aube trust check

• Usage: aube trust check [FLAGS] <PACKAGE@VERSION>
• Effect: read-only

Check one package version for a publishing-trust downgrade

Arguments

• <PACKAGE@VERSION> — Exact npm package version to inspect

  Example: @hono/node-server@1.19.17.

Flags

• --ignore-default-excludes — Evaluate the policy without aube's built-in package exceptions
• --json — Emit a JSON report
• -h --help — Print help

Network

• --fetch-retries <N> — Number of retry attempts for failed registry fetches.

  Overrides fetchRetries / fetch-retries from .npmrc / aube-workspace.yaml when set. Pair with --fetch-timeout to fail fast in scripted test runs.

• --fetch-retry-factor <N> — Exponential backoff factor between retry attempts.

  Overrides fetchRetryFactor / fetch-retry-factor from .npmrc / aube-workspace.yaml when set. Integer-only; fractional values like 1.5 are rejected.

• --fetch-retry-maxtimeout <MS> — Upper bound (ms) on the computed retry backoff.

  Overrides fetchRetryMaxtimeout / fetch-retry-maxtimeout from .npmrc / aube-workspace.yaml when set.

• --fetch-retry-mintimeout <MS> — Lower bound (ms) on the computed retry backoff.

  Overrides fetchRetryMintimeout / fetch-retry-mintimeout from .npmrc / aube-workspace.yaml when set.

• --fetch-timeout <MS> — Per-request HTTP timeout in milliseconds.

  Overrides fetchTimeout / fetch-timeout from .npmrc / aube-workspace.yaml when set. Covers the whole request (headers and body together).

• --registry <URL> — Override the default registry URL for this invocation.

  Use this npm registry URL for package metadata, tarballs, audit requests, dist-tags, and registry writes.

Examples:

$ aube trust check @hono/node-server@1.19.17 @hono/node-server@1.19.17: pass published: 2026-07-27T03:07:48.993Z current evidence: trusted publisher strongest earlier evidence: trusted publisher (2.0.10)

Evaluate the underlying policy even when aube has a built-in exception

$ aube trust check @hono/node-server@1.19.15 --ignore-default-excludes

Machine-readable report

$ aube trust check @hono/node-server@1.19.17 --json