@cellajs/cli 0.2.0 → 0.2.1

package/README.md

@@ -144,13 +144,31 @@ During analysis and sync, files are displayed with status indicators:
 | ◇ | `managed` | Package/config file changed | Handled separately by cella |
 | ⨂ | `ignored` | Protected by ignored config | Excluded from sync |
 | ✓ | `identical` | Fork matches upstream | No action needed |
-| ↑ | `ahead` | Fork changed (pinned) | Protected, keeping fork |
+| ↑ | `ahead` | Fork changed (pinned), upstream did not | Protected, keeping fork |
 | ! | `drifted` | Fork changed, not protected | At risk, consider pinning |
 | ↓ | `behind` | Upstream has changes | Will sync from upstream |
 | ⇅ | `diverged` | Both sides changed | Will merge from upstream |
-| ⨀ | `pinned` | Both changed, fork wins | Protected, keeping fork |
+| ⨀ | `pinned` | Both changed, fork wins | Protected, keeping fork — review, see below |
 | + | `local` | Only in fork, never in upstream | No action needed |
 
+### Protected but behind upstream
+
+A pinned or ignored file wins whole-file: when upstream also changed it since the last sync,
+upstream's hunks are dropped, not merged. That is easy to miss (a pinned stylesheet quietly
+missing new upstream utilities that synced components rely on), so both commands call it out:
+
+- `analyze` lists them in a `⚠ protected but behind upstream` section (pinned files as ⨀,
+  ignored as ⨂) with the number of lines upstream changed; `--list`/`--json` include them in
+  `--scope all` and `--scope protected` (`--json` adds `upstreamChanged` and `upstreamChangedLines`).
+- `sync` prints the same list at the end of its summary, right when the drop happens.
+
+Diff each against upstream (`cella analyze --open-diff <path>`) and adopt what you need. The
+check is relative to the last sync point: a drop that happened in an earlier sync only shows up
+as plain `ahead` afterwards. For that case the `↑ protected in fork` section annotates pinned
+files with `· N upstream lines absent` (lines upstream has that the fork lacks, compared at the
+tips, `--json`: `upstreamLinesAbsent`). That is upstream content the fork never received,
+deliberately or not: diff and decide. Ignored files are not annotated.
+
 ## Package.json sync
 
 `packageJsonSync` controls which package.json sections sync from upstream:
@@ -159,10 +177,12 @@ During analysis and sync, files are displayed with status indicators:
 packageJsonSync: ['dependencies', 'devDependencies', 'scripts']
 ```
 
-**Supported keys:** `dependencies`, `devDependencies`, `peerDependencies`, `optionalDependencies`, `scripts`, `engines`, `packageManager`, `overrides`
+**Supported keys:** `dependencies`, `devDependencies`, `peerDependencies`, `optionalDependencies`, `scripts`, `engines`, `packageManager`, `overrides`, `exports`, `pnpm`
 
 It **adds** new keys and **updates** existing ones to match upstream, but never **removes** keys
-that only exist in your fork — so extra dependencies and scripts survive each sync.
+that only exist in your fork — so extra dependencies and scripts survive each sync. `scripts` and
+`exports` are add-only: an entry your fork already defines is never rewritten. `exports` only
+merges when both sides are subpath maps (`{ ".": …, "./config": … }`).
 
 ## Contributions (pull from forks)
 

package/dist/config.d.ts

@@ -5,7 +5,7 @@
  */
 
 /** Valid package.json keys that can be synced */
-type PackageJsonSyncKey = 'dependencies' | 'devDependencies' | 'peerDependencies' | 'optionalDependencies' | 'scripts' | 'engines' | 'packageManager' | 'overrides' | 'pnpm';
+type PackageJsonSyncKey = 'dependencies' | 'devDependencies' | 'peerDependencies' | 'optionalDependencies' | 'scripts' | 'engines' | 'packageManager' | 'overrides' | 'exports' | 'pnpm';
 /**
  * Sync settings - all configurable options for the sync CLI.
  * Hover over each property for documentation.

package/dist/config.js

@@ -19,6 +19,7 @@ var cellaConfigSchema = z.object({
         "engines",
         "packageManager",
         "overrides",
+        "exports",
         "pnpm"
       ])
     ).optional(),

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/config/types.ts"],"sourcesContent":["/**\n * Sync CLI v2 - Configuration Types\n *\n * Simplified configuration for worktree-based merge approach.\n */\n\nimport { z } from 'zod';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// PUBLIC API - for cella/cella.config.ts\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Valid package.json keys that can be synced */\nexport type PackageJsonSyncKey =\n  | 'dependencies'\n  | 'devDependencies'\n  | 'peerDependencies'\n  | 'optionalDependencies'\n  | 'scripts'\n  | 'engines'\n  | 'packageManager'\n  | 'overrides'\n  | 'pnpm';\n\n/**\n * Sync settings - all configurable options for the sync CLI.\n * Hover over each property for documentation.\n */\nexport interface SyncSettings {\n  /** Upstream repository URL (e.g., 'git@github.com:cellajs/cella.git') */\n  upstreamUrl: string;\n\n  /**\n   * Upstream branch, used for `upstreamTrack: 'branch'` and for GitHub file links.\n   * Defaults to 'main'.\n   */\n  upstreamBranch?: string;\n\n  /**\n   * How to track upstream cella. Defaults to 'release'.\n   * - 'release' (default): sync to a published cella release tag (`v*`). Stable and\n   *   reviewable — each bump maps to a changelog. Uses the latest release.\n   * - 'branch': follow the bleeding-edge tip of `upstreamBranch`. For cella\n   *   maintainers and forks doing active development on top of unreleased changes.\n   */\n  upstreamTrack?: 'release' | 'branch';\n\n  /**\n   * Trunk branch that `pnpm cella sync` cuts the temporary branch from and that you open the\n   * squash-merge PR into. Defaults to 'main'. Cutting fresh from trunk each cycle keeps every\n   * PR limited to that cycle's upstream delta (no accumulation) and `main` linear.\n   */\n  releaseBase?: string;\n\n  /** Which package.json keys to sync (default: ['dependencies', 'devDependencies']) */\n  packageJsonSync?: PackageJsonSyncKey[];\n\n  /**\n   * Automatically run packages sync after the sync service completes.\n   * When true (default), the packages service is hidden from the menu\n   * and runs automatically as part of sync.\n   * Set to false to keep packages as a separate manual service.\n   */\n  syncWithPackages?: boolean;\n\n  /**\n   * How to link files in CLI output.\n   * - 'commit' (default): Link to the commit that changed the file on GitHub.\n   * - 'file': Link to the file in the repo at the upstream branch on GitHub.\n   * - 'local': Deprecated (the upstream view worktree was replaced by browser diffs); treated as 'file'.\n   */\n  fileLinkMode?: 'commit' | 'file' | 'local';\n}\n\n/**\n * Configuration for a downstream fork repository that cella interacts with.\n *\n * Cella is the upstream/source-of-truth. For each fork it can:\n * - pull contributions FROM the fork's `pullBranch` (contributions service)\n * - run the normal temporary-branch sync flow inside the fork (forks service)\n */\nexport interface ForkConfig {\n  /** Display name for the fork (also used as the contrib/<name> branch slug) */\n  name: string;\n  /** Local path to the fork repository (relative to this config or absolute) */\n  localPath: string;\n  /**\n   * Git remote URL of the fork (e.g. 'git@github.com:org/fork.git').\n   * When set, the contributions service fetches the fork's `pullBranch` from this\n   * remote (the authoritative committed ref) instead of the local clone, so the\n   * comparison no longer depends on the local checkout being up to date. The local\n   * clone is still used to read the fork's owned-folder territory when available.\n   */\n  remoteUrl?: string;\n  /** Fork branch that cella pulls contributions from (contributions service) */\n  pullBranch: string;\n}\n\n/**\n * User-configurable sync options for cella/cella.config.ts.\n * Simplified for v2 - no long-lived sync branch or squash options.\n */\nexport interface CellaCliConfig {\n  /** Core sync settings */\n  settings: SyncSettings;\n\n  /**\n   * File overrides for controlling sync behavior per folder/file.\n   */\n  overrides?: {\n    /**\n     * Paths the fork fully owns — never synced (existing or new).\n     * Exact paths or directory prefixes, not globs: 'bench' matches 'bench/' and\n     * everything under it, 'README.md' matches that exact file.\n     * Local territory: upstream cannot add, modify, or delete anything under these.\n     */\n    ignored?: string[];\n\n    /**\n     * Paths pinned to fork — fork wins on conflicts.\n     * Exact paths or directory prefixes, not globs: 'bench' matches 'bench/' and\n     * everything under it, 'README.md' matches that exact file.\n     * Non-conflicting upstream changes merge normally.\n     * If fork deleted a pinned file, deletion is respected.\n     */\n    pinned?: string[];\n  };\n\n  /**\n   * Downstream fork repositories that cella interacts with (for upstream template repos).\n   * When configured, the 'forks' and 'contributions' services appear in the CLI menu.\n   */\n  forks?: ForkConfig[];\n}\n\n/**\n * Helper function for defining cella/cella.config.ts with type checking.\n */\nexport function defineConfig(config: CellaCliConfig): CellaCliConfig {\n  return config;\n}\n\n/**\n * Strict runtime schema mirroring {@link CellaCliConfig}.\n *\n * The TS interfaces above stay the source of truth (and keep their hover docs for\n * config authors). This schema is what's enforced at load time: `.strict()` rejects\n * unknown keys, so a typo like `ignoredFolders` instead of `ignored` fails closed\n * instead of silently dropping sync protection (tsx does not typecheck the config).\n *\n * The `satisfies z.ZodType<CellaCliConfig>` assertion keeps schema and interface in\n * lockstep: if either drifts (a renamed/removed/mis-typed field), TypeScript errors here.\n */\nexport const cellaConfigSchema = z\n  .object({\n    settings: z\n      .object({\n        upstreamUrl: z.string().min(1),\n        upstreamBranch: z.string().min(1).optional(),\n        upstreamTrack: z.enum(['release', 'branch']).optional(),\n        releaseBase: z.string().min(1).optional(),\n        packageJsonSync: z\n          .array(\n            z.enum([\n              'dependencies',\n              'devDependencies',\n              'peerDependencies',\n              'optionalDependencies',\n              'scripts',\n              'engines',\n              'packageManager',\n              'overrides',\n              'pnpm',\n            ]),\n          )\n          .optional(),\n        syncWithPackages: z.boolean().optional(),\n        fileLinkMode: z.enum(['commit', 'file', 'local']).optional(),\n      })\n      .strict(),\n    overrides: z\n      .object({\n        ignored: z.array(z.string()).optional(),\n        pinned: z.array(z.string()).optional(),\n      })\n      .strict()\n      .optional(),\n    forks: z\n      .array(\n        z\n          .object({\n            name: z.string().min(1),\n            localPath: z.string().min(1),\n            remoteUrl: z.string().optional(),\n            pullBranch: z.string().min(1),\n          })\n          .strict(),\n      )\n      .optional(),\n  })\n  .strict() satisfies z.ZodType<CellaCliConfig>;\n\n// ─────────────────────────────────────────────────────────────────────────────\n// INTERNAL TYPES - for sync modules\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Sync services available in the CLI */\nexport type SyncService = 'analyze' | 'sync' | 'audit' | 'forks' | 'contributions' | 'stats';\n\n/** Analyze output scope for interactive and machine-readable flows */\nexport type AnalyzeScope = 'all' | 'risk' | 'protected';\n\n/** Runtime configuration with all resolved values */\nexport interface RuntimeConfig extends CellaCliConfig {\n  /** Resolved fork repository path */\n  forkPath: string;\n\n  /** Full upstream remote ref (e.g., 'cella-upstream/development') */\n  upstreamRef: string;\n\n  /** Selected sync service */\n  service: SyncService;\n\n  /** Write full file list to log file */\n  logFile: boolean;\n\n  /** Non-interactive list output (for LLM/agent usage) */\n  list: boolean;\n\n  /** Machine-readable JSON output (for tooling/agent usage) */\n  json: boolean;\n\n  /** Print the unified diff for a single contributed file, then exit (contributions; for tooling/agents) */\n  diff?: string;\n\n  /** Open a browser diff for one file, then exit (analyze) */\n  openDiff?: string;\n\n  /** Scope of files returned in analyze list/json output */\n  scope?: AnalyzeScope;\n\n  /** Show verbose output */\n  verbose: boolean;\n\n  /** Pre-selected fork name (skips fork selection prompt) */\n  fork?: string;\n\n  /** Overwrite drifted files with upstream version (aggressive realignment) */\n  hard?: boolean;\n\n  /**\n   * Disable pinned entries (cella/cella.config.ts overrides.pinned) for this sync so upstream\n   * versions surface as behind/diverged. Managed files stay pinned because cella\n   * handles them separately. Like --hard, uses the natural merge-base to resurface\n   * full upstream history.\n   */\n  unpinned?: boolean;\n\n  /**\n   * Override upstream tracking for this run (analyze/sync), ignoring `settings.upstreamTrack`.\n   * 'branch' follows the upstream branch tip (bleeding edge); 'release' uses a release tag.\n   */\n  track?: 'release' | 'branch';\n\n  /** Bypass pnpm metadata cache for fresh registry data (audit service) */\n  force?: boolean;\n\n  /** Check which pnpm.overrides are still needed (audit service) */\n  checkOverrides?: boolean;\n\n  /** Regenerate test coverage before showing the stats summary (stats service) */\n  coverage?: boolean;\n\n  /**\n   * After opening the sync PR, enable GitHub auto-merge (squash) so it merges itself once\n   * required checks pass (sync service). Opt-in per run via `--direct-merge`; needs auto-merge\n   * enabled on the repo. Not the advised default — a sync PR is usually worth a human look.\n   */\n  directMerge?: boolean;\n}\n\n/** File status after analysis */\nexport type FileStatus =\n  | 'identical' // No changes needed\n  | 'ahead' // Fork is ahead, protected (pinned/ignored)\n  | 'local' // Local file (never existed upstream)\n  | 'drifted' // Fork is ahead, NOT protected (at risk)\n  | 'behind' // Upstream has changes to sync\n  | 'diverged' // Both changed, will merge\n  | 'pinned' // Fork wins on conflict\n  | 'ignored' // Excluded from sync entirely\n  | 'deleted' // Fork deleted, will stay deleted\n  | 'renamed'; // Upstream renamed file\n\n/** Analyzed file with status and metadata */\nexport interface AnalyzedFile {\n  path: string;\n  status: FileStatus;\n  /** True if file is in ignored list */\n  isIgnored: boolean;\n  /** True if file is in pinned list */\n  isPinned: boolean;\n  /** True if file exists in fork */\n  existsInFork: boolean;\n  /** True if file exists in upstream */\n  existsInUpstream: boolean;\n  /** True if file has merge conflict */\n  hasConflict?: boolean;\n  /** Relative date when file was last changed (since merge-base) */\n  changedAt?: string;\n  /** Unix epoch seconds of the last change, for sorting */\n  changedTs?: number;\n  /** Short commit hash of the last change */\n  changedCommit?: string;\n  /** For diverged files: relative date of upstream change */\n  upstreamChangedAt?: string;\n  /** For diverged files: Unix epoch seconds of the upstream change, for sorting */\n  upstreamChangedTs?: number;\n  /** For diverged files: short commit hash of the upstream change */\n  upstreamCommit?: string;\n  /** For renamed files: the original path before rename */\n  renamedFrom?: string;\n}\n\n/** Summary counts by status */\nexport interface AnalysisSummary {\n  /** Changed package/config files that are handled separately from normal sync categories */\n  managed: number;\n  identical: number;\n  ahead: number;\n  local: number;\n  drifted: number;\n  behind: number;\n  diverged: number;\n  pinned: number;\n  ignored: number;\n  deleted: number;\n  renamed: number;\n  total: number;\n}\n\n/** Merge result from merge-engine */\nexport interface MergeResult {\n  success: boolean;\n  /** Upstream branch name for file links */\n  upstreamBranch?: string;\n  /** Resolved concrete upstream ref that was merged (branch ref or release tag ref) */\n  upstreamRef?: string;\n  /** Upstream release tag synced (when tracking releases) */\n  upstreamTag?: string;\n  files: AnalyzedFile[];\n  summary: AnalysisSummary;\n  conflicts: string[];\n  /** Upstream GitHub URL base for commit links */\n  upstreamGitHubUrl?: string;\n  /** Upstream commit info */\n  upstreamCommit?: {\n    hash: string;\n    message: string;\n    date: string;\n  };\n  /** Commits included in this sync range (oldest-first when rendered) */\n  upstreamCommits?: Array<{\n    hash: string;\n    message: string;\n    date: string;\n  }>;\n  /** Files that were auto-merged by git (diverged without remaining conflicts) */\n  autoMergedFiles?: string[];\n}\n"],"mappings":";AAMA,SAAS,SAAS;AAoIX,SAAS,aAAa,QAAwC;AACnE,SAAO;AACT;AAaO,IAAM,oBAAoB,EAC9B,OAAO;AAAA,EACN,UAAU,EACP,OAAO;AAAA,IACN,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC7B,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAC3C,eAAe,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC,EAAE,SAAS;AAAA,IACtD,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IACxC,iBAAiB,EACd;AAAA,MACC,EAAE,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,EACC,SAAS;AAAA,IACZ,kBAAkB,EAAE,QAAQ,EAAE,SAAS;AAAA,IACvC,cAAc,EAAE,KAAK,CAAC,UAAU,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA,EAC7D,CAAC,EACA,OAAO;AAAA,EACV,WAAW,EACR,OAAO;AAAA,IACN,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACtC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACvC,CAAC,EACA,OAAO,EACP,SAAS;AAAA,EACZ,OAAO,EACJ;AAAA,IACC,EACG,OAAO;AAAA,MACN,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC9B,CAAC,EACA,OAAO;AAAA,EACZ,EACC,SAAS;AACd,CAAC,EACA,OAAO;","names":[]}
+{"version":3,"sources":["../src/config/types.ts"],"sourcesContent":["/**\n * Sync CLI v2 - Configuration Types\n *\n * Simplified configuration for worktree-based merge approach.\n */\n\nimport { z } from 'zod';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// PUBLIC API - for cella/cella.config.ts\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Valid package.json keys that can be synced */\nexport type PackageJsonSyncKey =\n  | 'dependencies'\n  | 'devDependencies'\n  | 'peerDependencies'\n  | 'optionalDependencies'\n  | 'scripts'\n  | 'engines'\n  | 'packageManager'\n  | 'overrides'\n  | 'exports'\n  | 'pnpm';\n\n/**\n * Sync settings - all configurable options for the sync CLI.\n * Hover over each property for documentation.\n */\nexport interface SyncSettings {\n  /** Upstream repository URL (e.g., 'git@github.com:cellajs/cella.git') */\n  upstreamUrl: string;\n\n  /**\n   * Upstream branch, used for `upstreamTrack: 'branch'` and for GitHub file links.\n   * Defaults to 'main'.\n   */\n  upstreamBranch?: string;\n\n  /**\n   * How to track upstream cella. Defaults to 'release'.\n   * - 'release' (default): sync to a published cella release tag (`v*`). Stable and\n   *   reviewable — each bump maps to a changelog. Uses the latest release.\n   * - 'branch': follow the bleeding-edge tip of `upstreamBranch`. For cella\n   *   maintainers and forks doing active development on top of unreleased changes.\n   */\n  upstreamTrack?: 'release' | 'branch';\n\n  /**\n   * Trunk branch that `pnpm cella sync` cuts the temporary branch from and that you open the\n   * squash-merge PR into. Defaults to 'main'. Cutting fresh from trunk each cycle keeps every\n   * PR limited to that cycle's upstream delta (no accumulation) and `main` linear.\n   */\n  releaseBase?: string;\n\n  /** Which package.json keys to sync (default: ['dependencies', 'devDependencies']) */\n  packageJsonSync?: PackageJsonSyncKey[];\n\n  /**\n   * Automatically run packages sync after the sync service completes.\n   * When true (default), the packages service is hidden from the menu\n   * and runs automatically as part of sync.\n   * Set to false to keep packages as a separate manual service.\n   */\n  syncWithPackages?: boolean;\n\n  /**\n   * How to link files in CLI output.\n   * - 'commit' (default): Link to the commit that changed the file on GitHub.\n   * - 'file': Link to the file in the repo at the upstream branch on GitHub.\n   * - 'local': Deprecated (the upstream view worktree was replaced by browser diffs); treated as 'file'.\n   */\n  fileLinkMode?: 'commit' | 'file' | 'local';\n}\n\n/**\n * Configuration for a downstream fork repository that cella interacts with.\n *\n * Cella is the upstream/source-of-truth. For each fork it can:\n * - pull contributions FROM the fork's `pullBranch` (contributions service)\n * - run the normal temporary-branch sync flow inside the fork (forks service)\n */\nexport interface ForkConfig {\n  /** Display name for the fork (also used as the contrib/<name> branch slug) */\n  name: string;\n  /** Local path to the fork repository (relative to this config or absolute) */\n  localPath: string;\n  /**\n   * Git remote URL of the fork (e.g. 'git@github.com:org/fork.git').\n   * When set, the contributions service fetches the fork's `pullBranch` from this\n   * remote (the authoritative committed ref) instead of the local clone, so the\n   * comparison no longer depends on the local checkout being up to date. The local\n   * clone is still used to read the fork's owned-folder territory when available.\n   */\n  remoteUrl?: string;\n  /** Fork branch that cella pulls contributions from (contributions service) */\n  pullBranch: string;\n}\n\n/**\n * User-configurable sync options for cella/cella.config.ts.\n * Simplified for v2 - no long-lived sync branch or squash options.\n */\nexport interface CellaCliConfig {\n  /** Core sync settings */\n  settings: SyncSettings;\n\n  /**\n   * File overrides for controlling sync behavior per folder/file.\n   */\n  overrides?: {\n    /**\n     * Paths the fork fully owns — never synced (existing or new).\n     * Exact paths or directory prefixes, not globs: 'bench' matches 'bench/' and\n     * everything under it, 'README.md' matches that exact file.\n     * Local territory: upstream cannot add, modify, or delete anything under these.\n     */\n    ignored?: string[];\n\n    /**\n     * Paths pinned to fork — fork wins on conflicts.\n     * Exact paths or directory prefixes, not globs: 'bench' matches 'bench/' and\n     * everything under it, 'README.md' matches that exact file.\n     * Non-conflicting upstream changes merge normally.\n     * If fork deleted a pinned file, deletion is respected.\n     */\n    pinned?: string[];\n  };\n\n  /**\n   * Downstream fork repositories that cella interacts with (for upstream template repos).\n   * When configured, the 'forks' and 'contributions' services appear in the CLI menu.\n   */\n  forks?: ForkConfig[];\n}\n\n/**\n * Helper function for defining cella/cella.config.ts with type checking.\n */\nexport function defineConfig(config: CellaCliConfig): CellaCliConfig {\n  return config;\n}\n\n/**\n * Strict runtime schema mirroring {@link CellaCliConfig}.\n *\n * The TS interfaces above stay the source of truth (and keep their hover docs for\n * config authors). This schema is what's enforced at load time: `.strict()` rejects\n * unknown keys, so a typo like `ignoredFolders` instead of `ignored` fails closed\n * instead of silently dropping sync protection (tsx does not typecheck the config).\n *\n * The `satisfies z.ZodType<CellaCliConfig>` assertion keeps schema and interface in\n * lockstep: if either drifts (a renamed/removed/mis-typed field), TypeScript errors here.\n */\nexport const cellaConfigSchema = z\n  .object({\n    settings: z\n      .object({\n        upstreamUrl: z.string().min(1),\n        upstreamBranch: z.string().min(1).optional(),\n        upstreamTrack: z.enum(['release', 'branch']).optional(),\n        releaseBase: z.string().min(1).optional(),\n        packageJsonSync: z\n          .array(\n            z.enum([\n              'dependencies',\n              'devDependencies',\n              'peerDependencies',\n              'optionalDependencies',\n              'scripts',\n              'engines',\n              'packageManager',\n              'overrides',\n              'exports',\n              'pnpm',\n            ]),\n          )\n          .optional(),\n        syncWithPackages: z.boolean().optional(),\n        fileLinkMode: z.enum(['commit', 'file', 'local']).optional(),\n      })\n      .strict(),\n    overrides: z\n      .object({\n        ignored: z.array(z.string()).optional(),\n        pinned: z.array(z.string()).optional(),\n      })\n      .strict()\n      .optional(),\n    forks: z\n      .array(\n        z\n          .object({\n            name: z.string().min(1),\n            localPath: z.string().min(1),\n            remoteUrl: z.string().optional(),\n            pullBranch: z.string().min(1),\n          })\n          .strict(),\n      )\n      .optional(),\n  })\n  .strict() satisfies z.ZodType<CellaCliConfig>;\n\n// ─────────────────────────────────────────────────────────────────────────────\n// INTERNAL TYPES - for sync modules\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Sync services available in the CLI */\nexport type SyncService = 'analyze' | 'sync' | 'audit' | 'forks' | 'contributions' | 'stats';\n\n/** Analyze output scope for interactive and machine-readable flows */\nexport type AnalyzeScope = 'all' | 'risk' | 'protected';\n\n/** Runtime configuration with all resolved values */\nexport interface RuntimeConfig extends CellaCliConfig {\n  /** Resolved fork repository path */\n  forkPath: string;\n\n  /** Full upstream remote ref (e.g., 'cella-upstream/development') */\n  upstreamRef: string;\n\n  /** Selected sync service */\n  service: SyncService;\n\n  /** Write full file list to log file */\n  logFile: boolean;\n\n  /** Non-interactive list output (for LLM/agent usage) */\n  list: boolean;\n\n  /** Machine-readable JSON output (for tooling/agent usage) */\n  json: boolean;\n\n  /** Print the unified diff for a single contributed file, then exit (contributions; for tooling/agents) */\n  diff?: string;\n\n  /** Open a browser diff for one file, then exit (analyze) */\n  openDiff?: string;\n\n  /** Scope of files returned in analyze list/json output */\n  scope?: AnalyzeScope;\n\n  /** Show verbose output */\n  verbose: boolean;\n\n  /** Pre-selected fork name (skips fork selection prompt) */\n  fork?: string;\n\n  /** Overwrite drifted files with upstream version (aggressive realignment) */\n  hard?: boolean;\n\n  /**\n   * Disable pinned entries (cella/cella.config.ts overrides.pinned) for this sync so upstream\n   * versions surface as behind/diverged. Managed files stay pinned because cella\n   * handles them separately. Like --hard, uses the natural merge-base to resurface\n   * full upstream history.\n   */\n  unpinned?: boolean;\n\n  /**\n   * Override upstream tracking for this run (analyze/sync), ignoring `settings.upstreamTrack`.\n   * 'branch' follows the upstream branch tip (bleeding edge); 'release' uses a release tag.\n   */\n  track?: 'release' | 'branch';\n\n  /** Bypass pnpm metadata cache for fresh registry data (audit service) */\n  force?: boolean;\n\n  /** Check which pnpm.overrides are still needed (audit service) */\n  checkOverrides?: boolean;\n\n  /** Regenerate test coverage before showing the stats summary (stats service) */\n  coverage?: boolean;\n\n  /**\n   * After opening the sync PR, enable GitHub auto-merge (squash) so it merges itself once\n   * required checks pass (sync service). Opt-in per run via `--direct-merge`; needs auto-merge\n   * enabled on the repo. Not the advised default — a sync PR is usually worth a human look.\n   */\n  directMerge?: boolean;\n}\n\n/** File status after analysis */\nexport type FileStatus =\n  | 'identical' // No changes needed\n  | 'ahead' // Fork is ahead, protected (pinned/ignored)\n  | 'local' // Local file (never existed upstream)\n  | 'drifted' // Fork is ahead, NOT protected (at risk)\n  | 'behind' // Upstream has changes to sync\n  | 'diverged' // Both changed, will merge\n  | 'pinned' // Fork wins on conflict\n  | 'ignored' // Excluded from sync entirely\n  | 'deleted' // Fork deleted, will stay deleted\n  | 'renamed'; // Upstream renamed file\n\n/** Analyzed file with status and metadata */\nexport interface AnalyzedFile {\n  path: string;\n  status: FileStatus;\n  /** True if file is in ignored list */\n  isIgnored: boolean;\n  /** True if file is in pinned list */\n  isPinned: boolean;\n  /** True if file exists in fork */\n  existsInFork: boolean;\n  /** True if file exists in upstream */\n  existsInUpstream: boolean;\n  /** True if file has merge conflict */\n  hasConflict?: boolean;\n  /** Relative date when file was last changed (since merge-base) */\n  changedAt?: string;\n  /** Unix epoch seconds of the last change, for sorting */\n  changedTs?: number;\n  /** Short commit hash of the last change */\n  changedCommit?: string;\n  /** For diverged files: relative date of upstream change */\n  upstreamChangedAt?: string;\n  /** For diverged files: Unix epoch seconds of the upstream change, for sorting */\n  upstreamChangedTs?: number;\n  /** For diverged files: short commit hash of the upstream change */\n  upstreamCommit?: string;\n  /** For renamed files: the original path before rename */\n  renamedFrom?: string;\n  /**\n   * Protected (pinned/ignored) files only: both sides changed since the merge-base. The fork\n   * side wins whole-file, so upstream's changes to this path are dropped by the sync.\n   */\n  upstreamChanged?: boolean;\n  /** For `upstreamChanged` files: lines upstream changed since the merge-base (undefined for binary) */\n  upstreamChangedLines?: number;\n  /**\n   * Pinned `ahead` files only: lines present upstream but absent from the fork (undefined for\n   * binary). Independent of the sync point, so it also shows upstream content dropped by an\n   * earlier sync — or removed on purpose; only a diff can tell.\n   */\n  upstreamLinesAbsent?: number;\n}\n\n/** Summary counts by status */\nexport interface AnalysisSummary {\n  /** Changed package/config files that are handled separately from normal sync categories */\n  managed: number;\n  identical: number;\n  ahead: number;\n  local: number;\n  drifted: number;\n  behind: number;\n  diverged: number;\n  pinned: number;\n  ignored: number;\n  deleted: number;\n  renamed: number;\n  total: number;\n}\n\n/** Merge result from merge-engine */\nexport interface MergeResult {\n  success: boolean;\n  /** Upstream branch name for file links */\n  upstreamBranch?: string;\n  /** Resolved concrete upstream ref that was merged (branch ref or release tag ref) */\n  upstreamRef?: string;\n  /** Upstream release tag synced (when tracking releases) */\n  upstreamTag?: string;\n  files: AnalyzedFile[];\n  summary: AnalysisSummary;\n  conflicts: string[];\n  /** Upstream GitHub URL base for commit links */\n  upstreamGitHubUrl?: string;\n  /** Upstream commit info */\n  upstreamCommit?: {\n    hash: string;\n    message: string;\n    date: string;\n  };\n  /** Commits included in this sync range (oldest-first when rendered) */\n  upstreamCommits?: Array<{\n    hash: string;\n    message: string;\n    date: string;\n  }>;\n  /** Files that were auto-merged by git (diverged without remaining conflicts) */\n  autoMergedFiles?: string[];\n  /**\n   * Protected (pinned/ignored) files resolved to the fork side although upstream also changed\n   * them: upstream's hunks were dropped, not merged. Review each against upstream.\n   */\n  protectedConflicts?: string[];\n}\n"],"mappings":";AAMA,SAAS,SAAS;AAqIX,SAAS,aAAa,QAAwC;AACnE,SAAO;AACT;AAaO,IAAM,oBAAoB,EAC9B,OAAO;AAAA,EACN,UAAU,EACP,OAAO;AAAA,IACN,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC7B,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAC3C,eAAe,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC,EAAE,SAAS;AAAA,IACtD,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IACxC,iBAAiB,EACd;AAAA,MACC,EAAE,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,EACC,SAAS;AAAA,IACZ,kBAAkB,EAAE,QAAQ,EAAE,SAAS;AAAA,IACvC,cAAc,EAAE,KAAK,CAAC,UAAU,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA,EAC7D,CAAC,EACA,OAAO;AAAA,EACV,WAAW,EACR,OAAO;AAAA,IACN,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACtC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACvC,CAAC,EACA,OAAO,EACP,SAAS;AAAA,EACZ,OAAO,EACJ;AAAA,IACC,EACG,OAAO;AAAA,MACN,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC9B,CAAC,EACA,OAAO;AAAA,EACZ,EACC,SAAS;AACd,CAAC,EACA,OAAO;","names":[]}

package/dist/index.js

@@ -75,6 +75,7 @@ var cellaConfigSchema = z.object({
         "engines",
         "packageManager",
         "overrides",
+        "exports",
         "pnpm"
       ])
     ).optional(),
@@ -215,7 +216,7 @@ import process4 from "process";
 // package.json
 var package_default = {
   name: "@cellajs/cli",
-  version: "0.2.0",
+  version: "0.2.1",
   private: false,
   license: "MIT",
   description: "CLI for managing your monorepo and syncing with upstream Cella.",
@@ -226,7 +227,7 @@ var package_default = {
   homepage: "https://cellajs.com",
   author: "CellaJS <info@cellajs.com>",
   engines: {
-    node: "24.x"
+    node: "26.x"
   },
   type: "module",
   main: "./dist/index.js",
@@ -266,24 +267,24 @@ var package_default = {
   },
   dependencies: {
     "@inquirer/core": "^11.2.1",
-    "@inquirer/prompts": "^8.5.2",
-    "@pierre/diffs": "^1.2.12",
+    "@inquirer/prompts": "^8.7.2",
+    "@pierre/diffs": "^1.4.3",
     commander: "^15.0.0",
     "ts-morph": "^28.0.0",
-    zod: "^4.4.3"
+    zod: "^4.6.5"
   },
   devDependencies: {
-    "@biomejs/biome": "^2.5.2",
-    "@commitlint/cli": "^21.2.0",
-    "@commitlint/config-conventional": "^21.2.0",
-    "@evilmartians/lefthook": "^2.1.9",
-    "@types/node": "24.10.13",
+    "@biomejs/biome": "^2.5.14",
+    "@commitlint/cli": "^21.2.3",
+    "@commitlint/config-conventional": "^21.2.3",
+    "@evilmartians/lefthook": "^2.1.14",
+    "@types/node": "26.5.0",
     "@typescript/native-preview": "7.0.0-dev.20260702.3",
     rimraf: "^6.1.3",
     tsup: "^8.5.1",
-    tsx: "^4.22.4",
+    tsx: "^4.23.15",
     typescript: "^6.0.3",
-    vitest: "^4.1.9"
+    vitest: "^4.1.11"
   },
   publishConfig: {
     access: "public"
@@ -567,37 +568,74 @@ function printSummary(summary, title = "summary") {
   console.info();
   printLine("behind", summary.behind);
 }
-function printFileGroup(files, status, linkOptions, options) {
-  const filtered = files.filter((f) => f.status === status && !isManagedFile(f.path));
-  if (filtered.length === 0) return;
-  const config = statusConfig[status];
-  const title = options?.title ?? `${config.icon} ${config.label}`;
-  printSectionHeader(`${title} ${colors_default.dim(`\xB7 ${filtered.length} files`)}`);
-  const useUpstream = options?.dateSource === "upstream";
+function printFileSection(files, title, linkOptions, options) {
+  if (files.length === 0) return;
+  printSectionHeader(`${title} ${colors_default.dim(`\xB7 ${files.length} files`)}`);
+  const useUpstream = options.dateSource === "upstream";
   const maxLines = 100;
-  const shown = filtered.length > maxLines ? filtered.slice(0, maxLines) : filtered;
+  const shown = files.length > maxLines ? files.slice(0, maxLines) : files;
   for (const file of shown) {
+    const icon = typeof options.icon === "string" ? options.icon : options.icon(file);
     const commit = useUpstream ? file.upstreamCommit : file.changedCommit;
     const date = useUpstream ? file.upstreamChangedAt : file.changedAt;
     const dateInfo = formatFileDateInfo(file.path, commit, date, linkOptions);
-    console.info(`  ${config.icon} ${file.path}${dateInfo}`);
+    console.info(`  ${icon} ${file.path}${dateInfo}${options.suffix?.(file) ?? ""}`);
   }
-  if (filtered.length > maxLines) {
-    console.info(colors_default.dim(`  ... + ${filtered.length - maxLines} more`));
+  if (files.length > maxLines) {
+    console.info(colors_default.dim(`  ... + ${files.length - maxLines} more`));
   }
-  if (options?.hint) {
+  if (options.hint) {
     console.info();
-    console.info(colors_default.dim(`  ${options.hint}`));
+    for (const line of Array.isArray(options.hint) ? options.hint : [options.hint]) {
+      console.info(colors_default.dim(`  ${line}`));
+    }
   }
 }
+function printFileGroup(files, status, linkOptions, options) {
+  const filtered = files.filter((f) => f.status === status && !isManagedFile(f.path));
+  const config = statusConfig[status];
+  const title = options?.title ?? `${config.icon} ${config.label}`;
+  printFileSection(filtered, title, linkOptions, { ...options, icon: config.icon });
+}
+function findProtectedBehind(files) {
+  return files.filter((file) => file.upstreamChanged && !isManagedFile(file.path));
+}
+var PROTECTED_BEHIND_HINT = "pinned/ignored files where upstream also changed since the last sync; the fork side wins on conflict, so diff each against upstream (analyze --open-diff <path>) and adopt what you need.";
+function protectionIcon(file) {
+  return file.isIgnored ? statusConfig.ignored.icon : statusConfig.pinned.icon;
+}
+function formatUpstreamChangedLines(file) {
+  if (file.upstreamChangedLines === void 0) return "";
+  const n = file.upstreamChangedLines;
+  return colors_default.yellow(` \xB7 ${n} ${n === 1 ? "line" : "lines"} changed upstream`);
+}
+function formatUpstreamLinesAbsent(file) {
+  const n = file.upstreamLinesAbsent ?? 0;
+  return n > 0 ? colors_default.yellow(` \xB7 ${n} upstream ${n === 1 ? "line" : "lines"} absent`) : "";
+}
 function printAnalysisFileGroups(files, linkOptions) {
   printFileGroup(files, "behind", linkOptions, {
     title: colors_default.cyan("\u2193 behind on upstream")
   });
   printFileGroup(files, "ahead", linkOptions, {
     title: `${colors_default.blue("\u2191 protected in fork")}`,
-    hint: "these files have fork changes but are protected (pinned)."
+    suffix: formatUpstreamLinesAbsent,
+    hint: [
+      "these files have fork changes but are protected (pinned); upstream did not change them since the last sync.",
+      "pinned files keep the fork side on every conflict; a count here is upstream content the fork never received, deliberately or not: diff and decide."
+    ]
   });
+  printFileSection(
+    findProtectedBehind(files),
+    `${warningMark} ${colors_default.yellow("protected but behind upstream")}`,
+    linkOptions,
+    {
+      icon: protectionIcon,
+      suffix: formatUpstreamChangedLines,
+      dateSource: "upstream",
+      hint: PROTECTED_BEHIND_HINT
+    }
+  );
   printFileGroup(files, "drifted", linkOptions, {
     title: `${warningMark} ${colors_default.yellow("drifted from upstream")}`,
     hint: "these files have fork changes but are not pinned or ignored."
@@ -607,11 +645,6 @@ function printAnalysisFileGroups(files, linkOptions) {
     hint: "both fork and upstream changed.",
     dateSource: "upstream"
   });
-  printFileGroup(files, "pinned", linkOptions, {
-    title: `${colors_default.green("\u2A00 pinned")}`,
-    hint: "both changed, fork wins (pinned in cella/cella.config.ts).",
-    dateSource: "upstream"
-  });
 }
 function writeLogFile(forkPath, files) {
   const logPath = join3(forkPath, "cella-sync.log");
@@ -652,8 +685,26 @@ function printSyncComplete(result, options = {}) {
     console.info(`${colors_default.green("\u2713")} sync complete`);
     console.info(colors_default.dim(`  ${updated} files updated, ${merged} auto-merged, ${conflicts} conflicts`));
   }
+  printProtectedConflicts(result);
   console.info();
 }
+function printProtectedConflicts(result) {
+  const paths = result.protectedConflicts ?? [];
+  if (paths.length === 0) return;
+  const byPath = new Map(result.files.map((file) => [file.path, file]));
+  console.info();
+  console.info(
+    `${warningMark} ${colors_default.yellow(
+      `${paths.length} protected ${paths.length === 1 ? "file kept" : "files kept"} the fork version, dropping upstream changes:`
+    )}`
+  );
+  for (const path4 of paths) {
+    const file = byPath.get(path4);
+    const icon = file ? protectionIcon(file) : statusConfig.pinned.icon;
+    console.info(`  ${icon} ${path4}${file ? formatUpstreamChangedLines(file) : ""}`);
+  }
+  console.info(colors_default.dim(`  ${PROTECTED_BEHIND_HINT}`));
+}
 function findMaskingPins(files) {
   return files.filter(
     (file) => file.isPinned && file.status === "behind" && file.existsInFork && file.existsInUpstream
@@ -1377,6 +1428,23 @@ async function getFileChanges(cwd, baseRef, targetRef) {
   }
   return changes;
 }
+async function getDiffStat(cwd, fromRef, toRef, paths = []) {
+  const args = ["diff", "--numstat", "--no-renames", fromRef, toRef];
+  if (paths.length > 0) args.push("--", ...paths);
+  const out = await git(args, cwd, { ignoreErrors: true });
+  const stat = /* @__PURE__ */ new Map();
+  for (const line of out.split("\n")) {
+    if (!line.trim()) continue;
+    const [a, d, ...rest] = line.split("	");
+    const path4 = rest.join("	");
+    if (!path4) continue;
+    stat.set(path4, {
+      additions: a === "-" ? null : Number(a),
+      deletions: d === "-" ? null : Number(d)
+    });
+  }
+  return stat;
+}
 async function getFileHashesAtRef(cwd, ref) {
   const output = await git(["ls-tree", "-r", ref], cwd);
   const hashes = /* @__PURE__ */ new Map();
@@ -1747,6 +1815,7 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
   );
   const analyzedFiles = [];
   const handledOldPaths = /* @__PURE__ */ new Set();
+  const renamedProtected = /* @__PURE__ */ new Set();
   let processed = 0;
   for (const filePath of allFiles) {
     if (handledOldPaths.has(filePath)) continue;
@@ -1785,8 +1854,13 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
       handledOldPaths.add(oldPath);
       const forkModifiedOld = forkOldHash !== baseOldHash;
       const oldPathPinned = predicates.isPinned(oldPath);
+      let upstreamChanged2;
       if (fileIsPinned || oldPathPinned || predicates.isIgnored(oldPath)) {
         status = "pinned";
+        if (forkModifiedOld && upstreamHash !== baseOldHash) {
+          upstreamChanged2 = true;
+          renamedProtected.add(filePath);
+        }
       } else if (!oldPathInFork) {
         status = "behind";
       } else if (forkModifiedOld) {
@@ -1803,7 +1877,8 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
         isPinned: fileIsPinned,
         existsInFork: inFork,
         existsInUpstream: true,
-        renamedFrom
+        renamedFrom,
+        upstreamChanged: upstreamChanged2
       });
       continue;
     }
@@ -1826,26 +1901,58 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
       status = "identical";
     } else {
       const forkChanged = forkHash !== baseHash;
-      const upstreamChanged = upstreamHash !== baseHash;
-      if (forkChanged && upstreamChanged) {
+      const upstreamChanged2 = upstreamHash !== baseHash;
+      if (forkChanged && upstreamChanged2) {
         status = fileIsPinned ? "pinned" : "diverged";
-      } else if (forkChanged && !upstreamChanged) {
+      } else if (forkChanged && !upstreamChanged2) {
         status = fileIsPinned ? "ahead" : predicates.hard ? "behind" : "drifted";
-      } else if (!forkChanged && upstreamChanged) {
+      } else if (!forkChanged && upstreamChanged2) {
         status = "behind";
       } else {
         status = "identical";
       }
     }
+    const upstreamChanged = (fileIsPinned || fileIsIgnored) && inUpstream && upstreamHash !== baseHash && forkHash !== baseHash;
     analyzedFiles.push({
       path: filePath,
       status,
       isIgnored: fileIsIgnored,
       isPinned: fileIsPinned,
       existsInFork: inFork,
-      existsInUpstream: inUpstream
+      existsInUpstream: inUpstream,
+      upstreamChanged: upstreamChanged || void 0
     });
   }
+  const flagged = analyzedFiles.filter((file) => file.upstreamChanged && !renamedProtected.has(file.path));
+  if (flagged.length > 0) {
+    const stat = await getDiffStat(
+      repoPath,
+      mergeBaseRef,
+      incomingRef,
+      flagged.map((file) => file.path)
+    );
+    for (const file of flagged) {
+      const entry = stat.get(file.path);
+      if (entry && entry.additions !== null && entry.deletions !== null) {
+        file.upstreamChangedLines = entry.additions + entry.deletions;
+      }
+    }
+  }
+  const stale = analyzedFiles.filter(
+    (file) => file.status === "ahead" && file.isPinned && !file.isIgnored && file.existsInFork && file.existsInUpstream && forkHashes.get(file.path) !== upstreamHashes.get(file.path)
+  );
+  if (stale.length > 0) {
+    const stat = await getDiffStat(
+      repoPath,
+      incomingRef,
+      localRef,
+      stale.map((file) => file.path)
+    );
+    for (const file of stale) {
+      const deletions = stat.get(file.path)?.deletions;
+      if (deletions !== null && deletions !== void 0) file.upstreamLinesAbsent = deletions;
+    }
+  }
   return analyzedFiles;
 }
 async function enrichChangeInfo(repoPath, files, mergeBaseRef, localRef, incomingRef) {
@@ -1867,7 +1974,7 @@ async function enrichChangeInfo(repoPath, files, mergeBaseRef, localRef, incomin
         file.changedTs = info.timestamp;
         file.changedCommit = info.hash;
       }
-    } else if (file.status === "diverged" || file.status === "pinned") {
+    } else if (file.status === "diverged" || file.status === "pinned" || file.upstreamChanged) {
       const forkFileInfo = forkInfo.get(file.path);
       const upstreamFileInfo = upstreamInfo.get(file.path);
       if (forkFileInfo) {
@@ -2013,6 +2120,7 @@ async function applyDirectMerge(forkPath, upstreamRef, mergeBaseRef, config, onP
       }
     }
   }
+  const protectedConflicts = analyzedFiles.filter((file) => file.upstreamChanged).map((file) => file.path);
   const gitConflicts = await getConflictedFiles(forkPath);
   for (const filePath of gitConflicts) {
     const isProtected = isIgnored(filePath, config) || isPinnedForSync(filePath, config, config.unpinned);
@@ -2020,6 +2128,7 @@ async function applyDirectMerge(forkPath, upstreamRef, mergeBaseRef, config, onP
     if (await fileExistsAtRef(forkPath, "HEAD", filePath)) {
       onProgress?.(`\u2192 ${filePath}: keeping fork (protected conflict)`);
       await restoreToHead(forkPath, filePath);
+      if (!protectedConflicts.includes(filePath)) protectedConflicts.push(filePath);
     } else {
       onProgress?.(`\u2192 ${filePath}: removing (protected conflict, not in fork)`);
       await removeFileFully(forkPath, filePath);
@@ -2037,7 +2146,7 @@ async function applyDirectMerge(forkPath, upstreamRef, mergeBaseRef, config, onP
       await removeFileFromWorktree(forkPath, filePath);
     }
   }
-  return { remainingConflicts, analyzedFiles, autoMergedFiles };
+  return { remainingConflicts, analyzedFiles, autoMergedFiles, protectedConflicts };
 }
 function calculateSummary(files) {
   const summary = {
@@ -2130,7 +2239,7 @@ function resultMeta(config, ctx) {
 async function runSyncMerge(config, ctx, onProgress, onStep) {
   const { forkPath } = config;
   const { upstreamRef, releaseTag, mergeBase, upstreamGitHubUrl, upstreamCommit } = ctx;
-  const { remainingConflicts, analyzedFiles, autoMergedFiles } = await applyDirectMerge(
+  const { remainingConflicts, analyzedFiles, autoMergedFiles, protectedConflicts } = await applyDirectMerge(
     forkPath,
     upstreamRef,
     mergeBase,
@@ -2177,6 +2286,7 @@ async function runSyncMerge(config, ctx, onProgress, onStep) {
     summary,
     conflicts: remainingConflicts,
     autoMergedFiles,
+    protectedConflicts,
     ...resultMeta(config, ctx)
   };
 }
@@ -2213,6 +2323,7 @@ async function runAnalyzePreview(config, ctx, onProgress, onStep) {
     summary: calculateSummary(analyzedFiles),
     // For analyze mode, count diverged files as potential conflicts
     conflicts: analyzedFiles.filter((f) => f.status === "diverged").map((f) => f.path),
+    protectedConflicts: analyzedFiles.filter((f) => f.upstreamChanged).map((f) => f.path),
     ...resultMeta(config, ctx)
   };
 }
@@ -2239,7 +2350,8 @@ var scopeStatuses = {
 };
 function filterByScope(files, scope) {
   const statuses = scopeStatuses[scope];
-  return files.filter((f) => statuses.has(f.status));
+  const includeProtectedBehind = scope !== "risk";
+  return files.filter((f) => statuses.has(f.status) || includeProtectedBehind && f.upstreamChanged === true);
 }
 function findTargetFile(files, targetPath) {
   const exact = files.find((f) => f.path === targetPath);
@@ -2280,7 +2392,10 @@ async function runAnalyze(config) {
       changedAt: f.changedAt ?? null,
       changedCommit: f.changedCommit ?? null,
       upstreamChangedAt: f.upstreamChangedAt ?? null,
-      upstreamCommit: f.upstreamCommit ?? null
+      upstreamCommit: f.upstreamCommit ?? null,
+      upstreamChanged: f.upstreamChanged ?? false,
+      upstreamChangedLines: f.upstreamChangedLines ?? null,
+      upstreamLinesAbsent: f.upstreamLinesAbsent ?? null
     }));
     writeStdout(JSON.stringify(out, null, 2));
     return result;
@@ -3379,21 +3494,6 @@ async function forkRefMeta(cellaPath, forkRef) {
   const [sha = forkRef.slice(0, 7), date = "unknown"] = out.split("	");
   return { sha, date };
 }
-async function diffStat(cellaPath, baseRef, ref) {
-  const out = await git(["diff", "--numstat", `${baseRef}..${ref}`], cellaPath, { ignoreErrors: true });
-  const stat = /* @__PURE__ */ new Map();
-  for (const line of out.split("\n")) {
-    if (!line.trim()) continue;
-    const [a, d, ...rest] = line.split("	");
-    const path4 = rest.join("	");
-    if (!path4) continue;
-    stat.set(path4, {
-      additions: a === "-" ? null : Number(a),
-      deletions: d === "-" ? null : Number(d)
-    });
-  }
-  return stat;
-}
 async function runContributions(config) {
   const forks = config.forks ?? [];
   if (forks.length === 0) {
@@ -3468,7 +3568,7 @@ async function runContributions(config) {
     if (countDetection(detection) > 0) {
       const { branch, appliedFiles } = await buildContribBranch(config.forkPath, baseRef, forkRef, detection, forkName);
       if (appliedFiles.length > 0) {
-        const stat = await diffStat(config.forkPath, baseRef, branch);
+        const stat = await getDiffStat(config.forkPath, baseRef, branch);
         const metaByPath = new Map(detection.files.map((f) => [f.path, f]));
         for (const path4 of [...detection.modified, ...detection.created]) {
           const fileMeta = metaByPath.get(path4);
@@ -3716,6 +3816,18 @@ function safeMergeRecord(forkRecord, upstreamRecord, addOnly = false) {
   const sorted = Object.fromEntries(Object.entries(merged).sort(([a], [b]) => a.localeCompare(b)));
   return { merged: sorted, changed, added };
 }
+function isSubpathMap(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  return Object.keys(value).every((name) => name.startsWith("."));
+}
+function safeMergeExports(forkExports, upstreamExports) {
+  if (!isSubpathMap(upstreamExports)) return void 0;
+  if (forkExports !== void 0 && !isSubpathMap(forkExports)) return void 0;
+  const merged = { ...forkExports || {} };
+  const added = Object.keys(upstreamExports).filter((name) => !(name in merged));
+  for (const name of added) merged[name] = upstreamExports[name];
+  return { merged, changed: added.length > 0, added };
+}
 function safeMergePnpm(forkPnpm, upstreamPnpm) {
   if (!upstreamPnpm) return void 0;
   const merged = { ...forkPnpm || {} };
@@ -3830,6 +3942,15 @@ async function syncPackageJson(forkPath, upstreamRef, relativePath, keysToSync)
       }
       continue;
     }
+    if (key === "exports") {
+      const result2 = safeMergeExports(forkPkg.exports, upstreamPkg.exports);
+      if (result2?.changed) {
+        forkPkg.exports = result2.merged;
+        updated = true;
+        changes.push(...result2.added.map((name) => `exports.${name}: added`));
+      }
+      continue;
+    }
     const forkValue = forkPkg[key];
     const upstreamValue = upstreamPkg[key];
     const addOnly = key === "scripts";