fix(pnpm): keep workspace deps in source manifests

.github/workflows/ci.yml

@@ -28,7 +28,6 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
       - run: pnpm test
-      - run: pnpm verify:publish-manifests
 
   verify-pack:
     runs-on: ubuntu-latest
@@ -47,7 +46,6 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
-      - run: pnpm verify:publish-manifests
 
       - name: Verify no workspace:* in tarballs
         run: |

.github/workflows/release.yml

@@ -32,7 +32,6 @@ jobs:
       - run: pnpm --filter @actalk/inkos-core typecheck
       - run: pnpm --filter @actalk/inkos typecheck
       - run: pnpm test
-      - run: pnpm verify:publish-manifests
 
   smoke-test:
     runs-on: ubuntu-latest
@@ -51,7 +50,6 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
-      - run: pnpm verify:publish-manifests
 
       - name: Smoke test — CLI help and version
         run: |
@@ -102,7 +100,6 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
-      - run: pnpm verify:publish-manifests
 
       - name: Derive release versions
         id: versions
@@ -196,7 +193,6 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
-      - run: pnpm verify:publish-manifests
 
       - name: Rewrite package versions for final publish
         run: |

package.json

@@ -15,7 +15,7 @@
     "lint": "pnpm -r lint",
     "typecheck": "pnpm -r typecheck",
     "verify:publish-manifests": "node scripts/verify-no-workspace-protocol.mjs packages/core packages/cli",
-    "release": "pnpm build && pnpm test && pnpm verify:publish-manifests"
+    "release": "pnpm build && pnpm test"
   },
   "engines": {
     "node": ">=20.0.0",

packages/cli/package.json

@@ -26,7 +26,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@actalk/inkos-core": "0.4.8",
+    "@actalk/inkos-core": "workspace:*",
     "commander": "^13.0.0",
     "dotenv": "^16.4.0",
     "epub-gen-memory": "^1.0.10",

packages/cli/src/__tests__/publish-package.test.ts

@@ -53,7 +53,7 @@ describe("publish packaging", () => {
             name: "@actalk/inkos",
             version: "0.4.6",
             dependencies: {
-              "@actalk/inkos-core": "0.4.6",
+              "@actalk/inkos-core": "workspace:*",
               commander: "^13.0.0",
             },
           },
@@ -85,14 +85,10 @@ describe("publish packaging", () => {
     }
   });
 
-  it("keeps publishable CLI dependencies installable in source package.json", async () => {
+  it("keeps source CLI dependencies linked through the workspace protocol", async () => {
     const cliPackageJson = JSON.parse(await readFile(resolve(cliDir, "package.json"), "utf-8"));
-    const corePackageJson = JSON.parse(
-      await readFile(resolve(workspaceRoot, "packages/core/package.json"), "utf-8"),
-    );
 
-    expect(cliPackageJson.dependencies["@actalk/inkos-core"]).toBe(corePackageJson.version);
-    expect(cliPackageJson.dependencies["@actalk/inkos-core"]).not.toMatch(/^workspace:/);
+    expect(cliPackageJson.dependencies["@actalk/inkos-core"]).toBe("workspace:*");
   });
 
   it("verifies publishable manifests before npm publish runs", async () => {

pnpm-lock.yaml

@@ -11,8 +11,8 @@ importers:
   packages/cli:
     dependencies:
       '@actalk/inkos-core':
-        specifier: 0.4.8
-        version: 0.4.8
+        specifier: workspace:*
+        version: link:../core
       commander:
         specifier: ^13.0.0
         version: 13.1.0
@@ -63,9 +63,6 @@ importers:
 
 packages:
 
-  '@actalk/inkos-core@0.4.8':
-    resolution: {integrity: sha512-8DeR/7BOfqu6A4cdrmN0MNStVc1/4VXA7mxZ6eyFIlDx3a6H322UzFa/02KSwnKzuSdYPA2lwzo4D3F2heJh3A==}
-
   '@anthropic-ai/sdk@0.78.0':
     resolution: {integrity: sha512-PzQhR715td/m1UaaN5hHXjYB8Gl2lF9UVhrrGrZeysiF6Rb74Wc9GCB8hzLdzmQtBd1qe89F9OptgB9Za1Ib5w==}
     hasBin: true
@@ -967,16 +964,6 @@ packages:
 
 snapshots:
 
-  '@actalk/inkos-core@0.4.8':
-    dependencies:
-      '@anthropic-ai/sdk': 0.78.0(zod@3.25.76)
-      js-yaml: 4.1.1
-      openai: 4.104.0(zod@3.25.76)
-      zod: 3.25.76
-    transitivePeerDependencies:
-      - encoding
-      - ws
-
   '@anthropic-ai/sdk@0.78.0(zod@3.25.76)':
     dependencies:
       json-schema-to-ts: 3.1.1

scripts/verify-no-workspace-protocol.mjs

@@ -1,10 +1,12 @@
 /**
- * Standalone verification for publishable package manifests.
+ * Standalone verification for publish-time package manifests.
  *
  * Usage:
  *   node scripts/verify-no-workspace-protocol.mjs packages/cli packages/core
  *   node ../../scripts/verify-no-workspace-protocol.mjs .
  *
+ * Run this only after publish versions have been rewritten.
+ *
  * Checks two invariants before publish:
  * 1. publishable dependency fields must not contain workspace: specifiers
  * 2. internal workspace dependencies must match the current workspace package version exactly