create-windy 0.2.5 → 0.2.7

package/dist/cli.js

@@ -852,21 +852,68 @@ function compactReason(error) {
   return message ? `（原因：${message}）` : "";
 }
 
+// src/local-environment.ts
+import { randomBytes } from "node:crypto";
+import { open, readFile } from "node:fs/promises";
+import { join } from "node:path";
+async function initializeLocalEnvironment(projectRoot, generateSecret = defaultSecret) {
+  const target = join(projectRoot, ".env");
+  const [example, gitignore] = await Promise.all([
+    readFile(join(projectRoot, ".env.example"), "utf8"),
+    readFile(join(projectRoot, ".gitignore"), "utf8")
+  ]);
+  if (!gitignore.split(/\r?\n/).some((line) => line.trim() === ".env")) {
+    throw new Error("生成项目的 .gitignore 未排除 .env，拒绝写入本地密码");
+  }
+  const content = setEmptyVariable(setEmptyVariable(example, "POSTGRES_PASSWORD", generateSecret()), "WINDY_BOOTSTRAP_ADMIN_PASSWORD", generateSecret());
+  let handle;
+  try {
+    handle = await open(target, "wx", 384);
+  } catch (error) {
+    if (isAlreadyExists(error))
+      return "existing";
+    throw error;
+  }
+  try {
+    await handle.writeFile(content);
+    await handle.chmod(384);
+  } finally {
+    await handle.close();
+  }
+  return "created";
+}
+function setEmptyVariable(source, key, value) {
+  if (value.length < 12 || /\s|=/.test(value)) {
+    throw new Error(`${key} 的随机值不满足本地密码安全要求`);
+  }
+  const pattern = new RegExp(`^${key}=[ \\t\\r]*$`, "m");
+  if (!pattern.test(source)) {
+    throw new Error(`.env.example 缺少空的 ${key}`);
+  }
+  return source.replace(pattern, `${key}=${value}`);
+}
+function defaultSecret() {
+  return randomBytes(24).toString("base64url");
+}
+function isAlreadyExists(error) {
+  return error instanceof Error && "code" in error && error.code === "EEXIST";
+}
+
 // src/generator.ts
 import {
   copyFile,
   lstat as lstat3,
   mkdir as mkdir3,
-  readFile as readFile7,
+  readFile as readFile8,
   readdir as readdir3,
   rm as rm3,
   writeFile as writeFile7
 } from "node:fs/promises";
-import { basename as basename2, extname as extname2, join as join7 } from "node:path";
+import { basename as basename2, extname as extname2, join as join8 } from "node:path";
 
 // src/customer-docker.ts
-import { readFile, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { readFile as readFile2, writeFile } from "node:fs/promises";
+import { join as join2 } from "node:path";
 var supplierWorkspaceCopies = [
   "COPY apps/license/package.json apps/license/package.json",
   "COPY apps/signing-service/package.json apps/signing-service/package.json",
@@ -874,8 +921,8 @@ var supplierWorkspaceCopies = [
 ];
 async function prepareCustomerDockerfiles(root) {
   await Promise.all(["apps/server/Dockerfile", "apps/web/Dockerfile"].map(async (path) => {
-    const absolutePath = join(root, path);
-    const source = await readFile(absolutePath, "utf8");
+    const absolutePath = join2(root, path);
+    const source = await readFile2(absolutePath, "utf8");
     await writeFile(absolutePath, rewriteCustomerDockerfile(source));
   }));
 }
@@ -889,8 +936,8 @@ function rewriteCustomerDockerfile(source) {
 }
 
 // src/code-quality.ts
-import { readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join3 } from "node:path";
 var oxcStarterPolicy = [
   "- 生成时默认预装 Oxlint、Oxfmt、lint-staged 与 Husky。",
   "- 提交前自动格式化暂存文件；lint、typecheck 和 test 保留为显式命令。",
@@ -899,8 +946,8 @@ var oxcStarterPolicy = [
 `);
 var noCodeQualityPolicy = "- 本项目生成时未引入 lint 或 format 工具；项目所有者可按团队需要自行选择。";
 async function reflectCodeQualityChoice(targetDirectory, includeOxc) {
-  const path = join2(targetDirectory, "AGENTS.md");
-  const source = await readFile2(path, "utf8");
+  const path = join3(targetDirectory, "AGENTS.md");
+  const source = await readFile3(path, "utf8");
   if (includeOxc)
     return;
   if (!source.includes(oxcStarterPolicy)) {
@@ -910,19 +957,19 @@ async function reflectCodeQualityChoice(targetDirectory, includeOxc) {
 }
 
 // src/license-files.ts
-import { mkdir, readFile as readFile3, rm, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname, join as join3, resolve as resolve2 } from "node:path";
+import { mkdir, readFile as readFile4, rm, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname, join as join4, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
 var packageRoot = resolve2(dirname(fileURLToPath(import.meta.url)), "..");
 var apacheLicensePath = resolve2(packageRoot, "LICENSE");
 var windyLicensePath = ".windy/licenses/WINDY-APACHE-2.0.txt";
 async function applyWindyBaseLicense(targetDirectory) {
-  const target = join3(targetDirectory, windyLicensePath);
+  const target = join4(targetDirectory, windyLicensePath);
   await mkdir(dirname(target), { recursive: true });
-  await writeFile3(target, await readFile3(apacheLicensePath));
+  await writeFile3(target, await readFile4(apacheLicensePath));
 }
 async function applyProjectLicense(targetDirectory, license, holder, year = new Date().getFullYear()) {
-  const target = join3(targetDirectory, "LICENSE");
+  const target = join4(targetDirectory, "LICENSE");
   if (license === "UNLICENSED") {
     await rm(target, { force: true });
     return;
@@ -936,7 +983,7 @@ async function applyProjectLicense(targetDirectory, license, holder, year = new
     return;
   }
   await mkdir(targetDirectory, { recursive: true });
-  await writeFile3(target, await readFile3(apacheLicensePath));
+  await writeFile3(target, await readFile4(apacheLicensePath));
 }
 function mitLicense(year, holder) {
   return `MIT License
@@ -965,8 +1012,8 @@ SOFTWARE.
 
 // src/managed-files.ts
 import { createHash } from "node:crypto";
-import { lstat, readdir, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join4, relative, sep } from "node:path";
+import { lstat, readdir, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
+import { join as join5, relative, sep } from "node:path";
 var managedFilesManifestPath = ".windy/files.json";
 var ignoredDirectoryNames = new Set([".git", "node_modules", "dist"]);
 var ignoredFiles = new Set([
@@ -990,7 +1037,7 @@ var sharedScaffoldRoots = [
 async function writeManagedFilesManifest(targetDirectory, generatorVersion) {
   const paths = await collectFiles(targetDirectory);
   const files = await Promise.all(paths.map(async (path) => {
-    const content = await readFile4(join4(targetDirectory, path));
+    const content = await readFile5(join5(targetDirectory, path));
     return {
       path,
       ownership: classifyOwnership(path),
@@ -1003,11 +1050,11 @@ async function writeManagedFilesManifest(targetDirectory, generatorVersion) {
     algorithm: "sha256",
     files
   };
-  await writeFile4(join4(targetDirectory, managedFilesManifestPath), `${JSON.stringify(manifest, null, 2)}
+  await writeFile4(join5(targetDirectory, managedFilesManifestPath), `${JSON.stringify(manifest, null, 2)}
 `);
 }
 async function readManagedFilesManifest(targetDirectory) {
-  const parsed = JSON.parse(await readFile4(join4(targetDirectory, managedFilesManifestPath), "utf8"));
+  const parsed = JSON.parse(await readFile5(join5(targetDirectory, managedFilesManifestPath), "utf8"));
   if (!isManagedFilesManifest(parsed)) {
     throw new Error("受管文件清单无效，无法安全更新");
   }
@@ -1031,7 +1078,7 @@ async function collectFiles(root) {
     for (const name of (await readdir(directory)).sort()) {
       if (ignoredDirectoryNames.has(name))
         continue;
-      const path = join4(directory, name);
+      const path = join5(directory, name);
       const metadata = await lstat(path);
       if (metadata.isSymbolicLink())
         continue;
@@ -1065,8 +1112,8 @@ function isManagedFilesManifest(value) {
 }
 
 // src/module-materializer.ts
-import { lstat as lstat2, readFile as readFile5, readdir as readdir2, rm as rm2, writeFile as writeFile5 } from "node:fs/promises";
-import { basename, extname, join as join5, relative as relative2, sep as sep2 } from "node:path";
+import { lstat as lstat2, readFile as readFile6, readdir as readdir2, rm as rm2, writeFile as writeFile5 } from "node:fs/promises";
+import { basename, extname, join as join6, relative as relative2, sep as sep2 } from "node:path";
 var textExtensions = new Set([
   ".css",
   ".html",
@@ -1095,14 +1142,14 @@ async function materializeSelectedModules(targetDirectory, selectedNames) {
     ...manifest.documentation,
     ...manifest.schemaFiles
   ]);
-  await Promise.all([...new Set(removedRoots)].map((path) => rm2(join5(targetDirectory, path), { recursive: true, force: true })));
+  await Promise.all([...new Set(removedRoots)].map((path) => rm2(join6(targetDirectory, path), { recursive: true, force: true })));
   await pruneWorkspaceReferences(targetDirectory, removedPackageNames, removedRoots);
 }
 async function stripModuleBlocks(root, selected) {
   for (const path of await collectFiles2(root)) {
     if (!textExtensions.has(extname(path)))
       continue;
-    const source = await readFile5(path, "utf8");
+    const source = await readFile6(path, "utf8");
     if (!source.includes("@windy-module"))
       continue;
     const output = stripTaggedSource(source, selected, relativePath(root, path));
@@ -1139,7 +1186,7 @@ async function readRemovedPackageNames(root, roots) {
   const names = new Set;
   for (const packageRoot2 of roots) {
     try {
-      const value = JSON.parse(await readFile5(join5(root, packageRoot2, "package.json"), "utf8"));
+      const value = JSON.parse(await readFile6(join6(root, packageRoot2, "package.json"), "utf8"));
       if (value.name)
         names.add(value.name);
     } catch (error) {
@@ -1152,7 +1199,7 @@ async function readRemovedPackageNames(root, roots) {
 async function pruneWorkspaceReferences(root, removedPackages, removedRoots) {
   for (const path of await collectFiles2(root)) {
     if (basename(path) === "package.json") {
-      const value = JSON.parse(await readFile5(path, "utf8"));
+      const value = JSON.parse(await readFile6(path, "utf8"));
       let changed = false;
       for (const section of ["dependencies", "devDependencies"]) {
         const dependencies = value[section];
@@ -1170,7 +1217,7 @@ async function pruneWorkspaceReferences(root, removedPackages, removedRoots) {
     }
     if (basename(path) !== "Dockerfile")
       continue;
-    const source = await readFile5(path, "utf8");
+    const source = await readFile6(path, "utf8");
     const output = source.split(`
 `).filter((line) => !removedRoots.some((root2) => line.includes(root2))).join(`
 `);
@@ -1182,11 +1229,11 @@ async function pruneDatabaseArtifacts(root, tableNames, statementTokens) {
   if (!tableNames.length && !statementTokens.length)
     return;
   const tablePatterns = tableNames.map((name) => new RegExp(`(?:"${escapeRegExp(name)}"|\\b${escapeRegExp(name)}\\b)`));
-  const drizzleRoot = join5(root, "packages/database/drizzle");
+  const drizzleRoot = join6(root, "packages/database/drizzle");
   try {
     for (const path of await collectFiles2(drizzleRoot)) {
       if (path.endsWith(".sql")) {
-        const source = await readFile5(path, "utf8");
+        const source = await readFile6(path, "utf8");
         const statements = source.split("--> statement-breakpoint").map((statement) => statement.trim()).filter(Boolean).filter((statement) => !tablePatterns.some((pattern) => pattern.test(statement)) && !statementTokens.some((token) => statement.includes(token)));
         await writeFile5(path, statements.length ? `${statements.join(`
 --> statement-breakpoint
@@ -1194,7 +1241,7 @@ async function pruneDatabaseArtifacts(root, tableNames, statementTokens) {
 ` : `-- 此 migration 的模块未被当前项目选择。
 `);
       } else if (path.endsWith("_snapshot.json")) {
-        const snapshot = JSON.parse(await readFile5(path, "utf8"));
+        const snapshot = JSON.parse(await readFile6(path, "utf8"));
         for (const name of tableNames)
           delete snapshot.tables?.[`public.${name}`];
         await writeFile5(path, `${JSON.stringify(snapshot, null, 2)}
@@ -1214,7 +1261,7 @@ async function collectFiles2(root) {
     for (const name of (await readdir2(directory)).sort()) {
       if ([".git", "node_modules", "dist"].includes(name))
         continue;
-      const path = join5(directory, name);
+      const path = join6(directory, name);
       const metadata = await lstat2(path);
       if (metadata.isSymbolicLink())
         continue;
@@ -1363,32 +1410,47 @@ ${includeExample ? "创建时包含了 `work-order` 示例模块，用于演示
 不要使用 npm、Yarn 或 pnpm 安装本项目依赖，也不要提交它们产生的 lockfile；唯一的
 依赖锁文件是 \`bun.lock\`。
 
-## 第一次运行
+## 第一次运行：完整开发环境
 
 \`\`\`bash
 bun install
-cp .env.example .env
-# 为 POSTGRES_PASSWORD 和 WINDY_BOOTSTRAP_ADMIN_PASSWORD 设置本地值
-docker compose up --build
+bun run dev
 \`\`\`
 
+create-windy 已创建仅供本机使用且被 Git 忽略的 \`.env\`，其中两个开发密码均为随机值，
+文件权限为 \`0600\`。\`bun run dev\` 会通过 Docker Compose 等待 PostgreSQL、执行
+Drizzle migration，再启动 Server 与 Web；不要跳过 migration 后直接把 Server 连接到
+空数据库。首次启动需要本机已经安装并启动 Docker 与 Docker Compose，并可能需要下载
+基础镜像。
+
 | 服务 | 地址 |
 | ---- | ---- |
 | Web | http://localhost:9746 |
 | Server 健康检查 | http://localhost:3000/api/health |
 | PostgreSQL | localhost:5432 |
 
-Docker Web 固定使用 \`9746\`。只在宿主机运行 Web 时使用：
+Docker Web 固定使用 \`9746\`。只启动单个应用时使用：
 
 \`\`\`bash
 bun run dev:web
+bun run dev:server
 \`\`\`
 
-本地 Web 从 \`8746\` 开始探测。同一项目已经运行时会直接输出已有地址；其它服务占用
-时会自动使用后续端口，最多检查 100 个。实际地址始终以终端输出为准。
+\`dev:web\` 不会隐式启动后端；本地 Web 从 \`8746\` 开始探测。同一项目已经运行时会
+直接输出已有地址，其它服务占用时会自动使用后续端口，最多检查 100 个。实际地址始终
+以终端输出为准。\`dev:server\` 不会自动启动 PostgreSQL 或执行 migration；未配置
+\`DATABASE_URL\` 时使用内存模式。
 
 ## 页面与登录
 
+全新数据库的初始平台账号为 \`admin\`。初始密码不是所有项目共用的固定值，而是
+create-windy 在本机 \`.env\` 中随机生成的 \`WINDY_BOOTSTRAP_ADMIN_PASSWORD\`；该文件已
+被 Git 忽略，请在本机直接查看，不要把密码提交到仓库或复制到文档。首次登录会要求
+立即修改密码，新密码必须为 12-128 个字符，且不能与当前密码相同。
+
+\`.env\` 只负责全新数据库的首次初始化。账号密码写入数据库后，重启不会用环境变量
+覆盖已有密码；如果已经完成首次改密，应使用修改后的密码登录。
+
 | 路径 | 访问要求 | 说明 |
 | ---- | -------- | ---- |
 | \`/login\` | 公开 | 登录成功后回到安全的站内目标，默认进入 \`/\` |
@@ -1425,6 +1487,7 @@ ${moduleRows}
 ## 常用命令
 
 \`\`\`bash
+bun run dev
 bun run dev:web
 bun run dev:server
 bun run typecheck
@@ -1497,7 +1560,7 @@ function createStarterPackage(source, projectName, includeOxc = true, projectLic
       ...includeOxc ? {
         prepare: "git rev-parse --git-dir >/dev/null 2>&1 || exit 0; husky"
       } : {},
-      dev: "bun run --cwd apps/web dev",
+      dev: "docker compose up --build",
       ...generatorVersion ? { windy: "create-windy" } : {},
       "dev:web": "bun run --cwd apps/web dev",
       "dev:server": "bun run --cwd apps/server dev",
@@ -1614,21 +1677,21 @@ var excludedRuntimeFiles = new Set([
 ]);
 
 // src/provenance.ts
-import { mkdir as mkdir2, readFile as readFile6, writeFile as writeFile6 } from "node:fs/promises";
-import { join as join6 } from "node:path";
+import { mkdir as mkdir2, readFile as readFile7, writeFile as writeFile6 } from "node:fs/promises";
+import { join as join7 } from "node:path";
 var templateMetadataFile = ".windy-template.json";
 var generationMetadataFile = ".windy/generation.json";
 async function readTemplateMetadata(sourceRoot) {
-  const path = join6(sourceRoot, templateMetadataFile);
-  const parsed = JSON.parse(await readFile6(path, "utf8"));
+  const path = join7(sourceRoot, templateMetadataFile);
+  const parsed = JSON.parse(await readFile7(path, "utf8"));
   if (!isTemplateMetadata(parsed)) {
     throw new Error("create-windy 模板来源元数据无效");
   }
   return parsed;
 }
 async function readGenerationProvenance(targetDirectory) {
-  const path = join6(targetDirectory, generationMetadataFile);
-  const parsed = JSON.parse(await readFile6(path, "utf8"));
+  const path = join7(targetDirectory, generationMetadataFile);
+  const parsed = JSON.parse(await readFile7(path, "utf8"));
   if (!isGenerationProvenance(parsed)) {
     throw new Error("当前目录不是受支持的 Windy 项目：Project Lock 无效");
   }
@@ -1660,8 +1723,8 @@ async function writeGenerationProvenance(targetDirectory, metadata, profile, sel
       includeOxc
     }
   };
-  const path = join6(targetDirectory, generationMetadataFile);
-  await mkdir2(join6(path, ".."), { recursive: true });
+  const path = join7(targetDirectory, generationMetadataFile);
+  await mkdir2(join7(path, ".."), { recursive: true });
   await writeFile6(path, `${JSON.stringify(provenance, null, 2)}
 `);
 }
@@ -1697,27 +1760,27 @@ async function generateProject(input) {
   const templateMetadata = await readTemplateMetadata(input.sourceRoot);
   const selectedModules = input.selectedModules ?? templateMetadata.modules.filter(({ name }) => includeExample || name !== "work-order").map(({ name }) => name);
   for (const relativePath2 of generationTemplatePaths(true, includeOxc)) {
-    await copyTree(await resolveTemplateSource(input.sourceRoot, relativePath2), join7(input.targetDirectory, relativePath2));
+    await copyTree(await resolveTemplateSource(input.sourceRoot, relativePath2), join8(input.targetDirectory, relativePath2));
   }
   await materializeSelectedModules(input.targetDirectory, selectedModules);
-  const packagePath = join7(input.targetDirectory, "package.json");
-  const packageJson = JSON.parse(await readFile7(packagePath, "utf8"));
+  const packagePath = join8(input.targetDirectory, "package.json");
+  const packageJson = JSON.parse(await readFile8(packagePath, "utf8"));
   await writeFile7(packagePath, `${JSON.stringify(createStarterPackage(packageJson, input.projectName, includeOxc, projectLicense, selectedModules, templateMetadata.generatorVersion), null, 2)}
 `);
-  await writeFile7(join7(input.targetDirectory, "docker-compose.yml"), starterCompose);
-  await writeFile7(join7(input.targetDirectory, ".env.example"), environmentExample(includeExample));
-  await writeFile7(join7(input.targetDirectory, "README.md"), starterReadme(input.projectName, includeExample, includeOxc, projectLicense, selectedModules));
-  await writeFile7(join7(input.targetDirectory, "docs/README.md"), starterDocsReadme(selectedModules.includes("system.license")));
+  await writeFile7(join8(input.targetDirectory, "docker-compose.yml"), starterCompose);
+  await writeFile7(join8(input.targetDirectory, ".env.example"), environmentExample(includeExample));
+  await writeFile7(join8(input.targetDirectory, "README.md"), starterReadme(input.projectName, includeExample, includeOxc, projectLicense, selectedModules));
+  await writeFile7(join8(input.targetDirectory, "docs/README.md"), starterDocsReadme(selectedModules.includes("system.license")));
   await reflectCodeQualityChoice(input.targetDirectory, includeOxc);
   await applyWindyBaseLicense(input.targetDirectory);
   await applyProjectLicense(input.targetDirectory, projectLicense, input.licenseHolder);
   await prepareCustomerDockerfiles(input.targetDirectory);
   await writeGenerationProvenance(input.targetDirectory, templateMetadata, input.profile ?? starterProfile.key, selectedModules, includeOxc, projectLicense);
-  await rm3(join7(input.targetDirectory, "bun.lock"), { force: true });
+  await rm3(join8(input.targetDirectory, "bun.lock"), { force: true });
   await writeManagedFilesManifest(input.targetDirectory, templateMetadata.generatorVersion);
 }
 async function resolveTemplateSource(sourceRoot, relativePath2) {
-  const source = join7(sourceRoot, relativePath2);
+  const source = join8(sourceRoot, relativePath2);
   try {
     await lstat3(source);
     return source;
@@ -1728,7 +1791,7 @@ async function resolveTemplateSource(sourceRoot, relativePath2) {
   const alias = npmTemplateAliases[relativePath2];
   if (!alias)
     return source;
-  return join7(sourceRoot, alias);
+  return join8(sourceRoot, alias);
 }
 async function assertGeneratedProjectIsClean(targetDirectory) {
   const violations = [];
@@ -1770,11 +1833,11 @@ async function copyTree(source, target) {
   if (metadata.isDirectory()) {
     await mkdir3(target, { recursive: true });
     for (const child of await readdir3(source)) {
-      await copyTree(join7(source, child), join7(target, child));
+      await copyTree(join8(source, child), join8(target, child));
     }
     return;
   }
-  await mkdir3(join7(target, ".."), { recursive: true });
+  await mkdir3(join8(target, ".."), { recursive: true });
   await copyFile(source, target);
 }
 function shouldExclude(name) {
@@ -1782,7 +1845,7 @@ function shouldExclude(name) {
 }
 async function walk(directory, visit) {
   for (const name of await readdir3(directory)) {
-    const path = join7(directory, name);
+    const path = join8(directory, name);
     await visit(path);
     if ((await lstat3(path)).isDirectory())
       await walk(path, visit);
@@ -1815,6 +1878,7 @@ async function createProject(options, dependencies = {}) {
   const inspect = dependencies.inspect ?? assertGeneratedProjectIsClean;
   const resolveTemplate = dependencies.resolveTemplate ?? resolveTemplateRoot;
   let stage = "生成文件";
+  let localEnvironment = "existing";
   try {
     await generate({
       sourceRoot: await resolveTemplate(),
@@ -1831,6 +1895,8 @@ async function createProject(options, dependencies = {}) {
     await inspect(options.targetDirectory);
     stage = "安装与验证";
     await installAndVerify(options.targetDirectory, options.install, options.verify, options.includeOxc, dependencies.commandExecutor);
+    stage = "初始化本地环境";
+    localEnvironment = await (dependencies.initializeEnvironment ?? initializeLocalEnvironment)(options.targetDirectory);
   } catch (error) {
     await rollbackFailedTarget(options, targetState);
     throw stageError(stage, error);
@@ -1848,7 +1914,13 @@ async function createProject(options, dependencies = {}) {
 已创建 ${options.projectName}`);
   log(`运行时：Bun ${bunVersion}`);
   log(options.initializeGit ? gitInitialized ? "Git：已创建 main 分支和首次提交" : "Git：项目已保留，请按上述提示完成初始化" : "Git：已按 --no-git 跳过");
-  log(`下一步：cd ${options.projectName} && bun run dev`);
+  log(localEnvironment === "created" ? "本地 .env：已生成随机开发密码（权限 0600）" : "本地 .env：已存在，未覆盖");
+  log("初始平台账号：admin");
+  log("初始平台密码：查看 .env 中的 WINDY_BOOTSTRAP_ADMIN_PASSWORD（首次登录后必须修改）");
+  log("下一步（启动数据库、迁移、后端与前端）：");
+  log(`  cd ${options.projectName}`);
+  log("  bun run dev");
+  log("仅启动前端：bun run dev:web");
 }
 async function inspectTarget(path) {
   try {
@@ -3624,8 +3696,8 @@ import { rm as rm8 } from "node:fs/promises";
 import { resolve as resolve4 } from "node:path";
 
 // src/update/doctor.ts
-import { readFile as readFile9 } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { readFile as readFile10 } from "node:fs/promises";
+import { join as join10 } from "node:path";
 
 // src/update/process.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -3657,11 +3729,11 @@ import {
   access as access2,
   copyFile as copyFile2,
   mkdir as mkdir5,
-  readFile as readFile8,
+  readFile as readFile9,
   rm as rm5,
   writeFile as writeFile8
 } from "node:fs/promises";
-import { dirname as dirname3, join as join8 } from "node:path";
+import { dirname as dirname3, join as join9 } from "node:path";
 var updateStatePath = ".windy/update-state.json";
 async function applyTransaction(plan) {
   if (plan.conflicts.length) {
@@ -3670,7 +3742,7 @@ async function applyTransaction(plan) {
   const changed = plan.files.filter(({ action }) => action === "create" || action === "update" || action === "delete");
   for (const file of changed)
     assertSafePath(file.path);
-  const backupDirectory = join8(plan.projectDirectory, ".windy/backups", plan.id);
+  const backupDirectory = join9(plan.projectDirectory, ".windy/backups", plan.id);
   const protectedPaths = new Set([
     ...changed.map(({ path: path2 }) => path2),
     ".windy/generation.json",
@@ -3679,12 +3751,12 @@ async function applyTransaction(plan) {
   ]);
   const backupEntries = [];
   for (const path2 of protectedPaths) {
-    const source = join8(plan.projectDirectory, path2);
+    const source = join9(plan.projectDirectory, path2);
     const existed = await exists(source);
     backupEntries.push({ path: path2, existed });
     if (!existed)
       continue;
-    const target = join8(backupDirectory, "files", path2);
+    const target = join9(backupDirectory, "files", path2);
     await mkdir5(dirname3(target), { recursive: true });
     await copyFile2(source, target);
   }
@@ -3697,7 +3769,7 @@ async function applyTransaction(plan) {
   await writeState(plan.projectDirectory, state);
   try {
     for (const file of changed) {
-      const target = join8(plan.projectDirectory, file.path);
+      const target = join9(plan.projectDirectory, file.path);
       if (file.action === "delete") {
         await rm5(target, { force: true });
         continue;
@@ -3720,7 +3792,7 @@ async function applyTransaction(plan) {
 }
 async function readUpdateState(projectDirectory) {
   try {
-    const parsed = JSON.parse(await readFile8(join8(projectDirectory, updateStatePath), "utf8"));
+    const parsed = JSON.parse(await readFile9(join9(projectDirectory, updateStatePath), "utf8"));
     if (!isUpdateState(parsed))
       throw new Error("更新恢复状态无效，请人工检查 .windy 目录");
     return parsed;
@@ -3733,23 +3805,23 @@ async function readUpdateState(projectDirectory) {
 async function restoreUpdateState(projectDirectory, state) {
   for (const entry of state.entries) {
     assertSafePath(entry.path);
-    const target = join8(projectDirectory, entry.path);
+    const target = join9(projectDirectory, entry.path);
     if (!entry.existed) {
       await rm5(target, { force: true });
       continue;
     }
-    const backup = join8(state.backupDirectory, "files", entry.path);
+    const backup = join9(state.backupDirectory, "files", entry.path);
     await mkdir5(dirname3(target), { recursive: true });
     await copyFile2(backup, target);
   }
-  await rm5(join8(projectDirectory, updateStatePath), { force: true });
+  await rm5(join9(projectDirectory, updateStatePath), { force: true });
   await rm5(state.backupDirectory, { recursive: true, force: true });
 }
 async function clearUpdateState(projectDirectory) {
-  await rm5(join8(projectDirectory, updateStatePath), { force: true });
+  await rm5(join9(projectDirectory, updateStatePath), { force: true });
 }
 async function writeState(projectDirectory, state) {
-  const path2 = join8(projectDirectory, updateStatePath);
+  const path2 = join9(projectDirectory, updateStatePath);
   await mkdir5(dirname3(path2), { recursive: true });
   await writeFile8(path2, `${JSON.stringify(state, null, 2)}
 `);
@@ -3799,7 +3871,7 @@ async function diagnoseProject(projectDirectory, repair = false) {
     if (file.ownership === "project-owned")
       continue;
     try {
-      const changed = hashContent(await readFile9(join9(projectDirectory, file.path))) !== file.hash;
+      const changed = hashContent(await readFile10(join10(projectDirectory, file.path))) !== file.hash;
       if (!changed)
         continue;
       modifiedManagedFiles.push(file.path);
@@ -3834,7 +3906,9 @@ var recipes = [
   { id: "starter-0.2.1-to-0.2.2", from: "0.2.1", to: "0.2.2" },
   { id: "starter-0.2.2-to-0.2.3", from: "0.2.2", to: "0.2.3" },
   { id: "starter-0.2.3-to-0.2.4", from: "0.2.3", to: "0.2.4" },
-  { id: "starter-0.2.4-to-0.2.5", from: "0.2.4", to: "0.2.5" }
+  { id: "starter-0.2.4-to-0.2.5", from: "0.2.4", to: "0.2.5" },
+  { id: "starter-0.2.5-to-0.2.6", from: "0.2.5", to: "0.2.6" },
+  { id: "starter-0.2.6-to-0.2.7", from: "0.2.6", to: "0.2.7" }
 ];
 function resolveRecipeChain(sourceVersion, targetVersion) {
   if (sourceVersion === targetVersion)
@@ -3859,19 +3933,19 @@ function resolveRecipeChain(sourceVersion, targetVersion) {
 }
 
 // src/update/updater.ts
-import { mkdir as mkdir7, readFile as readFile12, rm as rm7, writeFile as writeFile10 } from "node:fs/promises";
-import { dirname as dirname4, join as join13 } from "node:path";
+import { mkdir as mkdir7, readFile as readFile13, rm as rm7, writeFile as writeFile10 } from "node:fs/promises";
+import { dirname as dirname4, join as join14 } from "node:path";
 
 // src/update/artifacts.ts
-import { mkdir as mkdir6, mkdtemp, readFile as readFile10 } from "node:fs/promises";
+import { mkdir as mkdir6, mkdtemp, readFile as readFile11 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { basename as basename3, join as join10 } from "node:path";
+import { basename as basename3, join as join11 } from "node:path";
 class PublishedArtifactProvider {
   async prepare(projectDirectory, provenance) {
-    const temporaryRoot = await mkdtemp(join10(tmpdir(), "windy-update-"));
+    const temporaryRoot = await mkdtemp(join11(tmpdir(), "windy-update-"));
     const projectName = await readProjectName2(projectDirectory);
-    const baseDirectory = join10(temporaryRoot, "base", projectName);
-    const targetDirectory = join10(temporaryRoot, "target", projectName);
+    const baseDirectory = join11(temporaryRoot, "base", projectName);
+    const targetDirectory = join11(temporaryRoot, "target", projectName);
     await generatePublishedBase(temporaryRoot, projectName, provenance, baseDirectory);
     await generateProject({
       sourceRoot: await resolveTemplateRoot(),
@@ -3887,7 +3961,7 @@ class PublishedArtifactProvider {
   }
 }
 async function generatePublishedBase(temporaryRoot, projectName, provenance, expectedDirectory) {
-  const parent = join10(temporaryRoot, "base");
+  const parent = join11(temporaryRoot, "base");
   await mkdir6(parent, { recursive: true });
   const args = [
     "--bun",
@@ -3911,29 +3985,29 @@ async function generatePublishedBase(temporaryRoot, projectName, provenance, exp
     }
   }
   await assertProcess("bunx", args, parent);
-  if (join10(parent, projectName) !== expectedDirectory) {
+  if (join11(parent, projectName) !== expectedDirectory) {
     throw new Error("历史 artifact 生成目录异常");
   }
 }
 async function readProjectName2(projectDirectory) {
-  const source = JSON.parse(await readFile10(join10(projectDirectory, "package.json"), "utf8"));
+  const source = JSON.parse(await readFile11(join11(projectDirectory, "package.json"), "utf8"));
   return source.name || basename3(projectDirectory);
 }
 
 // src/update/planner.ts
-import { access as access3, readFile as readFile11 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { access as access3, readFile as readFile12 } from "node:fs/promises";
+import { join as join13 } from "node:path";
 
 // src/update/merge.ts
 import { mkdtemp as mkdtemp2, rm as rm6, writeFile as writeFile9 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 async function mergeTextFile(base, ours, theirs) {
-  const root = await mkdtemp2(join11(tmpdir2(), "windy-merge-"));
+  const root = await mkdtemp2(join12(tmpdir2(), "windy-merge-"));
   try {
-    const oursPath = join11(root, "ours");
-    const basePath = join11(root, "base");
-    const theirsPath = join11(root, "theirs");
+    const oursPath = join12(root, "ours");
+    const basePath = join12(root, "base");
+    const theirsPath = join12(root, "theirs");
     await Promise.all([
       writeFile9(oursPath, ours),
       writeFile9(basePath, base),
@@ -4055,9 +4129,9 @@ async function createUpdatePlan(request, artifacts) {
 }
 async function planFile(path2, project, baseRoot, targetRoot, source, target) {
   const [ours, base, theirs] = await Promise.all([
-    readOptional(join12(project, path2)),
-    readOptional(join12(baseRoot, path2)),
-    readOptional(join12(targetRoot, path2))
+    readOptional(join13(project, path2)),
+    readOptional(join13(baseRoot, path2)),
+    readOptional(join13(targetRoot, path2))
   ]);
   const ownership = target?.ownership || source?.ownership || classifyOwnership(path2);
   if (path2.startsWith("packages/database/drizzle/") && path2.endsWith(".sql")) {
@@ -4125,7 +4199,7 @@ function conflict(path2, ownership, reason) {
 }
 async function readOptional(path2) {
   try {
-    return await readFile11(path2);
+    return await readFile12(path2);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
       return;
@@ -4141,7 +4215,7 @@ async function assertGitClean(projectDirectory) {
 }
 async function assertNoPendingUpdate(projectDirectory) {
   try {
-    await access3(join12(projectDirectory, ".windy/update-state.json"));
+    await access3(join13(projectDirectory, ".windy/update-state.json"));
     throw new Error("检测到未完成更新，请先运行 bun run windy doctor --repair");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
@@ -4177,7 +4251,7 @@ class DefaultStarterUpdater {
     try {
       await this.#execute("bun", ["install", "--force"], result.plan.projectDirectory);
       steps.push({ name: "bun install --force", status: "passed" });
-      const packageJson = JSON.parse(await readFile12(join13(result.plan.projectDirectory, "package.json"), "utf8"));
+      const packageJson = JSON.parse(await readFile13(join14(result.plan.projectDirectory, "package.json"), "utf8"));
       for (const name of ["lint", "typecheck", "test", "build"]) {
         if (!packageJson.scripts?.[name]) {
           steps.push({ name: `bun run ${name}`, status: "skipped" });
@@ -4206,13 +4280,13 @@ class DefaultStarterUpdater {
 }
 async function finalize(result) {
   const root = result.plan.projectDirectory;
-  await writeFile10(join13(root, ".windy/generation.json"), `${JSON.stringify(result.plan.targetProvenance, null, 2)}
+  await writeFile10(join14(root, ".windy/generation.json"), `${JSON.stringify(result.plan.targetProvenance, null, 2)}
 `);
-  await writeFile10(join13(root, ".windy/files.json"), `${JSON.stringify(result.plan.targetManifest, null, 2)}
+  await writeFile10(join14(root, ".windy/files.json"), `${JSON.stringify(result.plan.targetManifest, null, 2)}
 `);
 }
 async function writeReport(result, steps, relativePath2) {
-  const path2 = join13(result.plan.projectDirectory, relativePath2);
+  const path2 = join14(result.plan.projectDirectory, relativePath2);
   await mkdir7(dirname4(path2), { recursive: true });
   const lines = [
     `# Windy 更新报告 ${result.plan.id}`,