishRegistry(config, "canary");
+  const stableDistTag = resolvePublishTag(config, "stable");
+  const canaryDistTag = resolvePublishTag(config, "canary");
+  const sampled = packages.slice(0, maxPackagesToCheck);
+  const perPackage = [];
+  for (const pkg of sampled) {
+    const result = await fetchDistTags(pkg.name, registry);
+    if ("error" in result) {
+      perPackage.push({ name: pkg.name, stableVersion: null, canaryVersion: null, error: result.error });
+    } else {
+      perPackage.push({
+        name: pkg.name,
+        stableVersion: result[stableDistTag] ?? null,
+        canaryVersion: result[canaryDistTag] ?? null
+      });
+    }
+  }
+  const stableVersions = new Set(perPackage.map((p) => p.stableVersion).filter((v) => Boolean(v)));
+  const canaryVersions = new Set(perPackage.map((p) => p.canaryVersion).filter((v) => Boolean(v)));
+  const git = await findLatestStableTag(shell, cwd, flow, tagPattern);
+  const warnings = [];
+  if (stableVersions.size > 1) {
+    warnings.push(`Packages disagree on npm "${stableDistTag}" version: ${[...stableVersions].join(", ")}`);
+  }
+  if (canaryVersions.size > 1) {
+    warnings.push(`Packages disagree on npm "${canaryDistTag}" version: ${[...canaryVersions].join(", ")}`);
+  }
+  const stableVersion = stableVersions.size === 1 ? [...stableVersions][0] : null;
+  const canaryVersion = canaryVersions.size === 1 ? [...canaryVersions][0] : null;
+  if (git.version && stableVersion && git.version !== stableVersion) {
+    warnings.push(
+      `Latest git tag ${git.tag} (${git.version}) does not match npm "${stableDistTag}" (${stableVersion})`
+    );
+  }
+  if (stableVersion && canaryVersion && compareSemver(canaryVersion, stableVersion) > 0) {
+    warnings.push(
+      `npm "${canaryDistTag}" (${canaryVersion}) is ahead of "${stableDistTag}" (${stableVersion}) \u2014 treat as an unverified candidate, not a release, until it has a green delivery + smoke run and has been explicitly promoted`
+    );
+  }
+  return {
+    flow,
+    packages: packages.map((p) => p.name),
+    git,
+    npm: {
+      registry,
+      stableDistTag,
+      canaryDistTag,
+      perPackage,
+      stableVersion,
+      canaryVersion,
+      stableDrift: stableVersions.size > 1,
+      canaryDrift: canaryVersions.size > 1
+    },
+    verdict: {
+      ok: warnings.length === 0,
+      warnings
+    }
+  };
+}
 function buildIntraDeps(packages, nameSet) {
   const deps = /* @__PURE__ */ new Map();
   for (const pkg of packages) {
@@ -1198,7 +1325,7 @@ async function executeCommand(shell, command, args, cwd, timeoutMs, env) {
     exitCode
   };
 }
-var CHECKS_CONCURRENCY = 2;
+var CHECKS_CONCURRENCY = Number(process.env.KB_RELEASE_CHECKS_CONCURRENCY) || 2;
 async function runReleaseChecks(checks, options) {
   const results = [];
   for (const check of checks) {
@@ -1221,33 +1348,72 @@ async function runSingleCheck(check, options) {
   } else {
     pathsToRun = options.packagePaths.length > 0 ? options.packagePaths : [options.repoRoot];
   }
+  if (runIn === "perPackage" && check.skipPackages?.length) {
+    const skipPatterns = check.skipPackages;
+    pathsToRun = pathsToRun.filter((pkgPath) => {
+      const name = readPackageName(pkgPath);
+      const skip = name != null && matchesPackagePattern(name, pkgPath, skipPatterns);
+      if (skip) {
+        options.logger?.info?.(`Check ${check.id}: skipping ${name} (matches skipPackages)`);
+      }
+      return !skip;
+    });
+  }
   const resolvedArgs = (check.args ?? []).map(
     (arg) => arg.match(/\.(sh|js|ts|mjs|cjs)$/) ? join(options.repoRoot, arg) : arg
   );
   const timeoutMs = check.timeoutMs ?? 12e4;
-  async function runForPath(pkgPath) {
+  async function runForPath(pkgPath, attempt = 1) {
     const startedAt = Date.now();
-    const result = await options.shell.exec(check.command, resolvedArgs, { cwd: pkgPath, timeout: timeoutMs });
-    const ok = evaluateParser(check, result.stdout, result.stderr, result.code);
-    return {
-      path: pkgPath,
-      ok,
-      durationMs: Date.now() - startedAt,
-      details: {
-        packagePath: pkgPath,
-        stdout: result.stdout || void 0,
-        stderr: result.stderr || void 0,
-        exitCode: result.code,
-        error: !ok ? `exit code ${result.code}` : void 0
+    try {
+      const result = await options.shell.exec(check.command, resolvedArgs, { cwd: pkgPath, timeout: timeoutMs });
+      const ok = evaluateParser(check, result.stdout, result.stderr, result.code);
+      return {
+        path: pkgPath,
+        ok,
+        durationMs: Date.now() - startedAt,
+        details: {
+          packagePath: pkgPath,
+          stdout: result.stdout || void 0,
+          stderr: result.stderr || void 0,
+          exitCode: result.code,
+          error: !ok ? `exit code ${result.code}` : void 0
+        }
+      };
+    } catch (error) {
+      if (attempt === 1 && isTimeoutError(error)) {
+        const partial2 = partialResultOf(error);
+        options.logger?.warn?.(
+          `Check ${check.id}: ${pkgPath} timed out, retrying once` + (partial2?.stdout || partial2?.stderr ? ` (captured ${partial2.stdout?.length ?? 0}B stdout / ${partial2.stderr?.length ?? 0}B stderr before kill)` : "")
+        );
+        return runForPath(pkgPath, attempt + 1);
       }
-    };
+      const partial = partialResultOf(error);
+      return {
+        path: pkgPath,
+        ok: false,
+        durationMs: Date.now() - startedAt,
+        details: {
+          packagePath: pkgPath,
+          stdout: partial?.stdout || void 0,
+          stderr: partial?.stderr || void 0,
+          exitCode: partial?.exitCode,
+          error: error instanceof Error ? error.message : String(error)
+        }
+      };
+    }
   }
   let pkgResults;
-  if (runIn === "perPackage" && pathsToRun.length > 1) {
+  if (pathsToRun.length === 0) {
+    pkgResults = [];
+  } else if (runIn === "perPackage" && pathsToRun.length > 1) {
     pkgResults = [];
     for (let i = 0; i < pathsToRun.length; i += CHECKS_CONCURRENCY) {
       const batch = pathsToRun.slice(i, i + CHECKS_CONCURRENCY);
       pkgResults.push(...await Promise.all(batch.map(runForPath)));
+      options.logger?.info?.(
+        `Check ${check.id}: ${Math.min(i + CHECKS_CONCURRENCY, pathsToRun.length)}/${pathsToRun.length} packages checked`
+      );
     }
   } else {
     pkgResults = [await runForPath(pathsToRun[0])];
@@ -1266,6 +1432,36 @@ async function runSingleCheck(check, options) {
     packages: perPackage && perPackage.length > 0 ? perPackage : void 0
   };
 }
+function isTimeoutError(error) {
+  return typeof error === "object" && error !== null && error.code === "PROCESS_TIMEOUT";
+}
+function partialResultOf(error) {
+  if (typeof error !== "object" || error === null) {
+    return void 0;
+  }
+  const details = error.details;
+  if (typeof details !== "object" || details === null) {
+    return void 0;
+  }
+  const result = details.result;
+  if (typeof result !== "object" || result === null) {
+    return void 0;
+  }
+  const r = result;
+  return {
+    stdout: typeof r.stdout === "string" ? r.stdout : void 0,
+    stderr: typeof r.stderr === "string" ? r.stderr : void 0,
+    exitCode: typeof r.code === "number" ? r.code : void 0
+  };
+}
+function readPackageName(pkgPath) {
+  try {
+    const pkg = JSON.parse(readFileSync(join(pkgPath, "package.json"), "utf8"));
+    return typeof pkg.name === "string" ? pkg.name : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function evaluateParser(check, stdout, stderr, exitCode) {
   const parser = check.parser ?? "exitcode";
   if (parser === "exitcode") {
@@ -1486,31 +1682,35 @@ async function verifyAgainstRegistry(packages, options) {
   const { registry, timeout = DEFAULT_TIMEOUT_MS, retries = 0, retryDelaysMs = DEFAULT_POLL_RETRY_DELAYS_MS, logger } = options;
   const results = [];
   for (const pkg of packages) {
-    results.push(await verifyOneAgainstRegistry(pkg, registry, timeout, retries, retryDelaysMs, logger));
+    results.push(await verifyOneAgainstRegistry(pkg, registry, timeout, retries, retryDelaysMs, options.visibilityDeadlineMs, logger));
   }
   return results;
 }
-async function waitUntilPublished(pkg, registry, retries, retryDelaysMs, logger) {
-  for (let attempt = 0; attempt <= retries; attempt++) {
+async function waitUntilPublished(pkg, registry, retries, retryDelaysMs, visibilityDeadlineMs, logger) {
+  const deadline = visibilityDeadlineMs === void 0 ? void 0 : Date.now() + visibilityDeadlineMs;
+  for (let attempt = 0; deadline === void 0 ? attempt <= retries : Date.now() <= deadline; attempt++) {
     if (await isVersionPublished(pkg.name, pkg.version, registry)) {
       return true;
     }
-    if (attempt < retries) {
+    if (deadline === void 0 ? attempt < retries : Date.now() < deadline) {
       const delay = retryDelaysMs[Math.min(attempt, retryDelaysMs.length - 1)];
+      const remaining = deadline === void 0 ? void 0 : deadline - Date.now();
+      const waitMs = remaining === void 0 ? delay : Math.min(delay, Math.max(0, remaining));
       logger?.warn?.(
-        `${pkg.name}@${pkg.version} not yet visible on ${registry} (attempt ${attempt + 1}/${retries + 1}), retrying in ${(delay / 1e3).toFixed(0)}s \u2014 likely registry propagation lag`
+        `${pkg.name}@${pkg.version} not yet visible on ${registry} (attempt ${attempt + 1}${deadline === void 0 ? `/${retries + 1}` : ""}), retrying in ${(waitMs / 1e3).toFixed(0)}s${remaining === void 0 ? "" : `; ${(Math.max(0, remaining) / 1e3).toFixed(0)}s remain`} \u2014 likely registry propagation lag`
       );
       await new Promise((r) => {
-        setTimeout(r, delay);
+        setTimeout(r, waitMs);
       });
     }
   }
   return false;
 }
-async function verifyOneAgainstRegistry(pkg, registry, timeout, retries, retryDelaysMs, logger) {
-  const published = await waitUntilPublished(pkg, registry, retries, retryDelaysMs, logger);
+async function verifyOneAgainstRegistry(pkg, registry, timeout, retries, retryDelaysMs, visibilityDeadlineMs, logger) {
+  const published = await waitUntilPublished(pkg, registry, retries, retryDelaysMs, visibilityDeadlineMs, logger);
   if (!published) {
-    return { name: pkg.name, success: false, issues: [`${pkg.name}@${pkg.version} was not found on ${registry} after publish (waited through ${retries} retr${retries === 1 ? "y" : "ies"})`] };
+    const waited = visibilityDeadlineMs === void 0 ? `waited through ${retries} retr${retries === 1 ? "y" : "ies"}` : `visibility deadline of ${(visibilityDeadlineMs / 1e3).toFixed(0)}s elapsed`;
+    return { name: pkg.name, success: false, issues: [`${pkg.name}@${pkg.version} was not found on ${registry} after publish (${waited})`] };
   }
   logger?.info?.(`${pkg.name}@${pkg.version} confirmed on ${registry}`);
   const tmpDir = join(tmpdir(), `kb-verdaccio-verify-${randomBytes(6).toString("hex")}`);
@@ -1995,7 +2195,7 @@ function buildReport(stage, plan, repoRoot, dryRun, startTime, result) {
     result: { ...result, timingMs: result.timingMs ?? Date.now() - startTime }
   };
 }
-async function verifyCleanInstall(tarballPath, packageName, additionalTarballs = [], packageManager = "npm") {
+async function verifyCleanInstall(tarballPath, packageName, additionalTarballs = [], packageManager = "npm", registry) {
   const consumerDir = mkdtempSync(join(tmpdir(), "kb-clean-install-"));
   try {
     if (packageManager === "pnpm") {
@@ -2017,6 +2217,10 @@ async function verifyCleanInstall(tarballPath, packageName, additionalTarballs =
         join(consumerDir, "package.json"),
         JSON.stringify({ name: "kb-release-consumer", private: true, dependencies, pnpm: { overrides } }, null, 2) + "\n"
       );
+      if (registry) {
+        writeFileSync(join(consumerDir, ".npmrc"), `registry=${registry}
+`);
+      }
       const install = spawnSync(
         "pnpm",
         ["install", "--ignore-scripts", "--no-lockfile", "--config.auto-install-peers=true"],
@@ -2028,7 +2232,7 @@ async function verifyCleanInstall(tarballPath, packageName, additionalTarballs =
     } else {
       writeFileSync(join(consumerDir, "package.json"), JSON.stringify({ name: "kb-release-consumer", private: true }) + "\n");
       const { Arborist } = await import('@npmcli/arborist');
-      const arb = new Arborist({ path: consumerDir, ignoreScripts: true });
+      const arb = new Arborist({ path: consumerDir, ignoreScripts: true, audit: false, ...registry ? { registry } : {} });
       try {
         await arb.reify({ add: [tarballPath, ...additionalTarballs], save: false });
       } catch (err) {
@@ -2097,6 +2301,6 @@ async function resolveScopePath(repoRoot, scope) {
   return join(repoRoot, scope);
 }
 
-export { CHECKS_CONCURRENCY, DEFAULT_ROOT_CHANGELOG_PATH, DEFAULT_TAG_PATTERN, applyCanarySuffix, applyVersionStrategy, buildPackages, buildReleaseTag, commitAndTagRelease, copyChangelogToPackages, createExecaShellAdapter, discoverCurrentPackages, findForbiddenDependencyProtocols, isBuildCommand, isVersionPublished, matchesPackagePattern, mergeConfigWithFlow, mergeRootChangelog, planRelease, renderJson, renderMarkdown, renderText, resolveFlowFromTag, resolvePublishRegistry, resolvePublishTag, resolveRootChangelogRelPath, resolveScopePath, restoreSnapshot, runReleaseChecks, runReleasePipeline, runSafeBuild, saveSnapshot, updatePackageVersion, updatePackageVersions, verifyAgainstRegistry, verifyCleanInstall, verifyExtractedTarball, verifyPackage, verifyPackages };
+export { CHECKS_CONCURRENCY, DEFAULT_ROOT_CHANGELOG_PATH, DEFAULT_TAG_PATTERN, applyCanarySuffix, applyVersionStrategy, buildPackages, buildReleaseTag, commitAndTagRelease, computeFlowReleaseStatus, copyChangelogToPackages, createExecaShellAdapter, discoverCurrentPackages, findForbiddenDependencyProtocols, isBuildCommand, isVersionPublished, matchesPackagePattern, mergeConfigWithFlow, mergeRootChangelog, planRelease, renderJson, renderMarkdown, renderText, resolveFlowFromTag, resolvePublishRegistry, resolvePublishTag, resolveRootChangelogRelPath, resolveScopePath, restoreSnapshot, runReleaseChecks, runReleasePipeline, runSafeBuild, saveSnapshot, updatePackageVersion, updatePackageVersions, verifyAgainstRegistry, verifyCleanInstall, verifyExtractedTarball, verifyPackage, verifyPackages };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map