fix(release): retry npm publication verification

[lilbuda]

What changed

• retries npm publication verification while registry metadata propagates
• forces verification reads to prefer current online registry metadata
• reports the last observed package version and dist-tag after a genuine timeout
• tests delayed propagation, bounded failure, and invalid retry configuration

Why

@aeris-ui/core@22.0.0-alpha.2 published successfully with provenance, but the release script
performed one immediate npm view. The registry had not exposed the new version yet, so the script
stopped before publishing @aeris-ui/mcp.

Impact

The release remains idempotent. On retry it will recognize that Core alpha.2 already exists with
the correct next tag, skip it, and continue with MCP. Newly published packages get up to twelve
online verification attempts at five-second intervals before the workflow fails.

Verification

• npm run test:release — 10 passed
• Node syntax checks for the publisher and retry helper — passed
• npm run check:versions — passed
• npm audit --audit-level=moderate — 0 vulnerabilities
• git diff --check — passed

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aeris-ui	Ready	Preview, Comment	Jul 28, 2026 3:33pm