@cellajs/cli 0.2.2 → 0.3.0

package/dist/index.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env tsx
 
 // src/cella-cli.ts
-import { existsSync as existsSync11, statSync as statSync3 } from "fs";
-import { join as join18, resolve as resolve6 } from "path";
+import { existsSync as existsSync13, statSync as statSync3 } from "fs";
+import { join as join21, resolve as resolve7 } from "path";
 import process9 from "process";
 
 // src/cli.ts
 import { readFileSync } from "fs";
-import { join as join5 } from "path";
+import { join as join8 } from "path";
 import process5 from "process";
 import { select } from "@inquirer/prompts";
 import { Command } from "commander";
@@ -106,6 +106,10 @@ function isConfigFile(filePath) {
 function isPackageJson(filePath) {
   return filePath === "package.json" || filePath.endsWith("/package.json");
 }
+function isGeneratedFile(filePath) {
+  const segments = filePath.split("/");
+  return segments.includes("gen") || (segments.at(-1) ?? "").includes(".gen.");
+}
 function isManagedFile(filePath) {
   return isPackageJson(filePath) || filePath === "pnpm-lock.yaml" || isConfigFile(filePath);
 }
@@ -216,7 +220,7 @@ import process4 from "process";
 // package.json
 var package_default = {
   name: "@cellajs/cli",
-  version: "0.2.2",
+  version: "0.3.0",
   private: false,
   license: "MIT",
   description: "CLI for managing your monorepo and syncing with upstream Cella.",
@@ -266,25 +270,25 @@ var package_default = {
     prepare: "lefthook install"
   },
   dependencies: {
-    "@inquirer/core": "^11.2.1",
+    "@inquirer/core": "^12.0.3",
     "@inquirer/prompts": "^8.7.2",
-    "@pierre/diffs": "^1.4.3",
+    "@pierre/diffs": "^1.5.1",
     commander: "^15.0.0",
     "ts-morph": "^28.0.0",
     zod: "^4.6.5"
   },
   devDependencies: {
-    "@biomejs/biome": "^2.5.14",
+    "@biomejs/biome": "^2.5.15",
     "@commitlint/cli": "^21.2.3",
     "@commitlint/config-conventional": "^21.2.3",
-    "@evilmartians/lefthook": "^2.1.14",
-    "@types/node": "26.5.0",
-    "@typescript/native-preview": "7.0.0-dev.20260702.3",
+    "@evilmartians/lefthook": "^2.1.15",
+    "@types/node": "26.6.3",
+    "@typescript/native-preview": "7.0.0-dev.20260707.2",
     rimraf: "^6.1.3",
     tsup: "^8.5.1",
     tsx: "^4.23.15",
     typescript: "^6.0.3",
-    vitest: "^4.1.11"
+    vitest: "^5.0.3"
   },
   publishConfig: {
     access: "public"
@@ -705,6 +709,55 @@ function printProtectedConflicts(result) {
   }
   console.info(colors_default.dim(`  ${PROTECTED_BEHIND_HINT}`));
 }
+function plural(count, singular, pluralForm = `${singular}s`) {
+  return `${count} ${count === 1 ? singular : pluralForm}`;
+}
+function shellPath(path4) {
+  return /^[\w./@+-]+$/.test(path4) ? path4 : `'${path4.replace(/'/g, `'\\''`)}'`;
+}
+function printIgnoredUpstreamChanges(result) {
+  const groups = result.ignoredUpstreamChanges ?? [];
+  if (groups.length === 0) return;
+  const total = groups.reduce((count, group) => count + group.paths.length, 0);
+  console.info();
+  console.info(
+    `${warningMark} ${colors_default.yellow(`ignored paths changed upstream \xB7 ${plural(total, "file")} under ${plural(groups.length, "entry", "entries")}`)}`
+  );
+  for (const group of groups) {
+    const counts = [plural(group.paths.length, "file")];
+    if (group.added > 0) counts.push(`${group.added} new`);
+    if (group.deleted > 0) counts.push(`${group.deleted} deleted`);
+    console.info(`  ${statusConfig.ignored.icon} ${group.entry} ${colors_default.dim(`\xB7 ${counts.join(", ")}`)}`);
+    if (result.upstreamDiffRange) {
+      console.info(colors_default.dim(`    git diff ${result.upstreamDiffRange} -- ${shellPath(group.entry)}`));
+    }
+  }
+  console.info(colors_default.dim("  the fork left these untouched and ignored paths never sync: diff and adopt what you need."));
+}
+function printUpstreamOverrideChanges(result) {
+  const report = result.upstreamOverrides;
+  if (!report) return;
+  console.info();
+  if (report.kind === "unreadable") {
+    const side = report.side === "base" ? "the last sync point" : "the incoming ref";
+    console.info(
+      colors_default.dim(`upstream overrides not compared: upstream ${CONFIG_FILE} is missing or unreadable at ${side}`)
+    );
+    return;
+  }
+  const lines = [];
+  for (const list of ["pinned", "ignored"]) {
+    for (const entry of report[list].added) lines.push(`  ${colors_default.green("+")} ${list}: ${entry}`);
+    for (const entry of report[list].removed) {
+      lines.push(`  ${colors_default.red("\u2212")} ${list}: ${entry}${colors_default.dim(" \xB7 dropped upstream, still in your config")}`);
+    }
+  }
+  console.info(
+    `${warningMark} ${colors_default.yellow(`upstream changed its sync overrides \xB7 ${plural(lines.length, "entry", "entries")} to review`)}`
+  );
+  for (const line of lines) console.info(line);
+  console.info(colors_default.dim(`  ${CONFIG_FILE} never syncs: add or drop these by hand where they fit your app.`));
+}
 function findMaskingPins(files) {
   return files.filter(
     (file) => file.isPinned && !isManagedFile(file.path) && file.status === "behind" && file.existsInFork && file.existsInUpstream
@@ -747,565 +800,195 @@ function printFlagWarnings(options) {
 }
 
 // src/utils/overrides.ts
+import { existsSync as existsSync5 } from "fs";
+import { join as join7 } from "path";
+
+// src/utils/migration-notes.ts
+import { existsSync as existsSync4 } from "fs";
+import { mkdir as mkdir3, readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname3, join as join6 } from "path";
+
+// src/utils/git.ts
+import { execFile } from "child_process";
 import { existsSync as existsSync3 } from "fs";
-import { join as join4 } from "path";
-function isUnderAnyFolder(filePath, folders) {
-  return folders.some((folder) => {
-    const entry = folder.replace(/\/+$/, "");
-    return filePath === entry || filePath.startsWith(`${entry}/`);
+import { mkdir as mkdir2, readdir, rmdir, unlink } from "fs/promises";
+import { dirname as dirname2, join as join5 } from "path";
+import { promisify } from "util";
+
+// src/utils/manifest.ts
+import { mkdir, readFile, writeFile } from "fs/promises";
+import { dirname, join as join4 } from "path";
+var MANIFEST_FILE = "cella/cella.manifest.json";
+async function readSyncManifest(cwd) {
+  try {
+    const parsed = JSON.parse(await readFile(join4(cwd, MANIFEST_FILE), "utf8"));
+    const commit = parsed?.upstream?.commit;
+    if (typeof commit !== "string" || !/^[0-9a-f]{40}$/i.test(commit)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function readManifestBase(cwd) {
+  const manifest = await readSyncManifest(cwd);
+  return manifest ? manifest.upstream.commit.toLowerCase() : null;
+}
+async function writeSyncManifest(cwd, manifest) {
+  const manifestPath = join4(cwd, MANIFEST_FILE);
+  await mkdir(dirname(manifestPath), { recursive: true });
+  await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+}
+
+// src/utils/git.ts
+var execFileAsync = promisify(execFile);
+function sanitizeCredentials(text) {
+  return text.replace(/https?:\/\/[^@\s]+@/g, (match) => {
+    const protocol = match.startsWith("https") ? "https" : "http";
+    return `${protocol}://***@`;
   });
 }
-function isIgnored(filePath, config) {
-  return isUnderAnyFolder(filePath, config.overrides?.ignored || []);
+async function git(args, cwd, options = {}) {
+  const env = {
+    ...getEnvSnapshot(),
+    ...options.skipEditor ? { GIT_EDITOR: "true" } : {},
+    ...options.env
+  };
+  const maxBuffer = options.maxBuffer ?? 50 * 1024 * 1024;
+  try {
+    const { stdout } = await execFileAsync("git", args, { cwd, env, maxBuffer });
+    return stdout.trim();
+  } catch (error) {
+    if (options.ignoreErrors) return "";
+    if (error instanceof Error) {
+      error.message = sanitizeCredentials(error.message);
+    }
+    throw error;
+  }
 }
-function isPinned(filePath, config) {
-  if (isManagedFile(filePath)) return true;
-  return isUnderAnyFolder(filePath, config.overrides?.pinned || []);
+async function getCurrentBranch(cwd) {
+  return git(["rev-parse", "--abbrev-ref", "HEAD"], cwd);
 }
-function isPinnedForSync(filePath, config, unpinned) {
-  if (isManagedFile(filePath)) return true;
-  if (unpinned) return false;
-  return isPinned(filePath, config);
+async function switchBranch(cwd, branch) {
+  await git(["switch", branch], cwd);
 }
-function hasGlobChars(entry) {
-  return entry.includes("*") || entry.includes("?");
+async function createBranchFrom(cwd, branch, startPoint) {
+  await git(["switch", "-c", branch, startPoint], cwd);
 }
-function validateOverrides(config, forkPath) {
-  const warnings = [];
-  const pinned = config.overrides?.pinned || [];
-  for (const entry of pinned) {
-    if (hasGlobChars(entry)) {
-      warnings.push({
-        type: "pinned-glob",
-        pattern: entry,
-        message: `pin uses glob (not supported, use a path or folder): ${entry}`
-      });
-    } else if (!existsSync3(join4(forkPath, entry))) {
-      warnings.push({
-        type: "pinned-not-found",
-        pattern: entry,
-        message: `pin not found: ${entry}`
-      });
-    }
+async function deleteBranch(cwd, branch) {
+  await git(["branch", "-D", branch], cwd, { ignoreErrors: true });
+}
+async function pullFastForward(cwd) {
+  await git(["pull", "--ff-only"], cwd, { ignoreErrors: true, skipEditor: true });
+}
+async function getUpstreamStatus(cwd) {
+  const upstream = await git(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"], cwd, {
+    ignoreErrors: true
+  });
+  if (!upstream) return { upstream: null, ahead: 0, behind: 0 };
+  const remote = upstream.split("/")[0];
+  await git(["fetch", remote], cwd, { ignoreErrors: true, skipEditor: true });
+  const counts = await git(["rev-list", "--left-right", "--count", `HEAD...${upstream}`], cwd, { ignoreErrors: true });
+  const [ahead, behind] = counts.split(/\s+/).map((n) => Number.parseInt(n, 10) || 0);
+  return { upstream, ahead: ahead ?? 0, behind: behind ?? 0 };
+}
+async function pushBranch(cwd, remote, branch, options = {}) {
+  await git(["push", "-u", ...options.forceWithLease ? ["--force-with-lease"] : [], remote, branch], cwd);
+}
+async function listBranchMergeCommits(cwd, baseRef) {
+  const out = await git(["rev-list", "--merges", "--first-parent", `${baseRef}..HEAD`], cwd, { ignoreErrors: true });
+  return out ? out.split("\n").filter(Boolean) : [];
+}
+async function flattenBranch(cwd, baseRef, message) {
+  const parent = await getMergeBase(cwd, baseRef, "HEAD");
+  const tree = await git(["rev-parse", "HEAD^{tree}"], cwd);
+  const commit = await git(["commit-tree", tree, "-p", parent, "-m", message], cwd);
+  await git(["reset", "--hard", commit], cwd);
+}
+async function commitSquash(cwd, message) {
+  for (const file of ["MERGE_HEAD", "MERGE_MSG", "MERGE_MODE"]) {
+    const path4 = join5(cwd, ".git", file);
+    if (existsSync3(path4)) await unlink(path4);
   }
-  const ignored = config.overrides?.ignored || [];
-  for (const entry of ignored) {
-    if (hasGlobChars(entry)) {
-      warnings.push({
-        type: "ignored-not-found",
-        pattern: entry,
-        message: `ignored entry uses glob (not supported, use a path or folder): ${entry}`
-      });
-    } else if (!existsSync3(join4(forkPath, entry.replace(/\/+$/, "")))) {
-      warnings.push({
-        type: "ignored-not-found",
-        pattern: entry,
-        message: `ignored entry not found: ${entry}`
-      });
-    }
+  await git(["commit", "-m", message], cwd, { skipEditor: true });
+}
+async function stageAll(cwd) {
+  await git(["add", "-A"], cwd);
+}
+function mergeInProgress(cwd) {
+  return existsSync3(join5(cwd, ".git", "MERGE_HEAD"));
+}
+async function getShortSha(cwd, ref) {
+  return git(["rev-parse", "--short", ref], cwd);
+}
+async function getWorkingTreeChangeCount(cwd) {
+  const status = await git(["status", "--porcelain"], cwd);
+  if (!status) return 0;
+  return status.split("\n").filter(Boolean).length;
+}
+async function remoteExists(cwd, remoteName) {
+  const remotes = await git(["remote"], cwd);
+  return remotes.split("\n").includes(remoteName);
+}
+async function ensureRemote(cwd, remoteName, url) {
+  if (await remoteExists(cwd, remoteName)) {
+    await git(["remote", "set-url", remoteName, url], cwd);
+  } else {
+    await git(["remote", "add", remoteName, url], cwd);
   }
-  return warnings;
 }
-function printWarnings(warnings) {
-  for (const warning of warnings) {
-    console.info(`${warningMark} ${warning.message}`);
+async function fetch2(cwd, remoteName) {
+  await git(["fetch", remoteName], cwd);
+}
+async function fetchUpstreamTags(cwd, remoteName) {
+  await git(["fetch", remoteName, "--no-tags", `+refs/tags/*:refs/${remoteName}/tags/*`], cwd);
+}
+async function resolveLatestReleaseTag(cwd, remoteName) {
+  const prefix = `refs/${remoteName}/tags/`;
+  const output = await git(["for-each-ref", "--sort=-version:refname", "--format=%(refname)", prefix], cwd, {
+    ignoreErrors: true
+  });
+  if (!output) return null;
+  for (const line of output.split("\n")) {
+    const ref = line.trim();
+    if (!ref) continue;
+    const tag = ref.slice(prefix.length);
+    if (/^v\d/.test(tag)) return { tag, ref };
   }
+  return null;
 }
-
-// src/cli.ts
-function readOptions(opts) {
-  const scope = typeof opts.scope === "string" ? opts.scope : void 0;
-  if (scope && scope !== "all" && scope !== "risk" && scope !== "protected") {
-    throw new Error(`invalid --scope '${scope}'. expected one of: all, risk, protected`);
+async function getCommitInfo(cwd, ref) {
+  const format = "%H%n%s%n%ar";
+  const output = await git(["log", "-1", `--format=${format}`, ref], cwd);
+  const [hash, message, date] = output.split("\n");
+  return { hash, message, date };
+}
+async function countCommitsBetween(cwd, fromRef, toRef) {
+  const output = await git(["rev-list", "--count", `${fromRef}..${toRef}`], cwd);
+  return Number.parseInt(output.trim(), 10) || 0;
+}
+async function listCommitsBetween(cwd, fromRef, toRef, options = {}) {
+  const { oldestFirst = true, skip = 0, limit } = options;
+  const args = ["log", "--format=%H%x1f%s%x1f%ar"];
+  if (oldestFirst) args.push("--reverse");
+  args.push(`${fromRef}..${toRef}`);
+  const output = await git(args, cwd, { ignoreErrors: true });
+  if (!output) return [];
+  const commits = [];
+  for (const line of output.split("\n")) {
+    if (!line) continue;
+    const [hash, message, date] = line.split("");
+    if (!hash || !message || !date) continue;
+    commits.push({ hash, message, date });
   }
-  const normalizedScope = scope;
-  return {
-    logFile: opts.log === true,
-    verbose: opts.verbose === true,
-    list: opts.list === true,
-    json: opts.json === true,
-    diff: typeof opts.diff === "string" ? opts.diff : void 0,
-    openDiff: typeof opts.openDiff === "string" ? opts.openDiff : void 0,
-    scope: normalizedScope,
-    fork: typeof opts.fork === "string" ? opts.fork : void 0,
-    hard: opts.hard === true,
-    unpinned: opts.unpinned === true,
-    track: opts.track === "release" || opts.track === "branch" ? opts.track : void 0,
-    force: opts.force === true,
-    checkOverrides: opts.checkOverrides === true,
-    coverage: opts.coverage === true,
-    directMerge: opts.directMerge === true
-  };
-}
-var serviceDefinitions = [
-  {
-    name: "analyze",
-    description: "dry run to see what would change on sync",
-    options: [
-      { flags: "--log", description: "write complete file list to cella-sync.log" },
-      { flags: "--list", description: "non-interactive output for tooling (one file per line)" },
-      { flags: "--json", description: "machine-readable output for tooling/agents" },
-      { flags: "--scope <scope>", description: "analyze scope for --list/--json: all|risk|protected" },
-      { flags: "--track <mode>", description: "override upstream tracking for this run: release|branch" },
-      { flags: "--diff <path>", description: "print unified diff for one file, then exit" },
-      { flags: "--open-diff <path>", description: "open a browser diff for one file, then exit" }
-    ],
-    includeInMenu: (context) => !context.isUpstreamRepo
-  },
-  {
-    name: "sync",
-    description: "merge upstream changes into your app",
-    options: [
-      { flags: "--log", description: "write complete file list to cella-sync.log" },
-      { flags: "--hard", description: "overwrite drifted files with upstream version (aggressive realignment)" },
-      { flags: "--unpinned", description: "ignore pinned files (except package.json) to resurface upstream changes" },
-      { flags: "--track <mode>", description: "override upstream tracking for this run: release|branch" },
-      {
-        flags: "--direct-merge",
-        description: "auto-merge (squash) the sync PR once checks pass \u2014 needs auto-merge enabled on the repo"
-      }
-    ],
-    includeInMenu: (context) => !context.isUpstreamRepo,
-    menuDescription: () => "merge upstream changes + sync package.json"
-  },
-  {
-    name: "audit",
-    description: "check for outdated packages & vulnerabilities",
-    options: [
-      { flags: "--list", description: "skip interactive update prompts after printing audit results" },
-      { flags: "--force", description: "bypass pnpm metadata cache for fresh registry data" },
-      { flags: "--check-overrides", description: "check which pnpm.overrides are still needed" }
-    ]
-  },
-  {
-    name: "forks",
-    description: "sync downstream to local fork repositories",
-    options: [
-      { flags: "--fork <name>", description: "pre-select fork by name (skips fork selection prompt)" },
-      { flags: "--log", description: "write complete file list to cella-sync.log for each synced fork" },
-      { flags: "-V, --verbose", description: "show detailed output during operations" },
-      { flags: "--hard", description: "overwrite drifted files with upstream version (aggressive realignment)" }
-    ],
-    includeInMenu: (context) => context.hasForks
-  },
-  {
-    name: "contributions",
-    description: "pull and adopt changes from forks",
-    options: [
-      { flags: "--fork <name>", description: "select a specific fork directly (skips fork selection)" },
-      { flags: "--list", description: "non-interactive output (one file per line)" },
-      { flags: "--json", description: "machine-readable JSON output for tooling/agents" },
-      { flags: "--diff <path>", description: "print the unified diff for a single contributed file, then exit" }
-    ],
-    includeInMenu: (context) => context.hasForks
-  },
-  {
-    name: "stats",
-    description: "count files by category and workspace package",
-    options: [
-      { flags: "-V, --verbose", description: "show detailed output during operations" },
-      { flags: "--coverage", description: "regenerate test coverage before showing the stats summary" }
-    ]
-  }
-];
-async function getMenuContext(userConfig, forkPath) {
-  return {
-    hasForks: (userConfig.forks?.length ?? 0) > 0,
-    isUpstreamRepo: JSON.parse(readFileSync(join5(forkPath, "package.json"), "utf8")).name === "cella"
-  };
-}
-function buildServiceChoices(context) {
-  const label = (name) => name.padEnd(14);
-  const baseChoices = serviceDefinitions.filter((service) => service.includeInMenu?.(context) ?? true).map((service) => ({
-    value: service.name,
-    name: `${label(service.name)}${colors_default.dim(service.menuDescription?.(context) ?? service.description)}`
-  }));
-  return [
-    ...baseChoices,
-    { type: "separator", separator: "\u2500".repeat(40) },
-    { value: "exit", name: colors_default.red(`${label("exit")}${colors_default.dim("quit without doing anything")}`) }
-  ];
-}
-function addServiceCommand(program, definition, setSelection) {
-  const command = program.command(definition.name).description(definition.description);
-  for (const option of definition.options ?? []) {
-    command.option(option.flags, option.description);
-  }
-  command.action((opts) => {
-    setSelection({
-      service: definition.name,
-      options: readOptions(opts)
-    });
-  });
-}
-function buildProgram(setSelection) {
-  const program = new Command(NAME).name("cella").version(VERSION, "-v, --version", "output the current version").usage("[service] [options]").helpOption("-h, --help", "display help for a command").showHelpAfterError().addHelpText(
-    "after",
-    [
-      "",
-      "Examples:",
-      "  $ cella analyze",
-      "  $ cella analyze --json --scope risk",
-      "  $ cella analyze --open-diff frontend/src/routes/index.tsx",
-      "  $ cella sync --hard",
-      "  $ cella sync --unpinned",
-      "  $ cella sync --track branch",
-      "  $ cella sync --direct-merge",
-      "  $ cella audit --check-overrides",
-      "  $ cella contributions --fork raak --json"
-    ].join("\n")
-  );
-  for (const definition of serviceDefinitions) {
-    addServiceCommand(program, definition, setSelection);
-  }
-  return program;
-}
-function parseCommandLine(argv) {
-  if (argv.length <= 2) {
-    return { options: readOptions({}) };
-  }
-  let selection = { options: readOptions({}) };
-  const program = buildProgram((nextSelection) => {
-    selection = nextSelection;
-  });
-  program.parse(argv);
-  return selection;
-}
-async function promptForService(userConfig, forkPath) {
-  const selected = await select({
-    message: "choose a service:",
-    choices: buildServiceChoices(await getMenuContext(userConfig, forkPath)),
-    loop: false
-  });
-  if (selected === "exit") {
-    console.info(colors_default.dim("exiting..."));
-    console.info();
-    process5.exit(0);
-  }
-  console.info();
-  return selected;
-}
-function buildRuntimeConfig(userConfig, forkPath, selection) {
-  const { branchRef } = resolveUpstream(userConfig.settings);
-  return {
-    ...userConfig,
-    forkPath,
-    upstreamRef: branchRef,
-    service: selection.service ?? "analyze",
-    ...selection.options
-  };
-}
-async function parseCli(userConfig, forkPath) {
-  const selection = parseCommandLine(process5.argv);
-  if (selection.options.json || selection.options.diff) setJsonMode(true);
-  printHeader();
-  const warnings = validateOverrides(userConfig, forkPath);
-  if (warnings.length > 0) {
-    printWarnings(warnings);
-    console.info();
-  }
-  if (!selection.service) {
-    selection.service = await promptForService(userConfig, forkPath);
-  }
-  return buildRuntimeConfig(userConfig, forkPath, selection);
-}
-
-// src/services/analyze.ts
-import { basename as basename4 } from "path";
-
-// src/utils/diff.ts
-import { execFileSync } from "child_process";
-import { mkdirSync, writeFileSync as writeFileSync2 } from "fs";
-import { tmpdir } from "os";
-import { basename as basename2, join as join6 } from "path";
-import process6 from "process";
-function gitDiffFile(cwd, range, filePath, options = {}) {
-  const args = ["diff", "--no-color"];
-  if (options.dstPrefix) args.push("--src-prefix=cella/", `--dst-prefix=${options.dstPrefix}/`);
-  args.push(range, "--", filePath);
-  try {
-    return execFileSync("git", args, { cwd, maxBuffer: 50 * 1024 * 1024 });
-  } catch (error) {
-    const stderr = error.stderr?.toString().trim();
-    throw new Error(stderr || `failed to diff ${filePath}`);
-  }
-}
-function escapeHtml(text) {
-  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-async function renderDiffPage(patch, meta) {
-  const { preloadPatchDiff } = await import("@pierre/diffs/ssr");
-  const { prerenderedHTML } = await preloadPatchDiff({
-    patch,
-    options: {
-      diffStyle: "split",
-      themeType: "system",
-      lineDiffType: "word-alt",
-      hunkSeparators: "line-info",
-      overflow: "wrap",
-      disableFileHeader: true
-    }
-  });
-  const title = `${escapeHtml(meta.filePath)} \xB7 ${escapeHtml(meta.srcLabel)} vs ${escapeHtml(meta.dstLabel)}`;
-  const note = meta.note ? `<span class="note">\xB7 ${escapeHtml(meta.note)}</span>` : "";
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${title}</title>
-<style>
-  :root { color-scheme: light dark; }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0;
-    font-family: ui-sans-serif, system-ui, -apple-system, sans-serif;
-    background: light-dark(#fafafa, #111);
-    color: light-dark(#111, #eee);
-  }
-  header {
-    display: flex; align-items: baseline; gap: 0.75rem; flex-wrap: wrap;
-    padding: 0.9rem 1.25rem;
-    border-bottom: 1px solid light-dark(#e2e2e2, #2a2a2a);
-    position: sticky; top: 0;
-    background: inherit;
-  }
-  header .brand { font-weight: 600; color: light-dark(#0891b2, #22d3ee); }
-  header code { font-family: ui-monospace, monospace; font-size: 0.9rem; }
-  header .sides { margin-left: auto; font-size: 0.8rem; opacity: 0.7; }
-  main { max-width: 1400px; margin: 1rem auto; padding: 0 1rem 2rem; }
-  .diff-shell {
-    border: 1px solid light-dark(#e2e2e2, #2a2a2a);
-    border-radius: 8px; overflow: hidden;
-    background: light-dark(#fff, #161616);
-  }
-</style>
-</head>
-<body>
-<header>
-  <span class="brand">\u29C8 cella diff</span>
-  <code>${escapeHtml(meta.filePath)}</code>
-  <span class="sides">${escapeHtml(meta.srcLabel)} \u2190 \u2192 ${escapeHtml(meta.dstLabel)} ${note}</span>
-</header>
-<main>
-  <!-- Declarative shadow DOM: the library's CSS targets :host, which only
-       matches inside a shadow root (its browser component renders into one). -->
-  <div class="diff-shell">
-    <template shadowrootmode="open">
-${prerenderedHTML}
-    </template>
-  </div>
-</main>
-</body>
-</html>`;
-}
-function openWithDefaultApp(target) {
-  try {
-    if (process6.platform === "win32") {
-      execFileSync("rundll32", ["url.dll,FileProtocolHandler", target], { stdio: "ignore" });
-    } else {
-      execFileSync(process6.platform === "darwin" ? "open" : "xdg-open", [target], { stdio: "ignore" });
-    }
-  } catch {
-  }
-}
-async function openDiffInBrowser(patch, meta, repoPath) {
-  const html = await renderDiffPage(patch, meta);
-  const dir = join6(tmpdir(), `cella-diff-${basename2(repoPath)}`);
-  mkdirSync(dir, { recursive: true });
-  const outPath = join6(dir, `${meta.filePath.replace(/[^\w.-]+/g, "-")}.html`);
-  writeFileSync2(outPath, html);
-  openWithDefaultApp(outPath);
-  return outPath;
-}
-
-// src/utils/cleanup.ts
-import { existsSync as existsSync5, rmSync } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { basename as basename3, join as join9 } from "path";
-import process7 from "process";
-
-// src/utils/git.ts
-import { execFile } from "child_process";
-import { existsSync as existsSync4 } from "fs";
-import { mkdir as mkdir2, readdir, rmdir, unlink } from "fs/promises";
-import { dirname as dirname2, join as join8 } from "path";
-import { promisify } from "util";
-
-// src/utils/manifest.ts
-import { mkdir, readFile, writeFile } from "fs/promises";
-import { dirname, join as join7 } from "path";
-var MANIFEST_FILE = "cella/cella.manifest.json";
-async function readSyncManifest(cwd) {
-  try {
-    const parsed = JSON.parse(await readFile(join7(cwd, MANIFEST_FILE), "utf8"));
-    const commit = parsed?.upstream?.commit;
-    if (typeof commit !== "string" || !/^[0-9a-f]{40}$/i.test(commit)) return null;
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-async function readManifestBase(cwd) {
-  const manifest = await readSyncManifest(cwd);
-  return manifest ? manifest.upstream.commit.toLowerCase() : null;
-}
-async function writeSyncManifest(cwd, manifest) {
-  const manifestPath = join7(cwd, MANIFEST_FILE);
-  await mkdir(dirname(manifestPath), { recursive: true });
-  await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}
-`, "utf8");
-}
-
-// src/utils/git.ts
-var execFileAsync = promisify(execFile);
-function sanitizeCredentials(text) {
-  return text.replace(/https?:\/\/[^@\s]+@/g, (match) => {
-    const protocol = match.startsWith("https") ? "https" : "http";
-    return `${protocol}://***@`;
-  });
-}
-async function git(args, cwd, options = {}) {
-  const env = {
-    ...getEnvSnapshot(),
-    ...options.skipEditor ? { GIT_EDITOR: "true" } : {},
-    ...options.env
-  };
-  const maxBuffer = options.maxBuffer ?? 50 * 1024 * 1024;
-  try {
-    const { stdout } = await execFileAsync("git", args, { cwd, env, maxBuffer });
-    return stdout.trim();
-  } catch (error) {
-    if (options.ignoreErrors) return "";
-    if (error instanceof Error) {
-      error.message = sanitizeCredentials(error.message);
-    }
-    throw error;
-  }
-}
-async function getCurrentBranch(cwd) {
-  return git(["rev-parse", "--abbrev-ref", "HEAD"], cwd);
-}
-async function switchBranch(cwd, branch) {
-  await git(["switch", branch], cwd);
-}
-async function createBranchFrom(cwd, branch, startPoint) {
-  await git(["switch", "-c", branch, startPoint], cwd);
-}
-async function deleteBranch(cwd, branch) {
-  await git(["branch", "-D", branch], cwd, { ignoreErrors: true });
-}
-async function pullFastForward(cwd) {
-  await git(["pull", "--ff-only"], cwd, { ignoreErrors: true, skipEditor: true });
-}
-async function getUpstreamStatus(cwd) {
-  const upstream = await git(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"], cwd, {
-    ignoreErrors: true
-  });
-  if (!upstream) return { upstream: null, ahead: 0, behind: 0 };
-  const remote = upstream.split("/")[0];
-  await git(["fetch", remote], cwd, { ignoreErrors: true, skipEditor: true });
-  const counts = await git(["rev-list", "--left-right", "--count", `HEAD...${upstream}`], cwd, { ignoreErrors: true });
-  const [ahead, behind] = counts.split(/\s+/).map((n) => Number.parseInt(n, 10) || 0);
-  return { upstream, ahead: ahead ?? 0, behind: behind ?? 0 };
-}
-async function pushBranch(cwd, remote, branch, options = {}) {
-  await git(["push", "-u", ...options.forceWithLease ? ["--force-with-lease"] : [], remote, branch], cwd);
-}
-async function listBranchMergeCommits(cwd, baseRef) {
-  const out = await git(["rev-list", "--merges", "--first-parent", `${baseRef}..HEAD`], cwd, { ignoreErrors: true });
-  return out ? out.split("\n").filter(Boolean) : [];
-}
-async function flattenBranch(cwd, baseRef, message) {
-  const parent = await getMergeBase(cwd, baseRef, "HEAD");
-  const tree = await git(["rev-parse", "HEAD^{tree}"], cwd);
-  const commit = await git(["commit-tree", tree, "-p", parent, "-m", message], cwd);
-  await git(["reset", "--hard", commit], cwd);
-}
-async function commitSquash(cwd, message) {
-  for (const file of ["MERGE_HEAD", "MERGE_MSG", "MERGE_MODE"]) {
-    const path4 = join8(cwd, ".git", file);
-    if (existsSync4(path4)) await unlink(path4);
-  }
-  await git(["commit", "-m", message], cwd, { skipEditor: true });
-}
-async function stageAll(cwd) {
-  await git(["add", "-A"], cwd);
-}
-function mergeInProgress(cwd) {
-  return existsSync4(join8(cwd, ".git", "MERGE_HEAD"));
-}
-async function getShortSha(cwd, ref) {
-  return git(["rev-parse", "--short", ref], cwd);
-}
-async function getWorkingTreeChangeCount(cwd) {
-  const status = await git(["status", "--porcelain"], cwd);
-  if (!status) return 0;
-  return status.split("\n").filter(Boolean).length;
-}
-async function remoteExists(cwd, remoteName) {
-  const remotes = await git(["remote"], cwd);
-  return remotes.split("\n").includes(remoteName);
-}
-async function ensureRemote(cwd, remoteName, url) {
-  if (await remoteExists(cwd, remoteName)) {
-    await git(["remote", "set-url", remoteName, url], cwd);
-  } else {
-    await git(["remote", "add", remoteName, url], cwd);
-  }
-}
-async function fetch2(cwd, remoteName) {
-  await git(["fetch", remoteName], cwd);
-}
-async function fetchUpstreamTags(cwd, remoteName) {
-  await git(["fetch", remoteName, "--no-tags", `+refs/tags/*:refs/${remoteName}/tags/*`], cwd);
-}
-async function resolveLatestReleaseTag(cwd, remoteName) {
-  const prefix = `refs/${remoteName}/tags/`;
-  const output = await git(["for-each-ref", "--sort=-version:refname", "--format=%(refname)", prefix], cwd, {
-    ignoreErrors: true
-  });
-  if (!output) return null;
-  for (const line of output.split("\n")) {
-    const ref = line.trim();
-    if (!ref) continue;
-    const tag = ref.slice(prefix.length);
-    if (/^v\d/.test(tag)) return { tag, ref };
-  }
-  return null;
-}
-async function getCommitInfo(cwd, ref) {
-  const format = "%H%n%s%n%ar";
-  const output = await git(["log", "-1", `--format=${format}`, ref], cwd);
-  const [hash, message, date] = output.split("\n");
-  return { hash, message, date };
-}
-async function countCommitsBetween(cwd, fromRef, toRef) {
-  const output = await git(["rev-list", "--count", `${fromRef}..${toRef}`], cwd);
-  return Number.parseInt(output.trim(), 10) || 0;
-}
-async function listCommitsBetween(cwd, fromRef, toRef, options = {}) {
-  const { oldestFirst = true, skip = 0, limit } = options;
-  const args = ["log", "--format=%H%x1f%s%x1f%ar"];
-  if (oldestFirst) args.push("--reverse");
-  args.push(`${fromRef}..${toRef}`);
-  const output = await git(args, cwd, { ignoreErrors: true });
-  if (!output) return [];
-  const commits = [];
-  for (const line of output.split("\n")) {
-    if (!line) continue;
-    const [hash, message, date] = line.split("");
-    if (!hash || !message || !date) continue;
-    commits.push({ hash, message, date });
-  }
-  const normalizedSkip = Math.max(0, skip);
-  const normalizedLimit = typeof limit === "number" && limit > 0 ? limit : void 0;
-  if (normalizedSkip === 0 && normalizedLimit === void 0) {
-    return commits;
-  }
-  const start = Math.min(normalizedSkip, commits.length);
-  const end = normalizedLimit === void 0 ? commits.length : Math.min(start + normalizedLimit, commits.length);
-  return commits.slice(start, end);
+  const normalizedSkip = Math.max(0, skip);
+  const normalizedLimit = typeof limit === "number" && limit > 0 ? limit : void 0;
+  if (normalizedSkip === 0 && normalizedLimit === void 0) {
+    return commits;
+  }
+  const start = Math.min(normalizedSkip, commits.length);
+  const end = normalizedLimit === void 0 ? commits.length : Math.min(start + normalizedLimit, commits.length);
+  return commits.slice(start, end);
 }
 async function getFileChangeInfo(cwd, fromRef, toRef) {
   const info = /* @__PURE__ */ new Map();
@@ -1426,308 +1109,803 @@ async function getFileChanges(cwd, baseRef, targetRef) {
       });
     }
   }
-  return changes;
+  return changes;
+}
+async function getDiffStat(cwd, fromRef, toRef, paths = []) {
+  const args = ["diff", "--numstat", "--no-renames", fromRef, toRef];
+  if (paths.length > 0) args.push("--", ...paths);
+  const out = await git(args, cwd, { ignoreErrors: true });
+  const stat = /* @__PURE__ */ new Map();
+  for (const line of out.split("\n")) {
+    if (!line.trim()) continue;
+    const [a, d, ...rest] = line.split("	");
+    const path4 = rest.join("	");
+    if (!path4) continue;
+    stat.set(path4, {
+      additions: a === "-" ? null : Number(a),
+      deletions: d === "-" ? null : Number(d)
+    });
+  }
+  return stat;
+}
+async function getFileHashesAtRef(cwd, ref) {
+  const output = await git(["ls-tree", "-r", ref], cwd);
+  const hashes = /* @__PURE__ */ new Map();
+  if (!output) return hashes;
+  for (const line of output.split("\n")) {
+    if (!line) continue;
+    const match = line.match(/^\d+ \w+ ([a-f0-9]+)\t(.+)$/);
+    if (match) {
+      const [, hash, filePath] = match;
+      hashes.set(filePath, hash);
+    }
+  }
+  return hashes;
+}
+async function restoreToHead(cwd, filePath) {
+  await git(["checkout", "HEAD", "--", filePath], cwd);
+}
+async function batchRestoreToHead(cwd, filePaths) {
+  if (filePaths.length === 0) return;
+  await git(["checkout", "HEAD", "--", ...filePaths], cwd);
+}
+async function gitRm(cwd, filePath) {
+  await git(["rm", "-f", "--", filePath], cwd, { ignoreErrors: true });
+}
+async function batchGitRm(cwd, filePaths) {
+  if (filePaths.length === 0) return;
+  await git(["rm", "-f", "--", ...filePaths], cwd, { ignoreErrors: true });
+}
+async function getStagedNewFiles(cwd) {
+  const output = await git(["diff", "--cached", "--name-only", "--diff-filter=A"], cwd, { ignoreErrors: true });
+  return output ? output.split("\n").filter(Boolean) : [];
+}
+async function batchUnstageFiles(cwd, filePaths) {
+  if (filePaths.length === 0) return;
+  await git(["rm", "--cached", "-f", "--", ...filePaths], cwd, { ignoreErrors: true });
+}
+async function gitMv(cwd, oldPath, newPath) {
+  const newDir = dirname2(join5(cwd, newPath));
+  await mkdir2(newDir, { recursive: true });
+  await git(["mv", "-f", oldPath, newPath], cwd);
+}
+async function fileExistsInWorktree(cwd, filePath) {
+  return existsSync3(join5(cwd, filePath));
+}
+async function removeFileFromWorktree(cwd, filePath) {
+  const fullPath = join5(cwd, filePath);
+  try {
+    await unlink(fullPath);
+    await cleanupEmptyParentDirs(cwd, dirname2(filePath));
+  } catch {
+  }
+}
+async function removeFileFully(cwd, filePath) {
+  await gitRm(cwd, filePath);
+  await removeFileFromWorktree(cwd, filePath);
+}
+async function cleanupEmptyParentDirs(cwd, relativePath) {
+  if (!relativePath || relativePath === ".") return;
+  const fullPath = join5(cwd, relativePath);
+  try {
+    const entries = await readdir(fullPath);
+    if (entries.length === 0) {
+      await rmdir(fullPath);
+      await cleanupEmptyParentDirs(cwd, dirname2(relativePath));
+    }
+  } catch {
+  }
+}
+async function storeLastSyncRef(cwd, upstreamHash) {
+  await git(["update-ref", "refs/cella/last-sync", upstreamHash], cwd);
+  const head = await git(["rev-parse", "HEAD"], cwd, { ignoreErrors: true });
+  if (head) {
+    await git(["update-ref", "refs/cella/last-sync-head", head], cwd);
+  }
+}
+async function stagePath(cwd, path4) {
+  await git(["add", "--", path4], cwd, { ignoreErrors: true });
+}
+async function getStoredSyncRef(cwd) {
+  const ref = await git(["rev-parse", "refs/cella/last-sync"], cwd, { ignoreErrors: true });
+  return ref || null;
+}
+async function getStoredSyncHead(cwd) {
+  const ref = await git(["rev-parse", "refs/cella/last-sync-head"], cwd, { ignoreErrors: true });
+  return ref || null;
+}
+async function readManifestAtRef(cwd, ref) {
+  const raw = await git(["show", `${ref}:${MANIFEST_FILE}`], cwd, { ignoreErrors: true });
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    const commit = parsed?.upstream?.commit;
+    if (typeof commit !== "string" || !/^[0-9a-f]{40}$/i.test(commit)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function readManifestBaseAtRef(cwd, ref) {
+  const manifest = await readManifestAtRef(cwd, ref);
+  return manifest ? manifest.upstream.commit.toLowerCase() : null;
+}
+async function readPackageVersionAtRef(cwd, ref) {
+  const raw = await git(["show", `${ref}:package.json`], cwd, { ignoreErrors: true });
+  if (!raw) return null;
+  try {
+    const version = JSON.parse(raw).version;
+    return typeof version === "string" && version ? version : null;
+  } catch {
+    return null;
+  }
+}
+async function commitObjectExists(cwd, sha) {
+  try {
+    await git(["cat-file", "-e", `${sha}^{commit}`], cwd);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function getRootCommit(cwd, ref) {
+  const out = await git(["rev-list", "--max-parents=0", ref], cwd, { ignoreErrors: true });
+  const roots = out.split("\n").filter(Boolean);
+  return roots.length > 0 ? roots[roots.length - 1] : null;
+}
+var SCAFFOLD_CANDIDATE_LIMIT = 400;
+var SCAFFOLD_SCORE_CONCURRENCY = 10;
+var SCAFFOLD_MATCH_MAX_DIFF_RATIO = 0.3;
+async function inferScaffoldBase(cwd, headRef, upstreamRef) {
+  const root = await getRootCommit(cwd, headRef);
+  if (!root) return null;
+  const rootDate = await git(["show", "-s", "--format=%cI", root], cwd, { ignoreErrors: true });
+  if (!rootDate) return null;
+  const before = new Date(new Date(rootDate).getTime() + 24 * 60 * 60 * 1e3).toISOString();
+  const revList = await git(
+    ["rev-list", `--max-count=${SCAFFOLD_CANDIDATE_LIMIT}`, `--before=${before}`, upstreamRef],
+    cwd,
+    { ignoreErrors: true }
+  );
+  const candidates = revList.split("\n").filter(Boolean);
+  if (candidates.length === 0) return null;
+  const totalPaths = (await git(["ls-tree", "-r", "--name-only", root], cwd)).split("\n").filter(Boolean).length;
+  if (totalPaths === 0) return null;
+  let best = null;
+  outer: for (let i = 0; i < candidates.length; i += SCAFFOLD_SCORE_CONCURRENCY) {
+    const chunk = candidates.slice(i, i + SCAFFOLD_SCORE_CONCURRENCY);
+    const scores = await Promise.all(
+      chunk.map(async (sha) => {
+        try {
+          const out = await git(["diff-tree", "-r", "--name-only", sha, root], cwd);
+          return { sha, diff: out ? out.split("\n").length : 0 };
+        } catch {
+          return { sha, diff: Number.POSITIVE_INFINITY };
+        }
+      })
+    );
+    for (const score of scores) {
+      if (!best || score.diff < best.diff) best = score;
+      if (best.diff === 0) break outer;
+    }
+  }
+  if (!best || best.diff / totalPaths > SCAFFOLD_MATCH_MAX_DIFF_RATIO) return null;
+  return best.sha;
+}
+async function readRootTrailerBase(cwd, headRef) {
+  const root = await getRootCommit(cwd, headRef);
+  if (!root) return null;
+  const message = await git(["show", "-s", "--format=%B", root], cwd, { ignoreErrors: true });
+  const match = message.match(/^cella-base:\s*([0-9a-f]{40})$/im);
+  return match ? match[1].toLowerCase() : null;
+}
+async function isShallowRepository(cwd) {
+  const out = await git(["rev-parse", "--is-shallow-repository"], cwd, { ignoreErrors: true });
+  return out === "true";
+}
+async function unshallowRepository(cwd) {
+  try {
+    await git(["fetch", "--unshallow"], cwd, { skipEditor: true });
+  } catch (error) {
+    const detail = error instanceof Error ? `
+
+${error.message}` : "";
+    throw new Error(
+      `this is a shallow clone and its full history could not be restored automatically.
+Sync needs the complete history to find the common ancestor with upstream. Restore it with:
+
+  git fetch --unshallow
+
+then re-run sync.${detail}`
+    );
+  }
+}
+async function ensureSyncBase(cwd, headRef, upstreamRef) {
+  if (await isShallowRepository(cwd)) {
+    await unshallowRepository(cwd);
+  }
+  const nativeBase = await git(["merge-base", headRef, upstreamRef], cwd, { ignoreErrors: true });
+  if (nativeBase) return;
+  const sources = [
+    () => getStoredSyncRef(cwd),
+    () => readManifestBaseAtRef(cwd, headRef),
+    () => readManifestBase(cwd),
+    () => readRootTrailerBase(cwd, headRef),
+    () => inferScaffoldBase(cwd, headRef, upstreamRef)
+  ];
+  let baseSha = null;
+  for (const source of sources) {
+    const sha = await source();
+    if (sha && await commitObjectExists(cwd, sha)) {
+      baseSha = sha;
+      break;
+    }
+  }
+  if (!baseSha) {
+    throw new Error(
+      `no common ancestor between the fork and '${upstreamRef}', and no sync base could be determined.
+
+This fork has unrelated history with upstream \u2014 typical for a create-cella scaffold, or after
+upstream squashed its history \u2014 and no recorded or inferable base commit exists after fetching
+upstream. Seed it manually with the upstream commit the fork was created from, then re-run sync:
+
+  git update-ref refs/cella/last-sync <upstream-sha>
+`
+    );
+  }
+  const root = await getRootCommit(cwd, headRef);
+  if (!root) throw new Error("could not determine the fork's root commit to bootstrap sync ancestry");
+  await git(["replace", "-f", "--graft", root, baseSha], cwd);
+  await git(["update-ref", "refs/cella/last-sync", baseSha], cwd);
+}
+async function isAncestor(cwd, ancestor, descendant) {
+  try {
+    await git(["merge-base", "--is-ancestor", ancestor, descendant], cwd);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function getLegacySyncRef(cwd, headRef) {
+  const storedRef = await getStoredSyncRef(cwd);
+  if (!storedRef) return null;
+  const storedHead = await getStoredSyncHead(cwd);
+  if (storedHead) {
+    const currentHead = await git(["rev-parse", headRef], cwd, { ignoreErrors: true });
+    if (currentHead && currentHead === storedHead) return null;
+  }
+  return storedRef;
 }
-async function getDiffStat(cwd, fromRef, toRef, paths = []) {
-  const args = ["diff", "--numstat", "--no-renames", fromRef, toRef];
-  if (paths.length > 0) args.push("--", ...paths);
-  const out = await git(args, cwd, { ignoreErrors: true });
-  const stat = /* @__PURE__ */ new Map();
-  for (const line of out.split("\n")) {
-    if (!line.trim()) continue;
-    const [a, d, ...rest] = line.split("	");
-    const path4 = rest.join("	");
-    if (!path4) continue;
-    stat.set(path4, {
-      additions: a === "-" ? null : Number(a),
-      deletions: d === "-" ? null : Number(d)
-    });
+async function getEffectiveMergeBase(cwd, headRef, upstreamRef) {
+  const gitBase = await getMergeBase(cwd, headRef, upstreamRef);
+  const recorded = await readManifestBaseAtRef(cwd, headRef) ?? await getLegacySyncRef(cwd, headRef);
+  if (!recorded) {
+    return { base: gitBase, isStale: false, storedRef: null };
   }
-  return stat;
+  const recordedIsNewer = await isAncestor(cwd, gitBase, recorded);
+  if (recordedIsNewer && recorded !== gitBase) {
+    return { base: recorded, isStale: true, storedRef: recorded };
+  }
+  return { base: gitBase, isStale: false, storedRef: recorded };
 }
-async function getFileHashesAtRef(cwd, ref) {
-  const output = await git(["ls-tree", "-r", ref], cwd);
-  const hashes = /* @__PURE__ */ new Map();
-  if (!output) return hashes;
-  for (const line of output.split("\n")) {
-    if (!line) continue;
-    const match = line.match(/^\d+ \w+ ([a-f0-9]+)\t(.+)$/);
-    if (match) {
-      const [, hash, filePath] = match;
-      hashes.set(filePath, hash);
-    }
+async function withTemporarySyncBaseGraft(cwd, headRef, baseSha, fn) {
+  const headSha = await git(["rev-parse", headRef], cwd, { ignoreErrors: true });
+  if (!headSha || !await commitObjectExists(cwd, baseSha)) return fn();
+  if (await isAncestor(cwd, baseSha, headSha)) return fn();
+  const existingReplacement = await git(["replace", "-l", headSha], cwd, { ignoreErrors: true });
+  if (existingReplacement) return fn();
+  const parentsRaw = await git(["log", "-1", "--format=%P", headSha], cwd, { ignoreErrors: true });
+  const parents = parentsRaw ? parentsRaw.split(/\s+/) : [];
+  await git(["replace", "-f", "--graft", headSha, ...parents, baseSha], cwd);
+  try {
+    return await fn();
+  } finally {
+    await git(["replace", "-d", headSha], cwd, { ignoreErrors: true });
   }
-  return hashes;
 }
-async function restoreToHead(cwd, filePath) {
-  await git(["checkout", "HEAD", "--", filePath], cwd);
+
+// src/utils/migration-notes.ts
+var NOTES_DIR = "cella/migrations";
+var PENDING_FILE = "cella/cella.migrations.json";
+var NOTE_ID = /^\d{8}T\d{4}-[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function isUpstreamOnly(filePath) {
+  return filePath === NOTES_DIR || filePath.startsWith(`${NOTES_DIR}/`);
+}
+function bodyLines(lines) {
+  let inComment = false;
+  return lines.filter((line) => {
+    if (!inComment && !line.trimStart().startsWith("<!--")) return true;
+    inComment = !line.includes("-->");
+    return false;
+  });
 }
-async function batchRestoreToHead(cwd, filePaths) {
-  if (filePaths.length === 0) return;
-  await git(["checkout", "HEAD", "--", ...filePaths], cwd);
+function parseNote(id, source, fileNames) {
+  const lines = source.replace(/\r\n/g, "\n").split("\n");
+  const close = lines[0] === "---" ? lines.indexOf("---", 1) : -1;
+  const meta = /* @__PURE__ */ new Map();
+  for (const line of lines.slice(1, Math.max(close, 1))) {
+    const match = /^(\w+):\s*(.*)$/.exec(line);
+    if (match) meta.set(match[1], match[2].trim());
+  }
+  const body = bodyLines(lines.slice(close + 1)).join("\n");
+  const blocks = body.split(/\n\s*\n/).map((block) => block.trim()).filter(Boolean);
+  const title = /^# (.+)$/.exec(blocks[0] ?? "")?.[1].trim();
+  const summary = title && blocks[1] && !/^(#|>|[-*|]|```)/.test(blocks[1]) ? blocks[1].replace(/\s*\n\s*/g, " ") : "";
+  return {
+    id,
+    title: title || id,
+    summary,
+    syncBreaking: meta.get("syncBreaking") === "true",
+    clientCacheBump: meta.get("clientCacheBump") === "true",
+    roots: (meta.get("roots") ?? "").split(",").map((root) => root.trim()).filter(Boolean),
+    codemod: fileNames.find((name) => name.endsWith(".ts") && !name.endsWith(".test.ts")) ?? null
+  };
 }
-async function gitRm(cwd, filePath) {
-  await git(["rm", "-f", "--", filePath], cwd, { ignoreErrors: true });
+async function listNoteIds(cwd, ref) {
+  const out = await git(["ls-tree", "--name-only", `${ref}:${NOTES_DIR}`], cwd, { ignoreErrors: true });
+  return out.split("\n").filter((name) => NOTE_ID.test(name)).sort();
+}
+async function readNote(cwd, ref, id) {
+  const source = await git(["show", `${ref}:${NOTES_DIR}/${id}/README.md`], cwd, { ignoreErrors: true });
+  if (!source) return null;
+  const files = await git(["ls-tree", "--name-only", `${ref}:${NOTES_DIR}/${id}`], cwd, { ignoreErrors: true });
+  return parseNote(id, source, files.split("\n").filter(Boolean));
+}
+async function arrivedNoteIds(cwd, from, to) {
+  const [before, after] = await Promise.all([listNoteIds(cwd, from), listNoteIds(cwd, to)]);
+  const known = new Set(before);
+  return after.filter((id) => !known.has(id));
+}
+async function readPending(cwd, syncRef) {
+  const path4 = join6(cwd, PENDING_FILE);
+  if (!existsSync4(path4)) return [];
+  const parsed = JSON.parse(await readFile2(path4, "utf8"));
+  if (Array.isArray(parsed.pending)) return parsed.pending.filter((id) => typeof id === "string");
+  if (!Array.isArray(parsed.applied) || !syncRef) return [];
+  const applied = new Set(parsed.applied);
+  return (await listNoteIds(cwd, syncRef)).filter((id) => !applied.has(id));
+}
+async function writePending(cwd, ids) {
+  const path4 = join6(cwd, PENDING_FILE);
+  const pending = [...new Set(ids)].sort();
+  if (pending.length === 0) {
+    await rm(path4, { force: true });
+    return;
+  }
+  await mkdir3(dirname3(path4), { recursive: true });
+  await writeFile2(path4, `${JSON.stringify({ pending }, null, 2)}
+`, "utf8");
 }
-async function batchGitRm(cwd, filePaths) {
-  if (filePaths.length === 0) return;
-  await git(["rm", "-f", "--", ...filePaths], cwd, { ignoreErrors: true });
+function noteUrl(upstreamGitHubUrl, commit, id) {
+  return upstreamGitHubUrl ? `${upstreamGitHubUrl}/blob/${commit}/${NOTES_DIR}/${id}/README.md` : void 0;
 }
-async function getStagedNewFiles(cwd) {
-  const output = await git(["diff", "--cached", "--name-only", "--diff-filter=A"], cwd, { ignoreErrors: true });
-  return output ? output.split("\n").filter(Boolean) : [];
+function formatNotesLine(total, open, arrived, options = {}) {
+  const parts = [open === 0 ? `all ${total} handled` : `${Math.max(0, total - open)} of ${total} handled`];
+  if (arrived) parts.push(`${arrived} ${options.dryRun ? "arrive" : "arrived"} with this sync`);
+  if (open > 0) parts.push(`${open} open: pnpm cella migrate`);
+  return `migration notes: ${parts.join(" \xB7 ")}`;
 }
-async function batchUnstageFiles(cwd, filePaths) {
-  if (filePaths.length === 0) return;
-  await git(["rm", "--cached", "-f", "--", ...filePaths], cwd, { ignoreErrors: true });
+
+// src/utils/overrides.ts
+function isUnderAnyFolder(filePath, folders) {
+  return folders.some((folder) => {
+    const entry = folder.replace(/\/+$/, "");
+    return filePath === entry || filePath.startsWith(`${entry}/`);
+  });
 }
-async function gitMv(cwd, oldPath, newPath) {
-  const newDir = dirname2(join8(cwd, newPath));
-  await mkdir2(newDir, { recursive: true });
-  await git(["mv", "-f", oldPath, newPath], cwd);
+function isIgnored(filePath, config) {
+  return isUpstreamOnly(filePath) || isUnderAnyFolder(filePath, config.overrides?.ignored || []);
 }
-async function fileExistsInWorktree(cwd, filePath) {
-  return existsSync4(join8(cwd, filePath));
+function isPinned(filePath, config) {
+  if (isManagedFile(filePath)) return true;
+  return isUnderAnyFolder(filePath, config.overrides?.pinned || []);
 }
-async function removeFileFromWorktree(cwd, filePath) {
-  const fullPath = join8(cwd, filePath);
-  try {
-    await unlink(fullPath);
-    await cleanupEmptyParentDirs(cwd, dirname2(filePath));
-  } catch {
-  }
+function groupIgnoredUpstreamChanges(files, ignored) {
+  const entries = [...new Set(ignored.map((entry) => entry.replace(/\/+$/, "")).filter(Boolean))];
+  const mostSpecificFirst = [...entries].sort((a, b) => b.length - a.length);
+  const groups = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    if (!file.upstreamOnly || isManagedFile(file.path) || isGeneratedFile(file.path)) continue;
+    const entry = mostSpecificFirst.find((candidate) => isUnderAnyFolder(file.path, [candidate]));
+    if (!entry) continue;
+    const group = groups.get(entry) ?? { entry, paths: [], added: 0, deleted: 0 };
+    group.paths.push(file.path);
+    if (!file.existsInFork) group.added++;
+    if (!file.existsInUpstream) group.deleted++;
+    groups.set(entry, group);
+  }
+  for (const group of groups.values()) group.paths.sort();
+  return entries.flatMap((entry) => groups.get(entry) ?? []);
 }
-async function removeFileFully(cwd, filePath) {
-  await gitRm(cwd, filePath);
-  await removeFileFromWorktree(cwd, filePath);
+function isPinnedForSync(filePath, config, unpinned) {
+  if (isManagedFile(filePath)) return true;
+  if (unpinned) return false;
+  return isPinned(filePath, config);
 }
-async function cleanupEmptyParentDirs(cwd, relativePath) {
-  if (!relativePath || relativePath === ".") return;
-  const fullPath = join8(cwd, relativePath);
-  try {
-    const entries = await readdir(fullPath);
-    if (entries.length === 0) {
-      await rmdir(fullPath);
-      await cleanupEmptyParentDirs(cwd, dirname2(relativePath));
+function hasGlobChars(entry) {
+  return entry.includes("*") || entry.includes("?");
+}
+function validateOverrides(config, forkPath) {
+  const warnings = [];
+  const pinned = config.overrides?.pinned || [];
+  for (const entry of pinned) {
+    if (hasGlobChars(entry)) {
+      warnings.push({
+        type: "pinned-glob",
+        pattern: entry,
+        message: `pin uses glob (not supported, use a path or folder): ${entry}`
+      });
+    } else if (!existsSync5(join7(forkPath, entry))) {
+      warnings.push({
+        type: "pinned-not-found",
+        pattern: entry,
+        message: `pin not found: ${entry}`
+      });
+    }
+  }
+  const ignored = config.overrides?.ignored || [];
+  for (const entry of ignored) {
+    if (hasGlobChars(entry)) {
+      warnings.push({
+        type: "ignored-not-found",
+        pattern: entry,
+        message: `ignored entry uses glob (not supported, use a path or folder): ${entry}`
+      });
+    } else if (!existsSync5(join7(forkPath, entry.replace(/\/+$/, "")))) {
+      warnings.push({
+        type: "ignored-not-found",
+        pattern: entry,
+        message: `ignored entry not found: ${entry}`
+      });
     }
-  } catch {
   }
+  return warnings;
 }
-async function storeLastSyncRef(cwd, upstreamHash) {
-  await git(["update-ref", "refs/cella/last-sync", upstreamHash], cwd);
-  const head = await git(["rev-parse", "HEAD"], cwd, { ignoreErrors: true });
-  if (head) {
-    await git(["update-ref", "refs/cella/last-sync-head", head], cwd);
+function printWarnings(warnings) {
+  for (const warning of warnings) {
+    console.info(`${warningMark} ${warning.message}`);
+  }
+}
+
+// src/cli.ts
+function readOptions(opts) {
+  const scope = typeof opts.scope === "string" ? opts.scope : void 0;
+  if (scope && scope !== "all" && scope !== "risk" && scope !== "protected") {
+    throw new Error(`invalid --scope '${scope}'. expected one of: all, risk, protected`);
+  }
+  const normalizedScope = scope;
+  return {
+    logFile: opts.log === true,
+    verbose: opts.verbose === true,
+    list: opts.list === true,
+    json: opts.json === true,
+    diff: typeof opts.diff === "string" ? opts.diff : void 0,
+    openDiff: typeof opts.openDiff === "string" ? opts.openDiff : void 0,
+    scope: normalizedScope,
+    fork: typeof opts.fork === "string" ? opts.fork : void 0,
+    hard: opts.hard === true,
+    unpinned: opts.unpinned === true,
+    track: opts.track === "release" || opts.track === "branch" ? opts.track : void 0,
+    force: opts.force === true,
+    checkOverrides: opts.checkOverrides === true,
+    coverage: opts.coverage === true,
+    all: opts.all === true,
+    show: typeof opts.show === "string" ? opts.show : void 0,
+    extract: typeof opts.extract === "string" ? opts.extract : void 0,
+    mark: Array.isArray(opts.mark) ? opts.mark.filter((id) => typeof id === "string") : void 0
+  };
+}
+var serviceDefinitions = [
+  {
+    name: "analyze",
+    description: "dry run to see what would change on sync",
+    options: [
+      { flags: "--log", description: "write complete file list to cella-sync.log" },
+      { flags: "--list", description: "non-interactive output for tooling (one file per line)" },
+      { flags: "--json", description: "machine-readable output for tooling/agents" },
+      { flags: "--scope <scope>", description: "analyze scope for --list/--json: all|risk|protected" },
+      { flags: "--track <mode>", description: "override upstream tracking for this run: release|branch" },
+      { flags: "--diff <path>", description: "print unified diff for one file, then exit" },
+      { flags: "--open-diff <path>", description: "open a browser diff for one file, then exit" }
+    ],
+    includeInMenu: (context) => !context.isUpstreamRepo
+  },
+  {
+    name: "sync",
+    description: "merge upstream changes into your app",
+    options: [
+      { flags: "--log", description: "write complete file list to cella-sync.log" },
+      { flags: "--hard", description: "overwrite drifted files with upstream version (aggressive realignment)" },
+      { flags: "--unpinned", description: "ignore pinned files (except package.json) to resurface upstream changes" },
+      { flags: "--track <mode>", description: "override upstream tracking for this run: release|branch" }
+    ],
+    includeInMenu: (context) => !context.isUpstreamRepo,
+    menuDescription: () => "merge upstream changes + sync package.json"
+  },
+  {
+    name: "migrate",
+    description: "list the upstream migration notes this app has not handled yet",
+    options: [
+      { flags: "--all", description: "list every upstream note, handled or not" },
+      { flags: "--json", description: "machine-readable output for tooling/agents" },
+      { flags: "--show <id>", description: "print one note's README" },
+      { flags: "--extract <id>", description: "write one note's folder under node_modules/.cache to run its codemod" },
+      { flags: "--mark <ids...>", description: "record notes as handled" }
+    ],
+    includeInMenu: (context) => !context.isUpstreamRepo
+  },
+  {
+    name: "audit",
+    description: "check for outdated packages & vulnerabilities",
+    options: [
+      { flags: "--list", description: "skip interactive update prompts after printing audit results" },
+      { flags: "--force", description: "bypass pnpm metadata cache for fresh registry data" },
+      { flags: "--check-overrides", description: "check which pnpm.overrides are still needed" }
+    ]
+  },
+  {
+    name: "forks",
+    description: "sync downstream to local fork repositories",
+    options: [
+      { flags: "--fork <name>", description: "pre-select fork by name (skips fork selection prompt)" },
+      { flags: "--log", description: "write complete file list to cella-sync.log for each synced fork" },
+      { flags: "-V, --verbose", description: "show detailed output during operations" },
+      { flags: "--hard", description: "overwrite drifted files with upstream version (aggressive realignment)" }
+    ],
+    includeInMenu: (context) => context.hasForks
+  },
+  {
+    name: "contributions",
+    description: "pull and adopt changes from forks",
+    options: [
+      { flags: "--fork <name>", description: "select a specific fork directly (skips fork selection)" },
+      { flags: "--list", description: "non-interactive output (one file per line)" },
+      { flags: "--json", description: "machine-readable JSON output for tooling/agents" },
+      { flags: "--diff <path>", description: "print the unified diff for a single contributed file, then exit" }
+    ],
+    includeInMenu: (context) => context.hasForks
+  },
+  {
+    name: "stats",
+    description: "count files by category and workspace package",
+    options: [
+      { flags: "-V, --verbose", description: "show detailed output during operations" },
+      { flags: "--coverage", description: "regenerate test coverage before showing the stats summary" }
+    ]
   }
+];
+async function getMenuContext(userConfig, forkPath) {
+  return {
+    hasForks: (userConfig.forks?.length ?? 0) > 0,
+    isUpstreamRepo: JSON.parse(readFileSync(join8(forkPath, "package.json"), "utf8")).name === "cella"
+  };
 }
-async function stagePath(cwd, path4) {
-  await git(["add", "--", path4], cwd, { ignoreErrors: true });
-}
-async function getStoredSyncRef(cwd) {
-  const ref = await git(["rev-parse", "refs/cella/last-sync"], cwd, { ignoreErrors: true });
-  return ref || null;
-}
-async function getStoredSyncHead(cwd) {
-  const ref = await git(["rev-parse", "refs/cella/last-sync-head"], cwd, { ignoreErrors: true });
-  return ref || null;
+function buildServiceChoices(context) {
+  const label = (name) => name.padEnd(14);
+  const baseChoices = serviceDefinitions.filter((service) => service.includeInMenu?.(context) ?? true).map((service) => ({
+    value: service.name,
+    name: `${label(service.name)}${colors_default.dim(service.menuDescription?.(context) ?? service.description)}`
+  }));
+  return [
+    ...baseChoices,
+    { type: "separator", separator: "\u2500".repeat(40) },
+    { value: "exit", name: colors_default.red(`${label("exit")}${colors_default.dim("quit without doing anything")}`) }
+  ];
 }
-async function readManifestAtRef(cwd, ref) {
-  const raw = await git(["show", `${ref}:${MANIFEST_FILE}`], cwd, { ignoreErrors: true });
-  if (!raw) return null;
-  try {
-    const parsed = JSON.parse(raw);
-    const commit = parsed?.upstream?.commit;
-    if (typeof commit !== "string" || !/^[0-9a-f]{40}$/i.test(commit)) return null;
-    return parsed;
-  } catch {
-    return null;
+function addServiceCommand(program, definition, setSelection) {
+  const command = program.command(definition.name).description(definition.description);
+  for (const option of definition.options ?? []) {
+    command.option(option.flags, option.description);
   }
+  command.action((opts) => {
+    setSelection({
+      service: definition.name,
+      options: readOptions(opts)
+    });
+  });
 }
-async function readManifestBaseAtRef(cwd, ref) {
-  const manifest = await readManifestAtRef(cwd, ref);
-  return manifest ? manifest.upstream.commit.toLowerCase() : null;
-}
-async function readPackageVersionAtRef(cwd, ref) {
-  const raw = await git(["show", `${ref}:package.json`], cwd, { ignoreErrors: true });
-  if (!raw) return null;
-  try {
-    const version = JSON.parse(raw).version;
-    return typeof version === "string" && version ? version : null;
-  } catch {
-    return null;
+function buildProgram(setSelection) {
+  const program = new Command(NAME).name("cella").version(VERSION, "-v, --version", "output the current version").usage("[service] [options]").helpOption("-h, --help", "display help for a command").showHelpAfterError().addHelpText(
+    "after",
+    [
+      "",
+      "Examples:",
+      "  $ cella analyze",
+      "  $ cella analyze --json --scope risk",
+      "  $ cella analyze --open-diff frontend/src/routes/index.tsx",
+      "  $ cella sync --hard",
+      "  $ cella sync --unpinned",
+      "  $ cella sync --track branch",
+      "  $ cella migrate --mark 20261002T0614-config-switch",
+      "  $ cella audit --check-overrides",
+      "  $ cella contributions --fork raak --json"
+    ].join("\n")
+  );
+  for (const definition of serviceDefinitions) {
+    addServiceCommand(program, definition, setSelection);
   }
+  return program;
 }
-async function commitObjectExists(cwd, sha) {
-  try {
-    await git(["cat-file", "-e", `${sha}^{commit}`], cwd);
-    return true;
-  } catch {
-    return false;
+function parseCommandLine(argv) {
+  if (argv.length <= 2) {
+    return { options: readOptions({}) };
   }
+  let selection = { options: readOptions({}) };
+  const program = buildProgram((nextSelection) => {
+    selection = nextSelection;
+  });
+  program.parse(argv);
+  return selection;
 }
-async function getRootCommit(cwd, ref) {
-  const out = await git(["rev-list", "--max-parents=0", ref], cwd, { ignoreErrors: true });
-  const roots = out.split("\n").filter(Boolean);
-  return roots.length > 0 ? roots[roots.length - 1] : null;
-}
-var SCAFFOLD_CANDIDATE_LIMIT = 400;
-var SCAFFOLD_SCORE_CONCURRENCY = 10;
-var SCAFFOLD_MATCH_MAX_DIFF_RATIO = 0.3;
-async function inferScaffoldBase(cwd, headRef, upstreamRef) {
-  const root = await getRootCommit(cwd, headRef);
-  if (!root) return null;
-  const rootDate = await git(["show", "-s", "--format=%cI", root], cwd, { ignoreErrors: true });
-  if (!rootDate) return null;
-  const before = new Date(new Date(rootDate).getTime() + 24 * 60 * 60 * 1e3).toISOString();
-  const revList = await git(
-    ["rev-list", `--max-count=${SCAFFOLD_CANDIDATE_LIMIT}`, `--before=${before}`, upstreamRef],
-    cwd,
-    { ignoreErrors: true }
-  );
-  const candidates = revList.split("\n").filter(Boolean);
-  if (candidates.length === 0) return null;
-  const totalPaths = (await git(["ls-tree", "-r", "--name-only", root], cwd)).split("\n").filter(Boolean).length;
-  if (totalPaths === 0) return null;
-  let best = null;
-  outer: for (let i = 0; i < candidates.length; i += SCAFFOLD_SCORE_CONCURRENCY) {
-    const chunk = candidates.slice(i, i + SCAFFOLD_SCORE_CONCURRENCY);
-    const scores = await Promise.all(
-      chunk.map(async (sha) => {
-        try {
-          const out = await git(["diff-tree", "-r", "--name-only", sha, root], cwd);
-          return { sha, diff: out ? out.split("\n").length : 0 };
-        } catch {
-          return { sha, diff: Number.POSITIVE_INFINITY };
-        }
-      })
-    );
-    for (const score of scores) {
-      if (!best || score.diff < best.diff) best = score;
-      if (best.diff === 0) break outer;
-    }
+async function promptForService(userConfig, forkPath) {
+  const selected = await select({
+    message: "choose a service:",
+    choices: buildServiceChoices(await getMenuContext(userConfig, forkPath)),
+    loop: false
+  });
+  if (selected === "exit") {
+    console.info(colors_default.dim("exiting..."));
+    console.info();
+    process5.exit(0);
   }
-  if (!best || best.diff / totalPaths > SCAFFOLD_MATCH_MAX_DIFF_RATIO) return null;
-  return best.sha;
-}
-async function readRootTrailerBase(cwd, headRef) {
-  const root = await getRootCommit(cwd, headRef);
-  if (!root) return null;
-  const message = await git(["show", "-s", "--format=%B", root], cwd, { ignoreErrors: true });
-  const match = message.match(/^cella-base:\s*([0-9a-f]{40})$/im);
-  return match ? match[1].toLowerCase() : null;
-}
-async function isShallowRepository(cwd) {
-  const out = await git(["rev-parse", "--is-shallow-repository"], cwd, { ignoreErrors: true });
-  return out === "true";
+  console.info();
+  return selected;
 }
-async function unshallowRepository(cwd) {
-  try {
-    await git(["fetch", "--unshallow"], cwd, { skipEditor: true });
-  } catch (error) {
-    const detail = error instanceof Error ? `
-
-${error.message}` : "";
-    throw new Error(
-      `this is a shallow clone and its full history could not be restored automatically.
-Sync needs the complete history to find the common ancestor with upstream. Restore it with:
-
-  git fetch --unshallow
-
-then re-run sync.${detail}`
-    );
-  }
+function buildRuntimeConfig(userConfig, forkPath, selection) {
+  const { branchRef } = resolveUpstream(userConfig.settings);
+  return {
+    ...userConfig,
+    forkPath,
+    upstreamRef: branchRef,
+    service: selection.service ?? "analyze",
+    ...selection.options
+  };
 }
-async function ensureSyncBase(cwd, headRef, upstreamRef) {
-  if (await isShallowRepository(cwd)) {
-    await unshallowRepository(cwd);
+async function parseCli(userConfig, forkPath) {
+  const selection = parseCommandLine(process5.argv);
+  if (selection.options.json || selection.options.diff) setJsonMode(true);
+  printHeader();
+  const warnings = validateOverrides(userConfig, forkPath);
+  if (warnings.length > 0) {
+    printWarnings(warnings);
+    console.info();
   }
-  const nativeBase = await git(["merge-base", headRef, upstreamRef], cwd, { ignoreErrors: true });
-  if (nativeBase) return;
-  const sources = [
-    () => getStoredSyncRef(cwd),
-    () => readManifestBaseAtRef(cwd, headRef),
-    () => readManifestBase(cwd),
-    () => readRootTrailerBase(cwd, headRef),
-    () => inferScaffoldBase(cwd, headRef, upstreamRef)
-  ];
-  let baseSha = null;
-  for (const source of sources) {
-    const sha = await source();
-    if (sha && await commitObjectExists(cwd, sha)) {
-      baseSha = sha;
-      break;
-    }
+  if (!selection.service) {
+    selection.service = await promptForService(userConfig, forkPath);
   }
-  if (!baseSha) {
-    throw new Error(
-      `no common ancestor between the fork and '${upstreamRef}', and no sync base could be determined.
+  return buildRuntimeConfig(userConfig, forkPath, selection);
+}
 
-This fork has unrelated history with upstream \u2014 typical for a create-cella scaffold, or after
-upstream squashed its history \u2014 and no recorded or inferable base commit exists after fetching
-upstream. Seed it manually with the upstream commit the fork was created from, then re-run sync:
+// src/services/analyze.ts
+import { basename as basename4 } from "path";
 
-  git update-ref refs/cella/last-sync <upstream-sha>
-`
-    );
-  }
-  const root = await getRootCommit(cwd, headRef);
-  if (!root) throw new Error("could not determine the fork's root commit to bootstrap sync ancestry");
-  await git(["replace", "-f", "--graft", root, baseSha], cwd);
-  await git(["update-ref", "refs/cella/last-sync", baseSha], cwd);
-}
-async function isAncestor(cwd, ancestor, descendant) {
+// src/utils/diff.ts
+import { execFileSync } from "child_process";
+import { mkdirSync, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir } from "os";
+import { basename as basename2, join as join9 } from "path";
+import process6 from "process";
+function gitDiffFile(cwd, range, filePath, options = {}) {
+  const args = ["diff", "--no-color"];
+  if (options.dstPrefix) args.push("--src-prefix=cella/", `--dst-prefix=${options.dstPrefix}/`);
+  args.push(range, "--", filePath);
   try {
-    await git(["merge-base", "--is-ancestor", ancestor, descendant], cwd);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function getLegacySyncRef(cwd, headRef) {
-  const storedRef = await getStoredSyncRef(cwd);
-  if (!storedRef) return null;
-  const storedHead = await getStoredSyncHead(cwd);
-  if (storedHead) {
-    const currentHead = await git(["rev-parse", headRef], cwd, { ignoreErrors: true });
-    if (currentHead && currentHead === storedHead) return null;
+    return execFileSync("git", args, { cwd, maxBuffer: 50 * 1024 * 1024 });
+  } catch (error) {
+    const stderr = error.stderr?.toString().trim();
+    throw new Error(stderr || `failed to diff ${filePath}`);
   }
-  return storedRef;
 }
-async function getEffectiveMergeBase(cwd, headRef, upstreamRef) {
-  const gitBase = await getMergeBase(cwd, headRef, upstreamRef);
-  const recorded = await readManifestBaseAtRef(cwd, headRef) ?? await getLegacySyncRef(cwd, headRef);
-  if (!recorded) {
-    return { base: gitBase, isStale: false, storedRef: null };
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+async function renderDiffPage(patch, meta) {
+  const { preloadPatchDiff } = await import("@pierre/diffs/ssr");
+  const { prerenderedHTML } = await preloadPatchDiff({
+    patch,
+    options: {
+      diffStyle: "split",
+      themeType: "system",
+      lineDiffType: "word-alt",
+      hunkSeparators: "line-info",
+      overflow: "wrap",
+      disableFileHeader: true
+    }
+  });
+  const title = `${escapeHtml(meta.filePath)} \xB7 ${escapeHtml(meta.srcLabel)} vs ${escapeHtml(meta.dstLabel)}`;
+  const note = meta.note ? `<span class="note">\xB7 ${escapeHtml(meta.note)}</span>` : "";
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title}</title>
+<style>
+  :root { color-scheme: light dark; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    font-family: ui-sans-serif, system-ui, -apple-system, sans-serif;
+    background: light-dark(#fafafa, #111);
+    color: light-dark(#111, #eee);
   }
-  const recordedIsNewer = await isAncestor(cwd, gitBase, recorded);
-  if (recordedIsNewer && recorded !== gitBase) {
-    return { base: recorded, isStale: true, storedRef: recorded };
+  header {
+    display: flex; align-items: baseline; gap: 0.75rem; flex-wrap: wrap;
+    padding: 0.9rem 1.25rem;
+    border-bottom: 1px solid light-dark(#e2e2e2, #2a2a2a);
+    position: sticky; top: 0;
+    background: inherit;
   }
-  return { base: gitBase, isStale: false, storedRef: recorded };
+  header .brand { font-weight: 600; color: light-dark(#0891b2, #22d3ee); }
+  header code { font-family: ui-monospace, monospace; font-size: 0.9rem; }
+  header .sides { margin-left: auto; font-size: 0.8rem; opacity: 0.7; }
+  main { max-width: 1400px; margin: 1rem auto; padding: 0 1rem 2rem; }
+  .diff-shell {
+    border: 1px solid light-dark(#e2e2e2, #2a2a2a);
+    border-radius: 8px; overflow: hidden;
+    background: light-dark(#fff, #161616);
+  }
+</style>
+</head>
+<body>
+<header>
+  <span class="brand">\u29C8 cella diff</span>
+  <code>${escapeHtml(meta.filePath)}</code>
+  <span class="sides">${escapeHtml(meta.srcLabel)} \u2190 \u2192 ${escapeHtml(meta.dstLabel)} ${note}</span>
+</header>
+<main>
+  <!-- Declarative shadow DOM: the library's CSS targets :host, which only
+       matches inside a shadow root (its browser component renders into one). -->
+  <div class="diff-shell">
+    <template shadowrootmode="open">
+${prerenderedHTML}
+    </template>
+  </div>
+</main>
+</body>
+</html>`;
 }
-async function withTemporarySyncBaseGraft(cwd, headRef, baseSha, fn) {
-  const headSha = await git(["rev-parse", headRef], cwd, { ignoreErrors: true });
-  if (!headSha || !await commitObjectExists(cwd, baseSha)) return fn();
-  if (await isAncestor(cwd, baseSha, headSha)) return fn();
-  const existingReplacement = await git(["replace", "-l", headSha], cwd, { ignoreErrors: true });
-  if (existingReplacement) return fn();
-  const parentsRaw = await git(["log", "-1", "--format=%P", headSha], cwd, { ignoreErrors: true });
-  const parents = parentsRaw ? parentsRaw.split(/\s+/) : [];
-  await git(["replace", "-f", "--graft", headSha, ...parents, baseSha], cwd);
+function openWithDefaultApp(target) {
   try {
-    return await fn();
-  } finally {
-    await git(["replace", "-d", headSha], cwd, { ignoreErrors: true });
+    if (process6.platform === "win32") {
+      execFileSync("rundll32", ["url.dll,FileProtocolHandler", target], { stdio: "ignore" });
+    } else {
+      execFileSync(process6.platform === "darwin" ? "open" : "xdg-open", [target], { stdio: "ignore" });
+    }
+  } catch {
   }
 }
+async function openDiffInBrowser(patch, meta, repoPath) {
+  const html = await renderDiffPage(patch, meta);
+  const dir = join9(tmpdir(), `cella-diff-${basename2(repoPath)}`);
+  mkdirSync(dir, { recursive: true });
+  const outPath = join9(dir, `${meta.filePath.replace(/[^\w.-]+/g, "-")}.html`);
+  writeFileSync2(outPath, html);
+  openWithDefaultApp(outPath);
+  return outPath;
+}
+
+// src/services/merge-engine.ts
+import { existsSync as existsSync7 } from "fs";
+import { rm as rm2 } from "fs/promises";
+import { join as join11 } from "path";
 
 // src/utils/cleanup.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync6, rmSync } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { basename as basename3, join as join10, resolve as resolve3 } from "path";
+import process7 from "process";
 var WORKTREE_PREFIXES = {
   sync: "cella-sync-",
   view: "cella-view-"
 };
 function buildWorktreePath(kind, repoPath) {
-  return join9(tmpdir2(), `${WORKTREE_PREFIXES[kind]}${basename3(repoPath)}`);
+  const key = createHash("sha256").update(resolve3(repoPath)).digest("hex").slice(0, 8);
+  return join10(tmpdir2(), `${WORKTREE_PREFIXES[kind]}${basename3(repoPath)}-${key}`);
+}
+function legacyWorktreePath(kind, repoPath) {
+  return join10(tmpdir2(), `${WORKTREE_PREFIXES[kind]}${basename3(repoPath)}`);
 }
 function getWorktreePath(repoPath) {
   return buildWorktreePath("sync", repoPath);
@@ -1745,22 +1923,21 @@ function unregisterWorktree() {
 }
 async function cleanupWorktree(repoPath, worktreePath) {
   await removeWorktree(repoPath, worktreePath);
-  if (existsSync5(worktreePath)) {
+  if (existsSync6(worktreePath)) {
     rmSync(worktreePath, { recursive: true, force: true });
   }
   unregisterWorktree();
 }
 async function cleanupLeftoverWorktrees(repoPath) {
   for (const kind of Object.keys(WORKTREE_PREFIXES)) {
-    const worktreePath = buildWorktreePath(kind, repoPath);
-    if (existsSync5(worktreePath)) {
-      await cleanupWorktree(repoPath, worktreePath);
+    for (const worktreePath of [buildWorktreePath(kind, repoPath), legacyWorktreePath(kind, repoPath)]) {
+      if (existsSync6(worktreePath)) await cleanupWorktree(repoPath, worktreePath);
     }
   }
   const prefixes = Object.values(WORKTREE_PREFIXES);
   const worktrees = await listWorktrees(repoPath);
   for (const wt of worktrees) {
-    if (prefixes.some((prefix) => wt.includes(prefix)) && !existsSync5(wt)) {
+    if (prefixes.some((prefix) => wt.includes(prefix)) && !existsSync6(wt)) {
       await removeWorktree(repoPath, wt);
     }
   }
@@ -1791,7 +1968,160 @@ function registerSignalHandlers() {
   cleanupRegistered = true;
 }
 
+// src/utils/versions.ts
+function parseComparableVersion(version) {
+  const trimmed = version.trim();
+  if (trimmed === "" || trimmed === "*" || trimmed.includes("workspace:") || trimmed.includes("catalog:") || trimmed.includes("file:") || trimmed.includes("link:") || trimmed.includes("git+") || trimmed.includes("github:") || trimmed.includes("http://") || trimmed.includes("https://") || trimmed.includes("||")) {
+    return null;
+  }
+  const match = trimmed.match(
+    /^(?:\^|~|>=|<=|>|<|=)?\s*v?(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/
+  );
+  if (!match) return null;
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2] ?? 0),
+    patch: Number(match[3] ?? 0)
+  };
+}
+function compareVersions(left, right) {
+  if (left.major !== right.major) return left.major - right.major;
+  if (left.minor !== right.minor) return left.minor - right.minor;
+  return left.patch - right.patch;
+}
+
+// src/utils/cli-version.ts
+var CLI_PACKAGE = "@cellajs/cli";
+async function readUpstreamCliRange(repoPath, ref) {
+  const source = await git(["show", `${ref}:package.json`], repoPath, { ignoreErrors: true });
+  if (!source) return null;
+  try {
+    const pkg = JSON.parse(source);
+    return pkg.devDependencies?.[CLI_PACKAGE] ?? pkg.dependencies?.[CLI_PACKAGE] ?? null;
+  } catch {
+    return null;
+  }
+}
+function cliVersionMismatch(running, range) {
+  if (/^\s*(<|>(?!=))/.test(range)) return null;
+  const required = parseComparableVersion(range);
+  const current = parseComparableVersion(running);
+  if (!required || !current || compareVersions(current, required) >= 0) return null;
+  return [
+    `upstream needs ${CLI_PACKAGE} ${range}, this is ${running}: an older CLI misses fixes to the sync itself.`,
+    `  update it, commit, then rerun: pnpm add -D -w '${CLI_PACKAGE}@${range}'`
+  ].join("\n");
+}
+
+// src/utils/upstream-overrides.ts
+import { Node, Project as Project2, SyntaxKind as SyntaxKind2 } from "ts-morph";
+var LIST_KEYS = ["pinned", "ignored"];
+function resolveExpression(node, sourceFile, depth = 0) {
+  if (!node || depth > 8) return node;
+  if (Node.isParenthesizedExpression(node) || Node.isAsExpression(node) || Node.isSatisfiesExpression(node)) {
+    return resolveExpression(node.getExpression(), sourceFile, depth + 1);
+  }
+  if (Node.isIdentifier(node)) {
+    return resolveExpression(
+      sourceFile.getVariableDeclaration(node.getText())?.getInitializer(),
+      sourceFile,
+      depth + 1
+    );
+  }
+  return node;
+}
+function findConfigObject(sourceFile) {
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind2.CallExpression)) {
+    if (call.getExpression().getText() !== "defineConfig") continue;
+    const arg = resolveExpression(call.getArguments()[0], sourceFile);
+    if (Node.isObjectLiteralExpression(arg)) return arg;
+  }
+  const exported = sourceFile.getExportAssignment((assignment) => !assignment.isExportEquals());
+  const value = resolveExpression(exported?.getExpression(), sourceFile);
+  return Node.isObjectLiteralExpression(value) ? value : void 0;
+}
+function readProperty(object, name, sourceFile) {
+  for (const property of object.getProperties()) {
+    if (Node.isPropertyAssignment(property)) {
+      if (property.getName().replace(/^['"`]|['"`]$/g, "") !== name) continue;
+      return resolveExpression(property.getInitializer(), sourceFile) ?? null;
+    }
+    if (Node.isShorthandPropertyAssignment(property) && property.getName() === name) {
+      return resolveExpression(property.getNameNode(), sourceFile) ?? null;
+    }
+  }
+  return void 0;
+}
+function parseOverrideLists(source) {
+  try {
+    const project = new Project2({ useInMemoryFileSystem: true, skipLoadingLibFiles: true });
+    const sourceFile = project.createSourceFile("cella.config.ts", source);
+    const config = findConfigObject(sourceFile);
+    if (!config) return null;
+    const overrides = readProperty(config, "overrides", sourceFile);
+    if (overrides === void 0) return { pinned: [], ignored: [] };
+    if (!overrides || !Node.isObjectLiteralExpression(overrides)) return null;
+    const lists = { pinned: [], ignored: [] };
+    for (const key of LIST_KEYS) {
+      const list = readProperty(overrides, key, sourceFile);
+      if (list === void 0) continue;
+      if (!list || !Node.isArrayLiteralExpression(list)) return null;
+      for (const element of list.getElements()) {
+        if (Node.isStringLiteral(element) || Node.isNoSubstitutionTemplateLiteral(element)) {
+          lists[key].push(element.getLiteralValue());
+        }
+      }
+    }
+    return lists;
+  } catch {
+    return null;
+  }
+}
+function normalizeEntry(entry) {
+  return entry.trim().replace(/^\.\//, "").replace(/\/+$/, "");
+}
+function diffOverrideLists(base, incoming, fork) {
+  const diff = (key) => {
+    const baseSet = new Set(base[key].map(normalizeEntry).filter(Boolean));
+    const incomingSet = new Set(incoming[key].map(normalizeEntry).filter(Boolean));
+    const forkEntries = fork[key].map(normalizeEntry).filter(Boolean);
+    return {
+      added: [...incomingSet].filter((entry) => !baseSet.has(entry) && !isUnderAnyFolder(entry, forkEntries)),
+      removed: [...baseSet].filter((entry) => !incomingSet.has(entry) && forkEntries.includes(entry))
+    };
+  };
+  return { pinned: diff("pinned"), ignored: diff("ignored") };
+}
+async function readConfigSourceAtRef(repoPath, ref) {
+  for (const path4 of CONFIG_FILE_PATHS) {
+    const source = await git(["show", `${ref}:${path4}`], repoPath, { ignoreErrors: true });
+    if (source) return source;
+  }
+  return null;
+}
+async function compareUpstreamOverrides(repoPath, mergeBaseRef, incomingRef, forkConfig) {
+  const [baseSource, incomingSource] = await Promise.all([
+    readConfigSourceAtRef(repoPath, mergeBaseRef),
+    readConfigSourceAtRef(repoPath, incomingRef)
+  ]);
+  if (baseSource === incomingSource) return void 0;
+  const base = baseSource === null ? null : parseOverrideLists(baseSource);
+  if (!base) return { kind: "unreadable", side: "base" };
+  const incoming = incomingSource === null ? null : parseOverrideLists(incomingSource);
+  if (!incoming) return { kind: "unreadable", side: "incoming" };
+  const fork = {
+    pinned: forkConfig.overrides?.pinned ?? [],
+    ignored: forkConfig.overrides?.ignored ?? []
+  };
+  const changes = diffOverrideLists(base, incoming, fork);
+  const count = LIST_KEYS.reduce((n, key) => n + changes[key].added.length + changes[key].removed.length, 0);
+  return count > 0 ? { kind: "changes", ...changes } : void 0;
+}
+
 // src/services/analyze-core.ts
+function isReportableIgnored(filePath) {
+  return !isManagedFile(filePath) && !isGeneratedFile(filePath);
+}
 async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predicates, onProgress) {
   onProgress?.("collecting file hashes (batch)...");
   const [forkHashes, upstreamHashes, baseHashes] = await Promise.all([
@@ -1870,6 +2200,7 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
         status = "renamed";
         renamedFrom = oldPath;
       }
+      const upstreamOnly2 = fileIsIgnored && !forkModifiedOld && isReportableIgnored(filePath);
       analyzedFiles.push({
         path: filePath,
         status,
@@ -1878,7 +2209,8 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
         existsInFork: inFork,
         existsInUpstream: true,
         renamedFrom,
-        upstreamChanged: upstreamChanged2
+        upstreamChanged: upstreamChanged2,
+        upstreamOnly: upstreamOnly2 || void 0
       });
       continue;
     }
@@ -1913,6 +2245,7 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
       }
     }
     const upstreamChanged = (fileIsPinned || fileIsIgnored) && inUpstream && upstreamHash !== baseHash && forkHash !== baseHash;
+    const upstreamOnly = fileIsIgnored && isReportableIgnored(filePath) && upstreamHash !== baseHash && forkHash === baseHash;
     analyzedFiles.push({
       path: filePath,
       status,
@@ -1920,7 +2253,8 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
       isPinned: fileIsPinned,
       existsInFork: inFork,
       existsInUpstream: inUpstream,
-      upstreamChanged: upstreamChanged || void 0
+      upstreamChanged: upstreamChanged || void 0,
+      upstreamOnly: upstreamOnly || void 0
     });
   }
   const flagged = analyzedFiles.filter((file) => file.upstreamChanged && !renamedProtected.has(file.path));
@@ -2209,6 +2543,9 @@ async function prepareUpstream(config, onProgress, onStep) {
   }
   config.upstreamRef = upstreamRef;
   onStep?.("remote configured", `${releaseTag ?? upstreamRef} \u2192 ${config.settings.upstreamUrl}`);
+  const cliRange = await readUpstreamCliRange(forkPath, upstreamRef);
+  const cliMismatch = cliRange ? cliVersionMismatch(VERSION, cliRange) : null;
+  if (cliMismatch) throw new Error(cliMismatch);
   onProgress?.("checking sync base...");
   await ensureSyncBase(forkPath, "HEAD", upstreamRef);
   const upstreamGitHubUrl = getGitHubBaseUrl(config.settings.upstreamUrl) ?? void 0;
@@ -2236,9 +2573,52 @@ function resultMeta(config, ctx) {
     upstreamCommits: ctx.upstreamCommits
   };
 }
+async function upstreamOnlyReports(config, ctx, files) {
+  const { forkPath } = config;
+  try {
+    const [baseSha, upstreamSha, upstreamOverrides] = await Promise.all([
+      getShortSha(forkPath, ctx.mergeBase),
+      // the commit, not an annotated release tag object
+      getShortSha(forkPath, ctx.upstreamCommit.hash),
+      compareUpstreamOverrides(forkPath, ctx.mergeBase, ctx.upstreamRef, config)
+    ]);
+    return {
+      upstreamDiffRange: `${baseSha}..${upstreamSha}`,
+      upstreamOverrides,
+      ignoredUpstreamChanges: groupIgnoredUpstreamChanges(files, config.overrides?.ignored ?? [])
+    };
+  } catch {
+    return {};
+  }
+}
+async function readNotesInRange(config, ctx) {
+  const { forkPath } = config;
+  try {
+    const aggressive = config.hard === true || config.unpinned === true;
+    const syncBase = aggressive ? (await getEffectiveMergeBase(forkPath, "HEAD", ctx.upstreamRef)).base : ctx.mergeBase;
+    const [total, arrived, pending] = await Promise.all([
+      listNoteIds(forkPath, ctx.upstreamRef),
+      arrivedNoteIds(forkPath, syncBase, ctx.upstreamRef),
+      readPending(forkPath, syncBase)
+    ]);
+    return { total: total.length, arrived, pending: [.../* @__PURE__ */ new Set([...pending, ...arrived])] };
+  } catch {
+    return void 0;
+  }
+}
+function notesResult(notes) {
+  return notes ? { migrationNotes: { total: notes.total, arrived: notes.arrived, open: notes.pending.length } } : {};
+}
+async function removeUpstreamOnlyCopy(forkPath, onStep) {
+  if (!existsSync7(join11(forkPath, NOTES_DIR))) return;
+  await git(["rm", "-r", "-q", "--ignore-unmatch", "--", NOTES_DIR], forkPath);
+  await rm2(join11(forkPath, NOTES_DIR), { recursive: true, force: true });
+  onStep?.("migration notes", `removed ${NOTES_DIR}/: notes stay upstream, list them with pnpm cella migrate`);
+}
 async function runSyncMerge(config, ctx, onProgress, onStep) {
   const { forkPath } = config;
   const { upstreamRef, releaseTag, mergeBase, upstreamGitHubUrl, upstreamCommit } = ctx;
+  const notes = await readNotesInRange(config, ctx);
   const { remainingConflicts, analyzedFiles, autoMergedFiles, protectedConflicts } = await applyDirectMerge(
     forkPath,
     upstreamRef,
@@ -2265,6 +2645,11 @@ async function runSyncMerge(config, ctx, onProgress, onStep) {
     await storeLastSyncRef(forkPath, upstreamCommit.hash);
     await writeSyncManifest(forkPath, syncManifest);
     await stagePath(forkPath, MANIFEST_FILE);
+    if (notes) {
+      await writePending(forkPath, notes.pending);
+      await stagePath(forkPath, PENDING_FILE);
+    }
+    await removeUpstreamOnlyCopy(forkPath, onStep);
   };
   if (remainingConflicts.length > 0) {
     await recordSyncPoint();
@@ -2287,12 +2672,15 @@ async function runSyncMerge(config, ctx, onProgress, onStep) {
     conflicts: remainingConflicts,
     autoMergedFiles,
     protectedConflicts,
-    ...resultMeta(config, ctx)
+    ...resultMeta(config, ctx),
+    ...await upstreamOnlyReports(config, ctx, analyzedFiles),
+    ...notesResult(notes)
   };
 }
 async function runAnalyzePreview(config, ctx, onProgress, onStep) {
   const { forkPath } = config;
   const worktreePath = getWorktreePath(forkPath);
+  const notes = await readNotesInRange(config, ctx);
   onProgress?.("creating worktree in temp directory...");
   await createWorktree(forkPath, worktreePath, "HEAD");
   onStep?.("worktree created", worktreePath);
@@ -2314,6 +2702,7 @@ async function runAnalyzePreview(config, ctx, onProgress, onStep) {
     onProgress
   );
   await enrichChangeInfo(forkPath, analyzedFiles, ctx.mergeBase, "HEAD", ctx.upstreamRef);
+  const reports = await upstreamOnlyReports(config, ctx, analyzedFiles);
   onStep?.("analysis complete", `${analyzedFiles.length} files analyzed, dry run \u2014 no changes applied`);
   onProgress?.("cleaning up worktree...");
   await cleanupWorktree(forkPath, worktreePath);
@@ -2324,7 +2713,9 @@ async function runAnalyzePreview(config, ctx, onProgress, onStep) {
     // For analyze mode, count diverged files as potential conflicts
     conflicts: analyzedFiles.filter((f) => f.status === "diverged").map((f) => f.path),
     protectedConflicts: analyzedFiles.filter((f) => f.upstreamChanged).map((f) => f.path),
-    ...resultMeta(config, ctx)
+    ...resultMeta(config, ctx),
+    ...reports,
+    ...notesResult(notes)
   };
 }
 async function runMergeEngine(config, options) {
@@ -2342,16 +2733,164 @@ async function runMergeEngine(config, options) {
   }
 }
 
+// src/services/migrate.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { mkdir as mkdir4, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname4, join as join12 } from "path";
+var EXTRACT_DIR = "node_modules/.cache/cella/migrations";
+async function resolveNotesRef(config) {
+  const { forkPath } = config;
+  const ref = await getStoredSyncRef(forkPath) ?? await readManifestBaseAtRef(forkPath, "HEAD");
+  if (!ref) return null;
+  const present = async () => !!await git(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], forkPath, { ignoreErrors: true });
+  if (!await present()) {
+    await ensureRemote(forkPath, DEFAULT_UPSTREAM_REMOTE, config.settings.upstreamUrl);
+    await fetch2(forkPath, DEFAULT_UPSTREAM_REMOTE);
+    if (!await present())
+      throw new Error(`upstream commit ${ref.slice(0, 7)} is not reachable from '${DEFAULT_UPSTREAM_REMOTE}'`);
+  }
+  return ref;
+}
+async function readNotesStatus(config) {
+  try {
+    const ref = await resolveNotesRef(config);
+    if (!ref) return null;
+    const [ids, pending] = await Promise.all([listNoteIds(config.forkPath, ref), readPending(config.forkPath, ref)]);
+    return ids.length > 0 || pending.length > 0 ? { total: ids.length, open: pending.length } : null;
+  } catch {
+    return null;
+  }
+}
+async function printMigrationNotesLine(config, result) {
+  const notes = result?.migrationNotes;
+  if (notes) {
+    if (notes.total === 0) return;
+    console.info();
+    console.info(
+      colors_default.dim(formatNotesLine(notes.total, notes.open, notes.arrived.length, { dryRun: config.service === "analyze" }))
+    );
+    return;
+  }
+  const status = await readNotesStatus(config);
+  if (!status) return;
+  console.info();
+  console.info(colors_default.dim(formatNotesLine(status.total, status.open)));
+}
+function toJson(note, url, open) {
+  return { ...note, kind: note.codemod ? "codemod" : "manual", open, url: url ?? null };
+}
+function printNote(index, note, url) {
+  const tags = [
+    note.codemod ? "codemod" : "manual",
+    note.syncBreaking ? "sync-breaking" : null,
+    note.clientCacheBump ? "cache-bump" : null
+  ].filter(Boolean).join(", ");
+  console.info(`${index}. ${note.title}  ${colors_default.dim(`[${tags}]`)}`);
+  console.info(colors_default.dim(`   id:      ${note.id}`));
+  if (note.summary) console.info(`   ${note.summary}`);
+  console.info(colors_default.dim(`   read:    pnpm cella migrate --show ${note.id}`));
+  if (url) console.info(colors_default.dim(`            ${url}`));
+  if (note.codemod) console.info(colors_default.dim(`   codemod: pnpm cella migrate --extract ${note.id}`));
+  console.info();
+}
+async function extractNote(config, ref, id) {
+  const { forkPath } = config;
+  const note = await readNote(forkPath, ref, id);
+  if (!note) throw new Error(`no migration note '${id}' at upstream ${ref.slice(0, 7)}`);
+  const files = (await git(["ls-tree", "-r", "--name-only", `${ref}:${NOTES_DIR}/${id}`], forkPath)).split("\n").filter(Boolean);
+  const target = join12(EXTRACT_DIR, id);
+  for (const file of files) {
+    const content = execFileSync2("git", ["show", `${ref}:${NOTES_DIR}/${id}/${file}`], {
+      cwd: forkPath,
+      maxBuffer: 50 * 1024 * 1024
+    });
+    const path4 = join12(forkPath, target, file);
+    await mkdir4(dirname4(path4), { recursive: true });
+    await writeFile3(path4, content);
+  }
+  console.info(`${colors_default.green("\u2713")} extracted ${files.length} file(s) to ${target}/`);
+  console.info(colors_default.dim(`  the README's ${NOTES_DIR}/${id}/ paths are this folder.`));
+  if (note.codemod) console.info(colors_default.dim(`  pnpm exec tsx ${target}/${note.codemod} inventory ${note.roots.join(" ")}`));
+}
+async function markNotes(config, ref, pending, ids) {
+  const open = new Set(pending);
+  const unknown = ids.filter((id) => !open.has(id));
+  for (const id of ids) open.delete(id);
+  await writePending(config.forkPath, [...open]);
+  const marked = ids.length - unknown.length;
+  if (marked > 0) console.info(`${colors_default.green("\u2713")} recorded ${marked} note(s) as handled`);
+  if (unknown.length > 0) console.info(colors_default.dim(`not pending, left as is: ${unknown.join(", ")}`));
+  console.info(colors_default.dim(formatNotesLine((await listNoteIds(config.forkPath, ref)).length, open.size)));
+}
+async function runMigrate(config) {
+  const { forkPath } = config;
+  const ref = await resolveNotesRef(config);
+  if (!ref) {
+    console.info(colors_default.dim("no sync point recorded yet: migration notes start with the first `pnpm cella sync`."));
+    return;
+  }
+  const pending = await readPending(forkPath, ref);
+  const githubUrl = getGitHubBaseUrl(config.settings.upstreamUrl) ?? void 0;
+  const urlOf = (id) => noteUrl(githubUrl, ref, id);
+  if (config.mark?.length) return markNotes(config, ref, pending, config.mark);
+  if (config.extract) return extractNote(config, ref, config.extract);
+  if (config.show) {
+    const source = await git(["show", `${ref}:${NOTES_DIR}/${config.show}/README.md`], forkPath, {
+      ignoreErrors: true
+    });
+    if (!source) throw new Error(`no migration note '${config.show}' at upstream ${ref.slice(0, 7)}`);
+    const url = urlOf(config.show);
+    if (url) console.info(colors_default.dim(url));
+    console.info(source);
+    return;
+  }
+  const ids = config.all ? await listNoteIds(forkPath, ref) : pending;
+  const notes = (await Promise.all(ids.map((id) => readNote(forkPath, ref, id)))).map(
+    (note, i) => note ?? {
+      id: ids[i],
+      title: `${ids[i]} (no longer upstream)`,
+      summary: "",
+      syncBreaking: false,
+      clientCacheBump: false,
+      roots: [],
+      codemod: null
+    }
+  );
+  const total = (await listNoteIds(forkPath, ref)).length;
+  if (config.json) {
+    const open = new Set(pending);
+    const out = {
+      upstreamCommit: ref,
+      total,
+      open: pending.length,
+      notes: notes.map((note) => toJson(note, urlOf(note.id), open.has(note.id)))
+    };
+    writeStdout(JSON.stringify(out, null, 2));
+    return;
+  }
+  console.info(colors_default.dim(formatNotesLine(total, pending.length)));
+  if (notes.length === 0) return;
+  console.info();
+  for (const [i, note] of notes.entries()) printNote(i + 1, note, urlOf(note.id));
+  if (pending.length > 0) {
+    console.info(colors_default.dim("work each note's README, check with `pnpm check`, then record it:"));
+    console.info(colors_default.dim(`  pnpm cella migrate --mark ${pending.join(" ")}`));
+  }
+}
+
 // src/services/analyze.ts
 var scopeStatuses = {
   all: /* @__PURE__ */ new Set(["ahead", "drifted", "diverged"]),
   risk: /* @__PURE__ */ new Set(["drifted", "diverged"]),
   protected: /* @__PURE__ */ new Set(["ahead"])
 };
-function filterByScope(files, scope) {
+function filterByScope(result, scope) {
   const statuses = scopeStatuses[scope];
-  const includeProtectedBehind = scope !== "risk";
-  return files.filter((f) => statuses.has(f.status) || includeProtectedBehind && f.upstreamChanged === true);
+  if (scope === "risk") return result.files.filter((f) => statuses.has(f.status));
+  const overridesChanged = result.upstreamOverrides?.kind === "changes";
+  return result.files.filter(
+    (f) => statuses.has(f.status) || f.upstreamChanged === true || f.upstreamOnly === true || overridesChanged && f.path === CONFIG_FILE
+  );
 }
 function findTargetFile(files, targetPath) {
   const exact = files.find((f) => f.path === targetPath);
@@ -2378,7 +2917,7 @@ async function runAnalyze(config) {
     }
   });
   spinnerSuccess();
-  const scopedFiles = filterByScope(result.files, config.scope ?? "all");
+  const scopedFiles = filterByScope(result, config.scope ?? "all");
   if (config.diff) {
     const file = findTargetFile(scopedFiles, config.diff) ?? findTargetFile(result.files, config.diff);
     if (!file) throw new Error(`file not found in analysis results: ${config.diff}`);
@@ -2386,6 +2925,7 @@ async function runAnalyze(config) {
     return result;
   }
   if (config.json) {
+    const overrides = result.upstreamOverrides?.kind === "changes" ? result.upstreamOverrides : void 0;
     const out = scopedFiles.map((f) => ({
       path: f.path,
       status: f.status,
@@ -2395,7 +2935,10 @@ async function runAnalyze(config) {
       upstreamCommit: f.upstreamCommit ?? null,
       upstreamChanged: f.upstreamChanged ?? false,
       upstreamChangedLines: f.upstreamChangedLines ?? null,
-      upstreamLinesAbsent: f.upstreamLinesAbsent ?? null
+      upstreamLinesAbsent: f.upstreamLinesAbsent ?? null,
+      upstreamOnly: f.upstreamOnly ?? false,
+      // Only on the sync config: upstream override entries the fork config does not follow
+      upstreamOverrides: overrides && f.path === CONFIG_FILE ? { pinned: overrides.pinned, ignored: overrides.ignored } : null
     }));
     writeStdout(JSON.stringify(out, null, 2));
     return result;
@@ -2436,7 +2979,10 @@ async function runAnalyze(config) {
   };
   printAnalysisFileGroups(result.files, linkOptions);
   printSummary(result.summary, "analysis summary");
+  printIgnoredUpstreamChanges(result);
+  printUpstreamOverrideChanges(result);
   printMaskingPinWarning(result.files);
+  await printMigrationNotesLine(config, result);
   if (config.logFile) {
     const logPath = writeLogFile(config.forkPath, result.files);
     console.info();
@@ -3215,7 +3761,7 @@ async function checkOverrides(forkPath) {
 
 // src/services/contributions.ts
 import { readFileSync as readFileSync4 } from "fs";
-import { join as join13 } from "path";
+import { join as join16 } from "path";
 import {
   createPrompt,
   isDownKey,
@@ -3230,7 +3776,7 @@ import {
 import { select as select2 } from "@inquirer/prompts";
 
 // src/services/contrib-core.ts
-import { dirname as dirname3, join as join12, resolve as resolve3 } from "path";
+import { dirname as dirname5, join as join15, resolve as resolve4 } from "path";
 async function listFilesAtRef(repoPath, ref) {
   const raw = await git(["ls-tree", "-r", "--name-only", ref], repoPath);
   return new Set(raw.split("\n").filter(Boolean));
@@ -3246,10 +3792,10 @@ async function detectContributableFiles(repoPath, baseRef, forkRef, config, fork
   const baseFiles = await listFilesAtRef(repoPath, baseRef);
   const baseDirs = /* @__PURE__ */ new Set(["."]);
   for (const f of baseFiles) {
-    let dir = dirname3(f);
+    let dir = dirname5(f);
     while (dir !== ".") {
       baseDirs.add(dir);
-      dir = dirname3(dir);
+      dir = dirname5(dir);
     }
   }
   const files = [];
@@ -3262,7 +3808,7 @@ async function detectContributableFiles(repoPath, baseRef, forkRef, config, fork
     if (inCella && !inFork) {
       kind = "deleted";
     } else if (!inCella && inFork) {
-      if (!baseDirs.has(dirname3(file.path))) continue;
+      if (!baseDirs.has(dirname5(file.path))) continue;
       kind = "created";
     } else {
       kind = "modified";
@@ -3293,8 +3839,8 @@ async function readBlobInfo(repoPath, ref, filePath) {
 }
 async function buildContribBranch(repoPath, baseRef, forkRef, detection, forkName) {
   const branch = `contrib/${forkName}`;
-  const gitDir = resolve3(repoPath, await git(["rev-parse", "--git-dir"], repoPath));
-  const tmpIndex = join12(gitDir, `tmp-contrib-index-${forkName.replace(/[^\w.-]/g, "_")}`);
+  const gitDir = resolve4(repoPath, await git(["rev-parse", "--git-dir"], repoPath));
+  const tmpIndex = join15(gitDir, `tmp-contrib-index-${forkName.replace(/[^\w.-]/g, "_")}`);
   const indexEnv = { GIT_INDEX_FILE: tmpIndex };
   try {
     await git(["read-tree", baseRef], repoPath, { env: indexEnv });
@@ -3337,20 +3883,20 @@ ${commitBody}`;
 }
 
 // src/services/fork-utils.ts
-import { existsSync as existsSync7 } from "fs";
-import { dirname as dirname4, resolve as resolve4 } from "path";
+import { existsSync as existsSync9 } from "fs";
+import { dirname as dirname6, resolve as resolve5 } from "path";
 async function resolveForkBasePath(repoPath) {
   const commonDir = await git(["rev-parse", "--git-common-dir"], repoPath, { ignoreErrors: true });
-  return commonDir ? dirname4(resolve4(repoPath, commonDir)) : repoPath;
+  return commonDir ? dirname6(resolve5(repoPath, commonDir)) : repoPath;
 }
 function validateForkPath(fork, basePath, requireConfig = false) {
-  const resolvedPath = resolve4(basePath, fork.localPath);
-  if (!resolvedPath.startsWith(resolve4(basePath, ".."))) {
+  const resolvedPath = resolve5(basePath, fork.localPath);
+  if (!resolvedPath.startsWith(resolve5(basePath, ".."))) {
     return { fork, resolvedPath, valid: false, error: "path resolves outside parent directory" };
   }
-  if (!existsSync7(resolvedPath)) return { fork, resolvedPath, valid: false, error: "path does not exist" };
-  if (!existsSync7(`${resolvedPath}/.git`)) return { fork, resolvedPath, valid: false, error: "not a git repository" };
-  if (requireConfig && !existsSync7(`${resolvedPath}/${CONFIG_FILE}`)) {
+  if (!existsSync9(resolvedPath)) return { fork, resolvedPath, valid: false, error: "path does not exist" };
+  if (!existsSync9(`${resolvedPath}/.git`)) return { fork, resolvedPath, valid: false, error: "not a git repository" };
+  if (requireConfig && !existsSync9(`${resolvedPath}/${CONFIG_FILE}`)) {
     return { fork, resolvedPath, valid: false, error: `missing ${CONFIG_FILE}` };
   }
   return { fork, resolvedPath, valid: true };
@@ -3368,7 +3914,7 @@ async function showContribDiff(item, baseRef, cwd, forkName) {
   return openDiffInBrowser(patch.toString(), { filePath: item.path, srcLabel: "cella", dstLabel: forkName }, cwd);
 }
 function shouldApplyContributionsUnstaged(repoPath) {
-  return JSON.parse(readFileSync4(join13(repoPath, "package.json"), "utf8")).name === "cella";
+  return JSON.parse(readFileSync4(join16(repoPath, "package.json"), "utf8")).name === "cella";
 }
 var contribPrompt = createPrompt((config, done) => {
   const { pageSize = 20, baseRef, cwd, forkName } = config;
@@ -3713,7 +4259,7 @@ async function runContributions(config) {
 }
 
 // src/services/forks.ts
-import { resolve as resolve5 } from "path";
+import { resolve as resolve6 } from "path";
 import process8 from "process";
 import { Separator as Separator2, select as select4 } from "@inquirer/prompts";
 
@@ -3756,7 +4302,6 @@ function listOpenSyncPrs(cwd, prefix) {
 }
 function buildMergeArgs(ref, options = {}) {
   const args = ["pr", "merge", ref, "--squash"];
-  if (options.auto) args.push("--auto");
   if (options.deleteBranch) args.push("--delete-branch");
   return args;
 }
@@ -3768,12 +4313,12 @@ function closePr(cwd, ref) {
 }
 
 // src/services/packages.ts
-import { existsSync as existsSync9, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { join as join18 } from "path";
 
 // src/services/package-usage.ts
-import { existsSync as existsSync8, readFileSync as readFileSync5, statSync } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync5, statSync } from "fs";
+import { join as join17 } from "path";
 var MAX_FILE_BYTES = 1024 * 1024;
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -3789,7 +4334,7 @@ function readSearchable(filePath) {
 }
 function fileSource(forkPath, path4) {
   let text;
-  return { path: path4, label: path4, text: () => text ??= readSearchable(join14(forkPath, path4)) };
+  return { path: path4, label: path4, text: () => text ??= readSearchable(join17(forkPath, path4)) };
 }
 async function readScriptsAtRef(forkPath, ref, path4) {
   try {
@@ -3801,7 +4346,7 @@ async function readScriptsAtRef(forkPath, ref, path4) {
 async function scriptSources(forkPath, upstreamRef, baseRef, path4) {
   let forkScripts;
   try {
-    forkScripts = JSON.parse(readFileSync5(join14(forkPath, path4), "utf-8")).scripts ?? {};
+    forkScripts = JSON.parse(readFileSync5(join17(forkPath, path4), "utf-8")).scripts ?? {};
   } catch {
     return [];
   }
@@ -3811,9 +4356,9 @@ async function scriptSources(forkPath, upstreamRef, baseRef, path4) {
 }
 function binNames(forkPath, location, name) {
   const bareName = name.split("/").pop();
-  for (const dir of [join14(forkPath, location), forkPath]) {
-    const manifest = join14(dir, "node_modules", name, "package.json");
-    if (!existsSync8(manifest)) continue;
+  for (const dir of [join17(forkPath, location), forkPath]) {
+    const manifest = join17(dir, "node_modules", name, "package.json");
+    if (!existsSync10(manifest)) continue;
     try {
       const { bin } = JSON.parse(readFileSync5(manifest, "utf-8"));
       if (typeof bin === "string") return [bareName];
@@ -3855,26 +4400,6 @@ async function loadForkUsage(forkPath, upstreamRef, baseRef) {
 }
 
 // src/services/packages.ts
-function parseComparableVersion(version) {
-  const trimmed = version.trim();
-  if (trimmed === "" || trimmed === "*" || trimmed.includes("workspace:") || trimmed.includes("catalog:") || trimmed.includes("file:") || trimmed.includes("link:") || trimmed.includes("git+") || trimmed.includes("github:") || trimmed.includes("http://") || trimmed.includes("https://") || trimmed.includes("||")) {
-    return null;
-  }
-  const match = trimmed.match(
-    /^(?:\^|~|>=|<=|>|<|=)?\s*v?(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/
-  );
-  if (!match) return null;
-  return {
-    major: Number(match[1]),
-    minor: Number(match[2] ?? 0),
-    patch: Number(match[3] ?? 0)
-  };
-}
-function compareVersions(left, right) {
-  if (left.major !== right.major) return left.major - right.major;
-  if (left.minor !== right.minor) return left.minor - right.minor;
-  return left.patch - right.patch;
-}
 function isHigherVersion(upstreamVersion, forkVersion) {
   if (upstreamVersion === forkVersion) return false;
   const upCoerced = parseComparableVersion(upstreamVersion);
@@ -3993,7 +4518,7 @@ function safeMergePnpm(forkPnpm, upstreamPnpm, basePnpm) {
   return { merged, changed };
 }
 function readPackageJson(filePath) {
-  if (!existsSync9(filePath)) return null;
+  if (!existsSync11(filePath)) return null;
   try {
     return JSON.parse(readFileSync6(filePath, "utf-8"));
   } catch {
@@ -4031,13 +4556,13 @@ async function syncPackageJson(config, baseRef, usage, relativePath, keysToSync)
   const changes = [];
   const kept = [];
   const pkgRelPath = packageJsonPath(relativePath);
-  const pkgPath = join15(forkPath, pkgRelPath);
+  const pkgPath = join18(forkPath, pkgRelPath);
   const forkPkg = readPackageJson(pkgPath);
   const upstream = await readPackageJsonAtRef(forkPath, upstreamRef, relativePath);
   const basePkg = baseRef ? (await readPackageJsonAtRef(forkPath, baseRef, relativePath))?.data : void 0;
   if (!upstream) return { updated: false, changes, kept };
   if (!forkPkg) {
-    const workspaceArrived = relativePath !== "" && existsSync9(join15(forkPath, relativePath));
+    const workspaceArrived = relativePath !== "" && existsSync11(join18(forkPath, relativePath));
     if (basePkg || !workspaceArrived || isIgnored(pkgRelPath, config)) return { updated: false, changes, kept };
     writeFileSync4(pkgPath, upstream.raw.endsWith("\n") ? upstream.raw : `${upstream.raw}
 `, "utf-8");
@@ -4204,6 +4729,8 @@ async function runSync(config, options) {
     spinnerFail("sync completed with conflicts");
   }
   printSummary(result.summary, "merge summary");
+  printIgnoredUpstreamChanges(result);
+  printUpstreamOverrideChanges(result);
   printMaskingPinWarning(result.files);
   if (config.logFile) {
     const logPath = writeLogFile(config.forkPath, result.files);
@@ -4213,6 +4740,7 @@ async function runSync(config, options) {
   const stagedBranch = options?.stagedBranch && result.conflicts.length === 0 && hasStagedSyncChanges(result) ? options.stagedBranch : void 0;
   printSyncComplete(result, { stagedBranch });
   printFlagWarnings({ hard: config.hard, unpinned: config.unpinned });
+  await printMigrationNotesLine(config, result);
   return result;
 }
 var SYNC_PR_TITLE = "chore: sync upstream cella";
@@ -4229,7 +4757,7 @@ function qualifyPrRefs(subject, repoSlug) {
   return subject.replace(/(^|[^\w/])#(\d+)\b/g, `$1${repoSlug}#$2`);
 }
 function buildSyncPrBody(input) {
-  const { repoSlug, version, fromSha, toSha, commits, totalCount } = input;
+  const { repoSlug, version, fromSha, toSha, commits, totalCount, notes } = input;
   const githubUrl = repoSlug ? `https://github.com/${repoSlug}` : void 0;
   const short = (sha) => sha.slice(0, 7);
   const commitRef = (sha) => githubUrl ? `[\`${short(sha)}\`](${githubUrl}/commit/${sha})` : `\`${short(sha)}\``;
@@ -4244,6 +4772,19 @@ function buildSyncPrBody(input) {
       lines.push(`- ${commitRef(commit.hash)} ${qualifyPrRefs(commit.message, repoSlug)}`);
     }
   }
+  if (notes && notes.total > 0) {
+    const { total, open } = notes;
+    if (open.length === 0) lines.push("", `**Migration notes**: all ${total} handled.`);
+    else {
+      lines.push(
+        "",
+        `**Migration notes**: ${Math.max(0, total - open.length)} of ${total} handled, open (\`pnpm cella migrate\`):`,
+        ""
+      );
+      for (const note of open)
+        lines.push(`- ${note.url ? `[${note.title}](${note.url})` : note.title} (\`${note.id}\`)`);
+    }
+  }
   return `${lines.join("\n")}
 `;
 }
@@ -4259,7 +4800,20 @@ async function buildSyncPrBodyForBranch(forkPath, base) {
     skip: totalCount > PR_BODY_COMMIT_MAX ? totalCount - PR_BODY_COMMIT_MAX : 0,
     limit: PR_BODY_COMMIT_MAX
   }) : [];
-  return buildSyncPrBody({ repoSlug: manifest.upstream.repo, version, fromSha, toSha, commits, totalCount });
+  const notes = await readPrBodyNotes(forkPath, toSha, manifest.upstream.repo).catch(() => void 0);
+  return buildSyncPrBody({ repoSlug: manifest.upstream.repo, version, fromSha, toSha, commits, totalCount, notes });
+}
+async function readPrBodyNotes(forkPath, toSha, repoSlug) {
+  const githubUrl = repoSlug ? `https://github.com/${repoSlug}` : void 0;
+  const [ids, pending] = await Promise.all([listNoteIds(forkPath, toSha), readPending(forkPath, toSha)]);
+  const open = await Promise.all(
+    pending.map(async (id) => ({
+      id,
+      title: (await readNote(forkPath, toSha, id))?.title ?? id,
+      url: noteUrl(githubUrl, toSha, id)
+    }))
+  );
+  return { total: ids.length, open };
 }
 function printPrCreateStep(branch, base, title = SYNC_PR_TITLE) {
   console.info(colors_default.dim(`  gh pr create --base ${base} --head ${branch} --title "${title}" --fill`));
@@ -4293,22 +4847,12 @@ async function flattenSyncBranch(forkPath, branch, base) {
 function indentLines(text) {
   return text.split("\n").map((line) => `  ${line}`).join("\n");
 }
-function enableAutoMerge(forkPath, branch) {
-  console.info(colors_default.dim("enabling auto-merge (squash) once checks pass..."));
-  const merge2 = mergePrSquash(forkPath, branch, { auto: true, deleteBranch: true });
-  if (merge2.ok) return true;
-  console.info(colors_default.yellow("could not enable auto-merge (is it enabled for the repo?). merge it manually:"));
-  if (merge2.output) console.info(colors_default.dim(indentLines(merge2.output)));
-  console.info(colors_default.dim(`  gh pr merge ${branch} --squash --delete-branch`));
-  return false;
-}
 async function shipSyncBranch(config, branch) {
   const { forkPath, settings } = config;
   const base = resolveReleaseBase(settings);
   const flattened = await flattenSyncBranch(forkPath, branch, base);
   let prUrl;
   let prOpened = false;
-  let autoMergeEnabled = false;
   const headSubject = (await getCommitInfo(forkPath, "HEAD").catch(() => null))?.message;
   const prTitle = headSubject?.startsWith(SYNC_PR_TITLE) ? headSubject : SYNC_PR_TITLE;
   console.info(colors_default.dim(`pushing '${branch}' to origin...`));
@@ -4332,9 +4876,7 @@ async function shipSyncBranch(config, branch) {
     prUrl = extractFirstUrl(`${pr.stdout ?? ""}
 ${pr.stderr ?? ""}`);
     prOpened = pr.status === 0;
-    if (prOpened) {
-      if (config.directMerge) autoMergeEnabled = enableAutoMerge(forkPath, branch);
-    } else {
+    if (!prOpened) {
       console.info(colors_default.yellow("could not open the PR automatically (it may already exist). open it with:"));
       if (prUrl) console.info(colors_default.dim(`  ${prUrl}`));
       printPrCreateStep(branch, base, prTitle);
@@ -4350,12 +4892,12 @@ ${pr.stderr ?? ""}`);
   console.info();
   if (prUrl) {
     console.info(`${colors_default.green("\u2713")} Sync pull request ${prOpened ? "opened" : "ready"}`);
-    const status = autoMergeEnabled ? `auto-merge on \u2014 squashes into '${base}' when checks pass` : `branch pushed, back on '${base}'`;
-    console.info(colors_default.dim(`  ${prUrl} \xB7 ${status}`));
+    console.info(colors_default.dim(`  ${prUrl} \xB7 branch pushed, back on '${base}'`));
   } else {
     console.info(`${colors_default.green("\u2713")} Sync branch pushed`);
     console.info(colors_default.dim(`  '${branch}' is on origin, back on '${base}'`));
   }
+  await printMigrationNotesLine(config);
 }
 function finalizeWorkspace(forkPath) {
   for (const args of [["install"], ["check"]]) {
@@ -4404,6 +4946,7 @@ async function commitSyncMerge(config, branch) {
   console.info();
   console.info(colors_default.green(`committed the sync on '${branch}' as '${message}'.`));
   printTriageSteps(branch);
+  await printMigrationNotesLine(config);
 }
 function printTriageSteps(branch) {
   console.info(colors_default.dim(`staying on '${branch}' without pushing.`));
@@ -4595,7 +5138,7 @@ async function runForks(config) {
       console.error(colors_default.red(`fork '${config.fork}' not found in config`));
       return;
     }
-    const resolvedPath = resolve5(await resolveForkBasePath(config.forkPath), match.localPath);
+    const resolvedPath = resolve6(await resolveForkBasePath(config.forkPath), match.localPath);
     await syncFork(config, match, resolvedPath);
     return;
   }
@@ -4611,7 +5154,7 @@ async function runForks(config) {
     if (selectedPath === "_exit") {
       process8.exit(0);
     }
-    const resolvedForkPath = resolve5(forkBasePath, selectedPath);
+    const resolvedForkPath = resolve6(forkBasePath, selectedPath);
     const selectedFork = forks.find((f) => f.localPath === selectedPath);
     if (!selectedFork) {
       console.error(colors_default.red(`fork '${selectedPath}' not found in config`));
@@ -4623,8 +5166,8 @@ async function runForks(config) {
 }
 
 // src/services/stats.ts
-import { readFile as readFile2 } from "fs/promises";
-import { join as join17 } from "path";
+import { readFile as readFile3 } from "fs/promises";
+import { join as join20 } from "path";
 
 // src/utils/coverage-utils.ts
 import { spawnSync as spawnSync4 } from "child_process";
@@ -4718,7 +5261,7 @@ function printCoverageSummary(forkPath, options = {}) {
 // src/services/stats.ts
 var sourceExtensions = /* @__PURE__ */ new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs", "json", "jsonc", "css", "html"]);
 async function getWorkspacePackages(forkPath) {
-  const content = await readFile2(join17(forkPath, "pnpm-workspace.yaml"), "utf-8");
+  const content = await readFile3(join20(forkPath, "pnpm-workspace.yaml"), "utf-8");
   return parseYamlBlockList(content, "packages").map((pattern) => {
     if (pattern.endsWith("/*")) {
       const base = pattern.slice(0, -2);
@@ -4820,9 +5363,9 @@ function fmtPct(value, total) {
 function printStats(stats, verbose) {
   console.info();
   console.info(
-    `  ${colors_default.bold("source files")}  ${String(stats.total)}  ${colors_default.dim(`(${stats.skipped} non-source skipped)`)}`
+    `  ${colors_default.bold("code files".padEnd(13))}  ${String(stats.total)}  ${colors_default.dim(`(${[...sourceExtensions].join(" ")})`)}`
   );
-  console.info(`  ${colors_default.bold("lines of code")} ${colors_default.cyan(formatLoc(stats.totalLoc))}`);
+  console.info(`  ${colors_default.bold("lines of code")}  ${colors_default.cyan(formatLoc(stats.totalLoc))}`);
   console.info();
   const catEntries = [
     ["source & config", stats.categories.other],
@@ -4852,6 +5395,7 @@ function printStats(stats, verbose) {
       );
     }
   } else {
+    console.info(colors_default.dim("  source & config by package"));
     for (const [name, data] of Object.entries(stats.packages)) {
       const srcFiles = data.categories.other.files;
       const srcLoc = data.categories.other.loc;
@@ -4880,20 +5424,20 @@ async function runStats(forkPath, options = {}) {
 function getForkPath() {
   const envPath = getEnv("CELLA_FORK_PATH");
   if (envPath) {
-    const resolved = resolve6(envPath);
-    if (!existsSync11(resolved) || !statSync3(resolved).isDirectory()) {
+    const resolved = resolve7(envPath);
+    if (!existsSync13(resolved) || !statSync3(resolved).isDirectory()) {
       throw new Error(`CELLA_FORK_PATH is not a valid directory: ${resolved}`);
     }
     return resolved;
   }
   let cwd = process9.cwd();
   if (cwd.endsWith("/cli/cella") || cwd.endsWith("\\cli\\cella")) {
-    cwd = resolve6(cwd, "../..");
+    cwd = resolve7(cwd, "../..");
   }
   return cwd;
 }
 async function preflight(forkPath) {
-  if (!existsSync11(join18(forkPath, ".git"))) {
+  if (!existsSync13(join21(forkPath, ".git"))) {
     throw new Error(`not a git repository: ${forkPath}`);
   }
 }
@@ -4922,6 +5466,9 @@ async function main() {
         await runSyncCommand(config);
         break;
       }
+      case "migrate":
+        await runMigrate(config);
+        break;
       case "audit":
         await runAudit(config, { force: config.force, checkOverrides: config.checkOverrides });
         break;