fix(packaging): cli, hono and plugin-dev publish their @objectstack/* dependencies exact, not as caret ranges (#25662)

<!-- claude-projects-attribution: {"github_login":"os-elon-musk"} -->
_Requested by **Elon** · [project
thread](https://claude.ai/code/project/chan_01WedDzV26nniwxv7jC88B9D?thread=cmsg_01WedDzV26nniwxv7jC88B9DUhNa6cidmj22Tz1NuL5ZZQ)_

Fixes #25639

Clause-②: no
Metadata-protocol: none

## What changes

Twenty-one `dependencies` entries naming a lockstep `@objectstack/*`
package were written `workspace:^`, which pnpm publishes as `^VERSION`.
They are now `workspace:*`, which publishes the exact release version,
like every other internal dependency of these packages:

| package | entries moved | moved |
|:--|:--|:--|
| `packages/cli/package.json` | 8 | `core`, `driver-memory`,
`driver-mongodb`, `driver-sql`, `driver-sqlite-wasm`, `objectql`,
`observability`, `runtime` |
| `packages/adapters/hono/package.json` | 1 | `runtime` |
| `packages/plugins/plugin-dev/package.json` | 12 | `account`,
`driver-memory`, `objectql`, `plugin-auth`, `plugin-hono-server`,
`plugin-security`, `rest`, `runtime`, `service-i18n`,
`service-realtime`, `service-storage`, `setup` |

All 21 targets are members of the changesets `fixed` group (checked
against `.changeset/config.json`), so a range buys nothing: it only lets
an exactly-pinned app float to a newer release through the CLI and mix
two releases in one tree.

- `pnpm-lock.yaml` is pnpm-regenerated (`pnpm install --lockfile-only`);
its diff is exactly the 21 importer `specifier: workspace:^` lines
becoming `specifier: workspace:*`, nothing resolved differently.
- One `patch` changeset for the three packages, carrying the two
declaration lines.
- `packages/cli/src/commands/generate.ts`: a doc comment said
`driver-sql` is in the CLI's `dependencies` at `workspace:^`; this PR
made that false, so it now says `workspace:*`. Comment only (see
Acceptance notes: surface widening approved by the seat).
- Peer-dependency carets (`cli` and `runtime` on `driver-turso`,
`service-datasource` on three drivers) are untouched, as the card
scopes.
- No new check: triage scoped it out of this card.

## Verification

- **Published shape, after.** `pnpm --filter PKG pack` for each of the
three packages at this head, then read the packed
`package/package.json`:
- `@objectstack/cli`: 50 internal dependencies, 0 not exact; peer
`@objectstack/driver-turso` stays `^18.1.0`.
  - `@objectstack/hono`: 3 internal dependencies, 0 not exact.
  - `@objectstack/plugin-dev`: 15 internal dependencies, 0 not exact.
- **Published shape, before (control).** `npm view
@objectstack/cli@18.1.0 dependencies` lists the eight at `^18.1.0`;
`@objectstack/hono@18.1.0` has `@objectstack/runtime: ^18.1.0`;
`@objectstack/plugin-dev@18.1.0` has 12 caret entries. Same pnpm publish
path, so the pack reading distinguishes the two.
- **Source sweep.** No `dependencies` or `optionalDependencies` entry of
a published workspace package names a `fixed`-group package with
anything but `workspace:*` after this change (sweep over every tracked
`package.json`; the remaining non-exact entries are peers, the private
`examples/app-todo`, and the scaffold templates).
- **Local gates.** `node scripts/pm/dispatch-gates.mjs --commands`
derives 80 families for this diff. All 80 were run at `b18406b`, each
exit code captured before any pipe: 72 exit 0 (among them
`check-changeset-fixed`, `check-changeset-no-major --base origin/main`,
`check-adr-0087-registration --base origin/main`, `check-empty-changeset
--base origin/main`, `check:workspace-manifest-cycles`,
`check-undeclared-dep-imports`, `check:published-files`,
`check:override-consistency`, `check:manifest-repository-directory`,
`check:nul-bytes`, `check:doc-authoring`, `check:issue-citations`), and
8 exit 3, NOT MEASURED: `check:dts-closure`,
`check:dual-build-cjs-loads`, `check:i18n`, `check:i18n-coverage`,
`check:i18n-walk-parity`, `check:lean-entry-closure` and
`check:sourcemap-no-sources-content` need a full workspace build this
worktree does not have, and `check-plugin-teardown-shape --self-test`
needs an unshallowed clone. CI runs all eight. `dispatch-gates --ran`
reconciles: `80 derived famil(ies) accounted for — 72 run, 8
NOT-MEASURED`. The head `ee5f527` merges `origin/main` (four files under
`.claude/` and `scripts/pm/`, none on this diff's surface); the derived
set is byte-identical there.
- Unit suites of the three packages are declared to CI: the diff moves
manifests and one comment, and the workspace links pnpm installs for
`workspace:^` and `workspace:*` are the same local packages, so no
module a test loads changes.

## Acceptance notes

- **Surface widening:** `packages/cli/src/commands/generate.ts` (one
comment word) is outside the claim's file surface; the seat approved
adding it in the card thread.
- **Count correction:** the card says the CLI's "other 47"
`@objectstack/*` dependencies were `workspace:*`. Measured at the base:
49 `@objectstack/*` dependencies, 41 `workspace:*` and 8 `workspace:^`
(plus `create-objectstack`, also `workspace:*`). The first commit's
message repeats the card's 47; the number here is the measured one.
- `examples/app-todo/package.json` still writes three `workspace:^`
dependencies. It is `private` and never published, so it is not part of
this card. Noted, not filed.
- `packages/adapters/hono/package.json` lists `@objectstack/runtime` in
both `dependencies` and `devDependencies`; after this change both read
`workspace:*`. Noted, not filed.
- The scaffold templates' caret ranges are the template card (#25510),
which is not addressed here.
- Serial: #25631 regenerates `pnpm-lock.yaml` and may touch the same
manifests; `origin/main` is merged before each push.
- Whether to add a check that refuses a range on a `fixed`-group
dependency is the maintainer's question per triage; this PR adds none.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01ToEn6kUxajmjnSeRsFmTGn)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/25639-lockstep-exact-internal-deps.md

@@ -0,0 +1,14 @@
+---
+'@objectstack/cli': patch
+'@objectstack/hono': patch
+'@objectstack/plugin-dev': patch
+---
+
+Clause-②: no
+Metadata-protocol: none
+
+`@objectstack/cli`, `@objectstack/hono` and `@objectstack/plugin-dev` now depend on the other `@objectstack/*` packages at exactly their own release version, not at a caret range. Twenty-one dependencies were published as `^<version>`: eight of the CLI's (`core`, `driver-memory`, `driver-mongodb`, `driver-sql`, `driver-sqlite-wasm`, `objectql`, `observability`, `runtime`), the Hono adapter's `runtime`, and twelve of `plugin-dev`'s (`account`, `driver-memory`, `objectql`, `plugin-auth`, `plugin-hono-server`, `plugin-security`, `rest`, `runtime`, `service-i18n`, `service-realtime`, `service-storage`, `setup`).
+
+Every `@objectstack/*` package is released together on one version, so the range bought nothing. What it did was let an app that pins exact `@objectstack/*` versions still install a newer release of these packages, and of everything they depend on, through the CLI, which mixes two releases in one tree. They are now published exact, like the other `@objectstack/*` dependencies of these three packages.
+
+If you pinned exact versions and added `overrides` to hold these packages at your version, you can remove those overrides once you are on this release. Peer dependencies keep their caret ranges.

packages/adapters/hono/package.json

@@ -19,7 +19,7 @@
   },
   "dependencies": {
     "@objectstack/plugin-hono-server": "workspace:*",
-    "@objectstack/runtime": "workspace:^",
+    "@objectstack/runtime": "workspace:*",
     "@objectstack/types": "workspace:*"
   },
   "peerDependencies": {

packages/cli/package.json

@@ -60,19 +60,19 @@
     "@objectstack/client": "workspace:*",
     "@objectstack/cloud-connection": "workspace:*",
     "@objectstack/console": "workspace:*",
-    "@objectstack/core": "workspace:^",
-    "@objectstack/driver-memory": "workspace:^",
-    "@objectstack/driver-mongodb": "workspace:^",
-    "@objectstack/driver-sql": "workspace:^",
-    "@objectstack/driver-sqlite-wasm": "workspace:^",
+    "@objectstack/core": "workspace:*",
+    "@objectstack/driver-memory": "workspace:*",
+    "@objectstack/driver-mongodb": "workspace:*",
+    "@objectstack/driver-sql": "workspace:*",
+    "@objectstack/driver-sqlite-wasm": "workspace:*",
     "@objectstack/formula": "workspace:*",
     "@objectstack/lint": "workspace:*",
     "@objectstack/mcp": "workspace:*",
     "@objectstack/metadata": "workspace:*",
     "@objectstack/metadata-core": "workspace:*",
     "@objectstack/metadata-protocol": "workspace:*",
-    "@objectstack/objectql": "workspace:^",
-    "@objectstack/observability": "workspace:^",
+    "@objectstack/objectql": "workspace:*",
+    "@objectstack/observability": "workspace:*",
     "@objectstack/platform-objects": "workspace:*",
     "@objectstack/plugin-approvals": "workspace:*",
     "@objectstack/plugin-audit": "workspace:*",
@@ -84,7 +84,7 @@
     "@objectstack/plugin-sharing": "workspace:*",
     "@objectstack/plugin-webhooks": "workspace:*",
     "@objectstack/rest": "workspace:*",
-    "@objectstack/runtime": "workspace:^",
+    "@objectstack/runtime": "workspace:*",
     "@objectstack/service-analytics": "workspace:*",
     "@objectstack/service-automation": "workspace:*",
     "@objectstack/service-cache": "workspace:*",

packages/cli/src/commands/generate.ts

@@ -2914,7 +2914,7 @@ function columnDefaultTs(field: unknown, type: string): string {
  *
  * ⛔ NOT "because `packages/cli` does not depend on the driver at runtime" —
  * it does: `@objectstack/driver-sql` is in this package's `dependencies` at
- * `workspace:^`. A missing dependency was never the reason, and stating it as
+ * `workspace:*`. A missing dependency was never the reason, and stating it as
  * one invites the next reader to "simplify" the transcription away.
  *
  * ⛔ NOR "because it is `protected static`, so it reaches no exported surface"

packages/plugins/plugin-dev/package.json

@@ -19,19 +19,19 @@
     "check:test-typecheck": "tsx ../../../scripts/check-test-typecheck.mts --self-test && tsx ../../../scripts/check-test-typecheck.mts --package packages/plugins/plugin-dev --project tsconfig.test.json"
   },
   "dependencies": {
-    "@objectstack/account": "workspace:^",
+    "@objectstack/account": "workspace:*",
     "@objectstack/core": "workspace:*",
-    "@objectstack/driver-memory": "workspace:^",
-    "@objectstack/objectql": "workspace:^",
-    "@objectstack/plugin-auth": "workspace:^",
-    "@objectstack/plugin-hono-server": "workspace:^",
-    "@objectstack/plugin-security": "workspace:^",
-    "@objectstack/rest": "workspace:^",
-    "@objectstack/runtime": "workspace:^",
-    "@objectstack/service-i18n": "workspace:^",
-    "@objectstack/service-realtime": "workspace:^",
-    "@objectstack/service-storage": "workspace:^",
-    "@objectstack/setup": "workspace:^",
+    "@objectstack/driver-memory": "workspace:*",
+    "@objectstack/objectql": "workspace:*",
+    "@objectstack/plugin-auth": "workspace:*",
+    "@objectstack/plugin-hono-server": "workspace:*",
+    "@objectstack/plugin-security": "workspace:*",
+    "@objectstack/rest": "workspace:*",
+    "@objectstack/runtime": "workspace:*",
+    "@objectstack/service-i18n": "workspace:*",
+    "@objectstack/service-realtime": "workspace:*",
+    "@objectstack/service-storage": "workspace:*",
+    "@objectstack/setup": "workspace:*",
     "@objectstack/spec": "workspace:*",
     "@objectstack/types": "workspace:*"
   },