Address review feedback on the SDK bump automation

.github/workflows/update-nutrient-sdk.yml

@@ -64,10 +64,16 @@ jobs:
           # example that gains a script tag without an entry is left behind in
           # silence. examples/salesforce/README.md is exempt: its version is an
           # illustration, not a pin.
-          stale="$(grep -rEn "pspdfkit-web@[0-9]+\.[0-9]+\.[0-9]+" examples/ \
+          #
+          # -o prints one match per line rather than one line per match, so a
+          # line carrying both a bumped and a stale reference cannot have the
+          # stale one dropped along with the whole line. The exclusion escapes
+          # the dots in ${VERSION} and anchors on $, so 1.20.1 cannot swallow a
+          # stale 1.20.10 as a prefix of it.
+          stale="$(grep -rEon "pspdfkit-web@[0-9]+\.[0-9]+\.[0-9]+" examples/ \
             --exclude-dir=node_modules --exclude-dir=dist \
             --exclude-dir=.next --exclude-dir=.nuxt \
-            | grep -v "pspdfkit-web@${VERSION}" \
+            | grep -vE "pspdfkit-web@${VERSION//./\\.}$" \
             | grep -v '^examples/salesforce/README.md:' || true)"
 
           if [ -n "$stale" ]; then
@@ -158,6 +164,35 @@ jobs:
           [Workflow run](${RUN_URL})
           BODY
 
+          # Nothing retries a draft. The scheduled job treats any pull request
+          # for this branch as "handled" whatever its state, so without these
+          # instructions the version is parked on whoever opens the draft next,
+          # with no way to re-run the suite from the pull request itself.
+          if [ "$E2E_OUTCOME" != "success" ]; then
+            cat >> /tmp/pr-body.md <<RECOVERY
+
+          ## This draft needs a human
+
+          The e2e suite failed, so this was opened as a draft and GitHub did not
+          request code owners on it. It will not retry on its own: every future
+          scheduled run sees this pull request and skips ${VERSION}. Re-running
+          the workflow for ${VERSION} will not help either, for the same reason.
+
+          Pick one:
+
+          - **You want the checks to run here.** Close this pull request and
+            reopen it. Reopening it yourself fires \`pull_request: reopened\`,
+            which the Biome and Playwright workflows act on, so they run against
+            this bump and report in the checks tab. Marking a draft ready for
+            review triggers nothing, so it is not a substitute.
+          - **The bump needs a fix.** Push it to \`${BRANCH}\`. A push from
+            your own account runs those same checks. Then mark this ready for
+            review.
+          - **The bump is genuinely broken.** Close this pull request and leave
+            the branch in place. ${VERSION} will not be proposed again.
+          RECOVERY
+          fi
+
           gh pr create \
             --title "Update examples with Nutrient SDK version $VERSION" \
             --body-file /tmp/pr-body.md \

scripts/check-nutrient-update.sh

@@ -9,6 +9,7 @@ REPO_ROOT="${SCRIPT_DIR}/.."
 # the repository is on.
 REFERENCE_EXAMPLE="react"
 
+PACKAGE_URL="https://registry.npmjs.org/@nutrient-sdk/viewer"
 DIST_TAGS_URL="https://registry.npmjs.org/-/package/@nutrient-sdk/viewer/dist-tags"
 
 requested="${1:-}"
@@ -25,6 +26,34 @@ if ! [[ "${latest}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
   exit 1
 fi
 
+# A dispatched version is typed by hand, and the dist-tag is not there to vouch
+# for it. Without this, a typo gets through detection and only surfaces as an
+# npm 404 well into the bump, long after the branch has been created.
+#
+# No ordering check accompanies it, because none is needed: any version that has
+# been bumped before still has its pull request, and the check below refuses a
+# branch that already has one, whatever state that pull request is in.
+#
+# -f is deliberately absent so that a 404 and an unreachable registry stay
+# distinguishable; without it curl reports both as the same failure.
+if [ -n "${requested}" ]; then
+  curl_status=0
+  http_code="$(curl -sSL --retry 3 --retry-delay 2 -o /dev/null \
+    -w '%{http_code}' "${PACKAGE_URL}/${requested}")" || curl_status=$?
+
+  if [ "${curl_status}" -ne 0 ]; then
+    echo "Could not reach the npm registry to check ${requested}" \
+      "(curl exited ${curl_status})." >&2
+    exit 1
+  fi
+
+  if [ "${http_code}" != "200" ]; then
+    echo "@nutrient-sdk/viewer@${requested} is not published on the registry" \
+      "(HTTP ${http_code})." >&2
+    exit 1
+  fi
+fi
+
 # jq -r prints "null" and exits 0 for a missing key, which would silently
 # disable the already-on-this-version check.
 if ! current="$(jq -er '.dependencies["@nutrient-sdk/viewer"]' \