versioning-policy

Use a CI gate that scans all package.json files for a hyphen in the version field and blocks PRs containing prerelease strings. The prerelease-version-guard gate prevents merges until versions are cleaned, with a skip-version-check label for rare exceptions.

Per the semver specification, a range like >=0.9.0 does not match prerelease versions such as 0.9.1-build.4. npm then silently installs a stale published version from the registry instead of linking the local workspace package.

Yes, keeping the SDK, CLI, and root package.json versions identical prevents workspace resolution mismatches. A lockstep bump script that updates all three files together enforces this synchronization automatically.

Centralize version ownership under a single release manager role to avoid conflicting bumps. Other contributors should not modify version fields, except to revert an accidental prerelease leak back to the clean release version.

Yes, prerelease versions like 0.9.1-build.4 are acceptable for local testing only if they are never committed or pushed. Automate this with a bump script that skips itself in CI environments.