create-windy 0.2.18 → 0.2.20

package/dist/cli.js

@@ -727,7 +727,7 @@ var helpText = `create-windy <项目名> [选项]
 `;
 
 // src/create-project.ts
-import { mkdir as mkdir4, readdir as readdir5, rm as rm4 } from "node:fs/promises";
+import { mkdir as mkdir4, readdir as readdir6, rm as rm4 } from "node:fs/promises";
 
 // src/commands.ts
 import { spawn } from "node:child_process";
@@ -920,16 +920,147 @@ import {
   copyFile,
   lstat as lstat4,
   mkdir as mkdir3,
-  readFile as readFile9,
-  readdir as readdir4,
+  readFile as readFile10,
+  readdir as readdir5,
   rm as rm3,
-  writeFile as writeFile8
+  writeFile as writeFile9
 } from "node:fs/promises";
-import { basename as basename3, extname as extname3, join as join9 } from "node:path";
+import { basename as basename3, extname as extname3, join as join10 } from "node:path";
 
 // src/customer-docker.ts
-import { readFile as readFile2, writeFile } from "node:fs/promises";
+import { readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join3 } from "node:path";
+
+// src/docker-copy-sync.ts
+import { readdir, readFile as readFile2, writeFile } from "node:fs/promises";
 import { join as join2 } from "node:path";
+var webDockerfilePath = "apps/web/Dockerfile";
+var webEntryDirectory = "apps/web";
+var depsCopyAnchor = "windy-copy:deps";
+var buildCopyAnchor = "windy-copy:build";
+async function listWorkspacePackages(root) {
+  const manifest = await readManifest(join2(root, "package.json"));
+  const packages = [];
+  for (const pattern of manifest.workspaces ?? []) {
+    if (!pattern.endsWith("/*")) {
+      throw new Error(`暂不支持的 workspace pattern: ${pattern}`);
+    }
+    const base = pattern.slice(0, -2);
+    const entries = await readdir(join2(root, base), {
+      withFileTypes: true
+    }).catch((error) => {
+      if (isMissing(error))
+        return [];
+      throw error;
+    });
+    for (const entry of entries) {
+      if (!entry.isDirectory())
+        continue;
+      const directory = `${base}/${entry.name}`;
+      const manifestPath = join2(root, directory, "package.json");
+      if (!await Bun.file(manifestPath).exists())
+        continue;
+      const value = await readManifest(manifestPath);
+      packages.push({
+        name: value.name,
+        directory,
+        dependencies: [
+          ...Object.keys(value.dependencies ?? {}),
+          ...Object.keys(value.devDependencies ?? {})
+        ]
+      });
+    }
+  }
+  return packages.sort((a, b) => a.directory.localeCompare(b.directory));
+}
+function workspaceDependencyClosure(packages, entryDirectory) {
+  const directoryByName = new Map;
+  const packageByDirectory = new Map;
+  for (const pkg of packages) {
+    if (pkg.name)
+      directoryByName.set(pkg.name, pkg.directory);
+    packageByDirectory.set(pkg.directory, pkg);
+  }
+  const visited = new Set([entryDirectory]);
+  const queue = [entryDirectory];
+  while (queue.length) {
+    const current = packageByDirectory.get(queue.shift());
+    if (!current)
+      continue;
+    for (const dependency of current.dependencies) {
+      const directory = directoryByName.get(dependency);
+      if (directory && !visited.has(directory)) {
+        visited.add(directory);
+        queue.push(directory);
+      }
+    }
+  }
+  return [...visited].sort((a, b) => a.localeCompare(b));
+}
+function dockerCopyLines(directories) {
+  return directories.map((directory) => `COPY ${directory} ${directory}`);
+}
+function dockerManifestCopyLines(directories) {
+  return directories.map((directory) => `COPY ${directory}/package.json ${directory}/package.json`);
+}
+function rewriteAnchoredSection(source, anchor, lines) {
+  const { begin, end } = locateAnchoredSection(source, anchor);
+  const all = source.split(`
+`);
+  return [...all.slice(0, begin + 1), ...lines, ...all.slice(end)].join(`
+`);
+}
+function hasCopyAnchors(source) {
+  return source.includes(`# ${depsCopyAnchor} begin`) && source.includes(`# ${buildCopyAnchor} begin`);
+}
+function syncWebDockerfileSource(source, workspaceDirectories, buildDirectories) {
+  const withDeps = rewriteAnchoredSection(source, depsCopyAnchor, dockerManifestCopyLines(workspaceDirectories));
+  return rewriteAnchoredSection(withDeps, buildCopyAnchor, dockerCopyLines(buildDirectories));
+}
+async function syncWebDockerfileInProject(root, options = {}) {
+  const path = join2(root, webDockerfilePath);
+  let source;
+  try {
+    source = await readFile2(path, "utf8");
+  } catch (error) {
+    if (isMissing(error))
+      return { synced: false, changed: false };
+    throw error;
+  }
+  if (!hasCopyAnchors(source)) {
+    if (!options.requireAnchors)
+      return { synced: false, changed: false };
+    throw new Error(`${webDockerfilePath} 缺少 # ${depsCopyAnchor} / # ${buildCopyAnchor} 锚点段，` + `请先按最新模板为 deps 与 build 阶段的 COPY 段添加锚点后再同步`);
+  }
+  const packages = await listWorkspacePackages(root);
+  const next = syncWebDockerfileSource(source, packages.map(({ directory }) => directory), workspaceDependencyClosure(packages, webEntryDirectory));
+  if (next !== source)
+    await writeFile(path, next);
+  return { synced: true, changed: next !== source };
+}
+function locateAnchoredSection(source, anchor) {
+  const beginMarker = `# ${anchor} begin`;
+  const endMarker = `# ${anchor} end`;
+  const lines = source.split(`
+`);
+  const begin = lines.indexOf(beginMarker);
+  const end = lines.indexOf(endMarker);
+  if (begin === -1 || end === -1 || end <= begin) {
+    throw new Error(`Dockerfile 缺少锚点段 ${beginMarker} ... ${endMarker}，请先迁移到锚点格式`);
+  }
+  if (lines.indexOf(beginMarker, begin + 1) !== -1 || lines.indexOf(endMarker, end + 1) !== -1) {
+    throw new Error(`Dockerfile 锚点段 ${anchor} 重复，请保留唯一一段`);
+  }
+  return { begin, end };
+}
+async function readManifest(path) {
+  return JSON.parse(await readFile2(path, "utf8"));
+}
+function isMissing(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+
+// src/customer-docker.ts
 var supplierWorkspaceCopies = [
   "COPY apps/license/package.json apps/license/package.json",
   "COPY apps/signing-service/package.json apps/signing-service/package.json",
@@ -937,11 +1068,12 @@ var supplierWorkspaceCopies = [
 ];
 var supplierWorkspacePaths = ["packages/license-sdk"];
 async function prepareCustomerDockerfiles(root) {
-  await Promise.all(["apps/server/Dockerfile", "apps/web/Dockerfile"].map(async (path) => {
-    const absolutePath = join2(root, path);
-    const source = await readFile2(absolutePath, "utf8");
-    await writeFile(absolutePath, rewriteCustomerDockerfile(source));
+  await Promise.all(["apps/server/Dockerfile", webDockerfilePath].map(async (path) => {
+    const absolutePath = join3(root, path);
+    const source = await readFile3(absolutePath, "utf8");
+    await writeFile2(absolutePath, rewriteCustomerDockerfile(source));
   }));
+  await syncWebDockerfileInProject(root, { requireAnchors: true });
 }
 function rewriteCustomerDockerfile(source) {
   const lines = source.split(`
@@ -953,8 +1085,8 @@ function rewriteCustomerDockerfile(source) {
 }
 
 // src/code-quality.ts
-import { readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join3 } from "node:path";
+import { readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join4 } from "node:path";
 var oxcStarterPolicy = [
   "- 生成时默认预装 Oxlint、Oxfmt、lint-staged 与 Husky。",
   "- 提交前自动格式化暂存文件；lint、typecheck 和 test 保留为显式命令。",
@@ -963,30 +1095,30 @@ var oxcStarterPolicy = [
 `);
 var noCodeQualityPolicy = "- 本项目生成时未引入 lint 或 format 工具；项目所有者可按团队需要自行选择。";
 async function reflectCodeQualityChoice(targetDirectory, includeOxc) {
-  const path = join3(targetDirectory, "AGENTS.md");
-  const source = await readFile3(path, "utf8");
+  const path = join4(targetDirectory, "AGENTS.md");
+  const source = await readFile4(path, "utf8");
   if (includeOxc)
     return;
   if (!source.includes(oxcStarterPolicy)) {
     throw new Error("无法同步 --no-oxc 的项目开发约束");
   }
-  await writeFile2(path, source.replace(oxcStarterPolicy, noCodeQualityPolicy));
+  await writeFile3(path, source.replace(oxcStarterPolicy, noCodeQualityPolicy));
 }
 
 // src/license-files.ts
-import { mkdir, readFile as readFile4, rm, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname, join as join4, resolve as resolve2 } from "node:path";
+import { mkdir, readFile as readFile5, rm, writeFile as writeFile4 } from "node:fs/promises";
+import { dirname, join as join5, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
 var packageRoot = resolve2(dirname(fileURLToPath(import.meta.url)), "..");
 var apacheLicensePath = resolve2(packageRoot, "LICENSE");
 var windyLicensePath = ".windy/licenses/WINDY-APACHE-2.0.txt";
 async function applyWindyBaseLicense(targetDirectory) {
-  const target = join4(targetDirectory, windyLicensePath);
+  const target = join5(targetDirectory, windyLicensePath);
   await mkdir(dirname(target), { recursive: true });
-  await writeFile3(target, await readFile4(apacheLicensePath));
+  await writeFile4(target, await readFile5(apacheLicensePath));
 }
 async function applyProjectLicense(targetDirectory, license, holder, year = new Date().getFullYear()) {
-  const target = join4(targetDirectory, "LICENSE");
+  const target = join5(targetDirectory, "LICENSE");
   if (license === "UNLICENSED") {
     await rm(target, { force: true });
     return;
@@ -996,11 +1128,11 @@ async function applyProjectLicense(targetDirectory, license, holder, year = new
     if (!owner)
       throw new Error("选择 MIT 时必须填写许可证权利人名称");
     await mkdir(targetDirectory, { recursive: true });
-    await writeFile3(target, mitLicense(year, owner));
+    await writeFile4(target, mitLicense(year, owner));
     return;
   }
   await mkdir(targetDirectory, { recursive: true });
-  await writeFile3(target, await readFile4(apacheLicensePath));
+  await writeFile4(target, await readFile5(apacheLicensePath));
 }
 function mitLicense(year, holder) {
   return `MIT License
@@ -1029,8 +1161,8 @@ SOFTWARE.
 
 // src/managed-files.ts
 import { createHash } from "node:crypto";
-import { lstat, readdir, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join5, relative, sep } from "node:path";
+import { lstat, readdir as readdir2, readFile as readFile6, writeFile as writeFile5 } from "node:fs/promises";
+import { join as join6, relative, sep } from "node:path";
 var managedFilesManifestPath = ".windy/files.json";
 var ignoredDirectoryNames = new Set([".git", "node_modules", "dist"]);
 var ignoredFiles = new Set([
@@ -1040,6 +1172,7 @@ var ignoredFiles = new Set([
 ]);
 var projectOwnedRoots = [
   "apps/web/src/app",
+  "apps/server/src/installed-business-modules.ts",
   "apps/server/src/work-order",
   "packages/example-work-order"
 ];
@@ -1048,13 +1181,18 @@ var sharedScaffoldRoots = [
   "AGENTS.md",
   ".env.example",
   "docker-compose.yml",
+  "drizzle.config.ts",
+  "apps/server/Dockerfile",
+  "apps/server/src/index.ts",
+  "apps/web/Dockerfile",
   "apps/web/src/layout",
-  "apps/web/src/router"
+  "apps/web/src/router",
+  "packages/database/src/schema/index.ts"
 ];
 async function writeManagedFilesManifest(targetDirectory, generatorVersion) {
   const paths = await collectFiles(targetDirectory);
   const files = await Promise.all(paths.map(async (path) => {
-    const content = await readFile5(join5(targetDirectory, path));
+    const content = await readFile6(join6(targetDirectory, path));
     return {
       path,
       ownership: classifyOwnership(path),
@@ -1067,11 +1205,11 @@ async function writeManagedFilesManifest(targetDirectory, generatorVersion) {
     algorithm: "sha256",
     files
   };
-  await writeFile4(join5(targetDirectory, managedFilesManifestPath), `${JSON.stringify(manifest, null, 2)}
+  await writeFile5(join6(targetDirectory, managedFilesManifestPath), `${JSON.stringify(manifest, null, 2)}
 `);
 }
 async function readManagedFilesManifest(targetDirectory) {
-  const parsed = JSON.parse(await readFile5(join5(targetDirectory, managedFilesManifestPath), "utf8"));
+  const parsed = JSON.parse(await readFile6(join6(targetDirectory, managedFilesManifestPath), "utf8"));
   if (!isManagedFilesManifest(parsed)) {
     throw new Error("受管文件清单无效，无法安全更新");
   }
@@ -1092,10 +1230,10 @@ async function collectFiles(root) {
   await visit(root, files);
   return files.sort();
   async function visit(directory, output) {
-    for (const name of (await readdir(directory)).sort()) {
+    for (const name of (await readdir2(directory)).sort()) {
       if (ignoredDirectoryNames.has(name))
         continue;
-      const path = join5(directory, name);
+      const path = join6(directory, name);
       const metadata = await lstat(path);
       if (metadata.isSymbolicLink())
         continue;
@@ -1129,8 +1267,8 @@ function isManagedFilesManifest(value) {
 }
 
 // src/module-materializer.ts
-import { lstat as lstat2, readFile as readFile6, readdir as readdir2, rm as rm2, writeFile as writeFile5 } from "node:fs/promises";
-import { basename, extname, join as join6, relative as relative2, sep as sep2 } from "node:path";
+import { lstat as lstat2, readFile as readFile7, readdir as readdir3, rm as rm2, writeFile as writeFile6 } from "node:fs/promises";
+import { basename, extname, join as join7, relative as relative2, sep as sep2 } from "node:path";
 var textExtensions = new Set([
   ".css",
   ".html",
@@ -1163,18 +1301,18 @@ async function materializeSelectedModules(targetDirectory, selectedNames) {
     ...manifest.documentation,
     ...manifest.schemaFiles
   ]);
-  await Promise.all([...new Set(removedRoots)].map((path) => rm2(join6(targetDirectory, path), { recursive: true, force: true })));
+  await Promise.all([...new Set(removedRoots)].map((path) => rm2(join7(targetDirectory, path), { recursive: true, force: true })));
   await pruneWorkspaceReferences(targetDirectory, removedPackageNames, removedRoots);
 }
 async function stripModuleBlocks(root, selected) {
   for (const path of await collectFiles2(root)) {
     if (!textExtensions.has(extname(path)))
       continue;
-    const source = await readFile6(path, "utf8");
+    const source = await readFile7(path, "utf8");
     if (!source.includes("@windy-module"))
       continue;
     const output = stripTaggedSource(source, selected, relativePath(root, path));
-    await writeFile5(path, output);
+    await writeFile6(path, output);
   }
 }
 function stripTaggedSource(source, selected, path = "source") {
@@ -1207,11 +1345,11 @@ async function readRemovedPackageNames(root, roots) {
   const names = new Set;
   for (const packageRoot2 of roots) {
     try {
-      const value = JSON.parse(await readFile6(join6(root, packageRoot2, "package.json"), "utf8"));
+      const value = JSON.parse(await readFile7(join7(root, packageRoot2, "package.json"), "utf8"));
       if (value.name)
         names.add(value.name);
     } catch (error) {
-      if (!isMissing(error))
+      if (!isMissing2(error))
         throw error;
     }
   }
@@ -1220,7 +1358,7 @@ async function readRemovedPackageNames(root, roots) {
 async function pruneWorkspaceReferences(root, removedPackages, removedRoots) {
   for (const path of await collectFiles2(root)) {
     if (basename(path) === "package.json") {
-      const value = JSON.parse(await readFile6(path, "utf8"));
+      const value = JSON.parse(await readFile7(path, "utf8"));
       let changed = false;
       for (const section of ["dependencies", "devDependencies"]) {
         const dependencies = value[section];
@@ -1232,45 +1370,45 @@ async function pruneWorkspaceReferences(root, removedPackages, removedRoots) {
         }
       }
       if (changed)
-        await writeFile5(path, `${JSON.stringify(value, null, 2)}
+        await writeFile6(path, `${JSON.stringify(value, null, 2)}
 `);
       continue;
     }
     if (basename(path) !== "Dockerfile")
       continue;
-    const source = await readFile6(path, "utf8");
+    const source = await readFile7(path, "utf8");
     const output = source.split(`
 `).filter((line) => !removedRoots.some((root2) => line.includes(root2))).join(`
 `);
     if (output !== source)
-      await writeFile5(path, output);
+      await writeFile6(path, output);
   }
 }
 async function pruneDatabaseArtifacts(root, tableNames, statementTokens) {
   if (!tableNames.length && !statementTokens.length)
     return;
   const tablePatterns = tableNames.map((name) => new RegExp(`(?:"${escapeRegExp(name)}"|\\b${escapeRegExp(name)}\\b)`));
-  const drizzleRoot = join6(root, "packages/database/drizzle");
+  const drizzleRoot = join7(root, "packages/database/drizzle");
   try {
     for (const path of await collectFiles2(drizzleRoot)) {
       if (path.endsWith(".sql")) {
-        const source = await readFile6(path, "utf8");
+        const source = await readFile7(path, "utf8");
         const statements = source.split("--> statement-breakpoint").map((statement) => statement.trim()).filter(Boolean).filter((statement) => !tablePatterns.some((pattern) => pattern.test(statement)) && !statementTokens.some((token) => statement.includes(token)));
-        await writeFile5(path, statements.length ? `${statements.join(`
+        await writeFile6(path, statements.length ? `${statements.join(`
 --> statement-breakpoint
 `)}
 ` : `-- 此 migration 的模块未被当前项目选择。
 `);
       } else if (path.endsWith("_snapshot.json")) {
-        const snapshot = JSON.parse(await readFile6(path, "utf8"));
+        const snapshot = JSON.parse(await readFile7(path, "utf8"));
         for (const name of tableNames)
           delete snapshot.tables?.[`public.${name}`];
-        await writeFile5(path, `${JSON.stringify(snapshot, null, 2)}
+        await writeFile6(path, `${JSON.stringify(snapshot, null, 2)}
 `);
       }
     }
   } catch (error) {
-    if (!isMissing(error))
+    if (!isMissing2(error))
       throw error;
   }
 }
@@ -1279,10 +1417,10 @@ async function collectFiles2(root) {
   await visit(root);
   return files.sort();
   async function visit(directory) {
-    for (const name of (await readdir2(directory)).sort()) {
+    for (const name of (await readdir3(directory)).sort()) {
       if ([".git", "node_modules", "dist"].includes(name))
         continue;
-      const path = join6(directory, name);
+      const path = join7(directory, name);
       const metadata = await lstat2(path);
       if (metadata.isSymbolicLink())
         continue;
@@ -1299,7 +1437,7 @@ function relativePath(root, path) {
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function isMissing(error) {
+function isMissing2(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
 
@@ -1598,7 +1736,8 @@ function createStarterPackage(source, projectName, includeOxc = true, projectLic
         prepare: "git rev-parse --git-dir >/dev/null 2>&1 || exit 0; husky"
       } : {},
       dev: "docker compose up",
-      "dev:build": "docker compose up --build",
+      "docker:sync": "create-windy sync-docker",
+      "dev:build": "bun run docker:sync && docker compose up --build",
       ...generatorVersion ? { windy: "create-windy" } : {},
       "dev:web": "bun run --cwd apps/web dev",
       "dev:server": "bun run --cwd apps/server dev",
@@ -1719,21 +1858,21 @@ var excludedRuntimeFiles = new Set([
 ]);
 
 // src/provenance.ts
-import { mkdir as mkdir2, readFile as readFile7, writeFile as writeFile6 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { mkdir as mkdir2, readFile as readFile8, writeFile as writeFile7 } from "node:fs/promises";
+import { join as join8 } from "node:path";
 var templateMetadataFile = ".windy-template.json";
 var generationMetadataFile = ".windy/generation.json";
 async function readTemplateMetadata(sourceRoot) {
-  const path = join7(sourceRoot, templateMetadataFile);
-  const parsed = JSON.parse(await readFile7(path, "utf8"));
+  const path = join8(sourceRoot, templateMetadataFile);
+  const parsed = JSON.parse(await readFile8(path, "utf8"));
   if (!isTemplateMetadata(parsed)) {
     throw new Error("create-windy 模板来源元数据无效");
   }
   return parsed;
 }
 async function readGenerationProvenance(targetDirectory) {
-  const path = join7(targetDirectory, generationMetadataFile);
-  const parsed = JSON.parse(await readFile7(path, "utf8"));
+  const path = join8(targetDirectory, generationMetadataFile);
+  const parsed = JSON.parse(await readFile8(path, "utf8"));
   if (!isGenerationProvenance(parsed)) {
     throw new Error("当前目录不是受支持的 Windy 项目：Project Lock 无效");
   }
@@ -1765,9 +1904,9 @@ async function writeGenerationProvenance(targetDirectory, metadata, profile, sel
       includeOxc
     }
   };
-  const path = join7(targetDirectory, generationMetadataFile);
-  await mkdir2(join7(path, ".."), { recursive: true });
-  await writeFile6(path, `${JSON.stringify(provenance, null, 2)}
+  const path = join8(targetDirectory, generationMetadataFile);
+  await mkdir2(join8(path, ".."), { recursive: true });
+  await writeFile7(path, `${JSON.stringify(provenance, null, 2)}
 `);
 }
 function isTemplateMetadata(value) {
@@ -1792,8 +1931,8 @@ function isModuleVersion(value) {
 }
 
 // src/registry-dependencies.ts
-import { lstat as lstat3, readFile as readFile8, readdir as readdir3, writeFile as writeFile7 } from "node:fs/promises";
-import { basename as basename2, extname as extname2, join as join8 } from "node:path";
+import { lstat as lstat3, readFile as readFile9, readdir as readdir4, writeFile as writeFile8 } from "node:fs/promises";
+import { basename as basename2, extname as extname2, join as join9 } from "node:path";
 var dependencySections = [
   "dependencies",
   "devDependencies",
@@ -1821,14 +1960,14 @@ async function materializeRegistryDependencies(root, dependencies) {
       await rewritePackageJson(path, dependencies);
       continue;
     }
-    const source = await readFile8(path, "utf8");
+    const source = await readFile9(path, "utf8");
     const output = dependencies.reduce((value, dependency) => value.replaceAll(dependency.sourceName, dependency.name), source);
     if (output !== source)
-      await writeFile7(path, output);
+      await writeFile8(path, output);
   }
 }
 async function rewritePackageJson(path, registryDependencies) {
-  const value = JSON.parse(await readFile8(path, "utf8"));
+  const value = JSON.parse(await readFile9(path, "utf8"));
   let changed = false;
   for (const section of dependencySections) {
     const dependencies = value[section];
@@ -1843,7 +1982,7 @@ async function rewritePackageJson(path, registryDependencies) {
     }
   }
   if (changed)
-    await writeFile7(path, `${JSON.stringify(value, null, 2)}
+    await writeFile8(path, `${JSON.stringify(value, null, 2)}
 `);
 }
 async function collectFiles3(root) {
@@ -1851,10 +1990,10 @@ async function collectFiles3(root) {
   await visit(root);
   return files.sort();
   async function visit(directory) {
-    for (const name of (await readdir3(directory)).sort()) {
+    for (const name of (await readdir4(directory)).sort()) {
       if ([".git", "node_modules", "dist"].includes(name))
         continue;
-      const path = join8(directory, name);
+      const path = join9(directory, name);
       const metadata = await lstat3(path);
       if (metadata.isSymbolicLink())
         continue;
@@ -1878,39 +2017,39 @@ async function generateProject(input) {
   const selectedModules = input.selectedModules ?? templateMetadata.modules.filter(({ name }) => requestedIncludeExample || name !== "work-order").map(({ name }) => name);
   const includeExample = selectedModules.includes("work-order");
   for (const relativePath2 of generationTemplatePaths(true, includeOxc)) {
-    await copyTree(await resolveTemplateSource(input.sourceRoot, relativePath2), join9(input.targetDirectory, relativePath2));
+    await copyTree(await resolveTemplateSource(input.sourceRoot, relativePath2), join10(input.targetDirectory, relativePath2));
   }
   await materializeSelectedModules(input.targetDirectory, selectedModules);
   await materializeRegistryDependencies(input.targetDirectory, selectedModuleManifests(selectedModules).flatMap(({ registryDependencies }) => registryDependencies));
-  const packagePath = join9(input.targetDirectory, "package.json");
-  const packageJson = JSON.parse(await readFile9(packagePath, "utf8"));
-  await writeFile8(packagePath, `${JSON.stringify(createStarterPackage(packageJson, input.projectName, includeOxc, projectLicense, selectedModules, templateMetadata.generatorVersion), null, 2)}
+  const packagePath = join10(input.targetDirectory, "package.json");
+  const packageJson = JSON.parse(await readFile10(packagePath, "utf8"));
+  await writeFile9(packagePath, `${JSON.stringify(createStarterPackage(packageJson, input.projectName, includeOxc, projectLicense, selectedModules, templateMetadata.generatorVersion), null, 2)}
 `);
-  await writeFile8(join9(input.targetDirectory, "docker-compose.yml"), starterCompose);
-  await writeFile8(join9(input.targetDirectory, ".env.example"), environmentExample(includeExample));
-  await writeFile8(join9(input.targetDirectory, "README.md"), starterReadme(input.projectName, includeExample, includeOxc, projectLicense, selectedModules));
-  await writeFile8(join9(input.targetDirectory, "docs/README.md"), starterDocsReadme(selectedModules.includes("system.license")));
+  await writeFile9(join10(input.targetDirectory, "docker-compose.yml"), starterCompose);
+  await writeFile9(join10(input.targetDirectory, ".env.example"), environmentExample(includeExample));
+  await writeFile9(join10(input.targetDirectory, "README.md"), starterReadme(input.projectName, includeExample, includeOxc, projectLicense, selectedModules));
+  await writeFile9(join10(input.targetDirectory, "docs/README.md"), starterDocsReadme(selectedModules.includes("system.license")));
   await reflectCodeQualityChoice(input.targetDirectory, includeOxc);
   await applyWindyBaseLicense(input.targetDirectory);
   await applyProjectLicense(input.targetDirectory, projectLicense, input.licenseHolder);
   await prepareCustomerDockerfiles(input.targetDirectory);
   await writeGenerationProvenance(input.targetDirectory, templateMetadata, input.profile ?? starterProfile.key, selectedModules, includeOxc, projectLicense);
-  await rm3(join9(input.targetDirectory, "bun.lock"), { force: true });
+  await rm3(join10(input.targetDirectory, "bun.lock"), { force: true });
   await writeManagedFilesManifest(input.targetDirectory, templateMetadata.generatorVersion);
 }
 async function resolveTemplateSource(sourceRoot, relativePath2) {
-  const source = join9(sourceRoot, relativePath2);
+  const source = join10(sourceRoot, relativePath2);
   try {
     await lstat4(source);
     return source;
   } catch (error) {
-    if (!isMissing2(error))
+    if (!isMissing3(error))
       throw error;
   }
   const alias = npmTemplateAliases[relativePath2];
   if (!alias)
     return source;
-  return join9(sourceRoot, alias);
+  return join10(sourceRoot, alias);
 }
 async function assertGeneratedProjectIsClean(targetDirectory) {
   const violations = [];
@@ -1935,11 +2074,11 @@ function validateProjectName(projectName) {
 }
 async function assertTargetAvailable(targetDirectory) {
   try {
-    const entries = await readdir4(targetDirectory);
+    const entries = await readdir5(targetDirectory);
     if (entries.length)
       throw new Error("目标目录不是空目录");
   } catch (error) {
-    if (isMissing2(error))
+    if (isMissing3(error))
       return;
     throw error;
   }
@@ -1951,26 +2090,26 @@ async function copyTree(source, target) {
     return;
   if (metadata.isDirectory()) {
     await mkdir3(target, { recursive: true });
-    for (const child of await readdir4(source)) {
-      await copyTree(join9(source, child), join9(target, child));
+    for (const child of await readdir5(source)) {
+      await copyTree(join10(source, child), join10(target, child));
     }
     return;
   }
-  await mkdir3(join9(target, ".."), { recursive: true });
+  await mkdir3(join10(target, ".."), { recursive: true });
   await copyFile(source, target);
 }
 function shouldExclude(name) {
   return excludedNames.has(name) || excludedRuntimeFiles.has(name);
 }
 async function walk(directory, visit) {
-  for (const name of await readdir4(directory)) {
-    const path = join9(directory, name);
+  for (const name of await readdir5(directory)) {
+    const path = join10(directory, name);
     await visit(path);
     if ((await lstat4(path)).isDirectory())
       await walk(path, visit);
   }
 }
-function isMissing2(error) {
+function isMissing3(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
 
@@ -2043,9 +2182,9 @@ async function createProject(options, dependencies = {}) {
 }
 async function inspectTarget(path) {
   try {
-    return (await readdir5(path)).length === 0 ? "empty" : "non-empty";
+    return (await readdir6(path)).length === 0 ? "empty" : "non-empty";
   } catch (error) {
-    if (isMissing3(error))
+    if (isMissing4(error))
       return "missing";
     throw error;
   }
@@ -2067,7 +2206,7 @@ function stageError(stage, error) {
 function sanitizeReason(reason) {
   return reason.replace(/\b([A-Z][A-Z0-9_]*(?:PASSWORD|SECRET|TOKEN|DATABASE_URL)[A-Z0-9_]*)=\S+/g, "$1=[已隐藏]").replace(/:\/\/([^\s:/]+):([^\s@]+)@/g, "://$1:[已隐藏]@");
 }
-function isMissing3(error) {
+function isMissing4(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
 
@@ -3815,8 +3954,8 @@ import { rm as rm8 } from "node:fs/promises";
 import { resolve as resolve5 } from "node:path";
 
 // src/update/doctor.ts
-import { readFile as readFile11 } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { readFile as readFile12 } from "node:fs/promises";
+import { join as join12 } from "node:path";
 
 // src/update/process.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -3848,12 +3987,12 @@ import {
   access as access2,
   copyFile as copyFile2,
   mkdir as mkdir5,
-  readFile as readFile10,
+  readFile as readFile11,
   rm as rm5,
   rmdir,
-  writeFile as writeFile9
+  writeFile as writeFile10
 } from "node:fs/promises";
-import { dirname as dirname3, join as join10, resolve as resolve4, sep as sep3 } from "node:path";
+import { dirname as dirname3, join as join11, resolve as resolve4, sep as sep3 } from "node:path";
 var updateStatePath = ".windy/update-state.json";
 async function applyTransaction(plan) {
   if (plan.conflicts.length) {
@@ -3862,21 +4001,22 @@ async function applyTransaction(plan) {
   const changed = plan.files.filter(({ action }) => action === "create" || action === "update" || action === "delete");
   for (const file of changed)
     assertSafePath(file.path);
-  const backupDirectory = join10(plan.projectDirectory, ".windy/backups", plan.id);
+  const backupDirectory = join11(plan.projectDirectory, ".windy/backups", plan.id);
   const protectedPaths = new Set([
     ...changed.map(({ path: path2 }) => path2),
     ".windy/generation.json",
     ".windy/files.json",
+    "apps/web/Dockerfile",
     "bun.lock"
   ]);
   const backupEntries = [];
   for (const path2 of protectedPaths) {
-    const source = join10(plan.projectDirectory, path2);
+    const source = join11(plan.projectDirectory, path2);
     const existed = await exists(source);
     backupEntries.push({ path: path2, existed });
     if (!existed)
       continue;
-    const target = join10(backupDirectory, "files", path2);
+    const target = join11(backupDirectory, "files", path2);
     await mkdir5(dirname3(target), { recursive: true });
     await copyFile2(source, target);
   }
@@ -3889,7 +4029,7 @@ async function applyTransaction(plan) {
   await writeState(plan.projectDirectory, state);
   try {
     for (const file of changed) {
-      const target = join10(plan.projectDirectory, file.path);
+      const target = join11(plan.projectDirectory, file.path);
       if (file.action === "delete") {
         const existed = await exists(target);
         await rm5(target, { force: true });
@@ -3901,7 +4041,7 @@ async function applyTransaction(plan) {
       if (!file.content)
         throw new Error(`更新计划缺少文件内容：${file.path}`);
       await mkdir5(dirname3(target), { recursive: true });
-      await writeFile9(target, file.content);
+      await writeFile10(target, file.content);
     }
   } catch (error) {
     await restoreUpdateState(plan.projectDirectory, state);
@@ -3916,7 +4056,7 @@ async function applyTransaction(plan) {
 }
 async function readUpdateState(projectDirectory) {
   try {
-    const parsed = JSON.parse(await readFile10(join10(projectDirectory, updateStatePath), "utf8"));
+    const parsed = JSON.parse(await readFile11(join11(projectDirectory, updateStatePath), "utf8"));
     if (!isUpdateState(parsed))
       throw new Error("更新恢复状态无效，请人工检查 .windy 目录");
     return parsed;
@@ -3929,25 +4069,25 @@ async function readUpdateState(projectDirectory) {
 async function restoreUpdateState(projectDirectory, state) {
   for (const entry of state.entries) {
     assertSafePath(entry.path);
-    const target = join10(projectDirectory, entry.path);
+    const target = join11(projectDirectory, entry.path);
     if (!entry.existed) {
       await rm5(target, { force: true });
       continue;
     }
-    const backup = join10(state.backupDirectory, "files", entry.path);
+    const backup = join11(state.backupDirectory, "files", entry.path);
     await mkdir5(dirname3(target), { recursive: true });
     await copyFile2(backup, target);
   }
-  await rm5(join10(projectDirectory, updateStatePath), { force: true });
+  await rm5(join11(projectDirectory, updateStatePath), { force: true });
   await rm5(state.backupDirectory, { recursive: true, force: true });
 }
 async function clearUpdateState(projectDirectory) {
-  await rm5(join10(projectDirectory, updateStatePath), { force: true });
+  await rm5(join11(projectDirectory, updateStatePath), { force: true });
 }
 async function writeState(projectDirectory, state) {
-  const path2 = join10(projectDirectory, updateStatePath);
+  const path2 = join11(projectDirectory, updateStatePath);
   await mkdir5(dirname3(path2), { recursive: true });
-  await writeFile9(path2, `${JSON.stringify(state, null, 2)}
+  await writeFile10(path2, `${JSON.stringify(state, null, 2)}
 `);
 }
 async function exists(path2) {
@@ -4015,7 +4155,7 @@ async function diagnoseProject(projectDirectory, repair = false) {
     if (file.ownership === "project-owned")
       continue;
     try {
-      const changed = hashContent(await readFile11(join11(projectDirectory, file.path))) !== file.hash;
+      const changed = hashContent(await readFile12(join12(projectDirectory, file.path))) !== file.hash;
       if (!changed)
         continue;
       modifiedManagedFiles.push(file.path);
@@ -4063,7 +4203,9 @@ var recipes = [
   { id: "starter-0.2.14-to-0.2.15", from: "0.2.14", to: "0.2.15" },
   { id: "starter-0.2.15-to-0.2.16", from: "0.2.15", to: "0.2.16" },
   { id: "starter-0.2.16-to-0.2.17", from: "0.2.16", to: "0.2.17" },
-  { id: "starter-0.2.17-to-0.2.18", from: "0.2.17", to: "0.2.18" }
+  { id: "starter-0.2.17-to-0.2.18", from: "0.2.17", to: "0.2.18" },
+  { id: "starter-0.2.18-to-0.2.19", from: "0.2.18", to: "0.2.19" },
+  { id: "starter-0.2.19-to-0.2.20", from: "0.2.19", to: "0.2.20" }
 ];
 function resolveRecipeChain(sourceVersion, targetVersion) {
   if (sourceVersion === targetVersion)
@@ -4088,19 +4230,19 @@ function resolveRecipeChain(sourceVersion, targetVersion) {
 }
 
 // src/update/updater.ts
-import { mkdir as mkdir7, readFile as readFile14, rm as rm7, writeFile as writeFile11 } from "node:fs/promises";
-import { dirname as dirname4, join as join15 } from "node:path";
+import { mkdir as mkdir7, readFile as readFile16, rm as rm7, writeFile as writeFile12 } from "node:fs/promises";
+import { dirname as dirname4, join as join17 } from "node:path";
 
 // src/update/artifacts.ts
-import { mkdir as mkdir6, mkdtemp, readFile as readFile12 } from "node:fs/promises";
+import { mkdir as mkdir6, mkdtemp, readFile as readFile13 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { basename as basename4, join as join12 } from "node:path";
+import { basename as basename4, join as join13 } from "node:path";
 class PublishedArtifactProvider {
   async prepare(projectDirectory, provenance) {
-    const temporaryRoot = await mkdtemp(join12(tmpdir(), "windy-update-"));
+    const temporaryRoot = await mkdtemp(join13(tmpdir(), "windy-update-"));
     const projectName = await readProjectName2(projectDirectory);
-    const baseDirectory = join12(temporaryRoot, "base", projectName);
-    const targetDirectory = join12(temporaryRoot, "target", projectName);
+    const baseDirectory = join13(temporaryRoot, "base", projectName);
+    const targetDirectory = join13(temporaryRoot, "target", projectName);
     await generatePublishedBase(temporaryRoot, projectName, provenance, baseDirectory);
     await generateProject({
       sourceRoot: await resolveTemplateRoot(),
@@ -4117,7 +4259,7 @@ class PublishedArtifactProvider {
   }
 }
 async function generatePublishedBase(temporaryRoot, projectName, provenance, expectedDirectory) {
-  const parent = join12(temporaryRoot, "base");
+  const parent = join13(temporaryRoot, "base");
   await mkdir6(parent, { recursive: true });
   const args = [
     "--bun",
@@ -4141,18 +4283,18 @@ async function generatePublishedBase(temporaryRoot, projectName, provenance, exp
     }
   }
   await assertProcess("bunx", args, parent);
-  if (join12(parent, projectName) !== expectedDirectory) {
+  if (join13(parent, projectName) !== expectedDirectory) {
     throw new Error("历史 artifact 生成目录异常");
   }
 }
 async function readProjectName2(projectDirectory) {
-  const source = JSON.parse(await readFile12(join12(projectDirectory, "package.json"), "utf8"));
+  const source = JSON.parse(await readFile13(join13(projectDirectory, "package.json"), "utf8"));
   return source.name || basename4(projectDirectory);
 }
 
 // src/update/planner.ts
-import { access as access3, readFile as readFile13 } from "node:fs/promises";
-import { join as join14 } from "node:path";
+import { access as access3, readFile as readFile15 } from "node:fs/promises";
+import { join as join16 } from "node:path";
 
 // src/update/known-repairs.ts
 var wrongTextVersions = new Set(["0.2.12", "0.2.13"]);
@@ -4195,31 +4337,415 @@ function normalizeTableCell(cell) {
 }
 
 // src/update/merge.ts
-import { mkdtemp as mkdtemp2, rm as rm6, writeFile as writeFile10 } from "node:fs/promises";
+import { mkdtemp as mkdtemp2, rm as rm6, writeFile as writeFile11 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 async function mergeTextFile(base, ours, theirs) {
-  const root = await mkdtemp2(join13(tmpdir2(), "windy-merge-"));
+  const root = await mkdtemp2(join14(tmpdir2(), "windy-merge-"));
   try {
-    const oursPath = join13(root, "ours");
-    const basePath = join13(root, "base");
-    const theirsPath = join13(root, "theirs");
+    const oursPath = join14(root, "ours");
+    const basePath = join14(root, "base");
+    const theirsPath = join14(root, "theirs");
     await Promise.all([
-      writeFile10(oursPath, ours),
-      writeFile10(basePath, base),
-      writeFile10(theirsPath, theirs)
+      writeFile11(oursPath, ours),
+      writeFile11(basePath, base),
+      writeFile11(theirsPath, theirs)
     ]);
     const result = await captureProcess("git", ["merge-file", "-p", "--diff3", oursPath, basePath, theirsPath], root);
     if (result.code === 0) {
       return { content: new TextEncoder().encode(result.stdout) };
     }
-    if (result.code === 1)
-      return { conflict: "三方合并存在重叠修改" };
+    if (result.code === 1) {
+      const resolved = resolveConservativeConflicts(result.stdout);
+      return resolved ? { content: new TextEncoder().encode(resolved) } : { conflict: "三方合并存在重叠修改" };
+    }
     return { conflict: result.stderr.trim() || "git merge-file 执行失败" };
   } finally {
     await rm6(root, { recursive: true, force: true });
   }
 }
+function resolveConservativeConflicts(content) {
+  const lines = content.split(`
+`);
+  const output = [];
+  for (let index = 0;index < lines.length; index += 1) {
+    if (!lines[index]?.startsWith("<<<<<<< ")) {
+      output.push(lines[index] ?? "");
+      continue;
+    }
+    const baseMarker = lines.findIndex((line, candidate) => candidate > index && line.startsWith("||||||| "));
+    const separator = lines.indexOf("=======", baseMarker + 1);
+    const endMarker = lines.findIndex((line, candidate) => candidate > separator && line.startsWith(">>>>>>> "));
+    if (baseMarker < 0 || separator < 0 || endMarker < 0)
+      return;
+    const ours = lines.slice(index + 1, baseMarker);
+    const base = lines.slice(baseMarker + 1, separator);
+    const theirs = lines.slice(separator + 1, endMarker);
+    const resolved = resolveRegion(ours, base, theirs);
+    if (!resolved)
+      return;
+    output.push(...resolved);
+    index = endMarker;
+  }
+  return output.join(`
+`);
+}
+function resolveRegion(ours, base, theirs) {
+  const oursRebased = replaceSubsequence(ours, base, theirs);
+  if (oursRebased)
+    return oursRebased;
+  const theirsRebased = replaceSubsequence(theirs, base, ours);
+  if (theirsRebased)
+    return theirsRebased;
+  if (normalizeWhitespace(ours) === normalizeWhitespace(base))
+    return theirs;
+  if (normalizeWhitespace(theirs) === normalizeWhitespace(base))
+    return ours;
+  return applySemanticTokenEdits(ours, base, theirs) ?? mergeMarkdownTable(ours, base, theirs);
+}
+function replaceSubsequence(content, baseline, replacement) {
+  if (!baseline.length || baseline.length > content.length)
+    return;
+  const starts = [];
+  for (let index = 0;index <= content.length - baseline.length; index += 1) {
+    if (baseline.every((line, offset) => content[index + offset] === line)) {
+      starts.push(index);
+    }
+  }
+  if (starts.length !== 1)
+    return;
+  const start = starts[0] ?? 0;
+  return [
+    ...content.slice(0, start),
+    ...replacement,
+    ...content.slice(start + baseline.length)
+  ];
+}
+function normalizeWhitespace(lines) {
+  return lines.join(" ").replaceAll(/\s+/g, " ").trim();
+}
+function applySemanticTokenEdits(oursLines, baseLines, theirsLines) {
+  const oursText = oursLines.join(`
+`);
+  const baseText = baseLines.join(`
+`);
+  const theirsText = theirsLines.join(`
+`);
+  const ours = semanticTokens(oursText);
+  const base = semanticTokens(baseText);
+  const theirs = semanticTokens(theirsText);
+  let prefix = 0;
+  while (prefix < base.length && prefix < theirs.length && base[prefix]?.value === theirs[prefix]?.value) {
+    prefix += 1;
+  }
+  let suffix = 0;
+  while (suffix < base.length - prefix && suffix < theirs.length - prefix && base[base.length - 1 - suffix]?.value === theirs[theirs.length - 1 - suffix]?.value) {
+    suffix += 1;
+  }
+  const baseEnd = base.length - suffix;
+  const targetEnd = theirs.length - suffix;
+  const needle = base.slice(prefix, baseEnd).map(({ value }) => value);
+  if (!needle.length)
+    return;
+  const starts = findTokenSequence(ours, needle);
+  if (starts.length !== 1)
+    return;
+  const oursStart = starts[0] ?? 0;
+  const oursEnd = oursStart + needle.length - 1;
+  const targetFirst = theirs[prefix];
+  const targetLast = theirs[targetEnd - 1];
+  const replacement = targetFirst && targetLast ? theirsText.slice(targetFirst.start, targetLast.end) : "";
+  const merged = oursText.slice(0, ours[oursStart]?.start ?? 0) + replacement + oursText.slice(ours[oursEnd]?.end ?? 0);
+  return merged.split(`
+`);
+}
+function semanticTokens(content) {
+  return [...content.matchAll(/[A-Za-z0-9_@./:-]+|[^\s]/g)].map((match) => ({
+    value: match[0],
+    start: match.index,
+    end: match.index + match[0].length
+  }));
+}
+function findTokenSequence(tokens, needle) {
+  const starts = [];
+  for (let index = 0;index <= tokens.length - needle.length; index += 1) {
+    if (needle.every((value, offset) => tokens[index + offset]?.value === value)) {
+      starts.push(index);
+    }
+  }
+  return starts;
+}
+function mergeMarkdownTable(ours, base, theirs) {
+  if (![ours, base, theirs].every((rows) => rows.length === base.length && rows.every(isMarkdownTableRow))) {
+    return;
+  }
+  const parsed = [ours, base, theirs].map((rows) => rows.map(parseTableRow));
+  const [oursRows, baseRows, theirsRows] = parsed;
+  if (!oursRows || !baseRows || !theirsRows || !oursRows.every((cells, index) => cells.length === baseRows[index]?.length && cells.length === theirsRows[index]?.length)) {
+    return;
+  }
+  const merged = [];
+  for (let row = 0;row < baseRows.length; row += 1) {
+    const cells = [];
+    for (let column = 0;column < (baseRows[row]?.length ?? 0); column += 1) {
+      const baseCell = baseRows[row]?.[column] ?? "";
+      const oursCell = oursRows[row]?.[column] ?? "";
+      const theirsCell = theirsRows[row]?.[column] ?? "";
+      if (isTableSeparator(baseCell)) {
+        cells.push("---");
+      } else if (oursCell === baseCell || oursCell === theirsCell) {
+        cells.push(theirsCell);
+      } else if (theirsCell === baseCell) {
+        cells.push(oursCell);
+      } else {
+        return;
+      }
+    }
+    merged.push(`| ${cells.join(" | ")} |`);
+  }
+  return merged;
+}
+function isMarkdownTableRow(line) {
+  const trimmed = line.trim();
+  return trimmed.startsWith("|") && trimmed.endsWith("|");
+}
+function parseTableRow(line) {
+  return line.trim().slice(1, -1).split("|").map((cell) => cell.trim());
+}
+function isTableSeparator(cell) {
+  return /^:?-{3,}:?$/.test(cell);
+}
+
+// src/update/migration-reconciler.ts
+import { readFile as readFile14 } from "node:fs/promises";
+import { join as join15 } from "node:path";
+
+// src/update/snapshot-delta.ts
+function applySnapshotDelta(before, after, current, path2, conflicts, conflictPath) {
+  if (deepEqual(before, after))
+    return structuredClone(current);
+  if (!isRecord(before) || !isRecord(after) || !isRecord(current)) {
+    if (deepEqual(current, before) || deepEqual(current, after)) {
+      return structuredClone(after);
+    }
+    conflicts.push(`${conflictPath}：平台与业务同时修改 snapshot 节点 ${path2.join(".") || "<root>"}`);
+    return structuredClone(current);
+  }
+  const merged = structuredClone(current);
+  const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
+  for (const key of keys) {
+    if (path2.length === 0 && (key === "id" || key === "prevId"))
+      continue;
+    const nextPath = [...path2, key];
+    if (!(key in after)) {
+      if (!(key in current))
+        continue;
+      if (deepEqual(current[key], before[key]))
+        delete merged[key];
+      else
+        conflicts.push(`${conflictPath}：平台删除了业务已修改的 snapshot 节点 ${nextPath.join(".")}`);
+      continue;
+    }
+    if (!(key in before)) {
+      if (!(key in current) || deepEqual(current[key], after[key])) {
+        merged[key] = structuredClone(after[key]);
+      } else {
+        conflicts.push(`${conflictPath}：平台新增的 snapshot 节点已被业务占用 ${nextPath.join(".")}`);
+      }
+      continue;
+    }
+    merged[key] = applySnapshotDelta(before[key], after[key], current[key], nextPath, conflicts, conflictPath);
+  }
+  return merged;
+}
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function deepEqual(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+
+// src/update/migration-reconciler.ts
+var drizzleRoot = "packages/database/drizzle";
+var journalPath = `${drizzleRoot}/meta/_journal.json`;
+var migrationPattern = /^(\d{4})_(.+)$/;
+async function reconcileDrizzleMigrations(input) {
+  const journals = await readJournals(input);
+  if (!journals) {
+    return unchanged(input.targetManifest);
+  }
+  const { base, project, target } = journals;
+  const conflicts = [];
+  validateUniqueNames(base, "来源模板", conflicts);
+  validateUniqueNames(project, "当前项目", conflicts);
+  validateUniqueNames(target, "目标模板", conflicts);
+  if (conflicts.length) {
+    return { ...unchanged(input.targetManifest), conflicts };
+  }
+  const baseNames = new Set(base.entries.map(({ tag }) => stableName(tag)));
+  const projectNames = new Set(project.entries.map(({ tag }) => stableName(tag)));
+  const managedNames = new Set(input.sourceManifest.files.filter(({ path: path2 }) => isSqlMigration(path2)).map(({ path: path2 }) => stableName(path2.slice(drizzleRoot.length + 1, -4))));
+  const candidates = target.entries.filter(({ tag }) => !baseNames.has(stableName(tag)));
+  for (const { tag } of candidates) {
+    const name = stableName(tag);
+    if (projectNames.has(name) && !managedNames.has(name)) {
+      conflicts.push(`${journalPath}：平台 migration 名称与下游业务历史冲突 ${name}`);
+    }
+  }
+  const additions = candidates.filter(({ tag }) => !projectNames.has(stableName(tag)));
+  const contentOverrides = new Map;
+  const files = await preservePublishedHistory(input.sourceManifest, input.projectDirectory, contentOverrides);
+  const publishedPaths = new Set(files.map(({ path: path2 }) => path2));
+  files.push(...input.targetManifest.files.filter(({ path: path2 }) => !isDrizzleHistoryPath(path2)));
+  if (!additions.length) {
+    const journalContent2 = encodeJson(project);
+    contentOverrides.set(journalPath, journalContent2);
+    files.push(managedEntry(journalPath, journalContent2));
+    return result(input.targetManifest, files, contentOverrides, publishedPaths, conflicts);
+  }
+  let nextPrefix = highestPrefix(project) + 1;
+  let nextIndex = highestIndex(project) + 1;
+  let previousWhen = project.entries.at(-1)?.when ?? 0;
+  let currentSnapshot = await readLatestSnapshot(input.projectDirectory, project);
+  const mergedJournal = structuredClone(project);
+  for (const addition of additions) {
+    const targetPosition = target.entries.indexOf(addition);
+    const previousTarget = target.entries[targetPosition - 1];
+    if (!previousTarget) {
+      conflicts.push(`${journalPath}：目标 migration 缺少前置快照`);
+      break;
+    }
+    const targetBefore = await readSnapshot(input.targetDirectory, previousTarget.tag);
+    const targetAfter = await readSnapshot(input.targetDirectory, addition.tag);
+    const merged = applySnapshotDelta(targetBefore, targetAfter, currentSnapshot, [], conflicts, journalPath);
+    if (conflicts.length)
+      break;
+    const prefix = String(nextPrefix).padStart(4, "0");
+    const name = stableName(addition.tag);
+    const tag = `${prefix}_${name}`;
+    const sqlPath = `${drizzleRoot}/${tag}.sql`;
+    const snapshotPath = `${drizzleRoot}/meta/${prefix}_snapshot.json`;
+    const sql = await readFile14(join15(input.targetDirectory, `${drizzleRoot}/${addition.tag}.sql`));
+    merged.id = targetAfter.id;
+    merged.prevId = currentSnapshot.id;
+    const snapshot = encodeJson(merged);
+    contentOverrides.set(sqlPath, sql);
+    contentOverrides.set(snapshotPath, snapshot);
+    files.push(managedEntry(sqlPath, sql), managedEntry(snapshotPath, snapshot));
+    previousWhen = Math.max(previousWhen + 1, addition.when);
+    mergedJournal.entries.push({
+      ...addition,
+      idx: nextIndex,
+      when: previousWhen,
+      tag
+    });
+    currentSnapshot = merged;
+    nextPrefix += 1;
+    nextIndex += 1;
+  }
+  const journalContent = encodeJson(mergedJournal);
+  contentOverrides.set(journalPath, journalContent);
+  files.push(managedEntry(journalPath, journalContent));
+  return result(input.targetManifest, files, contentOverrides, publishedPaths, conflicts);
+}
+function result(targetManifest, files, contentOverrides, forcePreserves, conflicts) {
+  return {
+    targetManifest: {
+      ...targetManifest,
+      files: deduplicate(files).sort((left, right) => left.path.localeCompare(right.path))
+    },
+    contentOverrides,
+    forceUpdates: new Set([journalPath]),
+    forcePreserves,
+    conflicts
+  };
+}
+function unchanged(targetManifest) {
+  return {
+    targetManifest,
+    contentOverrides: new Map,
+    forceUpdates: new Set,
+    forcePreserves: new Set,
+    conflicts: []
+  };
+}
+async function readJournals(input) {
+  try {
+    const [base, project, target] = await Promise.all([
+      readJson(join15(input.baseDirectory, journalPath)),
+      readJson(join15(input.projectDirectory, journalPath)),
+      readJson(join15(input.targetDirectory, journalPath))
+    ]);
+    return { base, project, target };
+  } catch (error) {
+    if (isMissing5(error))
+      return;
+    throw error;
+  }
+}
+async function preservePublishedHistory(manifest, projectDirectory, overrides) {
+  const entries = manifest.files.filter(({ path: path2 }) => isMigrationArtifact(path2) && path2 !== journalPath);
+  await Promise.all(entries.map(async ({ path: path2 }) => {
+    overrides.set(path2, await readFile14(join15(projectDirectory, path2)));
+  }));
+  return entries;
+}
+async function readLatestSnapshot(root, journal) {
+  const latest = journal.entries.at(-1);
+  if (!latest)
+    throw new Error(`${journalPath}：当前项目没有 migration`);
+  return await readSnapshot(root, latest.tag);
+}
+async function readSnapshot(root, tag) {
+  const match = migrationPattern.exec(tag);
+  if (!match)
+    throw new Error(`${journalPath}：migration tag 格式无效：${tag}`);
+  return await readJson(join15(root, `${drizzleRoot}/meta/${match[1]}_snapshot.json`));
+}
+function validateUniqueNames(journal, label, conflicts) {
+  const seen = new Set;
+  for (const { tag } of journal.entries) {
+    const name = stableName(tag);
+    if (seen.has(name)) {
+      conflicts.push(`${journalPath}：${label}存在重复 migration 名称 ${name}`);
+    }
+    seen.add(name);
+  }
+}
+function stableName(tag) {
+  return migrationPattern.exec(tag)?.[2] ?? tag;
+}
+function highestPrefix(journal) {
+  return Math.max(-1, ...journal.entries.map(({ tag }) => Number(migrationPattern.exec(tag)?.[1] ?? -1)));
+}
+function highestIndex(journal) {
+  return Math.max(-1, ...journal.entries.map(({ idx }) => idx));
+}
+function isDrizzleHistoryPath(path2) {
+  return path2 === journalPath || isMigrationArtifact(path2);
+}
+function isMigrationArtifact(path2) {
+  return isSqlMigration(path2) || new RegExp(`^${drizzleRoot}/meta/\\d{4}_snapshot\\.json$`).test(path2);
+}
+function isSqlMigration(path2) {
+  return new RegExp(`^${drizzleRoot}/\\d{4}_.+\\.sql$`).test(path2);
+}
+function managedEntry(path2, content) {
+  return { path: path2, ownership: "windy-managed", hash: hashContent(content) };
+}
+function deduplicate(files) {
+  return [...new Map(files.map((entry) => [entry.path, entry])).values()];
+}
+function encodeJson(value) {
+  return new TextEncoder().encode(`${JSON.stringify(value, null, 2)}
+`);
+}
+async function readJson(path2) {
+  return JSON.parse(await readFile14(path2, "utf8"));
+}
+function isMissing5(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
 
 // src/update/package-merge.ts
 function mergePackageJson(base, ours, theirs) {
@@ -4284,10 +4810,18 @@ async function createUpdatePlan(request, artifacts) {
     throw new Error(`当前 CLI 只能更新到 ${targetProvenance.generatorVersion}，请运行 create-windy@${targetVersion}`);
   }
   const recipes2 = resolveRecipeChain(provenance.windyVersion, targetVersion);
-  const [sourceManifest, targetManifest] = await Promise.all([
+  const [sourceManifest, generatedTargetManifest] = await Promise.all([
     readManagedFilesManifest(request.projectDirectory),
     readManagedFilesManifest(artifactSet.targetDirectory)
   ]);
+  const migrations = await reconcileDrizzleMigrations({
+    projectDirectory: request.projectDirectory,
+    baseDirectory: artifactSet.baseDirectory,
+    targetDirectory: artifactSet.targetDirectory,
+    sourceManifest,
+    targetManifest: generatedTargetManifest
+  });
+  const targetManifest = migrations.targetManifest;
   targetProvenance.appliedRecipes = [
     ...provenance.appliedRecipes,
     ...recipes2.map(({ id }) => id)
@@ -4300,7 +4834,9 @@ async function createUpdatePlan(request, artifacts) {
   for (const path2 of [...paths].sort()) {
     if (metadataPaths.has(path2))
       continue;
-    const file = await planFile(path2, request.projectDirectory, artifactSet.baseDirectory, artifactSet.targetDirectory, sourceEntries.get(path2), targetEntries.get(path2), provenance);
+    const forcedContent = migrations.forceUpdates.has(path2) ? migrations.contentOverrides.get(path2) : undefined;
+    const forcePreserve = migrations.forcePreserves.has(path2);
+    const file = forcePreserve ? ready(path2, sourceEntries.get(path2)?.ownership ?? classifyOwnership(path2), "preserve", "保留项目已发布 migration 历史") : forcedContent ? ready(path2, targetEntries.get(path2)?.ownership ?? sourceEntries.get(path2)?.ownership ?? classifyOwnership(path2), "update", "合并平台与下游 migration 历史", forcedContent) : await planFile(path2, request.projectDirectory, artifactSet.baseDirectory, artifactSet.targetDirectory, sourceEntries.get(path2), targetEntries.get(path2), provenance, migrations.contentOverrides.get(path2));
     if (oxcManagedPaths.has(path2) && file.reason === "客户已修改") {
       file.action = "preserve";
       delete file.conflict;
@@ -4308,7 +4844,10 @@ async function createUpdatePlan(request, artifacts) {
     }
     files.push(file);
   }
-  const conflicts = files.flatMap((file) => file.conflict ? [`${file.path}：${file.conflict}`] : []);
+  const conflicts = [
+    ...migrations.conflicts,
+    ...files.flatMap((file) => file.conflict ? [`${file.path}：${file.conflict}`] : [])
+  ];
   return {
     id: createUpdateId(provenance.windyVersion, targetVersion),
     projectDirectory: request.projectDirectory,
@@ -4323,11 +4862,11 @@ async function createUpdatePlan(request, artifacts) {
     temporaryRoot: artifactSet.temporaryRoot
   };
 }
-async function planFile(path2, project, baseRoot, targetRoot, source, target, provenance) {
+async function planFile(path2, project, baseRoot, targetRoot, source, target, provenance, targetContentOverride) {
   const [ours, base, theirs] = await Promise.all([
-    readOptional(join14(project, path2)),
-    readOptional(join14(baseRoot, path2)),
-    readOptional(join14(targetRoot, path2))
+    readOptional(join16(project, path2)),
+    readOptional(join16(baseRoot, path2)),
+    targetContentOverride ? Promise.resolve(targetContentOverride) : readOptional(join16(targetRoot, path2))
   ]);
   const ownership = target?.ownership || source?.ownership || classifyOwnership(path2);
   const repaired = ours && theirs && provenance ? repairKnownDerivedFile({
@@ -4372,16 +4911,17 @@ async function planFile(path2, project, baseRoot, targetRoot, source, target, pr
     return conflict(path2, ownership, "文件状态不完整，不能安全推断");
   }
   const oursChanged = hashContent(ours) !== source.hash;
-  const targetChanged = target.hash !== source.hash;
+  const targetChanged = targetChangedSinceBase(source.hash, base, theirs);
+  const reconstructedBaseDrifted = !!base && hashContent(base) !== source.hash;
   if (!oursChanged && !targetChanged)
     return ready(path2, ownership, "preserve", "双方未修改");
-  if (!oursChanged)
+  if (!oursChanged && !reconstructedBaseDrifted)
     return ready(path2, ownership, "update", "仅 Windy 修改", theirs);
   if (!targetChanged)
     return ready(path2, ownership, "preserve", "客户已修改");
   if (hashContent(ours) === target.hash)
     return ready(path2, ownership, "preserve", "已包含目标内容");
-  if (path2 === "package.json" && base) {
+  if (path2.endsWith("package.json") && base) {
     const merged = mergePackageJson(base, ours, theirs);
     return merged.content ? ready(path2, ownership, "update", "package.json 字段级合并", merged.content) : conflict(path2, ownership, `字段冲突：${merged.conflicts.join("、")}`);
   }
@@ -4391,6 +4931,9 @@ async function planFile(path2, project, baseRoot, targetRoot, source, target, pr
   }
   return conflict(path2, ownership, "客户和 Windy 均已修改");
 }
+function targetChangedSinceBase(sourceHash, base, target) {
+  return base && target ? hashContent(base) !== hashContent(target) : !!target && hashContent(target) !== sourceHash;
+}
 function ready(path2, ownership, action, reason, content) {
   return { path: path2, ownership, action, reason, content };
 }
@@ -4405,7 +4948,7 @@ function conflict(path2, ownership, reason) {
 }
 async function readOptional(path2) {
   try {
-    return await readFile13(path2);
+    return await readFile15(path2);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
       return;
@@ -4413,15 +4956,15 @@ async function readOptional(path2) {
   }
 }
 async function assertGitClean(projectDirectory) {
-  const result = await captureProcess("git", ["status", "--porcelain"], projectDirectory);
-  if (result.code !== 0)
+  const result2 = await captureProcess("git", ["status", "--porcelain"], projectDirectory);
+  if (result2.code !== 0)
     throw new Error("更新要求当前目录是有效的 Git 仓库");
-  if (result.stdout.trim())
+  if (result2.stdout.trim())
     throw new Error("更新前请先提交或暂存之外妥善处理 Git 工作区改动");
 }
 async function assertNoPendingUpdate(projectDirectory) {
   try {
-    await access3(join14(projectDirectory, ".windy/update-state.json"));
+    await access3(join16(projectDirectory, ".windy/update-state.json"));
     throw new Error("检测到未完成更新，请先运行 bun run windy doctor --repair");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
@@ -4452,87 +4995,110 @@ class DefaultStarterUpdater {
       throw error;
     }
   }
-  async verify(result) {
+  async verify(result2) {
     const steps = [];
     try {
-      await this.#execute("bun", ["install", "--force"], result.plan.projectDirectory);
+      const dockerSync = await syncWebDockerfileInProject(result2.plan.projectDirectory, { requireAnchors: true });
+      if (dockerSync.changed) {
+        addChangedFile(result2, "apps/web/Dockerfile");
+      }
+      steps.push({
+        name: "同步 Web Dockerfile workspace COPY 清单",
+        status: dockerSync.synced ? "passed" : "skipped"
+      });
+      await this.#execute("bun", ["install", "--force"], result2.plan.projectDirectory);
       steps.push({ name: "bun install --force", status: "passed" });
-      const packageJson = JSON.parse(await readFile14(join15(result.plan.projectDirectory, "package.json"), "utf8"));
+      const packageJson = JSON.parse(await readFile16(join17(result2.plan.projectDirectory, "package.json"), "utf8"));
       for (const name of ["lint", "typecheck", "test", "build"]) {
         if (!packageJson.scripts?.[name]) {
           steps.push({ name: `bun run ${name}`, status: "skipped" });
           continue;
         }
-        await this.#execute("bun", ["run", name], result.plan.projectDirectory);
+        await this.#execute("bun", ["run", name], result2.plan.projectDirectory);
         steps.push({ name: `bun run ${name}`, status: "passed" });
       }
-      await finalize(result);
-      const reportPath = `.windy/reports/${result.plan.id}.md`;
-      await writeReport(result, steps, reportPath);
-      await clearUpdateState(result.plan.projectDirectory);
-      await rm7(result.plan.temporaryRoot, { recursive: true, force: true });
-      return { updateId: result.plan.id, status: "passed", steps, reportPath };
+      await finalize(result2);
+      const reportPath = `.windy/reports/${result2.plan.id}.md`;
+      await writeReport(result2, steps, reportPath);
+      await clearUpdateState(result2.plan.projectDirectory);
+      await rm7(result2.plan.temporaryRoot, { recursive: true, force: true });
+      return { updateId: result2.plan.id, status: "passed", steps, reportPath };
     } catch (error) {
-      await restoreUpdateState(result.plan.projectDirectory, {
+      await restoreUpdateState(result2.plan.projectDirectory, {
         schemaVersion: 1,
-        updateId: result.plan.id,
-        backupDirectory: result.backupDirectory,
-        entries: result.backupEntries
+        updateId: result2.plan.id,
+        backupDirectory: result2.backupDirectory,
+        entries: result2.backupEntries
       });
-      await rm7(result.plan.temporaryRoot, { recursive: true, force: true });
-      throw new Error(`更新验证失败，项目已回滚到 ${result.plan.sourceVersion}：${error instanceof Error ? error.message : String(error)}`, { cause: error });
+      await rm7(result2.plan.temporaryRoot, { recursive: true, force: true });
+      throw new Error(`更新验证失败，项目已回滚到 ${result2.plan.sourceVersion}：${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
   }
 }
-async function finalize(result) {
-  const root = result.plan.projectDirectory;
-  const generationContent = `${JSON.stringify(result.plan.targetProvenance, null, 2)}
+async function finalize(result2) {
+  const root = result2.plan.projectDirectory;
+  const generationContent = `${JSON.stringify(result2.plan.targetProvenance, null, 2)}
 `;
-  await writeFile11(join15(root, ".windy/generation.json"), generationContent);
+  await writeFile12(join17(root, ".windy/generation.json"), generationContent);
   const refreshedPaths = new Set([
     ".windy/generation.json",
-    ...result.plan.files.filter(({ action }) => action === "create" || action === "update").map(({ path: path2 }) => path2)
+    ...result2.changedFiles
   ]);
-  const refreshedHashes = new Map(await Promise.all([...refreshedPaths].map(async (path2) => [path2, hashContent(await readFile14(join15(root, path2)))])));
+  const refreshedHashes = new Map(await Promise.all([...refreshedPaths].map(async (path2) => [path2, hashContent(await readFile16(join17(root, path2)))])));
   const targetManifest = {
-    ...result.plan.targetManifest,
-    files: result.plan.targetManifest.files.map((entry) => ({
+    ...result2.plan.targetManifest,
+    files: result2.plan.targetManifest.files.map((entry) => ({
       ...entry,
       hash: refreshedHashes.get(entry.path) ?? entry.hash
     }))
   };
-  await writeFile11(join15(root, ".windy/files.json"), `${JSON.stringify(targetManifest, null, 2)}
+  await writeFile12(join17(root, ".windy/files.json"), `${JSON.stringify(targetManifest, null, 2)}
 `);
 }
-async function writeReport(result, steps, relativePath2) {
-  const path2 = join15(result.plan.projectDirectory, relativePath2);
+function addChangedFile(result2, path2) {
+  if (!result2.changedFiles.includes(path2))
+    result2.changedFiles.push(path2);
+}
+async function writeReport(result2, steps, relativePath2) {
+  const path2 = join17(result2.plan.projectDirectory, relativePath2);
   await mkdir7(dirname4(path2), { recursive: true });
   const lines = [
-    `# Windy 更新报告 ${result.plan.id}`,
+    `# Windy 更新报告 ${result2.plan.id}`,
     "",
-    `- 来源版本：${result.plan.sourceVersion}`,
-    `- 目标版本：${result.plan.targetVersion}`,
-    `- Recipe：${result.plan.recipes.join("、") || "无"}`,
-    `- 修改文件：${result.changedFiles.length}`,
-    `- Oxc 代管：${result.plan.detachedToolchain ? "已检测到客户接管并保留" : "保持"}`,
+    `- 来源版本：${result2.plan.sourceVersion}`,
+    `- 目标版本：${result2.plan.targetVersion}`,
+    `- Recipe：${result2.plan.recipes.join("、") || "无"}`,
+    `- 修改文件：${result2.changedFiles.length}`,
+    `- Oxc 代管：${result2.plan.detachedToolchain ? "已检测到客户接管并保留" : "保持"}`,
     "",
     "## 验证",
     "",
     ...steps.map(({ name, status }) => `- ${name}：${status}`),
     "",
-    `备份保留在 \`.windy/backups/${result.plan.id}\`，确认稳定后可人工删除。`,
+    `备份保留在 \`.windy/backups/${result2.plan.id}\`，确认稳定后可人工删除。`,
     ""
   ];
-  await writeFile11(path2, lines.join(`
+  await writeFile12(path2, lines.join(`
 `));
 }
 
 // src/update/cli.ts
 async function runLifecycleCommand(args) {
   const command = args[0];
-  if (command !== "doctor" && command !== "update")
+  if (command !== "doctor" && command !== "update" && command !== "sync-docker") {
     return false;
+  }
   const projectDirectory = resolve5(readValue2(args, "--cwd") || process.cwd());
+  if (command === "sync-docker") {
+    const result2 = await syncWebDockerfileInProject(projectDirectory, {
+      requireAnchors: true
+    });
+    if (!result2.synced) {
+      throw new Error("项目缺少 apps/web/Dockerfile，无法同步 COPY 清单");
+    }
+    console.log(result2.changed ? "已同步 apps/web/Dockerfile workspace COPY 清单" : "apps/web/Dockerfile workspace COPY 清单已是最新");
+    return true;
+  }
   if (command === "doctor") {
     const report = await diagnoseProject(projectDirectory, args.includes("--repair"));
     printDoctor(report);
@@ -4584,8 +5150,8 @@ async function runUpdate(args, projectDirectory) {
     await rm8(plan.temporaryRoot, { recursive: true, force: true });
     throw new Error("存在更新冲突；请按上方清单处理后重新运行，项目未被修改");
   }
-  const result = await updater.apply(plan);
-  const report = await updater.verify(result);
+  const result2 = await updater.apply(plan);
+  const report = await updater.verify(result2);
   console.log(`
 更新完成：${plan.sourceVersion} → ${plan.targetVersion}`);
   console.log(`报告：${report.reportPath}`);