[lucasbraum]

Closes UPT-109 once the enki check below is done. Refs UPT-107 (#224).

What and why

In the 0.15.1 pilot (#169), enki's Uptide PR installed and passed tests, but the type-check failed: 3 files import @react-types/datepicker, which enki uses without declaring it, and the new lockfile no longer had it.

Cause. The UPT-107 "moved entries" retry drops every package that declares react as a peer, and that includes @react-aria/datepicker. It re-resolved from 3.15.2 to 3.17.1, and 3.17.1 no longer depends on @react-types/datepicker. Nothing required that package any more, so npm pruned it.

Fix (managers/upgrade.ts, npm only):

• After a retry step succeeds, compare the top level of the old and new lockfile (root and workspaces). Then scan tracked .[cm]?[jt]sx? files for bare from / import / require specifiers. A package that left the top level and is imported is a dropped import.
• If there is one, the same step runs again. It keeps the dropped package and every locked package that requires it, transitively, at their locked versions. Moved packages are never kept.
• If that retry hits ERESOLVE, the first retry's lockfile stands.
• lockfile.undeclared ({ name, version, kept }) lists each one. The CLI summary and the PR body show it under "Imported but not declared": the package is imported but not declared in package.json, and it was kept at a version or the new lockfile no longer has it. Both suggest adding it to package.json.
• The same report also covers a normal install with no retry, where the only possible outcome is reporting it.
• package.json is never changed.

On enki this should keep @react-aria/datepicker (its react peer range already accepts 19) and its requirers at their old versions, and so keep @react-types/datepicker 3.13.2.

Tests

• eresolve.test.ts, stand-in npm (now resolves dependencies transitively and prunes unrequired entries, like npm):
  • kept: picker peers on the moved ui, so the first retry drops it. picker 1.1.0 no longer brings picker-types, which src/date.ts imports. The second retry starts with picker and picker-types locked, and the lockfile keeps both at 1.0.0. The report has undeclared: [{ picker-types, 1.0.0, kept: true }], and package.json is unchanged.
  • cannot keep: picker 1.0.0 conflicts too, so the second retry hits ERESOLVE. The first retry's lockfile stands (picker 1.1.0, no picker-types), with kept: false.
  • Both failed on main before the fix.
• format-fix.test.ts, report.test.ts: the summary and PR body lines for both kept and not kept.
• Locally: pnpm lint (only the existing warning/info from main), pnpm typecheck, core 2296 passed, cli 517 passed (after pnpm build, which the notices and telemetry tests need).

Not done

• enki not re-run. No bench runs for this PR, so the type-check result on enki is still unconfirmed. Running the bench: UpgradeBench v0 pilot harness (UPT-24) #169 harness's Uptide arm on enki would confirm it.
• pnpm and yarn are not covered. The retry is npm only, and their strict layouts already break undeclared imports.
• The import scan is a regex over JS/TS files. It does not read .vue / .svelte files or /// <reference types>.

🤖 Generated with Claude Code