fix: pin production runtime in applications

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/cli",
-  "version": "0.2.69",
+  "version": "0.2.70",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/cli/src/create.ts

@@ -86,6 +86,7 @@ Thumbs.db
   "dependencies": {
     "@wrnexus/ai": "${frameworkVersion}",
     "@wrnexus/core": "${frameworkVersion}",
+    "@wrnexus/dev-server": "${frameworkVersion}",
     "@wrnexus/helpers": "${frameworkVersion}",
     "@wrnexus/styles": "${frameworkVersion}",
     "@wrnexus/validation": "${frameworkVersion}",

packages/cli/src/update.ts

@@ -691,6 +691,22 @@ const MIGRATIONS: Migration[] = [
       // Runtime diagnostics improve automatically after updating and rebuilding.
     },
   },
+  {
+    version: "0.2.70",
+    id: "direct-production-runtime-dependency",
+    description:
+      "Declares @wrnexus/dev-server directly in runnable apps so production bundles resolve the matching runtime release.",
+    apply(ctx) {
+      if (!existsSync(join(ctx.appRoot, "app", "pages"))) return;
+      const file = join(ctx.appRoot, "package.json");
+      const pkg = JSON.parse(readFileSync(file, "utf8")) as Record<string, any>;
+      const dependencies = (pkg.dependencies ??= {} as Record<string, string>);
+      if (dependencies["@wrnexus/dev-server"] === `^${ctx.to}`) return;
+      dependencies["@wrnexus/dev-server"] = `^${ctx.to}`;
+      ctx.log(`+ @wrnexus/dev-server ^${ctx.to}`);
+      if (!ctx.dryRun) writeFileSync(file, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+    },
+  },
 ];
 
 /** Release tooling uses this to require an explicit migration entry per version. */

packages/cli/test/update.test.ts

@@ -62,6 +62,31 @@ test("0.2.18 migration adds helpers to existing apps and is idempotent", () => {
   }
 });
 
+test("0.2.70 migration pins the production runtime directly in runnable apps", () => {
+  const root = mkdtempSync(join(tmpdir(), "wrnexus-update-"));
+  mkdirSync(join(root, "app", "pages"), { recursive: true });
+  writeFileSync(
+    join(root, "package.json"),
+    JSON.stringify({
+      name: "existing-app",
+      dependencies: { "@wrnexus/core": "^0.2.69" },
+      wrnexus: { version: "0.2.69" },
+    }),
+  );
+
+  try {
+    updateApp(root, "0.2.70", false);
+    updateApp(root, "0.2.70", false);
+    const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+    expect(pkg.dependencies["@wrnexus/dev-server"]).toBe("^0.2.70");
+    expect(
+      Object.keys(pkg.dependencies).filter((name) => name === "@wrnexus/dev-server"),
+    ).toHaveLength(1);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test("0.2.19 migration adds VS Code formatting defaults without overwriting settings", () => {
   const root = mkdtempSync(join(tmpdir(), "wrnexus-update-"));
   mkdirSync(join(root, "app", "pages"), { recursive: true });