@cellajs/cli 0.2.1 → 0.2.3

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env tsx
 
 // src/cella-cli.ts
-import { existsSync as existsSync10, statSync as statSync2 } from "fs";
-import { join as join17, resolve as resolve6 } from "path";
+import { existsSync as existsSync11, statSync as statSync3 } from "fs";
+import { join as join18, resolve as resolve6 } from "path";
 import process9 from "process";
 
 // src/cli.ts
@@ -106,6 +106,10 @@ function isConfigFile(filePath) {
 function isPackageJson(filePath) {
   return filePath === "package.json" || filePath.endsWith("/package.json");
 }
+function isGeneratedFile(filePath) {
+  const segments = filePath.split("/");
+  return segments.includes("gen") || (segments.at(-1) ?? "").includes(".gen.");
+}
 function isManagedFile(filePath) {
   return isPackageJson(filePath) || filePath === "pnpm-lock.yaml" || isConfigFile(filePath);
 }
@@ -216,7 +220,7 @@ import process4 from "process";
 // package.json
 var package_default = {
   name: "@cellajs/cli",
-  version: "0.2.1",
+  version: "0.2.3",
   private: false,
   license: "MIT",
   description: "CLI for managing your monorepo and syncing with upstream Cella.",
@@ -705,9 +709,58 @@ function printProtectedConflicts(result) {
   }
   console.info(colors_default.dim(`  ${PROTECTED_BEHIND_HINT}`));
 }
+function plural(count, singular, pluralForm = `${singular}s`) {
+  return `${count} ${count === 1 ? singular : pluralForm}`;
+}
+function shellPath(path4) {
+  return /^[\w./@+-]+$/.test(path4) ? path4 : `'${path4.replace(/'/g, `'\\''`)}'`;
+}
+function printIgnoredUpstreamChanges(result) {
+  const groups = result.ignoredUpstreamChanges ?? [];
+  if (groups.length === 0) return;
+  const total = groups.reduce((count, group) => count + group.paths.length, 0);
+  console.info();
+  console.info(
+    `${warningMark} ${colors_default.yellow(`ignored paths changed upstream \xB7 ${plural(total, "file")} under ${plural(groups.length, "entry", "entries")}`)}`
+  );
+  for (const group of groups) {
+    const counts = [plural(group.paths.length, "file")];
+    if (group.added > 0) counts.push(`${group.added} new`);
+    if (group.deleted > 0) counts.push(`${group.deleted} deleted`);
+    console.info(`  ${statusConfig.ignored.icon} ${group.entry} ${colors_default.dim(`\xB7 ${counts.join(", ")}`)}`);
+    if (result.upstreamDiffRange) {
+      console.info(colors_default.dim(`    git diff ${result.upstreamDiffRange} -- ${shellPath(group.entry)}`));
+    }
+  }
+  console.info(colors_default.dim("  the fork left these untouched and ignored paths never sync: diff and adopt what you need."));
+}
+function printUpstreamOverrideChanges(result) {
+  const report = result.upstreamOverrides;
+  if (!report) return;
+  console.info();
+  if (report.kind === "unreadable") {
+    const side = report.side === "base" ? "the last sync point" : "the incoming ref";
+    console.info(
+      colors_default.dim(`upstream overrides not compared: upstream ${CONFIG_FILE} is missing or unreadable at ${side}`)
+    );
+    return;
+  }
+  const lines = [];
+  for (const list of ["pinned", "ignored"]) {
+    for (const entry of report[list].added) lines.push(`  ${colors_default.green("+")} ${list}: ${entry}`);
+    for (const entry of report[list].removed) {
+      lines.push(`  ${colors_default.red("\u2212")} ${list}: ${entry}${colors_default.dim(" \xB7 dropped upstream, still in your config")}`);
+    }
+  }
+  console.info(
+    `${warningMark} ${colors_default.yellow(`upstream changed its sync overrides \xB7 ${plural(lines.length, "entry", "entries")} to review`)}`
+  );
+  for (const line of lines) console.info(line);
+  console.info(colors_default.dim(`  ${CONFIG_FILE} never syncs: add or drop these by hand where they fit your app.`));
+}
 function findMaskingPins(files) {
   return files.filter(
-    (file) => file.isPinned && file.status === "behind" && file.existsInFork && file.existsInUpstream
+    (file) => file.isPinned && !isManagedFile(file.path) && file.status === "behind" && file.existsInFork && file.existsInUpstream
   );
 }
 function printMaskingPinWarning(files) {
@@ -762,6 +815,23 @@ function isPinned(filePath, config) {
   if (isManagedFile(filePath)) return true;
   return isUnderAnyFolder(filePath, config.overrides?.pinned || []);
 }
+function groupIgnoredUpstreamChanges(files, ignored) {
+  const entries = [...new Set(ignored.map((entry) => entry.replace(/\/+$/, "")).filter(Boolean))];
+  const mostSpecificFirst = [...entries].sort((a, b) => b.length - a.length);
+  const groups = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    if (!file.upstreamOnly || isManagedFile(file.path) || isGeneratedFile(file.path)) continue;
+    const entry = mostSpecificFirst.find((candidate) => isUnderAnyFolder(file.path, [candidate]));
+    if (!entry) continue;
+    const group = groups.get(entry) ?? { entry, paths: [], added: 0, deleted: 0 };
+    group.paths.push(file.path);
+    if (!file.existsInFork) group.added++;
+    if (!file.existsInUpstream) group.deleted++;
+    groups.set(entry, group);
+  }
+  for (const group of groups.values()) group.paths.sort();
+  return entries.flatMap((entry) => groups.get(entry) ?? []);
+}
 function isPinnedForSync(filePath, config, unpinned) {
   if (isManagedFile(filePath)) return true;
   if (unpinned) return false;
@@ -1791,7 +1861,115 @@ function registerSignalHandlers() {
   cleanupRegistered = true;
 }
 
+// src/utils/upstream-overrides.ts
+import { Node, Project as Project2, SyntaxKind as SyntaxKind2 } from "ts-morph";
+var LIST_KEYS = ["pinned", "ignored"];
+function resolveExpression(node, sourceFile, depth = 0) {
+  if (!node || depth > 8) return node;
+  if (Node.isParenthesizedExpression(node) || Node.isAsExpression(node) || Node.isSatisfiesExpression(node)) {
+    return resolveExpression(node.getExpression(), sourceFile, depth + 1);
+  }
+  if (Node.isIdentifier(node)) {
+    return resolveExpression(
+      sourceFile.getVariableDeclaration(node.getText())?.getInitializer(),
+      sourceFile,
+      depth + 1
+    );
+  }
+  return node;
+}
+function findConfigObject(sourceFile) {
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind2.CallExpression)) {
+    if (call.getExpression().getText() !== "defineConfig") continue;
+    const arg = resolveExpression(call.getArguments()[0], sourceFile);
+    if (Node.isObjectLiteralExpression(arg)) return arg;
+  }
+  const exported = sourceFile.getExportAssignment((assignment) => !assignment.isExportEquals());
+  const value = resolveExpression(exported?.getExpression(), sourceFile);
+  return Node.isObjectLiteralExpression(value) ? value : void 0;
+}
+function readProperty(object, name, sourceFile) {
+  for (const property of object.getProperties()) {
+    if (Node.isPropertyAssignment(property)) {
+      if (property.getName().replace(/^['"`]|['"`]$/g, "") !== name) continue;
+      return resolveExpression(property.getInitializer(), sourceFile) ?? null;
+    }
+    if (Node.isShorthandPropertyAssignment(property) && property.getName() === name) {
+      return resolveExpression(property.getNameNode(), sourceFile) ?? null;
+    }
+  }
+  return void 0;
+}
+function parseOverrideLists(source) {
+  try {
+    const project = new Project2({ useInMemoryFileSystem: true, skipLoadingLibFiles: true });
+    const sourceFile = project.createSourceFile("cella.config.ts", source);
+    const config = findConfigObject(sourceFile);
+    if (!config) return null;
+    const overrides = readProperty(config, "overrides", sourceFile);
+    if (overrides === void 0) return { pinned: [], ignored: [] };
+    if (!overrides || !Node.isObjectLiteralExpression(overrides)) return null;
+    const lists = { pinned: [], ignored: [] };
+    for (const key of LIST_KEYS) {
+      const list = readProperty(overrides, key, sourceFile);
+      if (list === void 0) continue;
+      if (!list || !Node.isArrayLiteralExpression(list)) return null;
+      for (const element of list.getElements()) {
+        if (Node.isStringLiteral(element) || Node.isNoSubstitutionTemplateLiteral(element)) {
+          lists[key].push(element.getLiteralValue());
+        }
+      }
+    }
+    return lists;
+  } catch {
+    return null;
+  }
+}
+function normalizeEntry(entry) {
+  return entry.trim().replace(/^\.\//, "").replace(/\/+$/, "");
+}
+function diffOverrideLists(base, incoming, fork) {
+  const diff = (key) => {
+    const baseSet = new Set(base[key].map(normalizeEntry).filter(Boolean));
+    const incomingSet = new Set(incoming[key].map(normalizeEntry).filter(Boolean));
+    const forkEntries = fork[key].map(normalizeEntry).filter(Boolean);
+    return {
+      added: [...incomingSet].filter((entry) => !baseSet.has(entry) && !isUnderAnyFolder(entry, forkEntries)),
+      removed: [...baseSet].filter((entry) => !incomingSet.has(entry) && forkEntries.includes(entry))
+    };
+  };
+  return { pinned: diff("pinned"), ignored: diff("ignored") };
+}
+async function readConfigSourceAtRef(repoPath, ref) {
+  for (const path4 of CONFIG_FILE_PATHS) {
+    const source = await git(["show", `${ref}:${path4}`], repoPath, { ignoreErrors: true });
+    if (source) return source;
+  }
+  return null;
+}
+async function compareUpstreamOverrides(repoPath, mergeBaseRef, incomingRef, forkConfig) {
+  const [baseSource, incomingSource] = await Promise.all([
+    readConfigSourceAtRef(repoPath, mergeBaseRef),
+    readConfigSourceAtRef(repoPath, incomingRef)
+  ]);
+  if (baseSource === incomingSource) return void 0;
+  const base = baseSource === null ? null : parseOverrideLists(baseSource);
+  if (!base) return { kind: "unreadable", side: "base" };
+  const incoming = incomingSource === null ? null : parseOverrideLists(incomingSource);
+  if (!incoming) return { kind: "unreadable", side: "incoming" };
+  const fork = {
+    pinned: forkConfig.overrides?.pinned ?? [],
+    ignored: forkConfig.overrides?.ignored ?? []
+  };
+  const changes = diffOverrideLists(base, incoming, fork);
+  const count = LIST_KEYS.reduce((n, key) => n + changes[key].added.length + changes[key].removed.length, 0);
+  return count > 0 ? { kind: "changes", ...changes } : void 0;
+}
+
 // src/services/analyze-core.ts
+function isReportableIgnored(filePath) {
+  return !isManagedFile(filePath) && !isGeneratedFile(filePath);
+}
 async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predicates, onProgress) {
   onProgress?.("collecting file hashes (batch)...");
   const [forkHashes, upstreamHashes, baseHashes] = await Promise.all([
@@ -1870,6 +2048,7 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
         status = "renamed";
         renamedFrom = oldPath;
       }
+      const upstreamOnly2 = fileIsIgnored && !forkModifiedOld && isReportableIgnored(filePath);
       analyzedFiles.push({
         path: filePath,
         status,
@@ -1878,7 +2057,8 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
         existsInFork: inFork,
         existsInUpstream: true,
         renamedFrom,
-        upstreamChanged: upstreamChanged2
+        upstreamChanged: upstreamChanged2,
+        upstreamOnly: upstreamOnly2 || void 0
       });
       continue;
     }
@@ -1913,6 +2093,7 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
       }
     }
     const upstreamChanged = (fileIsPinned || fileIsIgnored) && inUpstream && upstreamHash !== baseHash && forkHash !== baseHash;
+    const upstreamOnly = fileIsIgnored && isReportableIgnored(filePath) && upstreamHash !== baseHash && forkHash === baseHash;
     analyzedFiles.push({
       path: filePath,
       status,
@@ -1920,7 +2101,8 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
       isPinned: fileIsPinned,
       existsInFork: inFork,
       existsInUpstream: inUpstream,
-      upstreamChanged: upstreamChanged || void 0
+      upstreamChanged: upstreamChanged || void 0,
+      upstreamOnly: upstreamOnly || void 0
     });
   }
   const flagged = analyzedFiles.filter((file) => file.upstreamChanged && !renamedProtected.has(file.path));
@@ -2236,6 +2418,24 @@ function resultMeta(config, ctx) {
     upstreamCommits: ctx.upstreamCommits
   };
 }
+async function upstreamOnlyReports(config, ctx, files) {
+  const { forkPath } = config;
+  try {
+    const [baseSha, upstreamSha, upstreamOverrides] = await Promise.all([
+      getShortSha(forkPath, ctx.mergeBase),
+      // the commit, not an annotated release tag object
+      getShortSha(forkPath, ctx.upstreamCommit.hash),
+      compareUpstreamOverrides(forkPath, ctx.mergeBase, ctx.upstreamRef, config)
+    ]);
+    return {
+      upstreamDiffRange: `${baseSha}..${upstreamSha}`,
+      upstreamOverrides,
+      ignoredUpstreamChanges: groupIgnoredUpstreamChanges(files, config.overrides?.ignored ?? [])
+    };
+  } catch {
+    return {};
+  }
+}
 async function runSyncMerge(config, ctx, onProgress, onStep) {
   const { forkPath } = config;
   const { upstreamRef, releaseTag, mergeBase, upstreamGitHubUrl, upstreamCommit } = ctx;
@@ -2287,7 +2487,8 @@ async function runSyncMerge(config, ctx, onProgress, onStep) {
     conflicts: remainingConflicts,
     autoMergedFiles,
     protectedConflicts,
-    ...resultMeta(config, ctx)
+    ...resultMeta(config, ctx),
+    ...await upstreamOnlyReports(config, ctx, analyzedFiles)
   };
 }
 async function runAnalyzePreview(config, ctx, onProgress, onStep) {
@@ -2314,6 +2515,7 @@ async function runAnalyzePreview(config, ctx, onProgress, onStep) {
     onProgress
   );
   await enrichChangeInfo(forkPath, analyzedFiles, ctx.mergeBase, "HEAD", ctx.upstreamRef);
+  const reports = await upstreamOnlyReports(config, ctx, analyzedFiles);
   onStep?.("analysis complete", `${analyzedFiles.length} files analyzed, dry run \u2014 no changes applied`);
   onProgress?.("cleaning up worktree...");
   await cleanupWorktree(forkPath, worktreePath);
@@ -2324,7 +2526,8 @@ async function runAnalyzePreview(config, ctx, onProgress, onStep) {
     // For analyze mode, count diverged files as potential conflicts
     conflicts: analyzedFiles.filter((f) => f.status === "diverged").map((f) => f.path),
     protectedConflicts: analyzedFiles.filter((f) => f.upstreamChanged).map((f) => f.path),
-    ...resultMeta(config, ctx)
+    ...resultMeta(config, ctx),
+    ...reports
   };
 }
 async function runMergeEngine(config, options) {
@@ -2348,10 +2551,13 @@ var scopeStatuses = {
   risk: /* @__PURE__ */ new Set(["drifted", "diverged"]),
   protected: /* @__PURE__ */ new Set(["ahead"])
 };
-function filterByScope(files, scope) {
+function filterByScope(result, scope) {
   const statuses = scopeStatuses[scope];
-  const includeProtectedBehind = scope !== "risk";
-  return files.filter((f) => statuses.has(f.status) || includeProtectedBehind && f.upstreamChanged === true);
+  if (scope === "risk") return result.files.filter((f) => statuses.has(f.status));
+  const overridesChanged = result.upstreamOverrides?.kind === "changes";
+  return result.files.filter(
+    (f) => statuses.has(f.status) || f.upstreamChanged === true || f.upstreamOnly === true || overridesChanged && f.path === CONFIG_FILE
+  );
 }
 function findTargetFile(files, targetPath) {
   const exact = files.find((f) => f.path === targetPath);
@@ -2378,7 +2584,7 @@ async function runAnalyze(config) {
     }
   });
   spinnerSuccess();
-  const scopedFiles = filterByScope(result.files, config.scope ?? "all");
+  const scopedFiles = filterByScope(result, config.scope ?? "all");
   if (config.diff) {
     const file = findTargetFile(scopedFiles, config.diff) ?? findTargetFile(result.files, config.diff);
     if (!file) throw new Error(`file not found in analysis results: ${config.diff}`);
@@ -2386,6 +2592,7 @@ async function runAnalyze(config) {
     return result;
   }
   if (config.json) {
+    const overrides = result.upstreamOverrides?.kind === "changes" ? result.upstreamOverrides : void 0;
     const out = scopedFiles.map((f) => ({
       path: f.path,
       status: f.status,
@@ -2395,7 +2602,10 @@ async function runAnalyze(config) {
       upstreamCommit: f.upstreamCommit ?? null,
       upstreamChanged: f.upstreamChanged ?? false,
       upstreamChangedLines: f.upstreamChangedLines ?? null,
-      upstreamLinesAbsent: f.upstreamLinesAbsent ?? null
+      upstreamLinesAbsent: f.upstreamLinesAbsent ?? null,
+      upstreamOnly: f.upstreamOnly ?? false,
+      // Only on the sync config: upstream override entries the fork config does not follow
+      upstreamOverrides: overrides && f.path === CONFIG_FILE ? { pinned: overrides.pinned, ignored: overrides.ignored } : null
     }));
     writeStdout(JSON.stringify(out, null, 2));
     return result;
@@ -2436,6 +2646,8 @@ async function runAnalyze(config) {
   };
   printAnalysisFileGroups(result.files, linkOptions);
   printSummary(result.summary, "analysis summary");
+  printIgnoredUpstreamChanges(result);
+  printUpstreamOverrideChanges(result);
   printMaskingPinWarning(result.files);
   if (config.logFile) {
     const logPath = writeLogFile(config.forkPath, result.files);
@@ -2893,11 +3105,11 @@ function printOutdatedResults(enhancedPackages, dependentNameCache, forkPath) {
   const sortedDependents = [...dependentMap.entries()].sort((a, b) => a[0].localeCompare(b[0]));
   const maxDependentNameLen = Math.max(0, ...sortedDependents.map(([name]) => name.length));
   for (const [dependentName, { location, count }] of sortedDependents) {
-    const packageJsonPath = path2.join(location, "package.json");
-    const relativePath = path2.relative(forkPath, packageJsonPath);
+    const packageJsonPath2 = path2.join(location, "package.json");
+    const relativePath = path2.relative(forkPath, packageJsonPath2);
     const paddedName = dependentName.padEnd(maxDependentNameLen);
     console.info(
-      `  ${colors_default.dim("\u2022")} ${paddedName}  ${hyperlink(relativePath, `file://${packageJsonPath}`)} ${colors_default.dim(`${count}`)}`
+      `  ${colors_default.dim("\u2022")} ${paddedName}  ${hyperlink(relativePath, `file://${packageJsonPath2}`)} ${colors_default.dim(`${count}`)}`
     );
   }
 }
@@ -3768,8 +3980,93 @@ function closePr(cwd, ref) {
 }
 
 // src/services/packages.ts
-import { existsSync as existsSync8, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { join as join15 } from "path";
+
+// src/services/package-usage.ts
+import { existsSync as existsSync8, readFileSync as readFileSync5, statSync } from "fs";
 import { join as join14 } from "path";
+var MAX_FILE_BYTES = 1024 * 1024;
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function readSearchable(filePath) {
+  try {
+    if (statSync(filePath).size > MAX_FILE_BYTES) return "";
+    const text = readFileSync5(filePath, "utf-8");
+    return text.includes("\0") ? "" : text;
+  } catch {
+    return "";
+  }
+}
+function fileSource(forkPath, path4) {
+  let text;
+  return { path: path4, label: path4, text: () => text ??= readSearchable(join14(forkPath, path4)) };
+}
+async function readScriptsAtRef(forkPath, ref, path4) {
+  try {
+    return JSON.parse(await git(["show", `${ref}:${path4}`], forkPath)).scripts ?? {};
+  } catch {
+    return {};
+  }
+}
+async function scriptSources(forkPath, upstreamRef, baseRef, path4) {
+  let forkScripts;
+  try {
+    forkScripts = JSON.parse(readFileSync5(join14(forkPath, path4), "utf-8")).scripts ?? {};
+  } catch {
+    return [];
+  }
+  const baseScripts = await readScriptsAtRef(forkPath, baseRef, path4);
+  const upstreamScripts = await readScriptsAtRef(forkPath, upstreamRef, path4);
+  return Object.entries(forkScripts).filter(([name, value]) => value !== baseScripts[name] && value !== upstreamScripts[name]).map(([name, value]) => ({ path: path4, label: `${path4} (scripts.${name})`, text: () => value }));
+}
+function binNames(forkPath, location, name) {
+  const bareName = name.split("/").pop();
+  for (const dir of [join14(forkPath, location), forkPath]) {
+    const manifest = join14(dir, "node_modules", name, "package.json");
+    if (!existsSync8(manifest)) continue;
+    try {
+      const { bin } = JSON.parse(readFileSync5(manifest, "utf-8"));
+      if (typeof bin === "string") return [bareName];
+      return bin && typeof bin === "object" ? Object.keys(bin) : [];
+    } catch {
+      return [];
+    }
+  }
+  return [bareName];
+}
+function packagePatterns(forkPath, location, name) {
+  const specifiers = [name];
+  const typed = name.match(/^@types\/(.+)$/);
+  if (typed) specifiers.push(typed[1].includes("__") ? `@${typed[1].replace("__", "/")}` : typed[1]);
+  const patterns = specifiers.map((specifier) => new RegExp(`(['"\`])${escapeRegExp(specifier)}(?:/[^'"\`\\s]*)?\\1`));
+  for (const bin of binNames(forkPath, location, name)) {
+    patterns.push(new RegExp(`(?:^|[\\s'"\`(;&|=])${escapeRegExp(bin)}(?=$|[\\s'"\`);&|])`, "m"));
+  }
+  return patterns;
+}
+function scriptPattern(name) {
+  return new RegExp(`\\b(?:pnpm|npm|yarn|bun)\\s+(?:[^\\n;&|]*?\\s)?${escapeRegExp(name)}(?=$|[\\s'"\`);&|])`, "m");
+}
+async function loadForkUsage(forkPath, upstreamRef, baseRef) {
+  const diff = await git(["diff", "--name-only", "-z", "--diff-filter=d", upstreamRef], forkPath);
+  const sources = [];
+  for (const path4 of diff.split("\0").filter(Boolean)) {
+    if (isPackageJson(path4)) sources.push(...await scriptSources(forkPath, upstreamRef, baseRef, path4));
+    else if (!isManagedFile(path4)) sources.push(fileSource(forkPath, path4));
+  }
+  const findIn = (scoped, patterns) => scoped.find((source) => patterns.some((pattern) => pattern.test(source.text())))?.label;
+  return {
+    findPackage: (location, name) => findIn(
+      location ? sources.filter((source) => isUnderAnyFolder(source.path, [location])) : sources,
+      packagePatterns(forkPath, location, name)
+    ),
+    findScript: (name) => findIn(sources, [scriptPattern(name)])
+  };
+}
+
+// src/services/packages.ts
 function parseComparableVersion(version) {
   const trimmed = version.trim();
   if (trimmed === "" || trimmed === "*" || trimmed.includes("workspace:") || trimmed.includes("catalog:") || trimmed.includes("file:") || trimmed.includes("link:") || trimmed.includes("git+") || trimmed.includes("github:") || trimmed.includes("http://") || trimmed.includes("https://") || trimmed.includes("||")) {
@@ -3797,24 +4094,49 @@ function isHigherVersion(upstreamVersion, forkVersion) {
   if (!upCoerced || !forkCoerced) return false;
   return compareVersions(upCoerced, forkCoerced) > 0;
 }
-function safeMergeRecord(forkRecord, upstreamRecord, addOnly = false) {
+var DEPENDENCY_KEYS = [
+  "dependencies",
+  "devDependencies",
+  "peerDependencies",
+  "optionalDependencies"
+];
+function mergeRecord(forkRecord, upstreamRecord, baseRecord, { bumpHigher = true, findUse } = {}) {
   if (!upstreamRecord) return void 0;
   const merged = { ...forkRecord || {} };
+  const base = baseRecord || {};
   const added = [];
-  let changed = false;
+  const updated = [];
+  const removed = [];
+  const kept = [];
   for (const [name, upstreamValue] of Object.entries(upstreamRecord)) {
     const forkValue = merged[name];
     if (forkValue === void 0) {
+      if (name in base) continue;
       merged[name] = upstreamValue;
       added.push(name);
-      changed = true;
-    } else if (!addOnly && forkValue !== upstreamValue && isHigherVersion(upstreamValue, forkValue)) {
+    } else if (forkValue === upstreamValue) {
+    } else if (base[name] === forkValue) {
       merged[name] = upstreamValue;
-      changed = true;
+      updated.push(name);
+    } else if (bumpHigher && isHigherVersion(upstreamValue, forkValue)) {
+      merged[name] = upstreamValue;
+      updated.push(name);
+    }
+  }
+  for (const [name, forkValue] of Object.entries(merged)) {
+    if (name in upstreamRecord) continue;
+    if (base[name] === void 0 || base[name] !== forkValue) continue;
+    const usedAt = findUse?.(name);
+    if (usedAt) {
+      kept.push({ name, usedAt });
+      continue;
     }
+    delete merged[name];
+    removed.push(name);
   }
   const sorted = Object.fromEntries(Object.entries(merged).sort(([a], [b]) => a.localeCompare(b)));
-  return { merged: sorted, changed, added };
+  const changed = added.length + updated.length + removed.length > 0;
+  return { merged: sorted, changed, added, updated, removed, kept };
 }
 function isSubpathMap(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
@@ -3828,14 +4150,15 @@ function safeMergeExports(forkExports, upstreamExports) {
   for (const name of added) merged[name] = upstreamExports[name];
   return { merged, changed: added.length > 0, added };
 }
-function safeMergePnpm(forkPnpm, upstreamPnpm) {
+function safeMergePnpm(forkPnpm, upstreamPnpm, basePnpm) {
   if (!upstreamPnpm) return void 0;
   const merged = { ...forkPnpm || {} };
   let changed = false;
   if (upstreamPnpm.overrides) {
-    const result = safeMergeRecord(
+    const result = mergeRecord(
       merged.overrides,
-      upstreamPnpm.overrides
+      upstreamPnpm.overrides,
+      basePnpm?.overrides
     );
     if (result?.changed) {
       merged.overrides = result.merged;
@@ -3843,18 +4166,15 @@ function safeMergePnpm(forkPnpm, upstreamPnpm) {
     }
   }
   if (upstreamPnpm.patchedDependencies) {
-    const forkPatched = merged.patchedDependencies || {};
-    const upstreamPatched = upstreamPnpm.patchedDependencies;
-    for (const [name, value] of Object.entries(upstreamPatched)) {
-      if (!(name in forkPatched)) {
-        forkPatched[name] = value;
-        changed = true;
-      }
-    }
-    if (changed || !merged.patchedDependencies) {
-      merged.patchedDependencies = Object.fromEntries(
-        Object.entries(forkPatched).sort(([a], [b]) => a.localeCompare(b))
-      );
+    const result = mergeRecord(
+      merged.patchedDependencies,
+      upstreamPnpm.patchedDependencies,
+      basePnpm?.patchedDependencies,
+      { bumpHigher: false }
+    );
+    if (result?.changed) {
+      merged.patchedDependencies = result.merged;
+      changed = true;
     }
   }
   if (upstreamPnpm.packageExtensions) {
@@ -3885,9 +4205,9 @@ function safeMergePnpm(forkPnpm, upstreamPnpm) {
   return { merged, changed };
 }
 function readPackageJson(filePath) {
-  if (!existsSync8(filePath)) return null;
+  if (!existsSync9(filePath)) return null;
   try {
-    return JSON.parse(readFileSync5(filePath, "utf-8"));
+    return JSON.parse(readFileSync6(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -3896,31 +4216,50 @@ function writePackageJson(filePath, data) {
   writeFileSync4(filePath, `${JSON.stringify(data, null, 2)}
 `, "utf-8");
 }
-async function getUpstreamPackageJson(forkPath, upstreamRef, relativePath) {
-  const filePath = relativePath ? `${relativePath}/package.json` : "package.json";
+function packageJsonPath(relativePath) {
+  return relativePath ? `${relativePath}/package.json` : "package.json";
+}
+async function readPackageJsonAtRef(forkPath, ref, relativePath) {
   try {
-    return JSON.parse(await git(["show", `${upstreamRef}:${filePath}`], forkPath));
+    const raw = await git(["show", `${ref}:${packageJsonPath(relativePath)}`], forkPath);
+    return { raw, data: JSON.parse(raw) };
   } catch {
     return null;
   }
 }
 async function discoverPackageLocations(forkPath, upstreamRef) {
   const stdout = await git(["ls-tree", "-r", "--name-only", upstreamRef], forkPath, { ignoreErrors: true });
-  const upstreamPaths = stdout.split("\n").filter((p) => p.endsWith("/package.json") || p === "package.json").map((p) => p === "package.json" ? "" : p.replace("/package.json", ""));
-  return upstreamPaths.filter((loc) => existsSync8(join14(forkPath, loc, "package.json")));
+  return stdout.split("\n").filter((p) => p.endsWith("/package.json") || p === "package.json").map((p) => p === "package.json" ? "" : p.replace("/package.json", ""));
 }
-async function syncPackageJson(forkPath, upstreamRef, relativePath, keysToSync) {
+async function resolveMergeBase(forkPath, upstreamRef) {
+  try {
+    return (await getEffectiveMergeBase(forkPath, "HEAD", upstreamRef)).base || null;
+  } catch {
+    return null;
+  }
+}
+async function syncPackageJson(config, baseRef, usage, relativePath, keysToSync) {
+  const { forkPath, upstreamRef } = config;
   const changes = [];
-  const pkgPath = join14(forkPath, relativePath, "package.json");
+  const kept = [];
+  const pkgRelPath = packageJsonPath(relativePath);
+  const pkgPath = join15(forkPath, pkgRelPath);
   const forkPkg = readPackageJson(pkgPath);
-  const upstreamPkg = await getUpstreamPackageJson(forkPath, upstreamRef, relativePath);
-  if (!forkPkg || !upstreamPkg) {
-    return { updated: false, changes };
+  const upstream = await readPackageJsonAtRef(forkPath, upstreamRef, relativePath);
+  const basePkg = baseRef ? (await readPackageJsonAtRef(forkPath, baseRef, relativePath))?.data : void 0;
+  if (!upstream) return { updated: false, changes, kept };
+  if (!forkPkg) {
+    const workspaceArrived = relativePath !== "" && existsSync9(join15(forkPath, relativePath));
+    if (basePkg || !workspaceArrived || isIgnored(pkgRelPath, config)) return { updated: false, changes, kept };
+    writeFileSync4(pkgPath, upstream.raw.endsWith("\n") ? upstream.raw : `${upstream.raw}
+`, "utf-8");
+    return { updated: true, changes: ["copied from upstream (new workspace)"], kept };
   }
+  const upstreamPkg = upstream.data;
   let updated = false;
   for (const key of keysToSync) {
     if (key === "pnpm") {
-      const result2 = safeMergePnpm(forkPkg.pnpm, upstreamPkg.pnpm);
+      const result2 = safeMergePnpm(forkPkg.pnpm, upstreamPkg.pnpm, basePkg?.pnpm);
       if (result2?.changed) {
         forkPkg.pnpm = result2.merged;
         updated = true;
@@ -3931,14 +4270,16 @@ async function syncPackageJson(forkPath, upstreamRef, relativePath, keysToSync)
     if (key === "packageManager") {
       const upstreamValue2 = upstreamPkg[key];
       const forkValue2 = forkPkg[key];
+      const baseValue2 = basePkg?.[key];
       if (upstreamValue2 && !forkValue2) {
+        if (baseValue2) continue;
         forkPkg[key] = upstreamValue2;
         updated = true;
         changes.push(`${key}: added`);
-      } else if (upstreamValue2 && forkValue2 && upstreamValue2 !== forkValue2 && isHigherVersion(upstreamValue2, forkValue2)) {
+      } else if (upstreamValue2 && forkValue2 && upstreamValue2 !== forkValue2 && (forkValue2 === baseValue2 || isHigherVersion(upstreamValue2, forkValue2))) {
         forkPkg[key] = upstreamValue2;
         updated = true;
-        changes.push(`${key}: bumped`);
+        changes.push(`${key}: updated`);
       }
       continue;
     }
@@ -3953,46 +4294,64 @@ async function syncPackageJson(forkPath, upstreamRef, relativePath, keysToSync)
     }
     const forkValue = forkPkg[key];
     const upstreamValue = upstreamPkg[key];
-    const addOnly = key === "scripts";
-    const result = safeMergeRecord(forkValue, upstreamValue, addOnly);
+    const baseValue = basePkg?.[key];
+    let findUse;
+    if (usage && key === "scripts") findUse = (name) => usage.findScript(name);
+    else if (usage && DEPENDENCY_KEYS.includes(key)) findUse = (name) => usage.findPackage(relativePath, name);
+    const result = mergeRecord(forkValue, upstreamValue, baseValue, { bumpHigher: key !== "scripts", findUse });
+    kept.push(...(result?.kept ?? []).map(({ name, usedAt }) => `${key}.${name}: used in ${usedAt}`));
     if (result?.changed) {
       forkPkg[key] = result.merged;
       updated = true;
-      if (addOnly) {
-        changes.push(...result.added.map((name) => `scripts.${name}: added`));
-      } else {
-        changes.push(`${key}: merged`);
-      }
+      changes.push(
+        ...result.added.map((name) => `${key}.${name}: added`),
+        ...result.updated.map((name) => `${key}.${name}: updated`),
+        ...result.removed.map((name) => `${key}.${name}: removed`)
+      );
     }
   }
   if (updated) {
     writePackageJson(pkgPath, forkPkg);
   }
-  return { updated, changes };
+  return { updated, changes, kept };
 }
 async function runPackages(config, options = {}) {
   createSpinner("syncing package.json files...");
   const keysToSync = config.settings.packageJsonSync || ["dependencies", "devDependencies"];
   const conflictedSet = new Set(options.conflictedFiles ?? []);
+  const baseRef = await resolveMergeBase(config.forkPath, config.upstreamRef);
+  const usage = baseRef ? await loadForkUsage(config.forkPath, config.upstreamRef, baseRef) : null;
   const locations = await discoverPackageLocations(config.forkPath, config.upstreamRef);
-  let changedCount = 0;
+  const reports = [];
   const skipped = [];
   for (const location of locations) {
-    const pkgRelPath = location ? `${location}/package.json` : "package.json";
+    const pkgRelPath = packageJsonPath(location);
     if (conflictedSet.has(pkgRelPath)) {
       skipped.push(pkgRelPath);
       continue;
     }
     spinnerText(`syncing ${location || "root"}/package.json...`);
-    const { updated } = await syncPackageJson(config.forkPath, config.upstreamRef, location, keysToSync);
-    if (updated) {
-      changedCount += 1;
-    }
+    const { updated, changes, kept: kept2 } = await syncPackageJson(config, baseRef, usage, location, keysToSync);
+    if (updated || kept2.length > 0) reports.push({ path: pkgRelPath, changes, kept: kept2 });
   }
+  const changedCount = reports.filter(({ changes }) => changes.length > 0).length;
   spinnerSuccess(
     "package sync complete",
     `${changedCount} package.json${changedCount === 1 ? " was" : "s were"} changed`
   );
+  for (const { path: path4, changes } of reports) {
+    if (changes.length === 0) continue;
+    console.info(`  ${path4}`);
+    for (const change of changes) console.info(`    ${colors_default.dim(change)}`);
+  }
+  const kept = reports.flatMap(({ path: path4, kept: kept2 }) => kept2.map((entry) => `${path4} ${entry}`));
+  if (kept.length > 0) {
+    console.info();
+    console.warn(
+      `${warningMark} kept ${kept.length} ${kept.length === 1 ? "entry" : "entries"} upstream dropped, the fork still uses ${kept.length === 1 ? "it" : "them"}:`
+    );
+    for (const entry of kept) console.warn(`    ${colors_default.dim("\u2192")} ${entry}`);
+  }
   if (skipped.length > 0) {
     console.info();
     console.warn(
@@ -4057,6 +4416,8 @@ async function runSync(config, options) {
     spinnerFail("sync completed with conflicts");
   }
   printSummary(result.summary, "merge summary");
+  printIgnoredUpstreamChanges(result);
+  printUpstreamOverrideChanges(result);
   printMaskingPinWarning(result.files);
   if (config.logFile) {
     const logPath = writeLogFile(config.forkPath, result.files);
@@ -4477,7 +4838,7 @@ async function runForks(config) {
 
 // src/services/stats.ts
 import { readFile as readFile2 } from "fs/promises";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 
 // src/utils/coverage-utils.ts
 import { spawnSync as spawnSync4 } from "child_process";
@@ -4488,6 +4849,7 @@ function summaryPath(forkPath) {
   return path3.join(forkPath, ".coverage", "coverage-summary.json");
 }
 function colorPct(pct) {
+  if (typeof pct !== "number" || !Number.isFinite(pct)) return colors_default.dim("n/a");
   const label = `${pct.toFixed(2)}%`;
   if (pct >= 80) return colors_default.green(label);
   if (pct >= 50) return colors_default.yellow(label);
@@ -4550,6 +4912,11 @@ function printCoverageSummary(forkPath, options = {}) {
   if (stale) {
     console.info(colors_default.yellow("  \u26A0 data is older than 7 days \u2014 run `pnpm test` to refresh"));
   }
+  if (!Object.keys(summary).some((key) => key !== "total")) {
+    console.info(colors_default.yellow("  no coverage data found \u2014 run `pnpm test` to regenerate"));
+    console.info();
+    return;
+  }
   const total = summary.total;
   console.info(
     `  ${colors_default.bold("overall")}  lines ${colorPct(total.lines.pct)} ${colors_default.dim(`(${total.lines.covered}/${total.lines.total})`)}  funcs ${colorPct(total.functions.pct)}  branches ${colorPct(total.branches.pct)}`
@@ -4565,7 +4932,7 @@ function printCoverageSummary(forkPath, options = {}) {
 // src/services/stats.ts
 var sourceExtensions = /* @__PURE__ */ new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs", "json", "jsonc", "css", "html"]);
 async function getWorkspacePackages(forkPath) {
-  const content = await readFile2(join16(forkPath, "pnpm-workspace.yaml"), "utf-8");
+  const content = await readFile2(join17(forkPath, "pnpm-workspace.yaml"), "utf-8");
   return parseYamlBlockList(content, "packages").map((pattern) => {
     if (pattern.endsWith("/*")) {
       const base = pattern.slice(0, -2);
@@ -4667,9 +5034,9 @@ function fmtPct(value, total) {
 function printStats(stats, verbose) {
   console.info();
   console.info(
-    `  ${colors_default.bold("source files")}  ${String(stats.total)}  ${colors_default.dim(`(${stats.skipped} non-source skipped)`)}`
+    `  ${colors_default.bold("code files".padEnd(13))}  ${String(stats.total)}  ${colors_default.dim(`(${[...sourceExtensions].join(" ")})`)}`
   );
-  console.info(`  ${colors_default.bold("lines of code")} ${colors_default.cyan(formatLoc(stats.totalLoc))}`);
+  console.info(`  ${colors_default.bold("lines of code")}  ${colors_default.cyan(formatLoc(stats.totalLoc))}`);
   console.info();
   const catEntries = [
     ["source & config", stats.categories.other],
@@ -4699,6 +5066,7 @@ function printStats(stats, verbose) {
       );
     }
   } else {
+    console.info(colors_default.dim("  source & config by package"));
     for (const [name, data] of Object.entries(stats.packages)) {
       const srcFiles = data.categories.other.files;
       const srcLoc = data.categories.other.loc;
@@ -4728,7 +5096,7 @@ function getForkPath() {
   const envPath = getEnv("CELLA_FORK_PATH");
   if (envPath) {
     const resolved = resolve6(envPath);
-    if (!existsSync10(resolved) || !statSync2(resolved).isDirectory()) {
+    if (!existsSync11(resolved) || !statSync3(resolved).isDirectory()) {
       throw new Error(`CELLA_FORK_PATH is not a valid directory: ${resolved}`);
     }
     return resolved;
@@ -4740,7 +5108,7 @@ function getForkPath() {
   return cwd;
 }
 async function preflight(forkPath) {
-  if (!existsSync10(join17(forkPath, ".git"))) {
+  if (!existsSync11(join18(forkPath, ".git"))) {
     throw new Error(`not a git repository: ${forkPath}`);
   }
 }