@smoothbricks/cli 0.3.1 → 0.3.3

package/dist/monorepo/lockfile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/monorepo/lockfile.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,8BAA8B;IAC7C,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAWD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,8BAAmC,GAAG,MAAM,CA0C1G;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA6BhE"}
+{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/monorepo/lockfile.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,8BAA8B;IAC7C,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAWD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,8BAAmC,GAAG,MAAM,CAkD1G;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiChE"}

package/dist/monorepo/lockfile.js

@@ -1,3 +1,4 @@
+import { execSync } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { escapeRegex, getWorkspacePackages } from '../lib/workspace.js';
@@ -20,6 +21,12 @@ export function syncBunLockfileVersions(root, options = {}) {
     let lockfile = readFileSync(lockfilePath, 'utf8');
     let updated = 0;
     for (const pkg of packages) {
+        // If the package.json version is a prerelease (e.g. 0.2.2-next.0) it may
+        // never have been published.  Use the latest stable git tag version so
+        // that `bun pm pack` writes an installable dependency range for consumers.
+        const targetVersion = pkg.version.includes('-')
+            ? (latestStableTagVersion(root, pkg.projectName) ?? pkg.version)
+            : pkg.version;
         const relativePath = pkg.path.replaceAll('\\', '/');
         const escaped = escapeRegex(relativePath);
         const pattern = new RegExp(`("${escaped}":\\s*\\{[^}]*"version":\\s*")([^"]+)(")`);
@@ -31,15 +38,16 @@ export function syncBunLockfileVersions(root, options = {}) {
             continue;
         }
         const lockVersion = match[2];
-        if (lockVersion === pkg.version) {
+        if (lockVersion === targetVersion) {
             if (log) {
-                console.log(`ok:   ${relativePath} = ${pkg.version}`);
+                console.log(`ok:   ${relativePath} = ${targetVersion}`);
             }
             continue;
         }
-        lockfile = lockfile.replace(pattern, `$1${pkg.version}$3`);
+        lockfile = lockfile.replace(pattern, `$1${targetVersion}$3`);
         if (log) {
-            console.log(`fix:  ${relativePath}: ${lockVersion} -> ${pkg.version}`);
+            const suffix = targetVersion !== pkg.version ? ` (latest stable tag; package.json has ${pkg.version})` : '';
+            console.log(`fix:  ${relativePath}: ${lockVersion} -> ${targetVersion}${suffix}`);
         }
         updated++;
     }
@@ -61,6 +69,9 @@ export function validateBunLockfileVersions(root) {
     const lockfile = readFileSync(lockfilePath, 'utf8');
     let failures = 0;
     for (const pkg of packages) {
+        const targetVersion = pkg.version.includes('-')
+            ? (latestStableTagVersion(root, pkg.projectName) ?? pkg.version)
+            : pkg.version;
         const relativePath = pkg.path.replaceAll('\\', '/');
         const escaped = escapeRegex(relativePath);
         const pattern = new RegExp(`("${escaped}":\\s*\\{[^}]*"version":\\s*")([^"]+)(")`);
@@ -71,8 +82,8 @@ export function validateBunLockfileVersions(root) {
             continue;
         }
         const lockVersion = match[2];
-        if (lockVersion !== pkg.version) {
-            console.error(`${relativePath}: bun.lock workspace version must be ${pkg.version}, got ${lockVersion}`);
+        if (lockVersion !== targetVersion) {
+            console.error(`${relativePath}: bun.lock workspace version must be ${targetVersion}, got ${lockVersion}`);
             failures++;
         }
     }
@@ -81,3 +92,26 @@ export function validateBunLockfileVersions(root) {
     }
     return failures;
 }
+function latestStableTagVersion(root, projectName) {
+    try {
+        const output = execSync(`git tag --list '${projectName}@*' --sort=-v:refname`, {
+            cwd: root,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const prefix = `${projectName}@`;
+        for (const line of output.split('\n')) {
+            const tag = line.trim();
+            if (!tag.startsWith(prefix))
+                continue;
+            const version = tag.slice(prefix.length);
+            if (version && !version.includes('-')) {
+                return version;
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/monorepo/managed-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managed-files.d.ts","sourceRoot":"","sources":["../../src/monorepo/managed-files.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,GAAG,YAAY,CAAC;CACxG;AAwED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,EAAE,CAG/F;AA0ED,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAIxD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQzD"}
+{"version":3,"file":"managed-files.d.ts","sourceRoot":"","sources":["../../src/monorepo/managed-files.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,GAAG,YAAY,CAAC;CACxG;AA8ED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,EAAE,CAG/F;AA0ED,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAIxD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQzD"}

package/dist/monorepo/managed-files.js

@@ -4,6 +4,12 @@ import { fileURLToPath } from 'node:url';
 import { listReleasePackages, readPackageJson } from '../lib/workspace.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
 const managedFiles = [
+    {
+        kind: 'raw',
+        source: 'tooling/direnv/repo-path',
+        target: 'tooling/direnv/repo-path',
+        executable: true,
+    },
     {
         kind: 'raw',
         source: 'tooling/direnv/github-actions-bootstrap.sh',

package/dist/monorepo/packed-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"packed-manifest.d.ts","sourceRoot":"","sources":["../../src/monorepo/packed-manifest.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAUlC;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,WAAW,EAC1B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,MAAM,EAAE,CAoCV"}
+{"version":3,"file":"packed-manifest.d.ts","sourceRoot":"","sources":["../../src/monorepo/packed-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAUlC;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,WAAW,EAC1B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,MAAM,EAAE,CA8CV"}

package/dist/monorepo/packed-manifest.js

@@ -1,3 +1,4 @@
+import { execSync } from 'node:child_process';
 import { $ } from 'bun';
 import { isRecord, recordProperty } from '../lib/json.js';
 import { decode } from '../lib/run.js';
@@ -14,7 +15,9 @@ export async function readPackedPackageJson(root, tarball, packageName) {
     return parsed;
 }
 export function validatePackedWorkspaceDependencies(root, sourcePackage, packedPackage) {
-    const workspaceVersions = new Map(getWorkspacePackages(root).map((pkg) => [pkg.name, pkg.version]));
+    const workspacePackages = getWorkspacePackages(root);
+    const workspaceVersions = new Map(workspacePackages.map((pkg) => [pkg.name, pkg.version]));
+    const projectNameByPackage = new Map(workspacePackages.map((pkg) => [pkg.name, pkg.projectName]));
     const failures = [];
     for (const field of workspaceDependencyFields) {
         const sourceDependencies = recordProperty(sourcePackage.json, field);
@@ -39,8 +42,15 @@ export function validatePackedWorkspaceDependencies(root, sourcePackage, packedP
             if (sourceRange !== 'workspace:*') {
                 failures.push(`${sourcePackage.path}: source ${field}.${name} must use workspace:*`);
             }
-            if (packedRange !== workspaceVersion) {
-                failures.push(`${sourcePackage.path}: packed ${field}.${name} must be ${workspaceVersion}, got ${formatRange(packedRange)}`);
+            // When the workspace dep is at a prerelease version that was never
+            // published, the lockfile sync rewrites it to the latest stable tag
+            // version.  Accept that version as valid.
+            const projectName = projectNameByPackage.get(name);
+            const expectedVersion = workspaceVersion.includes('-') && projectName
+                ? (latestStableTagVersion(root, projectName) ?? workspaceVersion)
+                : workspaceVersion;
+            if (packedRange !== expectedVersion) {
+                failures.push(`${sourcePackage.path}: packed ${field}.${name} must be ${expectedVersion}, got ${formatRange(packedRange)}`);
             }
         }
     }
@@ -49,3 +59,26 @@ export function validatePackedWorkspaceDependencies(root, sourcePackage, packedP
 function formatRange(value) {
     return typeof value === 'string' ? value : '<missing>';
 }
+function latestStableTagVersion(root, projectName) {
+    try {
+        const output = execSync(`git tag --list '${projectName}@*' --sort=-v:refname`, {
+            cwd: root,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const prefix = `${projectName}@`;
+        for (const line of output.split('\n')) {
+            const tag = line.trim();
+            if (!tag.startsWith(prefix))
+                continue;
+            const version = tag.slice(prefix.length);
+            if (version && !version.includes('-')) {
+                return version;
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}

package/managed/raw/tooling/direnv/github-actions-bootstrap.sh

@@ -14,11 +14,7 @@ clear_devenv_cache_state() {
 }
 
 add_repo_paths() {
-  {
-    echo "$repo_root/tooling/direnv/.devenv/profile/bin"
-    echo "$repo_root/node_modules/.bin"
-    echo "$repo_root/tooling"
-  } >> "$GITHUB_PATH"
+  "$repo_root/tooling/direnv/repo-path" --github-path
 }
 
 restore_nix_store() {

package/managed/raw/tooling/direnv/repo-path

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Single source of truth for repo-local PATH entries.
+# All tooling that sets up PATH must call this instead of hardcoding paths.
+#
+# Usage:
+#   export PATH="$(tooling/direnv/repo-path)"         # shell
+#   tooling/direnv/repo-path --github-path             # CI — appends to $GITHUB_PATH
+#   tooling/direnv/repo-path --print                   # debug — one entry per line
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+# Order: most-specific → least-specific.
+entries=(
+  "$root/tooling/direnv/.devenv/profile/bin"
+  "$root/tooling/git-hooks"
+  "$root/tooling"
+  "$root/tooling/node_modules/.bin"
+  "$root/node_modules/.bin"
+)
+
+case "${1:-}" in
+  --github-path)
+    # GITHUB_PATH prepends entries; last line written = first in PATH.
+    # Reverse so most-specific directories are searched first.
+    for (( i=${#entries[@]}-1; i>=0; i-- )); do
+      echo "${entries[i]}"
+    done >> "$GITHUB_PATH" ;;
+  --print)
+    printf '%s\n' "${entries[@]}" ;;
+  *)
+    IFS=:
+    echo "${entries[*]}:$PATH" ;;
+esac

package/managed/raw/tooling/git-hooks/commit-msg.sh

@@ -2,13 +2,7 @@
 cd "$(git rev-parse --show-toplevel)"
 TOOLING="$PWD/tooling"
 
-# PATH order: most-specific → least-specific.
-#   1. git-hooks/   – hook-specific helper scripts
-#   2. tooling/     – the repo toolbox (curated tools like the smoo wrapper)
-#   3. tooling/node_modules/.bin – toolbox installed deps (@smoothbricks/cli)
-#   4. node_modules/.bin – root workspace deps (Nx, biome, etc.)
-#   5. devenv profile – upstream native/system tools
-export PATH="$TOOLING/git-hooks:$TOOLING:$TOOLING/node_modules/.bin:$PWD/node_modules/.bin:$TOOLING/direnv/.devenv/profile/bin:$PATH"
+export PATH="$("$TOOLING/direnv/repo-path")"
 
 set -e -o pipefail
 

package/managed/raw/tooling/git-hooks/pre-commit.sh

@@ -2,13 +2,7 @@
 cd "$(git rev-parse --show-toplevel)"
 TOOLING="$PWD/tooling"
 
-# PATH order: most-specific → least-specific.
-#   1. git-hooks/   – hook-specific helper scripts
-#   2. tooling/     – the repo toolbox (curated tools like the smoo wrapper)
-#   3. tooling/node_modules/.bin – toolbox installed deps (@smoothbricks/cli)
-#   4. node_modules/.bin – root workspace deps (Nx, biome, etc.)
-#   5. devenv profile – upstream native/system tools
-export PATH="$TOOLING/git-hooks:$TOOLING:$TOOLING/node_modules/.bin:$PWD/node_modules/.bin:$TOOLING/direnv/.devenv/profile/bin:$PATH"
+export PATH="$("$TOOLING/direnv/repo-path")"
 
 set -e -o pipefail
 

package/managed/templates/github/actions/save-nix-devenv/action.yml

@@ -20,9 +20,9 @@ runs:
       working-directory: tooling/direnv
       # build-shell normally adds repo paths to GITHUB_PATH, but this cleanup
       # must still run when build-shell fails before that happens.
-      run:
-        PATH="$PWD/.devenv/profile/bin:$PWD/../../node_modules/.bin:$PWD/../../tooling:$PATH" ../../tooling/smoo
-        github-ci cleanup-cache
+      run: |
+        export PATH="$(../../tooling/direnv/repo-path)"
+        smoo github-ci cleanup-cache
 
     - name: 🧊 Save Nix profiles and store NAR
       if: ${{ steps.cleanup-cache.outputs.cache-ready == 'true' && inputs.nix-cache-hit != 'true' }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -45,7 +45,7 @@
   ],
   "dependencies": {
     "@arethetypeswrong/cli": "^0.18.2",
-    "@smoothbricks/nx-plugin": "0.2.1",
+    "@smoothbricks/nx-plugin": "0.2.2",
     "@smoothbricks/validation": "0.1.1",
     "commander": "^14.0.3",
     "publint": "^0.3.18",

package/src/monorepo/lockfile.ts

@@ -1,3 +1,4 @@
+import { execSync } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { escapeRegex, getWorkspacePackages } from '../lib/workspace.js';
@@ -25,6 +26,13 @@ export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVe
   let lockfile = readFileSync(lockfilePath, 'utf8');
   let updated = 0;
   for (const pkg of packages) {
+    // If the package.json version is a prerelease (e.g. 0.2.2-next.0) it may
+    // never have been published.  Use the latest stable git tag version so
+    // that `bun pm pack` writes an installable dependency range for consumers.
+    const targetVersion = pkg.version.includes('-')
+      ? (latestStableTagVersion(root, pkg.projectName) ?? pkg.version)
+      : pkg.version;
+
     const relativePath = pkg.path.replaceAll('\\', '/');
     const escaped = escapeRegex(relativePath);
     const pattern = new RegExp(`("${escaped}":\\s*\\{[^}]*"version":\\s*")([^"]+)(")`);
@@ -36,15 +44,16 @@ export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVe
       continue;
     }
     const lockVersion = match[2];
-    if (lockVersion === pkg.version) {
+    if (lockVersion === targetVersion) {
       if (log) {
-        console.log(`ok:   ${relativePath} = ${pkg.version}`);
+        console.log(`ok:   ${relativePath} = ${targetVersion}`);
       }
       continue;
     }
-    lockfile = lockfile.replace(pattern, `$1${pkg.version}$3`);
+    lockfile = lockfile.replace(pattern, `$1${targetVersion}$3`);
     if (log) {
-      console.log(`fix:  ${relativePath}: ${lockVersion} -> ${pkg.version}`);
+      const suffix = targetVersion !== pkg.version ? ` (latest stable tag; package.json has ${pkg.version})` : '';
+      console.log(`fix:  ${relativePath}: ${lockVersion} -> ${targetVersion}${suffix}`);
     }
     updated++;
   }
@@ -69,6 +78,10 @@ export function validateBunLockfileVersions(root: string): number {
   const lockfile = readFileSync(lockfilePath, 'utf8');
   let failures = 0;
   for (const pkg of packages) {
+    const targetVersion = pkg.version.includes('-')
+      ? (latestStableTagVersion(root, pkg.projectName) ?? pkg.version)
+      : pkg.version;
+
     const relativePath = pkg.path.replaceAll('\\', '/');
     const escaped = escapeRegex(relativePath);
     const pattern = new RegExp(`("${escaped}":\\s*\\{[^}]*"version":\\s*")([^"]+)(")`);
@@ -79,8 +92,8 @@ export function validateBunLockfileVersions(root: string): number {
       continue;
     }
     const lockVersion = match[2];
-    if (lockVersion !== pkg.version) {
-      console.error(`${relativePath}: bun.lock workspace version must be ${pkg.version}, got ${lockVersion}`);
+    if (lockVersion !== targetVersion) {
+      console.error(`${relativePath}: bun.lock workspace version must be ${targetVersion}, got ${lockVersion}`);
       failures++;
     }
   }
@@ -89,3 +102,25 @@ export function validateBunLockfileVersions(root: string): number {
   }
   return failures;
 }
+
+function latestStableTagVersion(root: string, projectName: string): string | null {
+  try {
+    const output = execSync(`git tag --list '${projectName}@*' --sort=-v:refname`, {
+      cwd: root,
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    const prefix = `${projectName}@`;
+    for (const line of output.split('\n')) {
+      const tag = line.trim();
+      if (!tag.startsWith(prefix)) continue;
+      const version = tag.slice(prefix.length);
+      if (version && !version.includes('-')) {
+        return version;
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}

package/src/monorepo/managed-files.ts

@@ -26,6 +26,12 @@ interface ManagedFileContext {
 }
 
 const managedFiles: ManagedFile[] = [
+  {
+    kind: 'raw',
+    source: 'tooling/direnv/repo-path',
+    target: 'tooling/direnv/repo-path',
+    executable: true,
+  },
   {
     kind: 'raw',
     source: 'tooling/direnv/github-actions-bootstrap.sh',

package/src/monorepo/packed-manifest.ts

@@ -1,3 +1,4 @@
+import { execSync } from 'node:child_process';
 import { $ } from 'bun';
 import { isRecord, recordProperty } from '../lib/json.js';
 import { decode } from '../lib/run.js';
@@ -25,7 +26,9 @@ export function validatePackedWorkspaceDependencies(
   sourcePackage: PackageInfo,
   packedPackage: Record<string, unknown>,
 ): string[] {
-  const workspaceVersions = new Map(getWorkspacePackages(root).map((pkg) => [pkg.name, pkg.version]));
+  const workspacePackages = getWorkspacePackages(root);
+  const workspaceVersions = new Map(workspacePackages.map((pkg) => [pkg.name, pkg.version]));
+  const projectNameByPackage = new Map(workspacePackages.map((pkg) => [pkg.name, pkg.projectName]));
   const failures: string[] = [];
   for (const field of workspaceDependencyFields) {
     const sourceDependencies = recordProperty(sourcePackage.json, field);
@@ -52,9 +55,17 @@ export function validatePackedWorkspaceDependencies(
       if (sourceRange !== 'workspace:*') {
         failures.push(`${sourcePackage.path}: source ${field}.${name} must use workspace:*`);
       }
-      if (packedRange !== workspaceVersion) {
+      // When the workspace dep is at a prerelease version that was never
+      // published, the lockfile sync rewrites it to the latest stable tag
+      // version.  Accept that version as valid.
+      const projectName = projectNameByPackage.get(name);
+      const expectedVersion =
+        workspaceVersion.includes('-') && projectName
+          ? (latestStableTagVersion(root, projectName) ?? workspaceVersion)
+          : workspaceVersion;
+      if (packedRange !== expectedVersion) {
         failures.push(
-          `${sourcePackage.path}: packed ${field}.${name} must be ${workspaceVersion}, got ${formatRange(packedRange)}`,
+          `${sourcePackage.path}: packed ${field}.${name} must be ${expectedVersion}, got ${formatRange(packedRange)}`,
         );
       }
     }
@@ -65,3 +76,25 @@ export function validatePackedWorkspaceDependencies(
 function formatRange(value: unknown): string {
   return typeof value === 'string' ? value : '<missing>';
 }
+
+function latestStableTagVersion(root: string, projectName: string): string | null {
+  try {
+    const output = execSync(`git tag --list '${projectName}@*' --sort=-v:refname`, {
+      cwd: root,
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    const prefix = `${projectName}@`;
+    for (const line of output.split('\n')) {
+      const tag = line.trim();
+      if (!tag.startsWith(prefix)) continue;
+      const version = tag.slice(prefix.length);
+      if (version && !version.includes('-')) {
+        return version;
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}