@hs-x/cli 0.2.6 → 0.3.0

package/dist/commands/rollback.js

@@ -1,10 +1,13 @@
 import * as Command from '@effect/cli/Command';
 import * as Options from '@effect/cli/Options';
 import { HttpClientRequest, Schema, schemas } from '@hs-x/types';
+import { runTrafficRollback } from '@hs-x/types/rollback';
 import { Config, Effect, Option } from 'effect';
-import { loadStore } from '../account-store.js';
-import { CliError, cliError, exitWith } from '../cli-error.js';
+import { cliError, exitWith } from '../cli-error.js';
 import { accountIdOption, controlPlaneUrlOption, cwdOption, deployIdOption, forceOption, jsonOption, projectIdOption, runHandler, userIdOption, yesOption, } from '../cli/kit.js';
+import { readLocalProjectContext, resolveProjectId } from '../project-context.js';
+import { ProjectPickerCancelled, resolveAccountId, resolveProjectSelection, } from '../project-picker.js';
+import { isInteractive, promptConfirm, promptSelect, } from '../prompt.js';
 import { AccountStore } from '../services/account-store.js';
 import { CloudflareAuth } from '../services/cloudflare-auth.js';
 import { ControlPlaneClient } from '../services/control-plane.js';
@@ -15,13 +18,19 @@ import { Reporter } from '../services/reporter.js';
 import { TenantState } from '../services/tenant-state.js';
 const environmentOption = Options.text('environment').pipe(Options.withAlias('env'), Options.optional);
 // ─── Native @effect/cli command (Phase 4) ───────────────────────────────────
-// `rollback` moves the active deploy pointer. Linked: control-plane POST via
-// `ControlPlaneClient.authHeaders` + `CliHttp`. Unlinked: rewrites
+// `rollback` restores live traffic to a prior deploy. Linked (ADR-021 R04):
+// TRAFFIC-FIRST — a membership-gated control-plane PLAN resolves the verified
+// target + operation id (`ControlPlaneClient.authHeaders` + `CliHttp`), then the
+// R01 Worker Versions/Deployments adapter creates a 100% Cloudflare deployment
+// of that version and health-probes it, and only THEN a COMMIT records the
+// verbatim outcome + advances the active pointer. Unlinked: rewrites
 // `LocalActiveDeploy` in tenant KV through `TenantState` (pointer + credentials
 // resolved via `CloudflareAuth.loadPointer` and `Config`), with `MachineId` for
-// the audit stamp. Interactive prompts are skipped under --json / non-TTY (and
-// quarantined behind the legacy prompt helpers otherwise), so the subprocess
-// tests' exact stdout/exit assertions are preserved.
+// the audit stamp — bookkeeping only, honestly labelled (unlinked deploys carry
+// no captured Cloudflare version, so there is no verified target to serve).
+// Interactive prompts are skipped under --json / non-TTY (and quarantined behind
+// the legacy prompt helpers otherwise), so the subprocess tests' exact
+// stdout/exit assertions are preserved.
 //
 // JSON-shape MISMATCH (flagged, NOT changed): every `--json` branch emits a
 // bespoke pretty-printed object (e.g. `{ ok, command:'rollback', linkState,
@@ -43,6 +52,16 @@ export const rollbackCmd = Command.make('rollback', {
 }, (opts) => runHandler('rollback', { json: opts.json }, rollbackBody(opts)));
 function rollbackBody(opts) {
     return Effect.gen(function* () {
+        const reporter = yield* Reporter;
+        const needsExplicitConsent = !opts.yes && (opts.json || reporter.mode === 'ndjson' || !isInteractive());
+        if (needsExplicitConsent) {
+            const message = 'Rollback requires explicit consent in machine or non-interactive mode. Re-run with --yes.';
+            if (opts.json) {
+                yield* reporter.raw(`${JSON.stringify({ ok: false, error: message }, null, 2)}\n`);
+                return yield* Effect.fail(exitWith(1, 'HSX_E_INPUT_INVALID'));
+            }
+            return yield* Effect.fail(cliError('HSX_E_INPUT_INVALID', message));
+        }
         const store = yield* AccountStore;
         const envControlPlaneUrl = yield* Config.string('HSX_CONTROL_PLANE_URL').pipe(Config.withDefault(''), Effect.orDie);
         const explicitControlPlaneUrl = Option.getOrUndefined(opts.controlPlaneUrl) ?? (envControlPlaneUrl || undefined);
@@ -60,17 +79,55 @@ function rollbackLinkedEff(opts, explicitControlPlaneUrl) {
     return Effect.gen(function* () {
         const controlPlane = yield* ControlPlaneClient;
         const reporter = yield* Reporter;
-        const resolvedAcct = yield* resolveAccountIdEff(opts);
-        const projectId = yield* resolveWithEnv(opts.projectId, 'HSX_PROJECT_ID');
-        const accountId = (yield* resolveWithEnv(opts.accountId, 'HSX_ACCOUNT_ID')) ?? resolvedAcct;
+        const accounts = yield* AccountStore;
+        const cwd = yield* Cwd;
+        const root = Option.getOrElse(opts.cwd, () => cwd);
+        const local = yield* Effect.promise(() => readLocalProjectContext(root));
+        const stored = yield* accounts.load;
+        const envAccountId = yield* resolveEnv('HSX_ACCOUNT_ID');
+        const envProjectId = yield* resolveEnv('HSX_PROJECT_ID');
+        const explicitAccountId = Option.getOrUndefined(opts.accountId);
+        const accountId = resolveAccountId({
+            ...(explicitAccountId ? { explicitAccountId } : {}),
+            ...(envAccountId ? { envAccountId } : {}),
+            ...(local.projectBinding?.accountId
+                ? { localAccountId: local.projectBinding.accountId }
+                : {}),
+            ...(stored.defaultAccountId ? { defaultAccountId: stored.defaultAccountId } : {}),
+        });
+        const resolvedProject = resolveProjectId({
+            explicit: Option.getOrUndefined(opts.projectId),
+            env: envProjectId,
+            local,
+        });
         const controlPlaneUrl = explicitControlPlaneUrl;
-        const targetDeployId = Option.getOrUndefined(opts.deployId);
-        if (!projectId || !accountId || !controlPlaneUrl) {
-            return yield* Effect.fail(cliError('HSX_E_INTERNAL', 'Linked rollback requires --project-id/HSX_PROJECT_ID, --account-id/HSX_ACCOUNT_ID, and --control-plane-url/HSX_CONTROL_PLANE_URL.'));
+        const allowDiscovery = !opts.json && reporter.mode !== 'ndjson' && isInteractive();
+        // Automation never makes discovery-only calls: all authoritative context
+        // must come from flags, environment, or the checkout binding, and consent
+        // must already have been supplied by --yes (enforced before this function).
+        if (!accountId || !controlPlaneUrl || (!resolvedProject && !allowDiscovery)) {
+            return yield* Effect.fail(cliError('HSX_E_INTERNAL', 'Linked rollback requires --project-id/HSX_PROJECT_ID (or a linked project directory), --account-id/HSX_ACCOUNT_ID, and --control-plane-url/HSX_CONTROL_PLANE_URL. A human TTY may omit project and deploy to choose them interactively.'));
         }
         const userId = yield* resolveUserIdEff(opts.userId);
         const headers = yield* controlPlane.authHeaders(userId);
-        const rollback = yield* requestControlPlaneRollbackEff({
+        const environment = Option.getOrUndefined(opts.environment) ??
+            (yield* resolveEnv('HSX_ENVIRONMENT')) ??
+            'production';
+        const discovery = yield* resolveLinkedRollbackDiscoveryEff({
+            accountId,
+            controlPlaneUrl,
+            headers,
+            authoritativeProjectId: resolvedProject?.value,
+            localProjectId: local.projectBinding?.projectId,
+            targetDeployId: Option.getOrUndefined(opts.deployId),
+            environment,
+            allowDiscovery,
+        });
+        const projectId = discovery.projectId;
+        const targetDeployId = discovery.targetDeployId;
+        // Phase 1 — membership-gated PLAN (no traffic change). A non-member/cross-
+        // account caller is rejected here, so no Cloudflare work is reachable.
+        const plan = yield* requestRollbackPlanEff({
             controlPlaneUrl,
             projectId,
             accountId,
@@ -78,22 +135,189 @@ function rollbackLinkedEff(opts, explicitControlPlaneUrl) {
             force: opts.force,
             headers,
         });
+        // The authorized PLAN is read-only and resolves the exact target/version
+        // plus deterministic operation id. Show that target before credentials or
+        // any live traffic change. --force is visible as a compatibility override;
+        // it never doubles as consent.
+        if (!opts.json) {
+            const preview = linkedRollbackPreview({
+                projectId: plan.projectId,
+                fromDeployId: plan.fromDeploy.deployId,
+                targetDeployId: plan.targetDeploy.deployId,
+                targetVersionId: plan.revision.versionId,
+                operationId: plan.operationId,
+                warnings: plan.warnings,
+                force: opts.force,
+            });
+            if (reporter.mode === 'ndjson') {
+                yield* reporter.event('rollback.preview', preview.data);
+            }
+            else {
+                yield* reporter.header(projectId);
+                yield* reporter.block(preview.text);
+            }
+        }
+        const confirmation = yield* Effect.promise(() => confirmRollbackOperation({
+            yes: opts.yes,
+            machineOutput: opts.json || reporter.mode === 'ndjson',
+            message: `Move live traffic from ${plan.fromDeploy.deployId} to ${plan.targetDeploy.deployId}?`,
+        }));
+        if (confirmation !== 'proceed') {
+            if (confirmation === 'require-yes') {
+                return yield* Effect.fail(cliError('HSX_E_INPUT_INVALID', 'Rollback requires explicit consent in machine or non-interactive mode. Re-run with --yes.'));
+            }
+            yield* reporter.info('Cancelled.');
+            return yield* Effect.fail(exitWith(130));
+        }
+        // Cloudflare credentials for the real traffic change (ADR-021: metadata-only
+        // rollback is retired — a rollback that cannot reach Cloudflare must fail
+        // rather than silently claim a traffic change it did not make).
+        const cf = yield* resolveCloudflareRollbackCredsEff();
+        // Phase 2 — TRAFFIC-FIRST: create the 100% Cloudflare deployment of the
+        // target version, health-probe it, restore-on-failure. Verbatim outcome.
+        const outcome = yield* Effect.tryPromise({
+            try: () => runTrafficRollback({ ...(cf.baseUrl ? { baseUrl: cf.baseUrl } : {}) }, { plan, apiToken: cf.apiToken, force: opts.force }),
+            catch: (cause) => cliError('HSX_E_ROLLBACK_FAILED', `Cloudflare rollback failed: ${String(cause)}`),
+        });
+        // Phase 3 — RECORD-SECOND: commit the outcome. The control plane advances
+        // its active pointer only for confirmed-live statuses.
+        const commit = yield* commitRollbackEff({
+            controlPlaneUrl,
+            projectId,
+            accountId,
+            operation: outcome.operation,
+            headers,
+        });
+        if (!outcome.ok) {
+            const detail = outcome.operation.detail ?? 'Rollback did not complete.';
+            if (opts.json) {
+                yield* reporter.raw(`${JSON.stringify({
+                    ok: false,
+                    command: 'rollback',
+                    linkState: 'linked',
+                    mode: 'cloudflare-traffic-rollback',
+                    status: outcome.operation.status,
+                    operation: outcome.operation,
+                    error: detail,
+                }, null, 2)}\n`);
+                return yield* Effect.fail(exitWith(1, 'HSX_E_ROLLBACK_FAILED'));
+            }
+            return yield* Effect.fail(cliError('HSX_E_ROLLBACK_FAILED', `${detail} (status: ${outcome.operation.status})`));
+        }
         const result = {
             ok: true,
             command: 'rollback',
             linkState: 'linked',
-            mode: 'control-plane-rollback',
-            rollback,
+            mode: 'cloudflare-traffic-rollback',
+            status: outcome.operation.status,
+            liveVersionId: outcome.liveVersionId,
+            liveDeploymentId: outcome.liveDeploymentId,
+            operation: outcome.operation,
+            ...(commit.rollback ? { rollback: commit.rollback } : {}),
         };
         if (opts.json) {
             yield* reporter.raw(`${JSON.stringify(result, null, 2)}\n`);
             return;
         }
         yield* reporter.header(projectId);
-        yield* reporter.block(renderControlPlaneRollback(rollback));
+        yield* reporter.block(renderTrafficRollback(outcome, commit));
         yield* reporter.done('Rolled back');
     });
 }
+/**
+ * Eligible human rollback choices, newest first. History-only deploys have no
+ * verified Worker revision and the active deploy cannot be its own target.
+ * Compatibility/adjacency remains authoritative in the subsequent PLAN.
+ */
+export function linkedRollbackRevisionOptions(read) {
+    return read.revisions
+        .filter((record) => record.deployId !== read.activeDeployId && record.revision !== undefined)
+        .sort((left, right) => right.recordedAt.localeCompare(left.recordedAt))
+        .map((record) => ({
+        value: record.deployId,
+        label: record.deployId,
+        description: `${record.recordedAt} — ${record.status}`,
+    }));
+}
+function resolveLinkedRollbackDiscoveryEff(input) {
+    return Effect.gen(function* () {
+        let projectId = input.authoritativeProjectId;
+        let projectLabel = projectId;
+        if (!projectId) {
+            const projects = yield* fetchRollbackProjectsEff(input);
+            const project = yield* Effect.tryPromise({
+                try: () => resolveProjectSelection({
+                    accountId: input.accountId,
+                    projects,
+                    ...(input.localProjectId ? { localProjectId: input.localProjectId } : {}),
+                    allowPrompt: input.allowDiscovery,
+                    prompts: {
+                        select: (options) => promptSelect(options),
+                    },
+                    message: 'Which project do you want to roll back?',
+                }),
+                catch: rollbackDiscoveryError,
+            });
+            projectId = project.id;
+            projectLabel = project.displayName;
+        }
+        if (!projectId) {
+            return yield* Effect.fail(cliError('HSX_E_INTERNAL', 'Linked rollback could not resolve a project.'));
+        }
+        let targetDeployId = input.targetDeployId;
+        if (!targetDeployId && input.allowDiscovery) {
+            const revisions = yield* fetchRollbackRevisionsEff({ ...input, projectId });
+            const options = linkedRollbackRevisionOptions(revisions);
+            if (options.length === 0) {
+                return yield* Effect.fail(cliError('HSX_E_ROLLBACK_FAILED', `No prior revision-backed deploy is available to roll back ${projectLabel ?? projectId}.`));
+            }
+            targetDeployId = yield* Effect.promise(() => promptSelect({
+                message: `Which deploy should ${projectLabel ?? projectId}/${input.environment} roll back to?`,
+                options,
+            }));
+            if (!targetDeployId)
+                return yield* Effect.fail(exitWith(130));
+        }
+        return { projectId, targetDeployId };
+    });
+}
+function fetchRollbackProjectsEff(input) {
+    return Effect.gen(function* () {
+        const body = yield* rollbackDiscoveryGetEff(input, `/v1/accounts/${encodeURIComponent(input.accountId)}/projects`, 'Project discovery failed');
+        return yield* decodeRollbackDiscoveryEff(schemas.ListProjectsResponse, body).pipe(Effect.map((decoded) => decoded.projects));
+    });
+}
+function fetchRollbackRevisionsEff(input) {
+    return Effect.gen(function* () {
+        const body = yield* rollbackDiscoveryGetEff(input, `/v1/projects/${encodeURIComponent(input.projectId)}/revisions`, 'Revision discovery failed');
+        return yield* decodeRollbackDiscoveryEff(schemas.ProjectRevisionRead, body);
+    });
+}
+function rollbackDiscoveryGetEff(input, path, fallback) {
+    return Effect.gen(function* () {
+        const http = yield* CliHttp;
+        const request = HttpClientRequest.make('GET')(new URL(path, input.controlPlaneUrl)).pipe(HttpClientRequest.setHeaders(input.headers));
+        const response = yield* http.execute(request);
+        const body = yield* Effect.promise(() => response.json().catch(() => undefined));
+        if (!response.ok) {
+            return yield* Effect.fail(cliError('HSX_E_ROLLBACK_FAILED', isRecord(body) && typeof body.message === 'string'
+                ? body.message
+                : `${fallback} with status ${response.status}`));
+        }
+        return body;
+    });
+}
+function decodeRollbackDiscoveryEff(schema, body) {
+    return Effect.try({
+        try: () => Schema.decodeUnknownSync(schema)(body),
+        catch: (cause) => cliError('HSX_E_ROLLBACK_FAILED', `Invalid discovery response: ${cause}`),
+    });
+}
+function rollbackDiscoveryError(cause) {
+    return cause instanceof ProjectPickerCancelled
+        ? exitWith(130)
+        : cliError('HSX_E_ROLLBACK_FAILED', cause instanceof Error ? cause.message : String(cause));
+}
 function rollbackUnlinkedEff(opts) {
     return Effect.gen(function* () {
         const cwd = yield* Cwd;
@@ -114,19 +338,48 @@ function rollbackUnlinkedEff(opts) {
         });
         const projectId = yield* resolveWithEnv(opts.projectId, 'HSX_PROJECT_ID');
         const environment = Option.getOrElse(opts.environment, () => 'production');
-        const targetDeployId = Option.getOrUndefined(opts.deployId);
         if (!projectId) {
             return yield* failBespoke('Unlinked rollback requires --project-id (or HSX_PROJECT_ID). Linked rollback also accepts --account-id + --control-plane-url; run `hs-x link` to use it.');
         }
-        if (!targetDeployId) {
-            return yield* failBespoke('Unlinked rollback requires --deploy-id (the prior deploy to make active). Use `hs-x history` or check `.hs-x/` deploy entries for valid ids.');
-        }
         const pointer = yield* cloudflare.loadPointer(root);
         if (!pointer) {
             return yield* failBespoke('No `.hs-x/cloudflare.json` found in this project. Unlinked rollback can only operate on projects that have been deployed at least once.');
         }
         const credentials = yield* resolveTenantCredentialsEff(pointer.cloudflareAccountId);
         const stateStore = yield* tenantState.store({ pointer, credentials });
+        // Resolve the deploy to make active: the explicit --deploy-id, else an
+        // interactive picker over prior recorded deploys for this environment.
+        // `--json` / non-TTY skip the prompt (promptSelect returns undefined off a
+        // TTY) and fall through to the clear missing-argument error below.
+        let targetDeployId = Option.getOrUndefined(opts.deployId);
+        let pickerOpened = false;
+        if (!targetDeployId && !opts.json && isInteractive()) {
+            const activeNow = yield* stateStore.getActive({ projectId, environment });
+            const recorded = yield* stateStore.listDeploys({ projectId });
+            const candidates = recorded
+                .filter((entry) => entry.environment === environment &&
+                entry.status === 'deployed' &&
+                entry.deployId !== activeNow?.deployId)
+                .sort((a, b) => (a.updatedAt < b.updatedAt ? 1 : a.updatedAt > b.updatedAt ? -1 : 0));
+            if (candidates.length > 0) {
+                pickerOpened = true;
+                targetDeployId = yield* Effect.promise(() => promptSelect({
+                    message: `Which deploy should become active for ${projectId}/${environment}?`,
+                    options: candidates.map((entry) => ({
+                        value: entry.deployId,
+                        label: entry.deployId,
+                        description: entry.updatedAt,
+                    })),
+                }));
+            }
+        }
+        if (!targetDeployId && pickerOpened) {
+            yield* reporter.info('Cancelled.');
+            return yield* Effect.fail(exitWith(130));
+        }
+        if (!targetDeployId) {
+            return yield* failBespoke('Unlinked rollback requires --deploy-id (the prior deploy to make active). Use `hs-x history` or check `.hs-x/` deploy entries for valid ids.');
+        }
         const target = yield* stateStore.getDeploy({ projectId, deployId: targetDeployId });
         if (!target) {
             return yield* failBespoke(`Deploy ${targetDeployId} not found in tenant state for owner ${pointer.ownerId} (project ${projectId}).`);
@@ -155,6 +408,33 @@ function rollbackUnlinkedEff(opts) {
             yield* reporter.done('No change');
             return;
         }
+        const preview = unlinkedRollbackPreview({
+            projectId,
+            environment,
+            previousDeployId: previousActive?.deployId,
+            targetDeployId,
+        });
+        if (!opts.json) {
+            if (reporter.mode === 'ndjson') {
+                yield* reporter.event('rollback.preview', preview.data);
+            }
+            else {
+                yield* reporter.header(projectId);
+                yield* reporter.block(preview.text);
+            }
+        }
+        const confirmation = yield* Effect.promise(() => confirmRollbackOperation({
+            yes: opts.yes,
+            machineOutput: opts.json || reporter.mode === 'ndjson',
+            message: `Update the ${projectId}/${environment} active pointer to ${targetDeployId}?`,
+        }));
+        if (confirmation !== 'proceed') {
+            if (confirmation === 'require-yes') {
+                return yield* Effect.fail(cliError('HSX_E_INPUT_INVALID', 'Rollback requires explicit consent in machine or non-interactive mode. Re-run with --yes.'));
+            }
+            yield* reporter.info('Cancelled.');
+            return yield* Effect.fail(exitWith(130));
+        }
         const now = yield* Effect.sync(() => new Date().toISOString());
         const active = Schema.decodeUnknownSync(schemas.LocalActiveDeploy)({
             ownerId: pointer.ownerId,
@@ -208,21 +488,8 @@ function resolveUserIdEff(flag) {
         return env || 'local-cli-user';
     });
 }
-/**
- * Non-interactive account-id resolution for linked rollback: flag/env, else the
- * stored default account when present. The interactive picker the legacy used in
- * a TTY is deferred to the legacy path (see `resolveAccountIdOrPrompt`).
- */
-function resolveAccountIdEff(opts) {
-    return Effect.gen(function* () {
-        const fromFlagEnv = yield* resolveWithEnv(opts.accountId, 'HSX_ACCOUNT_ID');
-        if (fromFlagEnv)
-            return fromFlagEnv;
-        const store = yield* Effect.promise(() => loadStore());
-        const ids = Object.keys(store.accounts);
-        const defaultId = store.defaultAccountId;
-        return defaultId && ids.includes(defaultId) ? defaultId : undefined;
-    });
+function resolveEnv(key) {
+    return Config.string(key).pipe(Config.withDefault(''), Effect.orDie, Effect.map((value) => value || undefined));
 }
 /** Resolve Cloudflare API credentials for tenant KV (env-only, via `Config`). */
 function resolveTenantCredentialsEff(cloudflareAccountId) {
@@ -243,16 +510,27 @@ function resolveTenantCredentialsEff(cloudflareAccountId) {
         };
     });
 }
-/** Effect-native control-plane rollback POST over `CliHttp`. */
-function requestControlPlaneRollbackEff(input) {
+/** Resolve tenant Cloudflare credentials for the real traffic change (env-only). */
+function resolveCloudflareRollbackCredsEff() {
+    return Effect.gen(function* () {
+        const env = yield* Config.all({
+            tokenHsx: Config.string('HSX_CLOUDFLARE_API_TOKEN').pipe(Config.withDefault('')),
+            token: Config.string('CLOUDFLARE_API_TOKEN').pipe(Config.withDefault('')),
+            baseUrl: Config.string('HSX_CLOUDFLARE_API_BASE_URL').pipe(Config.withDefault('')),
+        }).pipe(Effect.orDie);
+        const apiToken = env.tokenHsx || env.token || undefined;
+        if (!apiToken) {
+            return yield* Effect.fail(cliError('HSX_E_ROLLBACK_CLOUDFLARE_CREDENTIALS', 'Rollback restores live Cloudflare traffic and needs a Cloudflare API token. Set HSX_CLOUDFLARE_API_TOKEN (or CLOUDFLARE_API_TOKEN).'));
+        }
+        return { apiToken, ...(env.baseUrl ? { baseUrl: env.baseUrl } : {}) };
+    });
+}
+/** Phase 1: membership-gated rollback PLAN POST over `CliHttp` (no traffic change). */
+function requestRollbackPlanEff(input) {
     return Effect.gen(function* () {
         const http = yield* CliHttp;
-        const url = new URL(`/v1/projects/${encodeURIComponent(input.projectId)}/rollback`, input.controlPlaneUrl);
-        const headers = {
-            ...input.headers,
-            'content-type': 'application/json',
-        };
-        const request = HttpClientRequest.make('POST')(url).pipe(HttpClientRequest.setHeaders(headers), HttpClientRequest.bodyText(JSON.stringify({
+        const url = new URL(`/v1/projects/${encodeURIComponent(input.projectId)}/rollback/plan`, input.controlPlaneUrl);
+        const request = HttpClientRequest.make('POST')(url).pipe(HttpClientRequest.setHeaders({ ...input.headers, 'content-type': 'application/json' }), HttpClientRequest.bodyText(JSON.stringify({
             accountId: input.accountId,
             ...(input.targetDeployId ? { targetDeployId: input.targetDeployId } : {}),
             ...(input.force ? { force: input.force } : {}),
@@ -260,41 +538,127 @@ function requestControlPlaneRollbackEff(input) {
         const response = yield* http.execute(request);
         const body = yield* Effect.promise(() => response.json().catch(() => undefined));
         if (!response.ok) {
-            return yield* Effect.fail(cliError('HSX_E_INTERNAL', isRecord(body) && typeof body.message === 'string'
+            return yield* Effect.fail(cliError('HSX_E_ROLLBACK_FAILED', isRecord(body) && typeof body.message === 'string'
                 ? body.message
-                : `Control-plane rollback failed with status ${response.status}`));
+                : `Rollback plan failed with status ${response.status}`));
         }
         return yield* Effect.try({
-            try: () => Schema.decodeUnknownSync(schemas.DeployRollbackResult)(body),
-            catch: (cause) => cliError('HSX_E_INTERNAL', String(cause)),
+            try: () => Schema.decodeUnknownSync(schemas.DeployRollbackPlan)(body),
+            catch: (cause) => cliError('HSX_E_ROLLBACK_FAILED', String(cause)),
         });
     });
 }
-function renderControlPlaneRollback(rollback) {
+/** Phase 3: commit the traffic-first rollback outcome POST over `CliHttp`. */
+function commitRollbackEff(input) {
+    return Effect.gen(function* () {
+        const http = yield* CliHttp;
+        const url = new URL(`/v1/projects/${encodeURIComponent(input.projectId)}/rollback/commit`, input.controlPlaneUrl);
+        const request = HttpClientRequest.make('POST')(url).pipe(HttpClientRequest.setHeaders({ ...input.headers, 'content-type': 'application/json' }), HttpClientRequest.bodyText(JSON.stringify({ accountId: input.accountId, operation: input.operation }), 'application/json'));
+        const response = yield* http.execute(request);
+        const body = yield* Effect.promise(() => response.json().catch(() => undefined));
+        if (!response.ok) {
+            return yield* Effect.fail(cliError('HSX_E_ROLLBACK_FAILED', isRecord(body) && typeof body.message === 'string'
+                ? body.message
+                : `Rollback commit failed with status ${response.status}`));
+        }
+        return yield* Effect.try({
+            try: () => Schema.decodeUnknownSync(schemas.DeployRollbackCommitResult)(body),
+            catch: (cause) => cliError('HSX_E_ROLLBACK_FAILED', String(cause)),
+        });
+    });
+}
+function renderTrafficRollback(outcome, commit) {
     const lines = [
-        `Rolled back ${rollback.projectId}`,
-        `Previous active: ${rollback.rolledBackFrom.deployId}`,
-        `New active: ${rollback.active.deployId}`,
+        `Rolled back ${outcome.operation.projectId}`,
+        `Now live: Cloudflare version ${outcome.liveVersionId}`,
+        `Cloudflare deployment: ${outcome.liveDeploymentId}`,
     ];
-    for (const warning of rollback.warnings) {
-        lines.push(`Warning: ${warning}`);
+    if (commit.rollback) {
+        lines.push(`Previous active deploy: ${commit.rollback.rolledBackFrom.deployId}`);
+        lines.push(`New active deploy: ${commit.rollback.active.deployId}`);
+        for (const warning of commit.rollback.warnings) {
+            lines.push(`Warning: ${warning}`);
+        }
+    }
+    if (outcome.alreadyApplied) {
+        lines.push('(idempotent: the target version was already live; reconciled without a duplicate deployment)');
     }
     return `${lines.join('\n')}\n`;
 }
+const liveRollbackConfirmationDeps = {
+    isInteractive,
+    confirm: promptConfirm,
+};
+/** Purely coordinates consent; --force is intentionally not an input. */
+export async function confirmRollbackOperation(input) {
+    if (input.yes)
+        return 'proceed';
+    const deps = input.deps ?? liveRollbackConfirmationDeps;
+    if (input.machineOutput || !deps.isInteractive())
+        return 'require-yes';
+    const confirmed = await deps.confirm({ message: input.message, default: false });
+    return confirmed === true ? 'proceed' : 'cancel';
+}
+export function linkedRollbackPreview(input) {
+    const lines = [
+        'Rollback preview (live traffic)',
+        `Project: ${input.projectId}`,
+        `Current deploy: ${input.fromDeployId}`,
+        `Target deploy: ${input.targetDeployId}`,
+        `Target Worker version: ${input.targetVersionId}`,
+        `Operation id: ${input.operationId}`,
+        `Compatibility override: ${input.force ? 'enabled (--force)' : 'off'}`,
+        ...input.warnings.map((warning) => `Warning: ${warning}`),
+    ];
+    return {
+        text: `${lines.join('\n')}\n`,
+        data: {
+            mode: 'cloudflare-traffic-rollback',
+            project_id: input.projectId,
+            from_deploy_id: input.fromDeployId,
+            target_deploy_id: input.targetDeployId,
+            target_version_id: input.targetVersionId,
+            operation_id: input.operationId,
+            force: input.force,
+            warnings: input.warnings,
+        },
+    };
+}
+export function unlinkedRollbackPreview(input) {
+    return {
+        text: `Rollback preview (tenant pointer only)\nProject: ${input.projectId}\nEnvironment: ${input.environment}\nCurrent active: ${input.previousDeployId ?? '(none)'}\nTarget active: ${input.targetDeployId}\nLive traffic is not redirected by this operation.\n`,
+        data: {
+            mode: 'tenant-kv-rollback',
+            project_id: input.projectId,
+            environment: input.environment,
+            from_deploy_id: input.previousDeployId ?? null,
+            target_deploy_id: input.targetDeployId,
+            effect: 'tenant-active-pointer-only',
+        },
+    };
+}
 export function rollbackHelpText() {
     return `hs-x rollback
 
 Linked (after \`hs-x login\`):
-  hs-x rollback --account-id <id> --project-id <id> --deploy-id <id> [--force] [--json]
-  POSTs to control-plane; rewrites the active deploy pointer and updates routing.
+  hs-x rollback --account-id <id> --project-id <id> --deploy-id <id> [--force] [--yes] [--json]
+  In a human TTY, project and deploy may be omitted: rollback chooses from the
+  account's projects by display name, then prior revision-backed deploys.
+  Restores LIVE Cloudflare traffic to the target deploy's verified Worker
+  version (creates a 100% deployment of it, health-probes it), then records the
+  outcome and advances the active pointer. If the probe fails, traffic is
+  restored to the pre-rollback version and the attempt is recorded as failed.
+  Needs a Cloudflare API token (HSX_CLOUDFLARE_API_TOKEN / CLOUDFLARE_API_TOKEN).
 
 Unlinked (default):
-  hs-x rollback --project-id <id> --deploy-id <id> [--environment <env>] [--cwd <dir>]
+  hs-x rollback --project-id <id> --deploy-id <id> [--environment <env>] [--cwd <dir>] [--yes]
   Updates the active deploy pointer in tenant Cloudflare KV. Without revisioned
   routing this is a bookkeeping change; redeploy or manually re-route Cloudflare
   traffic if you want the rollback to take effect on live requests.
 
-Interactive prompts apply when run in a TTY without --yes/--force.
+Interactive rollback confirmation defaults to No and is bypassed only by --yes.
+--force overrides target compatibility safeguards; it does not imply consent.
+JSON, JSON-stream, and non-TTY invocations never prompt and require --yes to mutate.
 \t`;
 }
 function isRecord(value) {