Seeding the result with theirs' keys and appending ours-only keys at the
end caused kilo-only deps (e.g. rotating-file-stream in packages/core)
to relocate from the middle of the deps block to the end during the
pre-merge transform. Git's textual 3-way merge then saw ours keeping
the line in place and theirs adding the same key elsewhere, producing
a duplicate JSON key in the merged file.
Iterate ours first so kilo-only deps stay in their original position,
then append any theirs-only keys at the end.
The transform that materialises the 'kilo compat for vX.Y.Z' commit during
an upstream merge takes upstream's package.json wholesale and re-applies a
hand-picked list of Kilo scripts. That list was incomplete: it only covered
`extension`, `changeset`, `changeset:version`, `test`, and `test:ci`, so
every merge silently dropped Kilo's `postinstall` tail (`&& bun run
script/setup-git.ts`) and the `dev-setup` root shortcut, and it never
pruned upstream-only scripts (`dev:desktop` / `dev:web` / `dev:console`)
or upstream-only catalog entries (`@sentry/solid`,
`@sentry/vite-plugin`) whose target packages Kilo doesn't ship.
- replace the per-script if-blocks with data-driven PRESERVE_SCRIPTS
- add DELETE_UPSTREAM_SCRIPTS for scripts that reference packages Kilo
doesn't ship
- add DELETE_UPSTREAM_CATALOG for catalog entries with zero Kilo consumers
- apply the same policy in both transformPackageJson (conflict path) and
transformAllPackageJson (pre-merge sweep path) — previously the
pre-merge sweep was missing `changeset` / `changeset:version`
preservation
- new tests covering preservation, deletion, opencode test scripts, and
the catalog pruning
Catriel Müller