@tutti-os/nexight-devops 0.5.4 → 0.6.1

package/dist/cli.js

@@ -213,7 +213,7 @@ var tuttiComputerPath = (computerId) => computerId ? `${TUTTI_COMPUTER_API_BASE_
 var runtimeLogRecallCollectionPath = (computerId) => `${tuttiComputerPath(computerId)}/runtime-log-recalls`;
 var runtimeLogRecallPath = (computerId, taskId) => `${runtimeLogRecallCollectionPath(computerId)}/${encodeURIComponent(taskId)}`;
 var runtimeLogRecallDownloadPath = (computerId, taskId) => `${runtimeLogRecallPath(computerId, taskId)}:create-download-url`;
-var appendQuery = (path2, values) => {
+var appendQuery = (path, values) => {
   const query = new URLSearchParams();
   for (const [key, value] of Object.entries(values)) {
     if (value !== void 0 && value !== "") {
@@ -221,7 +221,7 @@ var appendQuery = (path2, values) => {
     }
   }
   const encoded = query.toString();
-  return encoded ? `${path2}?${encoded}` : path2;
+  return encoded ? `${path}?${encoded}` : path;
 };
 var defaultSleep = async (durationMs) => new Promise((resolveSleep) => {
   setTimeout(resolveSleep, durationMs);
@@ -357,7 +357,7 @@ var AdminApi = class {
     this.runtime = runtime;
     this.fetchImpl = fetchImpl;
   }
-  async request(method, path2, body) {
+  async request(method, path, body) {
     const headers = {
       accept: "application/json"
     };
@@ -369,7 +369,7 @@ var AdminApi = class {
       headers["content-type"] = "application/json";
       payload = JSON.stringify(body);
     }
-    const response = await this.fetchImpl(`${this.runtime.apiOrigin}${path2}`, {
+    const response = await this.fetchImpl(`${this.runtime.apiOrigin}${path}`, {
       method,
       headers,
       body: payload
@@ -385,11 +385,11 @@ var AdminApi = class {
     }
     return parsed;
   }
-  get(path2) {
-    return this.request("GET", path2);
+  get(path) {
+    return this.request("GET", path);
   }
-  post(path2, body) {
-    return this.request("POST", path2, body);
+  post(path, body) {
+    return this.request("POST", path, body);
   }
   inspectToken(token) {
     return this.post(ADMIN_TOKEN_INSPECT_PATH, token ? { token_value: token } : {});
@@ -1616,8 +1616,8 @@ var createDataFinderSdkTransport = (options) => {
     options.baseUrl
   );
   return {
-    request: async (path2, requestOptions) => {
-      const response = await client.dataFinder(path2, {
+    request: async (path, requestOptions) => {
+      const response = await client.dataFinder(path, {
         ...requestOptions,
         ...requestOptions.body === void 0 ? {} : {
           body: typeof requestOptions.body === "string" ? requestOptions.body : JSON.stringify(requestOptions.body)
@@ -1666,11 +1666,11 @@ var DataFinderClient = class {
   get pathScope() {
     return this.publicConfig.pathMode === "project" ? `projects/${this.publicConfig.projectId}` : this.publicConfig.appId;
   }
-  async request(path2, options = {}, label = `DataFinder request ${path2}`) {
-    if (!path2.startsWith("/openapi/")) {
+  async request(path, options = {}, label = `DataFinder request ${path}`) {
+    if (!path.startsWith("/openapi/")) {
       throw new Error("DataFinder request path must start with /openapi/");
     }
-    const response = await this.transport.request(path2, options);
+    const response = await this.transport.request(path, options);
     let payload;
     try {
       payload = JSON.parse(response.text);
@@ -2082,8 +2082,198 @@ var registerDataFinderCommand = (program) => {
   registerDataFinderQueryCommand(datafinder);
 };
 
-// src/diagnostics/shared-agent.ts
-import { createHash } from "crypto";
+// src/commands/doctor.ts
+var registerDoctorCommand = (program) => {
+  program.command("doctor").description("Run a local readiness check for the CLI shell").action(() => {
+    logger.step("Running basic readiness checks");
+    logger.success("nexight-devops is ready");
+  });
+};
+
+// src/lib/datafinder/types.ts
+var DEFAULT_DATAFINDER_BASE_URL = "https://analytics.volcengineapi.com";
+var DEFAULT_DATAFINDER_TIMEZONE = "Asia/Shanghai";
+
+// src/locales/zh-CN.ts
+var zhCN = {
+  common: {
+    continue: "\u7EE7\u7EED",
+    skip: "\u8DF3\u8FC7"
+  },
+  errors: {
+    missingAws: "\u672A\u68C0\u6D4B\u5230 aws\uFF0C\u8BF7\u5148\u5B8C\u6210 AWS CLI \u5B89\u88C5\u3002",
+    missingGh: "\u672A\u68C0\u6D4B\u5230 gh\uFF0C\u8BF7\u5148\u5B8C\u6210 GitHub CLI \u5B89\u88C5\u3002"
+  },
+  onboard: {
+    adminLoginSucceeded: "\u7BA1\u7406\u540E\u53F0\u767B\u5F55\u6210\u529F",
+    adminSection: "\u7BA1\u7406\u540E\u53F0\u767B\u5F55\u8BBE\u7F6E",
+    adminTokenRequired: "\u7BA1\u7406\u540E\u53F0 Token \u4E0D\u80FD\u4E3A\u7A7A",
+    awsSection: "AWS CLI \u8BBE\u7F6E",
+    complete: "Onboard \u5B8C\u6210",
+    chooseAwsProfile: "\u8BF7\u9009\u62E9\u9ED8\u8BA4 AWS Profile",
+    chooseLocale: "\u8BF7\u9009\u62E9\u547D\u4EE4\u884C\u8BED\u8A00",
+    datafinderAppPathMode: "\u5E94\u7528\u8DEF\u5F84\uFF08\u4F20\u7EDF SaaS / \u79C1\u6709\u5316\uFF09",
+    datafinderCredentialAction: "\u5DF2\u914D\u7F6E DataFinder \u51ED\u8BC1\uFF0C\u8BF7\u9009\u62E9\u5904\u7406\u65B9\u5F0F",
+    datafinderKeepCredentials: "\u4FDD\u7559\u73B0\u6709\u51ED\u8BC1",
+    datafinderProjectPathMode: "\u9879\u76EE\u8DEF\u5F84\uFF08SaaS \u4E91\u539F\u751F\uFF0C\u63A8\u8350\uFF09",
+    datafinderReplaceCredentials: "\u91CD\u65B0\u8F93\u5165\u51ED\u8BC1",
+    datafinderSection: "DataFinder OpenAPI \u8BBE\u7F6E",
+    datafinderSucceeded: "DataFinder \u8FDE\u63A5\u6210\u529F\uFF1A{dashboardName}\uFF0C\u5171 {reportCount} \u4E2A\u62A5\u8868",
+    enterGhToken: "\u8BF7\u8F93\u5165 GitHub Token",
+    enterAdminToken: "\u8BF7\u8F93\u5165 Tutti \u7BA1\u7406\u540E\u53F0 Token",
+    enterDataFinderAk: "\u8BF7\u8F93\u5165 DataFinder AccessKeyId",
+    enterDataFinderAppId: "\u8BF7\u8F93\u5165 DataFinder \u5E94\u7528 ID",
+    enterDataFinderDashboardId: "\u8BF7\u8F93\u5165\u9ED8\u8BA4 DataFinder \u770B\u677F ID",
+    enterDataFinderProjectId: "\u8BF7\u8F93\u5165 DataFinder \u9879\u76EE ID",
+    enterDataFinderSk: "\u8BF7\u8F93\u5165 DataFinder SecretAccessKey",
+    enterDataFinderTimezone: "\u8BF7\u8F93\u5165 DataFinder \u67E5\u8BE2\u65F6\u533A",
+    enterDataFinderUrl: "\u8BF7\u8F93\u5165 DataFinder OpenAPI \u5730\u5740",
+    ghInstallDeferred: "\u672A\u5B8C\u6210 gh \u5B89\u88C5\u3002\u4F60\u53EF\u4EE5\u7A0D\u540E\u8FD0\u884C nexight-devops onboard --set-mode gh",
+    ghLoginToken: "\u4F7F\u7528 Token",
+    ghLoginWeb: "\u6D4F\u89C8\u5668\u767B\u5F55\uFF08\u63A8\u8350\uFF09",
+    ghSection: "GitHub CLI \u8BBE\u7F6E",
+    installAwsPrompt: "\u672A\u68C0\u6D4B\u5230 aws\uFF0C\u662F\u5426\u73B0\u5728\u5C1D\u8BD5\u5B89\u88C5\uFF1F",
+    installBrewFailed: "Homebrew \u5B89\u88C5\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u624B\u52A8\u91CD\u8BD5\u3002",
+    installBrewPrompt: "\u672A\u68C0\u6D4B\u5230 Homebrew\uFF0C\u662F\u5426\u73B0\u5728\u5C1D\u8BD5\u5B89\u88C5\uFF1F",
+    installGhPrompt: "\u672A\u68C0\u6D4B\u5230 gh\uFF0C\u662F\u5426\u73B0\u5728\u5C1D\u8BD5\u5B89\u88C5\uFF1F",
+    installManualPrefix: "\u8BF7\u5148\u5B89\u88C5 Homebrew\uFF0C\u518D\u6267\u884C",
+    selectDataFinderPathMode: "\u8BF7\u9009\u62E9 DataFinder OpenAPI \u8DEF\u5F84\u6A21\u5F0F",
+    selectGhLoginMode: "\u8BF7\u9009\u62E9 GitHub \u767B\u5F55\u65B9\u5F0F",
+    skipGhSetup: "\u8DF3\u8FC7 GitHub CLI \u8BBE\u7F6E",
+    skipAdminSetup: "\u8DF3\u8FC7\u7BA1\u7406\u540E\u53F0\u767B\u5F55\u8BBE\u7F6E",
+    skipAwsSetup: "\u8DF3\u8FC7 AWS CLI \u8BBE\u7F6E",
+    skipDataFinderSetup: "\u8DF3\u8FC7 DataFinder OpenAPI \u8BBE\u7F6E",
+    awsInstallDeferred: "\u672A\u5B8C\u6210 AWS CLI \u5B89\u88C5\u3002\u4F60\u53EF\u4EE5\u7A0D\u540E\u8FD0\u884C nexight-devops onboard --set-mode aws",
+    title: "\u5F00\u59CB\u521D\u59CB\u5316 nexight-devops"
+  },
+  release: {
+    common: {
+      approvalIssueUrl: "\u5BA1\u6279\u5355\u5730\u5740: {approvalIssueUrl}",
+      candidateTag: "\u5019\u9009\u7248\u672C: {candidateTag}",
+      controlRunUrl: "\u63A7\u5236\u9762\u8FD0\u884C\u5730\u5740: {controlRunUrl}",
+      releaseBranch: "\u53D1\u5E03\u5206\u652F: {releaseBranch}",
+      releaseProfile: "\u53D1\u5E03 Profile: {releaseProfile}",
+      targetRepo: "\u76EE\u6807\u4ED3\u5E93: {targetRepo}"
+    },
+    approve: {
+      approvalIssueMissing: "\u672A\u627E\u5230\u53EF\u5BA1\u6279\u7684\u53D1\u5E03\u5355\uFF0C\u8BF7\u91CD\u65B0\u9009\u62E9\u76EE\u6807\u4ED3\u5E93\u6216\u68C0\u67E5\u63A7\u5236\u9762\u72B6\u6001\u3002",
+      approvalWorkflowRunUrl: "\u5BA1\u6279\u5DE5\u4F5C\u6D41\u5730\u5740: {approvalWorkflowRunUrl}",
+      cancelled: "\u5DF2\u53D6\u6D88 release approve\u3002",
+      commenting: "\u6B63\u5728\u5BF9\u53D1\u5E03\u5355 #{issueNumber} \u6267\u884C /release-approve",
+      closeIssueWarning: "\u5BA1\u6279\u5355 #{issueNumber} \u81EA\u52A8\u5173\u95ED\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u624B\u52A8\u5173\u95ED\u3002",
+      confirm: "\u786E\u8BA4\u5BF9\u53D1\u5E03\u5355 #{issueNumber}\uFF08{candidateTag} / {releaseBranch}\uFF09\u6267\u884C /release-approve\uFF1F",
+      feishuReminder: "\u98DE\u4E66\u63D0\u9192\uFF1A\u6B63\u5F0F\u53D1\u7248\u5DF2\u5F00\u59CB\uFF0C\u8BF7\u7ACB\u5373\u5173\u6CE8\u98DE\u4E66\u7FA4\uFF0C\u6301\u7EED\u8DDF\u8FDB\u53D1\u5E03\u72B6\u6001\u3002",
+      noPendingIssues: "\u5F53\u524D\u6CA1\u6709\u5F85\u5BA1\u6279\u7684\u53D1\u5E03\u5355\uFF0C\u76EE\u6807\u4ED3\u5E93 {targetRepo} \u6682\u65E0\u53EF\u5904\u7406\u9879\u3002",
+      selectApprovalIssue: "\u8BF7\u9009\u62E9\u8981\u5BA1\u6279\u7684\u53D1\u5E03\u5355",
+      selectTarget: "\u8BF7\u9009\u62E9\u8981\u5BA1\u6279\u7684\u4ED3\u5E93",
+      success: "release approve \u5DF2\u5B8C\u6210\uFF0C\u6B63\u5F0F\u53D1\u7248\u5DF2\u5F00\u59CB",
+      workflowFailed: "\u5BA1\u6279\u5DE5\u4F5C\u6D41\u6267\u884C\u5931\u8D25\uFF0C\u8BF7\u6253\u5F00\u5BA1\u6279\u5DE5\u4F5C\u6D41\u8FD0\u884C\u67E5\u770B\u8BE6\u60C5: {approvalWorkflowRunUrl}"
+    },
+    hotfix: {
+      allowUnmergedHotfix: "\u662F\u5426\u5141\u8BB8 release \u5206\u652F\u4E0A\u7684\u8865\u4E01\u5C1A\u672A\u88AB main \u5438\u6536\u65F6\u76F4\u63A5\u53D1\u8D77 hotfix\uFF1F",
+      approvalIssueAmbiguous: "\u68C0\u6D4B\u5230\u591A\u4E2A\u65B0\u7684 hotfix \u5BA1\u6279\u5355\uFF0C\u8BF7\u68C0\u67E5\u4EE5\u4E0B\u5019\u9009\u9879: {candidateIssueUrls}\uFF1B\u63A7\u5236\u9762\u8FD0\u884C: {controlRunUrl}",
+      approvalIssueMissing: "\u672A\u627E\u5230\u65B0\u521B\u5EFA\u7684 hotfix \u5BA1\u6279\u5355\uFF0C\u8BF7\u6253\u5F00\u63A7\u5236\u9762\u8FD0\u884C\u67E5\u770B\u8BE6\u60C5: {controlRunUrl}",
+      cancelled: "\u5DF2\u53D6\u6D88 release hotfix\u3002",
+      confirm: "\u786E\u8BA4\u5BF9 {repoName} \u53D1\u8D77 hotfix\uFF0C\u5206\u652F {releaseBranch}\uFF1F",
+      dispatching: "\u6B63\u5728\u51C6\u5907 hotfix: {repoName}",
+      enterReleaseBranch: "\u8BF7\u8F93\u5165 hotfix \u7684 release \u5206\u652F\uFF08\u5FC5\u987B\u4EE5 release/ \u5F00\u5934\uFF09",
+      feishuReminder: "\u98DE\u4E66\u63D0\u9192\uFF1A\u81EA\u6D4B\u53D1\u7248\u901A\u77E5\u5DF2\u53D1\u9001\u5230\u98DE\u4E66\u7FA4\uFF0C\u8BF7\u5173\u6CE8\u98DE\u4E66\u7FA4\u5E76\u5B8C\u6210\u9A8C\u8BC1\uFF0C\u968F\u540E\u6267\u884C nexight-devops release approve\u3002",
+      invalidReleaseBranch: "release \u5206\u652F\u5FC5\u987B\u662F release/<name> \u683C\u5F0F\u3002",
+      nextSteps: "\u4E0B\u4E00\u6B65\uFF1A\u5B8C\u6210\u9A8C\u8BC1\u540E\uFF0C\u6267\u884C nexight-devops release approve\u3002",
+      overrideMode: "Override \u6A21\u5F0F: {overrideMode}",
+      overrideModeDisabled: "\u672A\u5F00\u542F",
+      overrideModeEnabled: "\u5DF2\u5F00\u542F",
+      overrideReason: "\u8BF7\u8F93\u5165 release \u5206\u652F\u4E0A\u7684\u8865\u4E01\u5C1A\u672A\u88AB main \u5438\u6536\u65F6\u7EE7\u7EED hotfix \u7684\u539F\u56E0",
+      overrideReasonRequired: "\u5F00\u542F release \u5206\u652F\u8865\u4E01 override \u65F6\u5FC5\u987B\u586B\u5199\u539F\u56E0\u3002",
+      workflowFailureReason: "\u5931\u8D25\u539F\u56E0: {failureMessage}",
+      selectTarget: "\u8BF7\u9009\u62E9\u8981\u6267\u884C hotfix \u7684\u4ED3\u5E93",
+      success: "release hotfix \u5DF2\u5B8C\u6210",
+      waiting: "\u63A7\u5236\u9762 hotfix \u5DE5\u4F5C\u6D41\u5DF2\u89E6\u53D1\uFF0C\u6B63\u5728\u7B49\u5F85\u5B8C\u6210: {repoName}",
+      workflowFailed: "controlled-hotfix-release \u5DE5\u4F5C\u6D41\u6267\u884C\u5931\u8D25\uFF0C\u8BF7\u6253\u5F00\u63A7\u5236\u9762\u8FD0\u884C\u67E5\u770B\u8BE6\u60C5: {controlRunUrl}"
+    },
+    prepare: {
+      approvalIssueAmbiguous: "\u68C0\u6D4B\u5230\u591A\u4E2A\u65B0\u7684\u53D1\u5E03\u5BA1\u6279\u5355\uFF0C\u8BF7\u68C0\u67E5\u4EE5\u4E0B\u5019\u9009\u9879: {candidateIssueUrls}\uFF1B\u63A7\u5236\u9762\u8FD0\u884C: {controlRunUrl}",
+      approvalIssueMissing: "\u672A\u627E\u5230\u65B0\u521B\u5EFA\u7684\u53D1\u5E03\u5BA1\u6279\u5355\uFF0C\u8BF7\u6253\u5F00\u63A7\u5236\u9762\u8FD0\u884C\u67E5\u770B\u8BE6\u60C5: {controlRunUrl}",
+      cancelled: "\u5DF2\u53D6\u6D88 release prepare\u3002",
+      confirm: "\u786E\u8BA4\u5BF9 {repoName} \u6267\u884C release prepare\uFF1F",
+      dispatching: "\u6B63\u5728\u51C6\u5907\u53D1\u5E03: {repoName}",
+      feishuReminder: "\u98DE\u4E66\u63D0\u9192\uFF1A\u81EA\u6D4B\u53D1\u7248\u901A\u77E5\u5DF2\u53D1\u9001\u5230\u98DE\u4E66\u7FA4\uFF0C\u8BF7\u5173\u6CE8\u98DE\u4E66\u7FA4\u5E76\u5B8C\u6210\u9A8C\u8BC1\uFF0C\u968F\u540E\u6267\u884C nexight-devops release approve\u3002",
+      nextSteps: "\u4E0B\u4E00\u6B65\uFF1A\u5B8C\u6210\u9A8C\u8BC1\u540E\uFF0C\u6267\u884C nexight-devops release approve\u3002",
+      selectTarget: "\u8BF7\u9009\u62E9\u8981\u51C6\u5907\u53D1\u5E03\u7684\u4ED3\u5E93",
+      success: "release prepare \u5DF2\u5B8C\u6210",
+      waiting: "\u63A7\u5236\u9762\u53D1\u5E03\u5DE5\u4F5C\u6D41\u5DF2\u89E6\u53D1\uFF0C\u6B63\u5728\u7B49\u5F85\u5B8C\u6210: {repoName}",
+      workflowFailed: "controlled-release \u5DE5\u4F5C\u6D41\u6267\u884C\u5931\u8D25\uFF0C\u8BF7\u6253\u5F00\u63A7\u5236\u9762\u8FD0\u884C\u67E5\u770B\u8BE6\u60C5: {controlRunUrl}"
+    }
+  },
+  ppeLane: {
+    destroy: {
+      atLeastOneRepo: "\u81F3\u5C11\u9009\u62E9\u4E00\u4E2A\u4ED3\u5E93",
+      blankLane: "PPE lane \u540D\u79F0\u4E0D\u80FD\u4E3A\u7A7A",
+      cancelled: "\u5DF2\u53D6\u6D88\u9500\u6BC1",
+      confirmLane: "\u8FD9\u662F\u9500\u6BC1\u64CD\u4F5C\uFF0C\u8BF7\u518D\u6B21\u8F93\u5165 {lane} \u786E\u8BA4",
+      enterLane: "\u8BF7\u8F93\u5165\u9700\u8981\u79FB\u9664\u7684 PPE lane \u540D\u79F0",
+      failed: "\u4E00\u4E2A\u6216\u591A\u4E2A PPE lane \u9500\u6BC1\u5DE5\u4F5C\u6D41\u6267\u884C\u5931\u8D25",
+      noRecords: "\u8BE5 ppe-lane \u6CA1\u67E5\u8BE2\u5230\u4EFB\u4F55\u90E8\u7F72\u8BB0\u5F55",
+      running: "\u6B63\u5728\u9500\u6BC1 lane {lane}",
+      selectRepos: "\u8BF7\u9009\u62E9\u9700\u8981\u9500\u6BC1\u7684\u4ED3\u5E93",
+      skippedReason: "Cloud Map \u4E2D\u672A\u627E\u5230\u90E8\u7F72\u8BB0\u5F55",
+      warning: "\u5C06\u9500\u6BC1\u4EE5\u4E0B\u4ED3\u5E93: {repos}"
+    }
+  },
+  versionUpdate: {
+    alreadyLatest: "\u5F53\u524D\u5DF2\u662F\u6700\u65B0\u7248\u672C {currentVersion}\u3002",
+    available: "\u68C0\u6D4B\u5230\u65B0\u7248\u672C {latestVersion}\uFF0C\u5F53\u524D\u7248\u672C\u4E3A {currentVersion}\u3002",
+    checkingRegistry: "\u6B63\u5728\u68C0\u67E5\u7248\u672C\u4FE1\u606F",
+    detectingInstallSource: "\u6B63\u5728\u68C0\u6D4B\u5B89\u88C5\u6765\u6E90",
+    majorRequired: "\u68C0\u6D4B\u5230\u5927\u7248\u672C\u66F4\u65B0 {latestVersion}\uFF0C\u5F53\u524D\u7248\u672C {currentVersion} \u5FC5\u987B\u5148\u5347\u7EA7\u540E\u518D\u7EE7\u7EED\u3002",
+    manualUpgrade: "\u65E0\u6CD5\u8BC6\u522B\u5F53\u524D\u5B89\u88C5\u6765\u6E90\uFF0C\u8BF7\u624B\u52A8\u6267\u884C\u4EE5\u4E0B\u4EFB\u4E00\u5347\u7EA7\u547D\u4EE4\uFF1A\n{commands}",
+    optionalUpgradeFailed: "\u81EA\u52A8\u5347\u7EA7\u5931\u8D25\uFF0C\u672C\u6B21\u7EE7\u7EED\u4F7F\u7528\u5F53\u524D\u7248\u672C\u3002\u4F60\u53EF\u4EE5\u7A0D\u540E\u624B\u52A8\u6267\u884C\uFF1A{command}",
+    registryCheckFailed: "\u7248\u672C\u68C0\u67E5\u5931\u8D25\uFF0C\u5DF2\u7EE7\u7EED\u6267\u884C\u5F53\u524D\u547D\u4EE4\u3002",
+    registryCheckFailedManual: "\u7248\u672C\u68C0\u67E5\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002",
+    rerun: "\u5347\u7EA7\u5B8C\u6210\u540E\u8BF7\u91CD\u65B0\u6267\u884C\u521A\u624D\u7684\u547D\u4EE4\u3002",
+    selectAction: "\u68C0\u6D4B\u5230\u53EF\u7528\u66F4\u65B0\uFF0C\u662F\u5426\u73B0\u5728\u5347\u7EA7\uFF1F",
+    skipThisRun: "\u8DF3\u8FC7\u672C\u6B21",
+    skippedForRun: "\u5DF2\u8DF3\u8FC7\u672C\u6B21\u5347\u7EA7\uFF0C\u7EE7\u7EED\u6267\u884C\u5F53\u524D\u547D\u4EE4\u3002",
+    upgradeFailed: "\u81EA\u52A8\u5347\u7EA7\u5931\u8D25\uFF0C\u8BF7\u5148\u624B\u52A8\u6267\u884C\uFF1A{command}",
+    upgradeNow: "\u7ACB\u5373\u5347\u7EA7",
+    upgradeSucceeded: "CLI \u5DF2\u66F4\u65B0\u5230\u6700\u65B0\u7248\u672C {latestVersion}\u3002",
+    upgrading: "\u6B63\u5728\u6267\u884C\u5347\u7EA7\u547D\u4EE4\uFF1A{command}"
+  }
+};
+
+// src/lib/i18n.ts
+var locales = {
+  "zh-CN": zhCN
+};
+var getNestedValue = (source, key) => {
+  const value = key.split(".").reduce((current, part) => {
+    if (current && typeof current === "object" && part in current) {
+      return current[part];
+    }
+    return void 0;
+  }, source);
+  return typeof value === "string" ? value : key;
+};
+var interpolate = (message, values) => {
+  if (!values) {
+    return message;
+  }
+  return message.replace(/\{(\w+)\}/g, (placeholder, key) => {
+    const value = values[key];
+    if (value === void 0) {
+      return placeholder;
+    }
+    return String(value);
+  });
+};
+var createI18n = (locale) => {
+  const messages = locales[locale];
+  return (key, values) => {
+    const messageFromLocale = messages ? getNestedValue(messages, key) : key;
+    const message = messageFromLocale === key ? getNestedValue(zhCN, key) : messageFromLocale;
+    return interpolate(message, values);
+  };
+};
 
 // src/lib/shell.ts
 import { execa } from "execa";
@@ -2099,598 +2289,435 @@ var runCommand = async (command, args = [], options = {}) => {
   };
 };
 
-// src/lib/cloudwatch-logs.ts
-var DEFAULT_QUERY_TIMEOUT_MS = 3e4;
-var DEFAULT_POLL_INTERVAL_MS = 750;
-var parseAwsJson = (raw, operation) => {
-  try {
-    return JSON.parse(raw);
-  } catch {
-    throw new CliError(`AWS ${operation} returned invalid JSON`, 1);
-  }
-};
-var runAwsLogs = async (run, args, operation) => {
-  const result = await run("aws", args);
-  if (result.exitCode !== 0) {
-    throw new CliError(result.stderr.trim() || `AWS ${operation} failed`, 1);
-  }
-  return result.stdout;
+// src/commands/onboard.ts
+var onboardModes = ["all", "admin", "aws", "datafinder", "gh", "locale"];
+var resolveBrewCommand = async () => {
+  const result = await runCommand("/bin/bash", [
+    "-lc",
+    "command -v brew || { [ -x /opt/homebrew/bin/brew ] && printf /opt/homebrew/bin/brew; } || { [ -x /usr/local/bin/brew ] && printf /usr/local/bin/brew; }"
+  ]);
+  const brewPath = result.stdout.trim();
+  return brewPath ? brewPath : null;
 };
-var queryRows = (rows = []) => rows.map(
-  (row) => Object.fromEntries(
-    row.flatMap(
-      (field2) => field2.field === void 0 || field2.value === void 0 ? [] : [[field2.field, field2.value]]
-    )
-  )
-);
-var queryStats = (stats = {}) => ({
-  bytesScanned: stats.bytesScanned ?? 0,
-  logGroupsScanned: stats.logGroupsScanned ?? 0,
-  recordsMatched: stats.recordsMatched ?? 0,
-  recordsScanned: stats.recordsScanned ?? 0
-});
-var epochSeconds = (value) => String(Math.floor(value.getTime() / 1e3));
-var defaultSleep2 = async (durationMs) => new Promise((resolve5) => {
-  setTimeout(resolve5, durationMs);
-});
-var queryCloudWatchLogs = async (input2, dependencies = {}) => {
-  const run = dependencies.run ?? runCommand;
-  const now = dependencies.now ?? Date.now;
-  const sleep2 = dependencies.sleep ?? defaultSleep2;
-  const timeoutMs = input2.timeoutMs ?? DEFAULT_QUERY_TIMEOUT_MS;
-  const pollIntervalMs = input2.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  const limit = Math.max(1, Math.min(1e4, Math.floor(input2.limit ?? 500)));
-  const startedAt = now();
-  const startReply = parseAwsJson(
-    await runAwsLogs(
-      run,
-      [
-        "logs",
-        "start-query",
-        "--log-group-name",
-        input2.logGroup,
-        "--start-time",
-        epochSeconds(input2.startTime),
-        "--end-time",
-        epochSeconds(input2.endTime),
-        "--query-string",
-        input2.query,
-        "--limit",
-        String(limit),
-        "--profile",
-        input2.profile,
-        "--region",
-        input2.region,
-        "--output",
-        "json"
-      ],
-      "Logs Insights start-query"
-    ),
-    "Logs Insights start-query"
+var installHomebrew = async () => {
+  const result = await runCommand(
+    "/bin/bash",
+    [
+      "-lc",
+      '/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"'
+    ],
+    { stdio: "inherit" }
   );
-  const queryId = startReply.queryId?.trim();
-  if (!queryId) {
-    throw new CliError("AWS Logs Insights start-query returned no query ID", 1);
-  }
-  while (now() - startedAt <= timeoutMs) {
-    const reply = parseAwsJson(
-      await runAwsLogs(
-        run,
-        [
-          "logs",
-          "get-query-results",
-          "--query-id",
-          queryId,
-          "--profile",
-          input2.profile,
-          "--region",
-          input2.region,
-          "--output",
-          "json"
-        ],
-        "Logs Insights get-query-results"
-      ),
-      "Logs Insights get-query-results"
-    );
-    const status = reply.status ?? "Unknown";
-    if (status === "Complete") {
-      return {
-        queryId,
-        rows: queryRows(reply.results),
-        stats: queryStats(reply.statistics)
-      };
+  return result.exitCode === 0;
+};
+var ensureBrewPackage = async (packageName, t) => {
+  let brewCommand = await resolveBrewCommand();
+  if (!brewCommand) {
+    const shouldInstallBrew = await ui.confirm({
+      message: t("onboard.installBrewPrompt"),
+      default: true
+    });
+    if (!shouldInstallBrew) {
+      logger.warn(`${t("onboard.installManualPrefix")} brew install ${packageName}`);
+      return false;
     }
-    if (status !== "Running" && status !== "Scheduled") {
-      throw new CliError(`AWS Logs Insights query ${queryId} ended with status ${status}`, 1);
+    if (!await installHomebrew()) {
+      logger.warn(t("onboard.installBrewFailed"));
+      return false;
+    }
+    brewCommand = await resolveBrewCommand();
+    if (!brewCommand) {
+      logger.warn(t("onboard.installBrewFailed"));
+      return false;
     }
-    await sleep2(pollIntervalMs);
   }
-  await run("aws", [
-    "logs",
-    "stop-query",
-    "--query-id",
-    queryId,
-    "--profile",
-    input2.profile,
-    "--region",
-    input2.region,
-    "--output",
-    "json"
-  ]);
-  throw new CliError(`AWS Logs Insights query ${queryId} exceeded ${timeoutMs}ms`, 1);
+  const installResult = await runCommand(brewCommand, ["install", packageName], { stdio: "inherit" });
+  return installResult.exitCode === 0;
 };
-
-// src/diagnostics/shared-agent.ts
-var SHARED_AGENT_PLAYBOOK_ID = "shared-agent-connectivity";
-var SHARED_AGENT_PLAYBOOK_VERSION = "1.0.0";
-var DEFAULT_TSH_LOG_GROUP = "/aws/containerinsights/nexight-ojo-us-east-1/application";
-var DEFAULT_TSH_NAMESPACE = "tsh";
-var DEFAULT_TSH_CONTAINER = "tsh-server";
-var DEFAULT_DIAGNOSIS_WINDOW_MINUTES = 30;
-var MAX_DIAGNOSIS_WINDOW_MINUTES = 24 * 60;
-var MAX_IDENTIFIER_LENGTH = 256;
-var QUERY_LIMIT = 500;
-var RESULT_EVENT_LIMIT = 50;
-var PRODUCT_DEVICE_ID = /^(?:dev_[0-9a-f]{32}|[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})$/;
-var PRODUCT_AUTHORITY_ID = /^deva_[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-var SAFE_IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
-var asString2 = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
-var asBoolean2 = (value) => typeof value === "boolean" ? value : void 0;
-var asNumber = (value) => {
-  if (typeof value === "number" && Number.isFinite(value)) {
-    return value;
-  }
-  if (typeof value === "string" && value.trim()) {
-    const parsed = Number(value);
-    return Number.isFinite(parsed) ? parsed : void 0;
-  }
-  return void 0;
-};
-var timestampValue = (row) => {
-  const value = row["@timestamp"];
-  const normalized = value && /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(?:\.\d+)?$/.test(value) ? `${value.replace(" ", "T")}Z` : value;
-  const parsed = normalized ? new Date(normalized) : void 0;
-  return parsed && !Number.isNaN(parsed.getTime()) ? parsed.toISOString() : value || (/* @__PURE__ */ new Date(0)).toISOString();
-};
-var newestFirst = (events) => events.sort((left, right) => Date.parse(right.timestamp) - Date.parse(left.timestamp));
-var validateDiagnosticIdentifier = (label, value) => {
-  const normalized = value.trim();
-  if (!normalized || normalized.length > MAX_IDENTIFIER_LENGTH || !SAFE_IDENTIFIER.test(normalized)) {
-    throw new CliError(`${label} must use 1-${MAX_IDENTIFIER_LENGTH} letters, digits, '.', '_', ':', or '-'`, 1);
-  }
-  return normalized;
-};
-var parseDiagnosisAnchor = (value) => {
-  const normalized = value.trim();
-  if (!/(?:z|[+-]\d{2}:\d{2})$/i.test(normalized)) {
-    throw new CliError("--at must include an explicit timezone offset or Z", 1);
-  }
-  const parsed = new Date(normalized);
-  if (Number.isNaN(parsed.getTime())) {
-    throw new CliError(`Invalid --at timestamp: ${value}`, 1);
-  }
-  return parsed;
-};
-var resolveDiagnosisWindow = (anchor, windowMinutes = DEFAULT_DIAGNOSIS_WINDOW_MINUTES, now = /* @__PURE__ */ new Date()) => {
-  if (!Number.isInteger(windowMinutes) || windowMinutes < 5 || windowMinutes > MAX_DIAGNOSIS_WINDOW_MINUTES) {
-    throw new CliError(`--window-minutes must be an integer between 5 and ${MAX_DIAGNOSIS_WINDOW_MINUTES}`, 1);
+var ensureGhInstalled = async (t) => {
+  const ghVersion = await runCommand("gh", ["--version"]);
+  if (ghVersion.exitCode === 0) {
+    return true;
   }
-  if (anchor.getTime() > now.getTime() + 5 * 6e4) {
-    throw new CliError("--at cannot be more than five minutes in the future", 1);
+  if (process.platform === "darwin") {
+    const shouldInstall = await ui.confirm({ message: t("onboard.installGhPrompt"), default: true });
+    if (shouldInstall) {
+      return ensureBrewPackage("gh", t);
+    }
   }
-  const halfWindowMs = windowMinutes * 6e4 / 2;
-  return {
-    from: new Date(anchor.getTime() - halfWindowMs),
-    to: new Date(Math.min(anchor.getTime() + halfWindowMs, now.getTime()))
-  };
+  logger.warn(t("onboard.ghInstallDeferred"));
+  return false;
 };
-var regexEscape = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replaceAll("/", "\\/");
-var jsonFieldFilter = (field2, value) => {
-  const encoded = JSON.stringify(value);
-  return `diagnosticPayload like /"${field2}"\\s*:\\s*"${regexEscape(encoded.slice(1, -1))}"/`;
-};
-var baseDiagnosticQuery = (namespace, container, prefix) => [
-  "fields @timestamp, log",
-  `| filter kubernetes.namespace_name = ${JSON.stringify(namespace)}`,
-  `| filter kubernetes.container_name = ${JSON.stringify(container)}`,
-  `| filter log like /diagnostic_prefix=${regexEscape(prefix)}/`,
-  "| parse log /diagnostic_payload=(?<diagnosticPayload>\\{.*\\})$/",
-  "| filter ispresent(diagnosticPayload)"
-];
-var buildDescriptorQuery = (input2) => {
-  const commands = baseDiagnosticQuery(input2.namespace, input2.container, "RELAY_DESCRIPTOR_DIAGNOSTIC");
-  commands.push(`| filter ${jsonFieldFilter("roomId", input2.roomId)}`);
-  if (input2.sharedAgentId) {
-    commands.push(`| filter ${jsonFieldFilter("sharedAgentId", input2.sharedAgentId)}`);
-  }
-  commands.push("| display @timestamp, diagnosticPayload", "| sort @timestamp desc", `| limit ${QUERY_LIMIT}`);
-  return commands.join("\n");
-};
-var buildHTTPFailureQuery = (input2) => {
-  const commands = baseDiagnosticQuery(input2.namespace, input2.container, "HTTP_FAILURE_DIAGNOSTIC");
-  const filters = [jsonFieldFilter("roomId", input2.roomId)];
-  if (input2.ownerDeviceId) {
-    filters.push(jsonFieldFilter("deviceId", input2.ownerDeviceId));
-  }
-  if (input2.authorityId) {
-    filters.push(`diagnosticPayload like /"urlPath"\\s*:\\s*"[^"]*${regexEscape(input2.authorityId)}[^"]*"/`);
-  }
-  commands.push(`| filter (${filters.join(" or ")})`);
-  commands.push("| display @timestamp, diagnosticPayload", "| sort @timestamp desc", `| limit ${QUERY_LIMIT}`);
-  return commands.join("\n");
-};
-var buildOwnerLeaseQuery = (input2) => {
-  const refs = [...new Set(input2.refs.filter(Boolean))];
-  if (refs.length === 0) {
-    throw new CliError("Owner lease query requires at least one pseudonymous device or authority reference", 1);
-  }
-  return [
-    "fields @timestamp, log",
-    `| filter kubernetes.namespace_name = ${JSON.stringify(input2.namespace)}`,
-    `| filter kubernetes.container_name = ${JSON.stringify(input2.container)}`,
-    "| filter log like /shared-agent owner lease observation accepted/",
-    `| filter (${refs.map((ref) => `log like /${regexEscape(ref)}/`).join(" or ")})`,
-    "| display @timestamp, log",
-    "| sort @timestamp desc",
-    `| limit ${QUERY_LIMIT}`
-  ].join("\n");
-};
-var parseDiagnosticPayload = (row) => {
-  const payload = row.diagnosticPayload;
-  if (!payload) {
-    return void 0;
-  }
-  try {
-    const parsed = JSON.parse(payload);
-    return parsed && typeof parsed === "object" ? parsed : void 0;
-  } catch {
-    return void 0;
+var ensureAwsInstalled = async (t) => {
+  const awsVersion = await runCommand("aws", ["--version"]);
+  if (awsVersion.exitCode === 0) {
+    return true;
   }
-};
-var parseDescriptorEvidence = (rows) => newestFirst(
-  rows.flatMap((row) => {
-    const payload = parseDiagnosticPayload(row);
-    const outcome = asString2(payload?.outcome);
-    const roomId = asString2(payload?.roomId);
-    const sharedAgentId = asString2(payload?.sharedAgentId);
-    if (!payload || payload.prefix !== "RELAY_DESCRIPTOR_DIAGNOSTIC" || !outcome || !roomId || !sharedAgentId) {
-      return [];
-    }
-    return [
-      {
-        timestamp: timestampValue(row),
-        outcome,
-        channel: asString2(payload.channel) ?? "unknown",
-        roomId,
-        sharedAgentId,
-        ...asString2(payload.ownerUserId) ? { ownerUserId: asString2(payload.ownerUserId) } : {},
-        ...asString2(payload.ownerDeviceId) ? { ownerDeviceId: asString2(payload.ownerDeviceId) } : {},
-        ...asString2(payload.reason) ? { reason: asString2(payload.reason) } : {},
-        ...asBoolean2(payload.directEligible) !== void 0 ? { directEligible: asBoolean2(payload.directEligible) } : {}
-      }
-    ];
-  })
-).slice(0, RESULT_EVENT_LIMIT);
-var extractLogValue = (log, field2) => {
-  const escapedField = regexEscape(field2);
-  const jsonMatch = log.match(new RegExp(`"${escapedField}"\\s*:\\s*(?:"([^"]*)"|([^,}\\s]+))`));
-  if (jsonMatch) {
-    return (jsonMatch[1] ?? jsonMatch[2])?.trim();
-  }
-  const keyValueMatch = log.match(new RegExp(`(?:^|\\s)${escapedField}=(?:"([^"]*)"|([^\\s]+))`));
-  return (keyValueMatch?.[1] ?? keyValueMatch?.[2])?.trim();
-};
-var parseOwnerLeaseEvidence = (rows) => newestFirst(
-  rows.flatMap((row) => {
-    const log = row.log ?? "";
-    const outcome = extractLogValue(log, "outcome");
-    const reasonCode = extractLogValue(log, "reason_code");
-    if (!log.includes("shared-agent owner lease observation accepted") || !outcome || !reasonCode) {
-      return [];
-    }
-    const retryable = extractLogValue(log, "retryable");
-    return [
-      {
-        timestamp: timestampValue(row),
-        outcome,
-        reasonCode,
-        clientVersion: extractLogValue(log, "client_version") ?? "unknown",
-        leaseStateBefore: extractLogValue(log, "lease_state_before") ?? "unknown",
-        leaseStateAfter: extractLogValue(log, "lease_state_after") ?? "unknown",
-        ...extractLogValue(log, "observation_id") ? { observationId: extractLogValue(log, "observation_id") } : {},
-        ...extractLogValue(log, "owner_device_ref") ? { ownerDeviceRef: extractLogValue(log, "owner_device_ref") } : {},
-        ...extractLogValue(log, "authority_ref") ? { authorityRef: extractLogValue(log, "authority_ref") } : {},
-        ...retryable === "true" || retryable === "false" ? { retryable: retryable === "true" } : {}
-      }
-    ];
-  })
-).slice(0, RESULT_EVENT_LIMIT);
-var parseHTTPFailureEvidence = (rows) => newestFirst(
-  rows.flatMap((row) => {
-    const payload = parseDiagnosticPayload(row);
-    if (!payload || payload.prefix !== "HTTP_FAILURE_DIAGNOSTIC") {
-      return [];
+  if (process.platform === "darwin") {
+    const shouldInstall = await ui.confirm({ message: t("onboard.installAwsPrompt"), default: true });
+    if (shouldInstall) {
+      return ensureBrewPackage("awscli", t);
     }
-    return [
-      {
-        timestamp: timestampValue(row),
-        ...asNumber(payload.statusCode) !== void 0 ? { statusCode: asNumber(payload.statusCode) } : {},
-        ...asString2(payload.route) ? { route: asString2(payload.route) } : {},
-        ...asString2(payload.urlPath) ? { urlPath: asString2(payload.urlPath) } : {},
-        ...asString2(payload.reason) ? { reason: asString2(payload.reason) } : {},
-        ...asString2(payload.requestId) ? { requestId: asString2(payload.requestId) } : {},
-        ...asString2(payload.roomId) ? { roomId: asString2(payload.roomId) } : {},
-        ...asString2(payload.deviceId) ? { deviceId: asString2(payload.deviceId) } : {},
-        ...asString2(payload.clientVersion) ? { clientVersion: asString2(payload.clientVersion) } : {}
-      }
-    ];
-  })
-).slice(0, RESULT_EVENT_LIMIT);
-var ownerGatewayRef = (kind, value) => {
-  const normalized = value?.trim().toLowerCase();
-  if (!normalized) {
-    return void 0;
-  }
-  const eligible = kind === "device" ? PRODUCT_DEVICE_ID.test(normalized) : PRODUCT_AUTHORITY_ID.test(normalized);
-  if (!eligible) {
-    return void 0;
-  }
-  return createHash("sha256").update(["shared-agent-owner-gateway/v1", kind, normalized].join("\0")).digest("hex").slice(0, 24);
-};
-var ownerDeviceRef = (deviceId) => ownerGatewayRef("device", deviceId);
-var ownerAuthorityRef = (authorityId) => ownerGatewayRef("authority", authorityId);
-var attemptQuery = async (name, queryLogs, input2) => {
-  try {
-    const result = await queryLogs(input2);
-    return { result, report: { name, status: "complete", queryId: result.queryId, stats: result.stats } };
-  } catch (error) {
-    return { report: { name, status: "failed", error: toErrorMessage(error) } };
   }
+  logger.warn(t("onboard.awsInstallDeferred"));
+  return false;
 };
-var classify = (input2) => {
-  const latestDescriptor = input2.descriptors[0];
-  const latestLease = input2.leases[0];
-  if (latestLease && ["failed", "rejected"].includes(latestLease.outcome) && (!latestDescriptor || Date.parse(latestLease.timestamp) >= Date.parse(latestDescriptor.timestamp))) {
-    return {
-      code: "OWNER_LEASE_UNHEALTHY",
-      confidence: "high",
-      summary: `Owner \u7EED\u7EA6\u4E3A ${latestLease.outcome}/${latestLease.reasonCode}\uFF0C\u63A7\u5236\u9762\u5DF2\u6536\u5230\u5F02\u5E38\u7EED\u7EA6\u8BC1\u636E\u3002`
-    };
-  }
-  if (latestDescriptor?.outcome === "authority_offline") {
-    if (latestLease?.outcome === "recovered" && Date.parse(latestLease.timestamp) >= Date.parse(latestDescriptor.timestamp)) {
-      return {
-        code: "OWNER_RECOVERED",
-        confidence: "high",
-        summary: "Descriptor \u8BF7\u6C42\u9047\u5230 Owner \u79BB\u7EBF\uFF0C\u968F\u540E\u670D\u52A1\u7AEF\u89C2\u5BDF\u5230 Owner \u7EED\u7EA6\u6062\u590D\u3002"
-      };
-    }
-    return {
-      code: "OWNER_OFFLINE",
-      confidence: "high",
-      summary: "\u63A7\u5236\u9762\u660E\u786E\u8FD4\u56DE authority_offline\uFF0COwner Presence lease \u5728\u8BF7\u6C42\u65F6\u4E0D\u53EF\u7528\u3002"
-    };
+var runGhSetup = async (t) => {
+  if (!await ensureGhInstalled(t)) {
+    return false;
   }
-  if (latestDescriptor?.outcome === "service_error") {
-    return {
-      code: "CONTROL_PLANE_FAILURE",
-      confidence: "high",
-      summary: "Descriptor \u7B7E\u53D1\u53D1\u751F\u670D\u52A1\u7AEF\u9519\u8BEF\uFF0C\u9700\u8981\u6309 requestId \u6216\u76F8\u90BB\u670D\u52A1\u7AEF\u65E5\u5FD7\u7EE7\u7EED\u5B9A\u4F4D\u3002"
-    };
+  const authStatus = await runCommand("gh", ["auth", "status"]);
+  if (authStatus.exitCode === 0) {
+    return true;
   }
-  if (latestDescriptor?.outcome === "rejected") {
-    return {
-      code: "DESCRIPTOR_REJECTED",
-      confidence: "high",
-      summary: `Descriptor \u8BF7\u6C42\u88AB\u62D2\u7EDD${latestDescriptor.reason ? `\uFF1A${latestDescriptor.reason}` : "\u3002"}`
-    };
+  const loginMode = await ui.select({
+    message: t("onboard.selectGhLoginMode"),
+    choices: [
+      { value: "web", name: t("onboard.ghLoginWeb") },
+      { value: "token", name: t("onboard.ghLoginToken") }
+    ]
+  });
+  if (loginMode === "web") {
+    await runCommand("gh", ["auth", "login", "--web"], { stdio: "inherit" });
+  } else {
+    const token = await ui.password({ message: t("onboard.enterGhToken") });
+    await runCommand("gh", ["auth", "login", "--with-token"], {
+      input: token
+    });
   }
-  if (latestDescriptor?.outcome === "issued") {
+  return (await runCommand("gh", ["auth", "status"])).exitCode === 0;
+};
+var runAwsSetup = async (defaultProfile, t) => {
+  if (!await ensureAwsInstalled(t)) {
     return {
-      code: "DESCRIPTOR_ISSUED",
-      confidence: latestLease ? "high" : "medium",
-      summary: latestLease ? "\u63A7\u5236\u9762\u5DF2\u7B7E\u53D1 descriptor\uFF0C\u4E14\u5B58\u5728\u5BF9\u5E94 Owner \u7EED\u7EA6\u8BC1\u636E\uFF1B\u540E\u7EED\u5E94\u68C0\u67E5\u5BA2\u6237\u7AEF\u5230 Device Gateway \u7684\u8FDE\u63A5\u9636\u6BB5\u3002" : "\u63A7\u5236\u9762\u5DF2\u7B7E\u53D1 descriptor\uFF0C\u4F46\u5F53\u524D\u7A97\u53E3\u6CA1\u6709\u5BF9\u5E94 Owner \u7EED\u7EA6\u89C2\u6D4B\uFF0C\u540E\u7EED\u5E94\u68C0\u67E5 Device Gateway \u8FDE\u63A5\u9636\u6BB5\u3002"
+      profile: defaultProfile,
+      configured: false
     };
   }
-  if (latestLease && ["succeeded", "recovered"].includes(latestLease.outcome)) {
-    return {
-      code: "OWNER_RENEWING_NO_DESCRIPTOR",
-      confidence: "medium",
-      summary: "Owner \u5728\u5F53\u524D\u7A97\u53E3\u6709\u5065\u5EB7\u7EED\u7EA6\uFF0C\u4F46\u6CA1\u6709\u627E\u5230\u8BE5\u623F\u95F4\u7684 descriptor \u8BF7\u6C42\u8BC1\u636E\u3002"
-    };
+  const profile = await ui.input({
+    message: t("onboard.chooseAwsProfile"),
+    default: defaultProfile
+  });
+  const listProfiles = await runCommand("aws", ["configure", "list-profiles"]);
+  const profiles = listProfiles.stdout.split("\n").map((item) => item.trim()).filter(Boolean);
+  if (!profiles.includes(profile)) {
+    await runCommand("aws", ["configure", "sso", "--profile", profile], { stdio: "inherit" });
   }
-  if (input2.failures.length > 0) {
+  const loginResult = await runCommand("aws", ["sso", "login", "--profile", profile], { stdio: "inherit" });
+  if (loginResult.exitCode !== 0) {
     return {
-      code: "HTTP_FAILURE_ONLY",
-      confidence: "medium",
-      summary: "\u53EA\u627E\u5230\u76F8\u5173 HTTP \u5931\u8D25\uFF0C\u672A\u627E\u5230 descriptor \u6216 Owner \u7EED\u7EA6\u8BC1\u636E\u3002"
+      profile,
+      configured: false
     };
   }
+  const identityResult = await runCommand("aws", [
+    "sts",
+    "get-caller-identity",
+    "--profile",
+    profile,
+    "--output",
+    "json"
+  ]);
   return {
-    code: "INCONCLUSIVE",
-    confidence: "low",
-    summary: "\u5F53\u524D\u65F6\u95F4\u7A97\u6CA1\u6709\u8DB3\u591F\u8BC1\u636E\u5224\u65AD\u5171\u4EAB Agent \u8FDE\u63A5\u5931\u8D25\u9636\u6BB5\u3002"
+    profile,
+    configured: identityResult.exitCode === 0
   };
 };
-var diagnoseSharedAgent = async (rawInput, dependencies = {}) => {
-  const now = dependencies.now?.() ?? /* @__PURE__ */ new Date();
-  const queryLogs = dependencies.queryLogs ?? queryCloudWatchLogs;
-  const namespace = validateDiagnosticIdentifier("namespace", rawInput.namespace ?? DEFAULT_TSH_NAMESPACE);
-  const container = validateDiagnosticIdentifier("container", rawInput.container ?? DEFAULT_TSH_CONTAINER);
-  const roomId = validateDiagnosticIdentifier("room ID", rawInput.roomId);
-  const sharedAgentId = rawInput.sharedAgentId ? validateDiagnosticIdentifier("shared Agent ID", rawInput.sharedAgentId) : void 0;
-  const providedOwnerDeviceId = rawInput.ownerDeviceId ? validateDiagnosticIdentifier("Owner device ID", rawInput.ownerDeviceId).toLowerCase() : void 0;
-  const authorityId = rawInput.authorityId ? validateDiagnosticIdentifier("Authority ID", rawInput.authorityId).toLowerCase() : void 0;
-  const window = resolveDiagnosisWindow(rawInput.anchor, rawInput.windowMinutes, now);
-  const commonQueryInput = {
-    startTime: window.from,
-    endTime: window.to,
-    logGroup: rawInput.logGroup,
-    profile: rawInput.profile,
-    region: rawInput.region,
-    limit: QUERY_LIMIT
-  };
-  const descriptorAttempt = await attemptQuery("descriptor", queryLogs, {
-    ...commonQueryInput,
-    query: buildDescriptorQuery({ namespace, container, roomId, sharedAgentId })
-  });
-  const descriptors = parseDescriptorEvidence(descriptorAttempt.result?.rows ?? []);
-  const descriptorWithOwner = descriptors.find((event) => event.ownerDeviceId || event.ownerUserId);
-  const ownerDeviceId = providedOwnerDeviceId ?? descriptorWithOwner?.ownerDeviceId?.toLowerCase();
-  const ownerUserId = descriptorWithOwner?.ownerUserId;
-  const deviceRef = ownerDeviceId ? ownerDeviceRef(ownerDeviceId) : void 0;
-  const authorityRef = authorityId ? ownerAuthorityRef(authorityId) : void 0;
-  const refs = [deviceRef, authorityRef].filter((value) => Boolean(value));
-  const httpAttemptPromise = attemptQuery("http-failure", queryLogs, {
-    ...commonQueryInput,
-    query: buildHTTPFailureQuery({ namespace, container, roomId, ownerDeviceId, authorityId })
-  });
-  const leaseAttemptPromise = refs.length > 0 ? attemptQuery("owner-lease", queryLogs, {
-    ...commonQueryInput,
-    query: buildOwnerLeaseQuery({ namespace, container, refs })
-  }) : Promise.resolve({ report: { name: "owner-lease", status: "skipped" } });
-  const [httpAttempt, leaseAttempt] = await Promise.all([httpAttemptPromise, leaseAttemptPromise]);
-  const failures = parseHTTPFailureEvidence(httpAttempt.result?.rows ?? []);
-  const leases = parseOwnerLeaseEvidence(leaseAttempt.result?.rows ?? []);
-  const queryReports = [descriptorAttempt.report, httpAttempt.report, leaseAttempt.report];
-  if (!queryReports.some((report) => report.status === "complete")) {
-    throw new CliError(
-      `All Shared Agent evidence queries failed: ${queryReports.filter((report) => report.status === "failed").map((report) => `${report.name}: ${report.error ?? "unknown error"}`).join("; ")}`,
-      1
-    );
-  }
-  const warnings = queryReports.flatMap(
-    (report) => report.status === "failed" ? [`${report.name} query failed: ${report.error ?? "unknown error"}`] : []
-  );
-  if (ownerDeviceId && !deviceRef) {
-    warnings.push("Owner device ID is not a canonical product ID, so server-side pseudonymous lease events cannot be joined.");
-  }
-  if (authorityId && !authorityRef) {
-    warnings.push("Authority ID is not canonical, so server-side pseudonymous lease events cannot be joined.");
-  }
-  const ownerRenewalFailure = failures.find(
-    (failure) => `${failure.route ?? ""} ${failure.urlPath ?? ""}`.includes("/lease/renew")
-  );
-  const ownerClientVersion = leases[0]?.clientVersion ?? ownerRenewalFailure?.clientVersion;
-  const missingEvidence = [];
-  if (descriptors.length === 0) {
-    missingEvidence.push("No RELAY_DESCRIPTOR_DIAGNOSTIC event matched this room and time window.");
-  }
-  if (!ownerDeviceId) {
-    missingEvidence.push("Owner device identity was not supplied and no issued descriptor exposed it.");
-  }
-  if (leaseAttempt.report.status === "skipped") {
-    missingEvidence.push("Owner lease evidence could not be queried without a canonical Owner device or Authority ID.");
-  } else if (leases.length === 0) {
-    missingEvidence.push("No sampled Owner lease observation matched the derived pseudonymous reference.");
+var runAdminSetup = async (config, options, t) => {
+  const apiOrigin = normalizeAdminApiOrigin(options.adminUrl ?? config.admin?.apiOrigin);
+  const token = (await ui.password({ message: t("onboard.enterAdminToken") })).trim();
+  if (!token) {
+    throw new CliError(t("onboard.adminTokenRequired"), 1);
   }
-  return {
-    schemaVersion: 1,
-    playbook: { id: SHARED_AGENT_PLAYBOOK_ID, version: SHARED_AGENT_PLAYBOOK_VERSION },
-    generatedAt: now.toISOString(),
-    backend: {
-      type: "aws-cloudwatch",
-      account: rawInput.account,
-      profile: rawInput.profile,
-      region: rawInput.region,
-      logGroup: rawInput.logGroup
-    },
-    subject: { roomId, ...sharedAgentId ? { sharedAgentId } : {} },
-    window: {
-      anchor: rawInput.anchor.toISOString(),
-      from: window.from.toISOString(),
-      to: window.to.toISOString()
-    },
-    verdict: classify({ descriptors, failures, leases }),
-    owner: {
-      ...ownerUserId ? { userId: ownerUserId } : {},
-      ...ownerDeviceId ? { deviceId: ownerDeviceId } : {},
-      ...deviceRef ? { deviceRef } : {},
-      ...ownerClientVersion ? { clientVersion: ownerClientVersion } : {}
-    },
-    descriptor: {
-      attemptCount: descriptors.length,
-      events: descriptors,
-      ...descriptors[0] ? { latest: descriptors[0] } : {}
-    },
-    ownerLease: {
-      observationCount: leases.length,
-      events: leases,
-      ...leases[0] ? { latest: leases[0] } : {}
-    },
-    httpFailures: { count: failures.length, events: failures },
-    queryReports,
-    partial: queryReports.some((report) => report.status === "failed"),
-    warnings,
-    missingEvidence
+  await new AdminApi({ apiOrigin, token }).inspectToken(token);
+  config.admin = {
+    apiOrigin,
+    token
   };
+  logger.success(t("onboard.adminLoginSucceeded"));
 };
-
-// src/lib/aws.ts
-var parseJson = (raw) => JSON.parse(raw);
-var isSsoAuthFailure = (stderr) => /(token has expired|token.*expired|sso|authorization pending|login)/i.test(stderr);
-var runAws = async (args) => {
-  const result = await runCommand("aws", args);
-  if (result.exitCode !== 0) {
-    throw new CliError(result.stderr || `AWS command failed: aws ${args.join(" ")}`, 1);
+var inputWithDefault = async (message, value) => (await ui.input({
+  message,
+  ...value ? { default: value } : {}
+})).trim();
+var requiredDataFinderValue = (value, label) => {
+  if (!value) {
+    throw new CliError(`DataFinder ${label} \u4E0D\u80FD\u4E3A\u7A7A`, 1);
   }
-  return result.stdout;
+  return value;
 };
-var ensureAwsAuthenticated = async (profile) => {
-  const identityArgs = ["sts", "get-caller-identity", "--profile", profile, "--output", "json"];
-  const firstAttempt = await runCommand("aws", identityArgs);
-  if (firstAttempt.exitCode === 0) {
-    return;
-  }
-  if (!isSsoAuthFailure(firstAttempt.stderr)) {
-    throw new CliError(firstAttempt.stderr || `AWS authentication failed for profile ${profile}`, 1);
-  }
-  const loginResult = await runCommand("aws", ["sso", "login", "--profile", profile], {
-    stdio: "inherit"
-  });
-  if (loginResult.exitCode !== 0) {
-    throw new CliError(`AWS SSO login failed for profile ${profile}`, 1);
+var runDataFinderSetup = async (config, options, t) => {
+  const previous = config.datafinder;
+  let accessKeyId = previous?.accessKeyId ?? "";
+  let secretAccessKey = previous?.secretAccessKey ?? "";
+  if (previous?.accessKeyId && previous.secretAccessKey) {
+    const credentialAction = await ui.select({
+      message: t("onboard.datafinderCredentialAction"),
+      choices: [
+        { value: "keep", name: t("onboard.datafinderKeepCredentials") },
+        { value: "replace", name: t("onboard.datafinderReplaceCredentials") }
+      ]
+    });
+    if (credentialAction === "replace") {
+      accessKeyId = "";
+      secretAccessKey = "";
+    }
   }
-  const secondAttempt = await runCommand("aws", identityArgs);
-  if (secondAttempt.exitCode !== 0) {
-    throw new CliError(`AWS authentication is still invalid for profile ${profile}`, 1);
+  if (!accessKeyId || !secretAccessKey) {
+    accessKeyId = (await ui.password({ message: t("onboard.enterDataFinderAk") })).trim();
+    secretAccessKey = (await ui.password({ message: t("onboard.enterDataFinderSk") })).trim();
   }
-};
-var getAwsCallerIdentity = async (profile) => {
-  const identity = parseJson(
-    await runAws(["sts", "get-caller-identity", "--profile", profile, "--output", "json"])
+  const pathMode = parseDataFinderPathMode(
+    options.datafinderPathMode ?? await ui.select({
+      message: t("onboard.selectDataFinderPathMode"),
+      choices: [
+        { value: "project", name: t("onboard.datafinderProjectPathMode") },
+        { value: "app", name: t("onboard.datafinderAppPathMode") }
+      ],
+      default: previous?.pathMode ?? "project"
+    })
   );
-  return {
-    account: identity.Account,
-    arn: identity.Arn,
-    userId: identity.UserId
-  };
-};
-var listLaneInstances = async (input2) => {
-  const service = parseJson(
-    await runAws([
-      "servicediscovery",
-      "get-service",
-      "--id",
-      input2.serviceId,
-      "--region",
-      input2.region,
-      "--profile",
-      input2.profile,
-      "--output",
-      "json"
-    ])
-  ).Service;
-  const namespace = parseJson(
-    await runAws([
-      "servicediscovery",
-      "get-namespace",
-      "--id",
-      service.NamespaceId,
-      "--region",
-      input2.region,
-      "--profile",
-      input2.profile,
+  const candidate = {
+    accessKeyId: requiredDataFinderValue(accessKeyId, "AccessKeyId"),
+    appId: requiredDataFinderValue(
+      await inputWithDefault(
+        t("onboard.enterDataFinderAppId"),
+        options.datafinderAppId ?? previous?.appId
+      ),
+      "appId"
+    ),
+    baseUrl: normalizeDataFinderBaseUrl(
+      requiredDataFinderValue(
+        await inputWithDefault(
+          t("onboard.enterDataFinderUrl"),
+          options.datafinderUrl ?? previous?.baseUrl ?? DEFAULT_DATAFINDER_BASE_URL
+        ),
+        "baseUrl"
+      )
+    ),
+    defaultDashboardId: requiredDataFinderValue(
+      await inputWithDefault(
+        t("onboard.enterDataFinderDashboardId"),
+        options.datafinderDashboardId ?? previous?.defaultDashboardId
+      ),
+      "defaultDashboardId"
+    ),
+    pathMode,
+    projectId: requiredDataFinderValue(
+      await inputWithDefault(
+        t("onboard.enterDataFinderProjectId"),
+        options.datafinderProjectId ?? previous?.projectId
+      ),
+      "projectId"
+    ),
+    secretAccessKey: requiredDataFinderValue(secretAccessKey, "SecretAccessKey"),
+    timezone: requiredDataFinderValue(
+      await inputWithDefault(
+        t("onboard.enterDataFinderTimezone"),
+        previous?.timezone ?? DEFAULT_DATAFINDER_TIMEZONE
+      ),
+      "timezone"
+    )
+  };
+  const summary = await new DataFinderClient(candidate).checkConnection();
+  config.datafinder = toStoredDataFinderConfig(candidate);
+  config.setup.datafinderConfigured = true;
+  logger.success(
+    t("onboard.datafinderSucceeded", {
+      dashboardName: summary.dashboardName ?? summary.dashboardId,
+      reportCount: summary.reportCount
+    })
+  );
+};
+var runOnboard = async (options) => {
+  const config = await loadConfig();
+  const t = createI18n(config.locale);
+  const mode = options.setMode ?? "all";
+  if (!onboardModes.includes(mode)) {
+    throw new CliError(`Invalid onboard mode: ${mode}`, 1);
+  }
+  if (mode === "all" || mode === "locale") {
+    const locale = await ui.select({
+      message: t("onboard.chooseLocale"),
+      choices: [
+        { value: "zh-CN", name: "\u4E2D\u6587" },
+        { value: "skip", name: t("common.skip") }
+      ]
+    });
+    if (locale !== "skip") {
+      config.locale = locale;
+    }
+    config.setup.localeConfigured = true;
+  }
+  if (mode === "all" || mode === "admin") {
+    const action = mode === "admin" ? "continue" : await ui.select({
+      message: t("onboard.adminSection"),
+      choices: [
+        { value: "continue", name: t("common.continue") },
+        { value: "skip", name: t("common.skip") }
+      ]
+    });
+    if (action === "continue") {
+      await runAdminSetup(config, options, t);
+    } else {
+      logger.info(t("onboard.skipAdminSetup"));
+    }
+  }
+  if (mode === "all" || mode === "datafinder") {
+    const action = mode === "datafinder" ? "continue" : await ui.select({
+      message: t("onboard.datafinderSection"),
+      choices: [
+        { value: "continue", name: t("common.continue") },
+        { value: "skip", name: t("common.skip") }
+      ]
+    });
+    if (action === "continue") {
+      await runDataFinderSetup(config, options, t);
+    } else {
+      logger.info(t("onboard.skipDataFinderSetup"));
+    }
+  }
+  if (mode === "all" || mode === "gh") {
+    const action = mode === "gh" ? "continue" : await ui.select({
+      message: t("onboard.ghSection"),
+      choices: [
+        { value: "continue", name: t("common.continue") },
+        { value: "skip", name: t("common.skip") }
+      ]
+    });
+    if (action === "continue") {
+      config.setup.ghConfigured = await runGhSetup(t);
+    } else {
+      logger.info(t("onboard.skipGhSetup"));
+      config.setup.ghConfigured = true;
+    }
+  }
+  if (mode === "all" || mode === "aws") {
+    const action = mode === "aws" ? "continue" : await ui.select({
+      message: t("onboard.awsSection"),
+      choices: [
+        { value: "continue", name: t("common.continue") },
+        { value: "skip", name: t("common.skip") }
+      ]
+    });
+    if (action === "continue") {
+      const result = await runAwsSetup(config.defaultAwsProfile, t);
+      config.setup.awsConfigured = result.configured;
+      if (result.configured) {
+        config.defaultAwsProfile = result.profile;
+      }
+    } else {
+      logger.info(t("onboard.skipAwsSetup"));
+      config.setup.awsConfigured = true;
+    }
+  }
+  await saveConfig(config);
+  logger.success(t("onboard.complete"));
+};
+var registerOnboardCommand = (program) => {
+  program.command("onboard").description("Install or configure local prerequisites").option("--set-mode <mode>", "setup only one flow: all|admin|aws|datafinder|gh|locale").option("--admin-url <url>", "management API URL or admin.tutti.sh page URL").option("--datafinder-url <url>", "DataFinder OpenAPI origin").option("--datafinder-project-id <id>", "DataFinder project ID").option("--datafinder-app-id <id>", "DataFinder application ID").option("--datafinder-dashboard-id <id>", "default DataFinder dashboard ID").option("--datafinder-path-mode <mode>", "DataFinder API path mode: project|app").action((options) => runOnboard(options));
+};
+
+// src/constants/ppe-lane-repos.ts
+var ppeLaneRepos = [
+  {
+    key: "tutti-server",
+    label: "tutti-server",
+    repoFullName: "tutti-lab/tutti-server",
+    deployWorkflowFile: "deploy-lane.yml",
+    destroyWorkflowFile: "destroy-lane.yml",
+    defaultRef: "main",
+    defaultDestroySelection: false,
+    cloudMapServiceId: "srv-izinli73rwxpf2dr",
+    serviceName: "tutti-server"
+  },
+  {
+    key: "zk-admin-server",
+    label: "zk-admin-server",
+    repoFullName: "zk-org-test/zk-admin-server",
+    deployWorkflowFile: "deploy-lane.yml",
+    destroyWorkflowFile: "destroy-lane.yml",
+    defaultRef: "main",
+    cloudMapServiceId: "srv-s4fn35h7nen4u5ci",
+    serviceName: "admin"
+  },
+  {
+    key: "account",
+    label: "account",
+    repoFullName: "zk-org-test/account",
+    deployWorkflowFile: "deploy-lane.yml",
+    destroyWorkflowFile: "destroy-lane.yml",
+    defaultRef: "main",
+    cloudMapServiceId: "srv-j2newpni247wsn7h",
+    serviceName: "account"
+  },
+  {
+    key: "zk-websocket",
+    label: "zk-websocket",
+    repoFullName: "zk-org-test/zk-websocket",
+    deployWorkflowFile: "deploy-lane.yml",
+    destroyWorkflowFile: "destroy-lane.yml",
+    defaultRef: "main",
+    cloudMapServiceId: "srv-34fi45edgao7tp2r",
+    serviceName: "zk-websocket"
+  }
+];
+
+// src/lib/aws.ts
+var parseJson = (raw) => JSON.parse(raw);
+var isSsoAuthFailure = (stderr) => /(token has expired|token.*expired|sso|authorization pending|login)/i.test(stderr);
+var runAws = async (args) => {
+  const result = await runCommand("aws", args);
+  if (result.exitCode !== 0) {
+    throw new CliError(result.stderr || `AWS command failed: aws ${args.join(" ")}`, 1);
+  }
+  return result.stdout;
+};
+var ensureAwsAuthenticated = async (profile) => {
+  const identityArgs = ["sts", "get-caller-identity", "--profile", profile, "--output", "json"];
+  const firstAttempt = await runCommand("aws", identityArgs);
+  if (firstAttempt.exitCode === 0) {
+    return;
+  }
+  if (!isSsoAuthFailure(firstAttempt.stderr)) {
+    throw new CliError(firstAttempt.stderr || `AWS authentication failed for profile ${profile}`, 1);
+  }
+  const loginResult = await runCommand("aws", ["sso", "login", "--profile", profile], {
+    stdio: "inherit"
+  });
+  if (loginResult.exitCode !== 0) {
+    throw new CliError(`AWS SSO login failed for profile ${profile}`, 1);
+  }
+  const secondAttempt = await runCommand("aws", identityArgs);
+  if (secondAttempt.exitCode !== 0) {
+    throw new CliError(`AWS authentication is still invalid for profile ${profile}`, 1);
+  }
+};
+var listLaneInstances = async (input2) => {
+  const service = parseJson(
+    await runAws([
+      "servicediscovery",
+      "get-service",
+      "--id",
+      input2.serviceId,
+      "--region",
+      input2.region,
+      "--profile",
+      input2.profile,
+      "--output",
+      "json"
+    ])
+  ).Service;
+  const namespace = parseJson(
+    await runAws([
+      "servicediscovery",
+      "get-namespace",
+      "--id",
+      service.NamespaceId,
+      "--region",
+      input2.region,
+      "--profile",
+      input2.profile,
       "--output",
       "json"
     ])
@@ -2722,11 +2749,6 @@ var listLaneInstances = async (input2) => {
   };
 };
 
-// src/lib/github.ts
-import { mkdtemp as mkdtemp2, readFile as readFile2, rm } from "fs/promises";
-import os from "os";
-import path from "path";
-
 // src/constants/release-targets.ts
 var CONTROL_REPO_FULL_NAME = "zk-org-test/github-action";
 var CONTROL_RELEASE_PREPARE_WORKFLOW_FILE = "controlled-release.yml";
@@ -2740,30 +2762,6 @@ var releaseTargets = [
     repoFullName: "zk-org-test/account",
     defaultReleaseProfile: "production"
   },
-  {
-    key: "design-project",
-    label: "design-project",
-    repoFullName: "zk-org-test/design-project",
-    defaultReleaseProfile: "production"
-  },
-  {
-    key: "zk-web",
-    label: "zk-web",
-    repoFullName: "zk-org-test/zk-web",
-    defaultReleaseProfile: "production"
-  },
-  {
-    key: "zk-agent-engine",
-    label: "zk-agent-engine",
-    repoFullName: "zk-org-test/zk-agent-engine",
-    defaultReleaseProfile: "production"
-  },
-  {
-    key: "zk-commerce",
-    label: "zk-commerce",
-    repoFullName: "zk-org-test/zk-commerce",
-    defaultReleaseProfile: "production"
-  },
   {
     key: "zk-admin-server",
     label: "zk-admin-server",
@@ -2946,17 +2944,6 @@ var ensureGhAuthenticated = async () => {
     throw new CliError("GitHub CLI authentication is required", 1);
   }
 };
-var getCurrentGitHubLogin = async () => {
-  const result = await runCommand("gh", ["api", "user", "--jq", ".login"]);
-  if (result.exitCode !== 0) {
-    throw new CliError("Failed to resolve current GitHub login", 1);
-  }
-  const login = result.stdout.trim();
-  if (!login) {
-    throw new CliError("Failed to resolve current GitHub login", 1);
-  }
-  return login;
-};
 var resolveBranchForRepo = async (input2) => {
   const result = await runCommand("gh", [
     "api",
@@ -3003,32 +2990,6 @@ var dispatchControlWorkflow = async (input2) => {
     throw new CliError(`Failed to dispatch ${input2.workflowFile} for ${CONTROL_REPO_FULL_NAME}`, 1);
   }
 };
-var dispatchCanvasStagingVersionWorkflow = async (input2) => {
-  const args = [
-    "api",
-    `repos/${input2.repoFullName}/actions/workflows/${input2.workflowFile}/dispatches`,
-    "--method",
-    "POST",
-    "-f",
-    `ref=${input2.workflowRef}`,
-    "-f",
-    `inputs[target_ref]=${input2.targetRef}`
-  ];
-  if (input2.versionMessage) {
-    args.push("-f", `inputs[version_message]=${input2.versionMessage}`);
-  }
-  if (input2.versionTag) {
-    args.push("-f", `inputs[version_tag]=${input2.versionTag}`);
-  }
-  const result = await runCommand("gh", args);
-  if (result.exitCode !== 0) {
-    const detail = getCommandFailureDetail(result.stderr, result.stdout);
-    throw new CliError(
-      detail ? `Failed to dispatch ${input2.workflowFile} for ${input2.repoFullName}: ${detail}` : `Failed to dispatch ${input2.workflowFile} for ${input2.repoFullName}`,
-      1
-    );
-  }
-};
 var dispatchWorkflow = async (input2) => {
   const result = await runCommand("gh", [
     "api",
@@ -3066,50 +3027,6 @@ var listOpenIssueIds = async (repoFullName) => {
   }
   return JSON.parse(result.stdout).map((issue) => issue.id);
 };
-var parseCanvasStagingVersionArtifact = (payload) => {
-  const parsed = JSON.parse(payload);
-  if (!parsed.deployment_id || !parsed.version_id || !parsed.override_header || !parsed.worker_name || !parsed.workflow_run_url) {
-    throw new CliError("Failed to parse canvas staging version artifact metadata", 1);
-  }
-  return {
-    deploymentId: String(parsed.deployment_id),
-    overrideHeader: String(parsed.override_header),
-    previewAliasUrl: parsed.preview_alias_url ? String(parsed.preview_alias_url) : null,
-    previewUrl: parsed.preview_url ? String(parsed.preview_url) : null,
-    versionId: String(parsed.version_id),
-    versionMessage: String(parsed.version_message ?? ""),
-    versionTag: String(parsed.version_tag ?? ""),
-    workerName: String(parsed.worker_name),
-    workflowRunUrl: String(parsed.workflow_run_url)
-  };
-};
-var fetchCanvasStagingVersionArtifact = async (input2) => {
-  const tempDir = await mkdtemp2(path.join(os.tmpdir(), "nexight-devops-canvas-"));
-  try {
-    const downloadResult = await runCommand("gh", [
-      "run",
-      "download",
-      String(input2.runId),
-      "--repo",
-      input2.repoFullName,
-      "--name",
-      input2.artifactName,
-      "--dir",
-      tempDir
-    ]);
-    if (downloadResult.exitCode !== 0) {
-      const detail = getCommandFailureDetail(downloadResult.stderr, downloadResult.stdout);
-      throw new CliError(
-        detail ? `Failed to download artifact ${input2.artifactName} for run ${input2.runId}: ${detail}` : `Failed to download artifact ${input2.artifactName} for run ${input2.runId}`,
-        1
-      );
-    }
-    const payload = await readFile2(path.join(tempDir, input2.artifactFileName), "utf8");
-    return parseCanvasStagingVersionArtifact(payload);
-  } finally {
-    await rm(tempDir, { recursive: true, force: true });
-  }
-};
 var listControlledReleaseIssues = async (state) => {
   const result = await runCommand("gh", [
     "api",
@@ -3225,6 +3142,9 @@ var matchesWorkflowRunCorrelation = (run, correlation) => {
   if (correlation.actorLogin && run.actor?.login !== correlation.actorLogin) {
     return false;
   }
+  if (correlation.runName && run.display_title !== correlation.runName) {
+    return false;
+  }
   if (!isRunCreatedAtOrAfter(run.created_at, correlation.createdAt)) {
     return false;
   }
@@ -3333,764 +3253,36 @@ var pollWorkflowRun = async (input2) => {
     if (!matchedRun) {
       input2.onUpdate?.({ runId: trackedRunId, status: "pending" });
       await sleep(intervalMs);
-      continue;
-    }
-    input2.onUpdate?.({
-      runId: trackedRunId,
-      htmlUrl: matchedRun.html_url,
-      status: matchedRun.status === "completed" ? "completed" : "in_progress"
-    });
-    if (matchedRun.status === "completed") {
-      const completion = {
-        conclusion: matchedRun.conclusion ?? "unknown",
-        htmlUrl: matchedRun.html_url,
-        runId: matchedRun.id,
-        status: matchedRun.status
-      };
-      if (completion.conclusion !== "success") {
-        const failureMessage = await fetchWorkflowRunFailureMessage({
-          repoFullName: input2.repoFullName,
-          runId: matchedRun.id
-        });
-        if (failureMessage) {
-          completion.failureMessage = failureMessage;
-        }
-      }
-      return completion;
-    }
-    await sleep(intervalMs);
-  }
-  throw new CliError(`Timed out waiting for workflow run in ${input2.repoFullName}`, 1);
-};
-
-// src/lib/prerequisites.ts
-var ensureCommandInstalled = async (command, installHint) => {
-  const result = await runCommand(command, ["--version"]);
-  if (result.exitCode !== 0) {
-    throw new CliError(installHint, 1);
-  }
-};
-var ensurePrerequisites = async (input2) => {
-  const config = await loadConfig();
-  if (input2.needsGh) {
-    await ensureCommandInstalled("gh", "gh is required. Run nexight-devops onboard --set-mode gh");
-    await ensureGhAuthenticated();
-  }
-  if (input2.needsAws) {
-    await ensureCommandInstalled("aws", "aws is required. Run nexight-devops onboard --set-mode aws");
-    await ensureAwsAuthenticated(config.defaultAwsProfile);
-  }
-  return config;
-};
-
-// src/commands/diagnose/shared-agent.ts
-var EXPECTED_PRODUCTION_ACCOUNT = "250509935467";
-var DEFAULT_REGION = "us-east-1";
-var parseWindowMinutes = (value) => {
-  if (!/^\d+$/.test(value.trim())) {
-    throw new CliError("--window-minutes must be an integer", 1);
-  }
-  return Number(value);
-};
-var formatBytes = (bytes) => {
-  if (bytes < 1024) {
-    return `${bytes} B`;
-  }
-  if (bytes < 1024 * 1024) {
-    return `${(bytes / 1024).toFixed(1)} KiB`;
-  }
-  return `${(bytes / (1024 * 1024)).toFixed(1)} MiB`;
-};
-var printSharedAgentDiagnosis = (result) => {
-  logger.info(`\u7ED3\u8BBA [${result.verdict.code}/${result.verdict.confidence}] ${result.verdict.summary}`);
-  logger.step(`\u65F6\u95F4\u7A97 ${result.window.from} \u2192 ${result.window.to}`);
-  const ownerParts = [
-    result.owner.userId ? `user=${result.owner.userId}` : void 0,
-    result.owner.deviceId ? `device=${result.owner.deviceId}` : void 0,
-    result.owner.clientVersion ? `version=${result.owner.clientVersion}` : void 0
-  ].filter(Boolean);
-  logger.step(`Owner ${ownerParts.length > 0 ? ownerParts.join(" | ") : "\u672A\u8BC6\u522B"}`);
-  const descriptor = result.descriptor.latest;
-  logger.step(
-    descriptor ? `Descriptor ${descriptor.timestamp} | ${descriptor.channel}/${descriptor.outcome}${descriptor.reason ? ` | ${descriptor.reason}` : ""}` : "Descriptor \u5F53\u524D\u65F6\u95F4\u7A97\u65E0\u8BC1\u636E"
-  );
-  const lease = result.ownerLease.latest;
-  logger.step(
-    lease ? `Owner lease ${lease.timestamp} | ${lease.outcome}/${lease.reasonCode} | version=${lease.clientVersion}` : "Owner lease \u5F53\u524D\u65F6\u95F4\u7A97\u65E0\u53EF\u5173\u8054\u89C2\u6D4B"
-  );
-  logger.step(`HTTP failures ${result.httpFailures.count}`);
-  result.queryReports.forEach((report) => {
-    if (report.status === "complete" && report.stats) {
-      logger.step(
-        `${report.name} query | matched=${report.stats.recordsMatched} scanned=${report.stats.recordsScanned} bytes=${formatBytes(
-          report.stats.bytesScanned
-        )}`
-      );
-    }
-  });
-  result.warnings.forEach((warning) => logger.warn(warning));
-  result.missingEvidence.forEach((missing) => logger.warn(`\u7F3A\u5931\u8BC1\u636E: ${missing}`));
-};
-var runSharedAgentDiagnosis = async (options) => {
-  const config = await loadConfig();
-  const profile = options.profile?.trim() || config.defaultAwsProfile;
-  await ensureCommandInstalled("aws", "aws is required. Run nexight-devops onboard --set-mode aws");
-  await ensureAwsAuthenticated(profile);
-  const identity = await getAwsCallerIdentity(profile);
-  if (identity.account !== EXPECTED_PRODUCTION_ACCOUNT) {
-    throw new CliError(
-      `AWS profile ${profile} is authenticated to account ${identity.account}; expected ${EXPECTED_PRODUCTION_ACCOUNT}`,
-      1
-    );
-  }
-  const run = () => diagnoseSharedAgent({
-    account: identity.account,
-    profile,
-    region: options.region,
-    logGroup: options.logGroup,
-    namespace: options.namespace,
-    roomId: options.roomId,
-    sharedAgentId: options.sharedAgentId,
-    ownerDeviceId: options.ownerDeviceId,
-    authorityId: options.authorityId,
-    anchor: parseDiagnosisAnchor(options.at),
-    windowMinutes: parseWindowMinutes(options.windowMinutes)
-  });
-  const result = options.json ? await run() : await withProgressTask(
-    {
-      initialText: "\u6B63\u5728\u67E5\u8BE2\u5171\u4EAB Agent \u63A7\u5236\u9762\u8BC1\u636E",
-      heartbeatText: (elapsedMs) => `\u6B63\u5728\u67E5\u8BE2\u5171\u4EAB Agent \u63A7\u5236\u9762\u8BC1\u636E\uFF08${Math.floor(elapsedMs / 1e3)}s\uFF09`
-    },
-    run
-  );
-  if (options.json) {
-    console.log(JSON.stringify(result, null, 2));
-  } else {
-    printSharedAgentDiagnosis(result);
-  }
-  return result;
-};
-var registerSharedAgentDiagnosisCommand = (program) => {
-  program.command("shared-agent").description("Diagnose Shared Agent connectivity from bounded production CloudWatch evidence").requiredOption("--room-id <roomId>", "room ID from the user report or requester diagnostics").requiredOption("--at <timestamp>", "incident timestamp with timezone, for example 2026-08-12T12:00:00+08:00").option("--shared-agent-id <sharedAgentId>", "narrow descriptor evidence to one Shared Agent").option("--owner-device-id <ownerDeviceId>", "known Owner device ID, used to join lease evidence").option("--authority-id <authorityId>", "known Device Authority ID, used to join lease evidence").option("--window-minutes <minutes>", "bounded window centered on --at", String(DEFAULT_DIAGNOSIS_WINDOW_MINUTES)).option("--profile <profile>", "AWS CLI profile; defaults to the configured nexight-devops profile").option("--region <region>", "AWS region", DEFAULT_REGION).option("--log-group <logGroup>", "CloudWatch application log group", DEFAULT_TSH_LOG_GROUP).option("--namespace <namespace>", "Kubernetes namespace", DEFAULT_TSH_NAMESPACE).option("--json", "print stable machine-readable JSON without CLI decorations").action(async (options) => {
-    await runSharedAgentDiagnosis(options);
-  });
-};
-
-// src/commands/diagnose/index.ts
-var registerDiagnoseCommand = (program) => {
-  const diagnose = program.command("diagnose").description("Run deterministic incident diagnosis playbooks");
-  registerSharedAgentDiagnosisCommand(diagnose);
-};
-
-// src/commands/doctor.ts
-var registerDoctorCommand = (program) => {
-  program.command("doctor").description("Run a local readiness check for the CLI shell").action(() => {
-    logger.step("Running basic readiness checks");
-    logger.success("nexight-devops is ready");
-  });
-};
-
-// src/lib/datafinder/types.ts
-var DEFAULT_DATAFINDER_BASE_URL = "https://analytics.volcengineapi.com";
-var DEFAULT_DATAFINDER_TIMEZONE = "Asia/Shanghai";
-
-// src/locales/zh-CN.ts
-var zhCN = {
-  common: {
-    continue: "\u7EE7\u7EED",
-    skip: "\u8DF3\u8FC7"
-  },
-  errors: {
-    missingAws: "\u672A\u68C0\u6D4B\u5230 aws\uFF0C\u8BF7\u5148\u5B8C\u6210 AWS CLI \u5B89\u88C5\u3002",
-    missingGh: "\u672A\u68C0\u6D4B\u5230 gh\uFF0C\u8BF7\u5148\u5B8C\u6210 GitHub CLI \u5B89\u88C5\u3002"
-  },
-  onboard: {
-    adminLoginSucceeded: "\u7BA1\u7406\u540E\u53F0\u767B\u5F55\u6210\u529F",
-    adminSection: "\u7BA1\u7406\u540E\u53F0\u767B\u5F55\u8BBE\u7F6E",
-    adminTokenRequired: "\u7BA1\u7406\u540E\u53F0 Token \u4E0D\u80FD\u4E3A\u7A7A",
-    awsSection: "AWS CLI \u8BBE\u7F6E",
-    complete: "Onboard \u5B8C\u6210",
-    chooseAwsProfile: "\u8BF7\u9009\u62E9\u9ED8\u8BA4 AWS Profile",
-    chooseLocale: "\u8BF7\u9009\u62E9\u547D\u4EE4\u884C\u8BED\u8A00",
-    datafinderAppPathMode: "\u5E94\u7528\u8DEF\u5F84\uFF08\u4F20\u7EDF SaaS / \u79C1\u6709\u5316\uFF09",
-    datafinderCredentialAction: "\u5DF2\u914D\u7F6E DataFinder \u51ED\u8BC1\uFF0C\u8BF7\u9009\u62E9\u5904\u7406\u65B9\u5F0F",
-    datafinderKeepCredentials: "\u4FDD\u7559\u73B0\u6709\u51ED\u8BC1",
-    datafinderProjectPathMode: "\u9879\u76EE\u8DEF\u5F84\uFF08SaaS \u4E91\u539F\u751F\uFF0C\u63A8\u8350\uFF09",
-    datafinderReplaceCredentials: "\u91CD\u65B0\u8F93\u5165\u51ED\u8BC1",
-    datafinderSection: "DataFinder OpenAPI \u8BBE\u7F6E",
-    datafinderSucceeded: "DataFinder \u8FDE\u63A5\u6210\u529F\uFF1A{dashboardName}\uFF0C\u5171 {reportCount} \u4E2A\u62A5\u8868",
-    enterGhToken: "\u8BF7\u8F93\u5165 GitHub Token",
-    enterAdminToken: "\u8BF7\u8F93\u5165 Tutti \u7BA1\u7406\u540E\u53F0 Token",
-    enterDataFinderAk: "\u8BF7\u8F93\u5165 DataFinder AccessKeyId",
-    enterDataFinderAppId: "\u8BF7\u8F93\u5165 DataFinder \u5E94\u7528 ID",
-    enterDataFinderDashboardId: "\u8BF7\u8F93\u5165\u9ED8\u8BA4 DataFinder \u770B\u677F ID",
-    enterDataFinderProjectId: "\u8BF7\u8F93\u5165 DataFinder \u9879\u76EE ID",
-    enterDataFinderSk: "\u8BF7\u8F93\u5165 DataFinder SecretAccessKey",
-    enterDataFinderTimezone: "\u8BF7\u8F93\u5165 DataFinder \u67E5\u8BE2\u65F6\u533A",
-    enterDataFinderUrl: "\u8BF7\u8F93\u5165 DataFinder OpenAPI \u5730\u5740",
-    ghInstallDeferred: "\u672A\u5B8C\u6210 gh \u5B89\u88C5\u3002\u4F60\u53EF\u4EE5\u7A0D\u540E\u8FD0\u884C nexight-devops onboard --set-mode gh",
-    ghLoginToken: "\u4F7F\u7528 Token",
-    ghLoginWeb: "\u6D4F\u89C8\u5668\u767B\u5F55\uFF08\u63A8\u8350\uFF09",
-    ghSection: "GitHub CLI \u8BBE\u7F6E",
-    installAwsPrompt: "\u672A\u68C0\u6D4B\u5230 aws\uFF0C\u662F\u5426\u73B0\u5728\u5C1D\u8BD5\u5B89\u88C5\uFF1F",
-    installBrewFailed: "Homebrew \u5B89\u88C5\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u624B\u52A8\u91CD\u8BD5\u3002",
-    installBrewPrompt: "\u672A\u68C0\u6D4B\u5230 Homebrew\uFF0C\u662F\u5426\u73B0\u5728\u5C1D\u8BD5\u5B89\u88C5\uFF1F",
-    installGhPrompt: "\u672A\u68C0\u6D4B\u5230 gh\uFF0C\u662F\u5426\u73B0\u5728\u5C1D\u8BD5\u5B89\u88C5\uFF1F",
-    installManualPrefix: "\u8BF7\u5148\u5B89\u88C5 Homebrew\uFF0C\u518D\u6267\u884C",
-    selectDataFinderPathMode: "\u8BF7\u9009\u62E9 DataFinder OpenAPI \u8DEF\u5F84\u6A21\u5F0F",
-    selectGhLoginMode: "\u8BF7\u9009\u62E9 GitHub \u767B\u5F55\u65B9\u5F0F",
-    skipGhSetup: "\u8DF3\u8FC7 GitHub CLI \u8BBE\u7F6E",
-    skipAdminSetup: "\u8DF3\u8FC7\u7BA1\u7406\u540E\u53F0\u767B\u5F55\u8BBE\u7F6E",
-    skipAwsSetup: "\u8DF3\u8FC7 AWS CLI \u8BBE\u7F6E",
-    skipDataFinderSetup: "\u8DF3\u8FC7 DataFinder OpenAPI \u8BBE\u7F6E",
-    awsInstallDeferred: "\u672A\u5B8C\u6210 AWS CLI \u5B89\u88C5\u3002\u4F60\u53EF\u4EE5\u7A0D\u540E\u8FD0\u884C nexight-devops onboard --set-mode aws",
-    title: "\u5F00\u59CB\u521D\u59CB\u5316 nexight-devops"
-  },
-  release: {
-    common: {
-      approvalIssueUrl: "\u5BA1\u6279\u5355\u5730\u5740: {approvalIssueUrl}",
-      candidateTag: "\u5019\u9009\u7248\u672C: {candidateTag}",
-      controlRunUrl: "\u63A7\u5236\u9762\u8FD0\u884C\u5730\u5740: {controlRunUrl}",
-      releaseBranch: "\u53D1\u5E03\u5206\u652F: {releaseBranch}",
-      releaseProfile: "\u53D1\u5E03 Profile: {releaseProfile}",
-      targetRepo: "\u76EE\u6807\u4ED3\u5E93: {targetRepo}"
-    },
-    approve: {
-      approvalIssueMissing: "\u672A\u627E\u5230\u53EF\u5BA1\u6279\u7684\u53D1\u5E03\u5355\uFF0C\u8BF7\u91CD\u65B0\u9009\u62E9\u76EE\u6807\u4ED3\u5E93\u6216\u68C0\u67E5\u63A7\u5236\u9762\u72B6\u6001\u3002",
-      approvalWorkflowRunUrl: "\u5BA1\u6279\u5DE5\u4F5C\u6D41\u5730\u5740: {approvalWorkflowRunUrl}",
-      cancelled: "\u5DF2\u53D6\u6D88 release approve\u3002",
-      commenting: "\u6B63\u5728\u5BF9\u53D1\u5E03\u5355 #{issueNumber} \u6267\u884C /release-approve",
-      closeIssueWarning: "\u5BA1\u6279\u5355 #{issueNumber} \u81EA\u52A8\u5173\u95ED\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u624B\u52A8\u5173\u95ED\u3002",
-      confirm: "\u786E\u8BA4\u5BF9\u53D1\u5E03\u5355 #{issueNumber}\uFF08{candidateTag} / {releaseBranch}\uFF09\u6267\u884C /release-approve\uFF1F",
-      feishuReminder: "\u98DE\u4E66\u63D0\u9192\uFF1A\u6B63\u5F0F\u53D1\u7248\u5DF2\u5F00\u59CB\uFF0C\u8BF7\u7ACB\u5373\u5173\u6CE8\u98DE\u4E66\u7FA4\uFF0C\u6301\u7EED\u8DDF\u8FDB\u53D1\u5E03\u72B6\u6001\u3002",
-      noPendingIssues: "\u5F53\u524D\u6CA1\u6709\u5F85\u5BA1\u6279\u7684\u53D1\u5E03\u5355\uFF0C\u76EE\u6807\u4ED3\u5E93 {targetRepo} \u6682\u65E0\u53EF\u5904\u7406\u9879\u3002",
-      selectApprovalIssue: "\u8BF7\u9009\u62E9\u8981\u5BA1\u6279\u7684\u53D1\u5E03\u5355",
-      selectTarget: "\u8BF7\u9009\u62E9\u8981\u5BA1\u6279\u7684\u4ED3\u5E93",
-      success: "release approve \u5DF2\u5B8C\u6210\uFF0C\u6B63\u5F0F\u53D1\u7248\u5DF2\u5F00\u59CB",
-      workflowFailed: "\u5BA1\u6279\u5DE5\u4F5C\u6D41\u6267\u884C\u5931\u8D25\uFF0C\u8BF7\u6253\u5F00\u5BA1\u6279\u5DE5\u4F5C\u6D41\u8FD0\u884C\u67E5\u770B\u8BE6\u60C5: {approvalWorkflowRunUrl}"
-    },
-    hotfix: {
-      allowUnmergedHotfix: "\u662F\u5426\u5141\u8BB8 release \u5206\u652F\u4E0A\u7684\u8865\u4E01\u5C1A\u672A\u88AB main \u5438\u6536\u65F6\u76F4\u63A5\u53D1\u8D77 hotfix\uFF1F",
-      approvalIssueAmbiguous: "\u68C0\u6D4B\u5230\u591A\u4E2A\u65B0\u7684 hotfix \u5BA1\u6279\u5355\uFF0C\u8BF7\u68C0\u67E5\u4EE5\u4E0B\u5019\u9009\u9879: {candidateIssueUrls}\uFF1B\u63A7\u5236\u9762\u8FD0\u884C: {controlRunUrl}",
-      approvalIssueMissing: "\u672A\u627E\u5230\u65B0\u521B\u5EFA\u7684 hotfix \u5BA1\u6279\u5355\uFF0C\u8BF7\u6253\u5F00\u63A7\u5236\u9762\u8FD0\u884C\u67E5\u770B\u8BE6\u60C5: {controlRunUrl}",
-      cancelled: "\u5DF2\u53D6\u6D88 release hotfix\u3002",
-      confirm: "\u786E\u8BA4\u5BF9 {repoName} \u53D1\u8D77 hotfix\uFF0C\u5206\u652F {releaseBranch}\uFF1F",
-      dispatching: "\u6B63\u5728\u51C6\u5907 hotfix: {repoName}",
-      enterReleaseBranch: "\u8BF7\u8F93\u5165 hotfix \u7684 release \u5206\u652F\uFF08\u5FC5\u987B\u4EE5 release/ \u5F00\u5934\uFF09",
-      feishuReminder: "\u98DE\u4E66\u63D0\u9192\uFF1A\u81EA\u6D4B\u53D1\u7248\u901A\u77E5\u5DF2\u53D1\u9001\u5230\u98DE\u4E66\u7FA4\uFF0C\u8BF7\u5173\u6CE8\u98DE\u4E66\u7FA4\u5E76\u5B8C\u6210\u9A8C\u8BC1\uFF0C\u968F\u540E\u6267\u884C nexight-devops release approve\u3002",
-      invalidReleaseBranch: "release \u5206\u652F\u5FC5\u987B\u662F release/<name> \u683C\u5F0F\u3002",
-      nextSteps: "\u4E0B\u4E00\u6B65\uFF1A\u5B8C\u6210\u9A8C\u8BC1\u540E\uFF0C\u6267\u884C nexight-devops release approve\u3002",
-      overrideMode: "Override \u6A21\u5F0F: {overrideMode}",
-      overrideModeDisabled: "\u672A\u5F00\u542F",
-      overrideModeEnabled: "\u5DF2\u5F00\u542F",
-      overrideReason: "\u8BF7\u8F93\u5165 release \u5206\u652F\u4E0A\u7684\u8865\u4E01\u5C1A\u672A\u88AB main \u5438\u6536\u65F6\u7EE7\u7EED hotfix \u7684\u539F\u56E0",
-      overrideReasonRequired: "\u5F00\u542F release \u5206\u652F\u8865\u4E01 override \u65F6\u5FC5\u987B\u586B\u5199\u539F\u56E0\u3002",
-      workflowFailureReason: "\u5931\u8D25\u539F\u56E0: {failureMessage}",
-      selectTarget: "\u8BF7\u9009\u62E9\u8981\u6267\u884C hotfix \u7684\u4ED3\u5E93",
-      success: "release hotfix \u5DF2\u5B8C\u6210",
-      waiting: "\u63A7\u5236\u9762 hotfix \u5DE5\u4F5C\u6D41\u5DF2\u89E6\u53D1\uFF0C\u6B63\u5728\u7B49\u5F85\u5B8C\u6210: {repoName}",
-      workflowFailed: "controlled-hotfix-release \u5DE5\u4F5C\u6D41\u6267\u884C\u5931\u8D25\uFF0C\u8BF7\u6253\u5F00\u63A7\u5236\u9762\u8FD0\u884C\u67E5\u770B\u8BE6\u60C5: {controlRunUrl}"
-    },
-    prepare: {
-      approvalIssueAmbiguous: "\u68C0\u6D4B\u5230\u591A\u4E2A\u65B0\u7684\u53D1\u5E03\u5BA1\u6279\u5355\uFF0C\u8BF7\u68C0\u67E5\u4EE5\u4E0B\u5019\u9009\u9879: {candidateIssueUrls}\uFF1B\u63A7\u5236\u9762\u8FD0\u884C: {controlRunUrl}",
-      approvalIssueMissing: "\u672A\u627E\u5230\u65B0\u521B\u5EFA\u7684\u53D1\u5E03\u5BA1\u6279\u5355\uFF0C\u8BF7\u6253\u5F00\u63A7\u5236\u9762\u8FD0\u884C\u67E5\u770B\u8BE6\u60C5: {controlRunUrl}",
-      cancelled: "\u5DF2\u53D6\u6D88 release prepare\u3002",
-      confirm: "\u786E\u8BA4\u5BF9 {repoName} \u6267\u884C release prepare\uFF1F",
-      dispatching: "\u6B63\u5728\u51C6\u5907\u53D1\u5E03: {repoName}",
-      feishuReminder: "\u98DE\u4E66\u63D0\u9192\uFF1A\u81EA\u6D4B\u53D1\u7248\u901A\u77E5\u5DF2\u53D1\u9001\u5230\u98DE\u4E66\u7FA4\uFF0C\u8BF7\u5173\u6CE8\u98DE\u4E66\u7FA4\u5E76\u5B8C\u6210\u9A8C\u8BC1\uFF0C\u968F\u540E\u6267\u884C nexight-devops release approve\u3002",
-      nextSteps: "\u4E0B\u4E00\u6B65\uFF1A\u5B8C\u6210\u9A8C\u8BC1\u540E\uFF0C\u6267\u884C nexight-devops release approve\u3002",
-      selectTarget: "\u8BF7\u9009\u62E9\u8981\u51C6\u5907\u53D1\u5E03\u7684\u4ED3\u5E93",
-      success: "release prepare \u5DF2\u5B8C\u6210",
-      waiting: "\u63A7\u5236\u9762\u53D1\u5E03\u5DE5\u4F5C\u6D41\u5DF2\u89E6\u53D1\uFF0C\u6B63\u5728\u7B49\u5F85\u5B8C\u6210: {repoName}",
-      workflowFailed: "controlled-release \u5DE5\u4F5C\u6D41\u6267\u884C\u5931\u8D25\uFF0C\u8BF7\u6253\u5F00\u63A7\u5236\u9762\u8FD0\u884C\u67E5\u770B\u8BE6\u60C5: {controlRunUrl}"
-    }
-  },
-  ppeLane: {
-    destroy: {
-      atLeastOneRepo: "\u81F3\u5C11\u9009\u62E9\u4E00\u4E2A\u4ED3\u5E93",
-      blankLane: "PPE lane \u540D\u79F0\u4E0D\u80FD\u4E3A\u7A7A",
-      cancelled: "\u5DF2\u53D6\u6D88\u9500\u6BC1",
-      confirmLane: "\u8FD9\u662F\u9500\u6BC1\u64CD\u4F5C\uFF0C\u8BF7\u518D\u6B21\u8F93\u5165 {lane} \u786E\u8BA4",
-      enterLane: "\u8BF7\u8F93\u5165\u9700\u8981\u79FB\u9664\u7684 PPE lane \u540D\u79F0",
-      failed: "\u4E00\u4E2A\u6216\u591A\u4E2A PPE lane \u9500\u6BC1\u5DE5\u4F5C\u6D41\u6267\u884C\u5931\u8D25",
-      noRecords: "\u8BE5 ppe-lane \u6CA1\u67E5\u8BE2\u5230\u4EFB\u4F55\u90E8\u7F72\u8BB0\u5F55",
-      running: "\u6B63\u5728\u9500\u6BC1 lane {lane}",
-      selectRepos: "\u8BF7\u9009\u62E9\u9700\u8981\u9500\u6BC1\u7684\u4ED3\u5E93",
-      skippedReason: "Cloud Map \u4E2D\u672A\u627E\u5230\u90E8\u7F72\u8BB0\u5F55",
-      warning: "\u5C06\u9500\u6BC1\u4EE5\u4E0B\u4ED3\u5E93: {repos}"
-    }
-  },
-  versionUpdate: {
-    alreadyLatest: "\u5F53\u524D\u5DF2\u662F\u6700\u65B0\u7248\u672C {currentVersion}\u3002",
-    available: "\u68C0\u6D4B\u5230\u65B0\u7248\u672C {latestVersion}\uFF0C\u5F53\u524D\u7248\u672C\u4E3A {currentVersion}\u3002",
-    checkingRegistry: "\u6B63\u5728\u68C0\u67E5\u7248\u672C\u4FE1\u606F",
-    detectingInstallSource: "\u6B63\u5728\u68C0\u6D4B\u5B89\u88C5\u6765\u6E90",
-    majorRequired: "\u68C0\u6D4B\u5230\u5927\u7248\u672C\u66F4\u65B0 {latestVersion}\uFF0C\u5F53\u524D\u7248\u672C {currentVersion} \u5FC5\u987B\u5148\u5347\u7EA7\u540E\u518D\u7EE7\u7EED\u3002",
-    manualUpgrade: "\u65E0\u6CD5\u8BC6\u522B\u5F53\u524D\u5B89\u88C5\u6765\u6E90\uFF0C\u8BF7\u624B\u52A8\u6267\u884C\u4EE5\u4E0B\u4EFB\u4E00\u5347\u7EA7\u547D\u4EE4\uFF1A\n{commands}",
-    optionalUpgradeFailed: "\u81EA\u52A8\u5347\u7EA7\u5931\u8D25\uFF0C\u672C\u6B21\u7EE7\u7EED\u4F7F\u7528\u5F53\u524D\u7248\u672C\u3002\u4F60\u53EF\u4EE5\u7A0D\u540E\u624B\u52A8\u6267\u884C\uFF1A{command}",
-    registryCheckFailed: "\u7248\u672C\u68C0\u67E5\u5931\u8D25\uFF0C\u5DF2\u7EE7\u7EED\u6267\u884C\u5F53\u524D\u547D\u4EE4\u3002",
-    registryCheckFailedManual: "\u7248\u672C\u68C0\u67E5\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002",
-    rerun: "\u5347\u7EA7\u5B8C\u6210\u540E\u8BF7\u91CD\u65B0\u6267\u884C\u521A\u624D\u7684\u547D\u4EE4\u3002",
-    selectAction: "\u68C0\u6D4B\u5230\u53EF\u7528\u66F4\u65B0\uFF0C\u662F\u5426\u73B0\u5728\u5347\u7EA7\uFF1F",
-    skipThisRun: "\u8DF3\u8FC7\u672C\u6B21",
-    skippedForRun: "\u5DF2\u8DF3\u8FC7\u672C\u6B21\u5347\u7EA7\uFF0C\u7EE7\u7EED\u6267\u884C\u5F53\u524D\u547D\u4EE4\u3002",
-    upgradeFailed: "\u81EA\u52A8\u5347\u7EA7\u5931\u8D25\uFF0C\u8BF7\u5148\u624B\u52A8\u6267\u884C\uFF1A{command}",
-    upgradeNow: "\u7ACB\u5373\u5347\u7EA7",
-    upgradeSucceeded: "CLI \u5DF2\u66F4\u65B0\u5230\u6700\u65B0\u7248\u672C {latestVersion}\u3002",
-    upgrading: "\u6B63\u5728\u6267\u884C\u5347\u7EA7\u547D\u4EE4\uFF1A{command}"
-  }
-};
-
-// src/lib/i18n.ts
-var locales = {
-  "zh-CN": zhCN
-};
-var getNestedValue = (source, key) => {
-  const value = key.split(".").reduce((current, part) => {
-    if (current && typeof current === "object" && part in current) {
-      return current[part];
-    }
-    return void 0;
-  }, source);
-  return typeof value === "string" ? value : key;
-};
-var interpolate = (message, values) => {
-  if (!values) {
-    return message;
-  }
-  return message.replace(/\{(\w+)\}/g, (placeholder, key) => {
-    const value = values[key];
-    if (value === void 0) {
-      return placeholder;
-    }
-    return String(value);
-  });
-};
-var createI18n = (locale) => {
-  const messages = locales[locale];
-  return (key, values) => {
-    const messageFromLocale = messages ? getNestedValue(messages, key) : key;
-    const message = messageFromLocale === key ? getNestedValue(zhCN, key) : messageFromLocale;
-    return interpolate(message, values);
-  };
-};
-
-// src/commands/onboard.ts
-var onboardModes = ["all", "admin", "aws", "datafinder", "gh", "locale"];
-var resolveBrewCommand = async () => {
-  const result = await runCommand("/bin/bash", [
-    "-lc",
-    "command -v brew || { [ -x /opt/homebrew/bin/brew ] && printf /opt/homebrew/bin/brew; } || { [ -x /usr/local/bin/brew ] && printf /usr/local/bin/brew; }"
-  ]);
-  const brewPath = result.stdout.trim();
-  return brewPath ? brewPath : null;
-};
-var installHomebrew = async () => {
-  const result = await runCommand(
-    "/bin/bash",
-    [
-      "-lc",
-      '/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"'
-    ],
-    { stdio: "inherit" }
-  );
-  return result.exitCode === 0;
-};
-var ensureBrewPackage = async (packageName, t) => {
-  let brewCommand = await resolveBrewCommand();
-  if (!brewCommand) {
-    const shouldInstallBrew = await ui.confirm({
-      message: t("onboard.installBrewPrompt"),
-      default: true
-    });
-    if (!shouldInstallBrew) {
-      logger.warn(`${t("onboard.installManualPrefix")} brew install ${packageName}`);
-      return false;
-    }
-    if (!await installHomebrew()) {
-      logger.warn(t("onboard.installBrewFailed"));
-      return false;
-    }
-    brewCommand = await resolveBrewCommand();
-    if (!brewCommand) {
-      logger.warn(t("onboard.installBrewFailed"));
-      return false;
-    }
-  }
-  const installResult = await runCommand(brewCommand, ["install", packageName], { stdio: "inherit" });
-  return installResult.exitCode === 0;
-};
-var ensureGhInstalled = async (t) => {
-  const ghVersion = await runCommand("gh", ["--version"]);
-  if (ghVersion.exitCode === 0) {
-    return true;
-  }
-  if (process.platform === "darwin") {
-    const shouldInstall = await ui.confirm({ message: t("onboard.installGhPrompt"), default: true });
-    if (shouldInstall) {
-      return ensureBrewPackage("gh", t);
-    }
-  }
-  logger.warn(t("onboard.ghInstallDeferred"));
-  return false;
-};
-var ensureAwsInstalled = async (t) => {
-  const awsVersion = await runCommand("aws", ["--version"]);
-  if (awsVersion.exitCode === 0) {
-    return true;
-  }
-  if (process.platform === "darwin") {
-    const shouldInstall = await ui.confirm({ message: t("onboard.installAwsPrompt"), default: true });
-    if (shouldInstall) {
-      return ensureBrewPackage("awscli", t);
-    }
-  }
-  logger.warn(t("onboard.awsInstallDeferred"));
-  return false;
-};
-var runGhSetup = async (t) => {
-  if (!await ensureGhInstalled(t)) {
-    return false;
-  }
-  const authStatus = await runCommand("gh", ["auth", "status"]);
-  if (authStatus.exitCode === 0) {
-    return true;
-  }
-  const loginMode = await ui.select({
-    message: t("onboard.selectGhLoginMode"),
-    choices: [
-      { value: "web", name: t("onboard.ghLoginWeb") },
-      { value: "token", name: t("onboard.ghLoginToken") }
-    ]
-  });
-  if (loginMode === "web") {
-    await runCommand("gh", ["auth", "login", "--web"], { stdio: "inherit" });
-  } else {
-    const token = await ui.password({ message: t("onboard.enterGhToken") });
-    await runCommand("gh", ["auth", "login", "--with-token"], {
-      input: token
-    });
-  }
-  return (await runCommand("gh", ["auth", "status"])).exitCode === 0;
-};
-var runAwsSetup = async (defaultProfile, t) => {
-  if (!await ensureAwsInstalled(t)) {
-    return {
-      profile: defaultProfile,
-      configured: false
-    };
-  }
-  const profile = await ui.input({
-    message: t("onboard.chooseAwsProfile"),
-    default: defaultProfile
-  });
-  const listProfiles = await runCommand("aws", ["configure", "list-profiles"]);
-  const profiles = listProfiles.stdout.split("\n").map((item) => item.trim()).filter(Boolean);
-  if (!profiles.includes(profile)) {
-    await runCommand("aws", ["configure", "sso", "--profile", profile], { stdio: "inherit" });
-  }
-  const loginResult = await runCommand("aws", ["sso", "login", "--profile", profile], { stdio: "inherit" });
-  if (loginResult.exitCode !== 0) {
-    return {
-      profile,
-      configured: false
-    };
-  }
-  const identityResult = await runCommand("aws", [
-    "sts",
-    "get-caller-identity",
-    "--profile",
-    profile,
-    "--output",
-    "json"
-  ]);
-  return {
-    profile,
-    configured: identityResult.exitCode === 0
-  };
-};
-var runAdminSetup = async (config, options, t) => {
-  const apiOrigin = normalizeAdminApiOrigin(options.adminUrl ?? config.admin?.apiOrigin);
-  const token = (await ui.password({ message: t("onboard.enterAdminToken") })).trim();
-  if (!token) {
-    throw new CliError(t("onboard.adminTokenRequired"), 1);
-  }
-  await new AdminApi({ apiOrigin, token }).inspectToken(token);
-  config.admin = {
-    apiOrigin,
-    token
-  };
-  logger.success(t("onboard.adminLoginSucceeded"));
-};
-var inputWithDefault = async (message, value) => (await ui.input({
-  message,
-  ...value ? { default: value } : {}
-})).trim();
-var requiredDataFinderValue = (value, label) => {
-  if (!value) {
-    throw new CliError(`DataFinder ${label} \u4E0D\u80FD\u4E3A\u7A7A`, 1);
-  }
-  return value;
-};
-var runDataFinderSetup = async (config, options, t) => {
-  const previous = config.datafinder;
-  let accessKeyId = previous?.accessKeyId ?? "";
-  let secretAccessKey = previous?.secretAccessKey ?? "";
-  if (previous?.accessKeyId && previous.secretAccessKey) {
-    const credentialAction = await ui.select({
-      message: t("onboard.datafinderCredentialAction"),
-      choices: [
-        { value: "keep", name: t("onboard.datafinderKeepCredentials") },
-        { value: "replace", name: t("onboard.datafinderReplaceCredentials") }
-      ]
-    });
-    if (credentialAction === "replace") {
-      accessKeyId = "";
-      secretAccessKey = "";
-    }
-  }
-  if (!accessKeyId || !secretAccessKey) {
-    accessKeyId = (await ui.password({ message: t("onboard.enterDataFinderAk") })).trim();
-    secretAccessKey = (await ui.password({ message: t("onboard.enterDataFinderSk") })).trim();
-  }
-  const pathMode = parseDataFinderPathMode(
-    options.datafinderPathMode ?? await ui.select({
-      message: t("onboard.selectDataFinderPathMode"),
-      choices: [
-        { value: "project", name: t("onboard.datafinderProjectPathMode") },
-        { value: "app", name: t("onboard.datafinderAppPathMode") }
-      ],
-      default: previous?.pathMode ?? "project"
-    })
-  );
-  const candidate = {
-    accessKeyId: requiredDataFinderValue(accessKeyId, "AccessKeyId"),
-    appId: requiredDataFinderValue(
-      await inputWithDefault(
-        t("onboard.enterDataFinderAppId"),
-        options.datafinderAppId ?? previous?.appId
-      ),
-      "appId"
-    ),
-    baseUrl: normalizeDataFinderBaseUrl(
-      requiredDataFinderValue(
-        await inputWithDefault(
-          t("onboard.enterDataFinderUrl"),
-          options.datafinderUrl ?? previous?.baseUrl ?? DEFAULT_DATAFINDER_BASE_URL
-        ),
-        "baseUrl"
-      )
-    ),
-    defaultDashboardId: requiredDataFinderValue(
-      await inputWithDefault(
-        t("onboard.enterDataFinderDashboardId"),
-        options.datafinderDashboardId ?? previous?.defaultDashboardId
-      ),
-      "defaultDashboardId"
-    ),
-    pathMode,
-    projectId: requiredDataFinderValue(
-      await inputWithDefault(
-        t("onboard.enterDataFinderProjectId"),
-        options.datafinderProjectId ?? previous?.projectId
-      ),
-      "projectId"
-    ),
-    secretAccessKey: requiredDataFinderValue(secretAccessKey, "SecretAccessKey"),
-    timezone: requiredDataFinderValue(
-      await inputWithDefault(
-        t("onboard.enterDataFinderTimezone"),
-        previous?.timezone ?? DEFAULT_DATAFINDER_TIMEZONE
-      ),
-      "timezone"
-    )
-  };
-  const summary = await new DataFinderClient(candidate).checkConnection();
-  config.datafinder = toStoredDataFinderConfig(candidate);
-  config.setup.datafinderConfigured = true;
-  logger.success(
-    t("onboard.datafinderSucceeded", {
-      dashboardName: summary.dashboardName ?? summary.dashboardId,
-      reportCount: summary.reportCount
-    })
-  );
-};
-var runOnboard = async (options) => {
-  const config = await loadConfig();
-  const t = createI18n(config.locale);
-  const mode = options.setMode ?? "all";
-  if (!onboardModes.includes(mode)) {
-    throw new CliError(`Invalid onboard mode: ${mode}`, 1);
-  }
-  if (mode === "all" || mode === "locale") {
-    const locale = await ui.select({
-      message: t("onboard.chooseLocale"),
-      choices: [
-        { value: "zh-CN", name: "\u4E2D\u6587" },
-        { value: "skip", name: t("common.skip") }
-      ]
-    });
-    if (locale !== "skip") {
-      config.locale = locale;
-    }
-    config.setup.localeConfigured = true;
-  }
-  if (mode === "all" || mode === "admin") {
-    const action = mode === "admin" ? "continue" : await ui.select({
-      message: t("onboard.adminSection"),
-      choices: [
-        { value: "continue", name: t("common.continue") },
-        { value: "skip", name: t("common.skip") }
-      ]
-    });
-    if (action === "continue") {
-      await runAdminSetup(config, options, t);
-    } else {
-      logger.info(t("onboard.skipAdminSetup"));
-    }
-  }
-  if (mode === "all" || mode === "datafinder") {
-    const action = mode === "datafinder" ? "continue" : await ui.select({
-      message: t("onboard.datafinderSection"),
-      choices: [
-        { value: "continue", name: t("common.continue") },
-        { value: "skip", name: t("common.skip") }
-      ]
-    });
-    if (action === "continue") {
-      await runDataFinderSetup(config, options, t);
-    } else {
-      logger.info(t("onboard.skipDataFinderSetup"));
-    }
-  }
-  if (mode === "all" || mode === "gh") {
-    const action = mode === "gh" ? "continue" : await ui.select({
-      message: t("onboard.ghSection"),
-      choices: [
-        { value: "continue", name: t("common.continue") },
-        { value: "skip", name: t("common.skip") }
-      ]
-    });
-    if (action === "continue") {
-      config.setup.ghConfigured = await runGhSetup(t);
-    } else {
-      logger.info(t("onboard.skipGhSetup"));
-      config.setup.ghConfigured = true;
+      continue;
     }
-  }
-  if (mode === "all" || mode === "aws") {
-    const action = mode === "aws" ? "continue" : await ui.select({
-      message: t("onboard.awsSection"),
-      choices: [
-        { value: "continue", name: t("common.continue") },
-        { value: "skip", name: t("common.skip") }
-      ]
+    input2.onUpdate?.({
+      runId: trackedRunId,
+      htmlUrl: matchedRun.html_url,
+      status: matchedRun.status === "completed" ? "completed" : "in_progress"
     });
-    if (action === "continue") {
-      const result = await runAwsSetup(config.defaultAwsProfile, t);
-      config.setup.awsConfigured = result.configured;
-      if (result.configured) {
-        config.defaultAwsProfile = result.profile;
+    if (matchedRun.status === "completed") {
+      const completion = {
+        conclusion: matchedRun.conclusion ?? "unknown",
+        htmlUrl: matchedRun.html_url,
+        runId: matchedRun.id,
+        status: matchedRun.status
+      };
+      if (completion.conclusion !== "success") {
+        const failureMessage = await fetchWorkflowRunFailureMessage({
+          repoFullName: input2.repoFullName,
+          runId: matchedRun.id
+        });
+        if (failureMessage) {
+          completion.failureMessage = failureMessage;
+        }
       }
-    } else {
-      logger.info(t("onboard.skipAwsSetup"));
-      config.setup.awsConfigured = true;
+      return completion;
     }
+    await sleep(intervalMs);
   }
-  await saveConfig(config);
-  logger.success(t("onboard.complete"));
-};
-var registerOnboardCommand = (program) => {
-  program.command("onboard").description("Install or configure local prerequisites").option("--set-mode <mode>", "setup only one flow: all|admin|aws|datafinder|gh|locale").option("--admin-url <url>", "management API URL or admin.tutti.sh page URL").option("--datafinder-url <url>", "DataFinder OpenAPI origin").option("--datafinder-project-id <id>", "DataFinder project ID").option("--datafinder-app-id <id>", "DataFinder application ID").option("--datafinder-dashboard-id <id>", "default DataFinder dashboard ID").option("--datafinder-path-mode <mode>", "DataFinder API path mode: project|app").action((options) => runOnboard(options));
-};
-
-// src/constants/ppe-lane-frontend-targets.ts
-var ppeLaneCanvasTarget = {
-  key: "zk-web/canvas",
-  label: "zk-web/canvas",
-  repoFullName: "zk-org-test/zk-web",
-  workflowFile: "upload-canvas-staging-version.yml",
-  defaultWorkflowRef: "main",
-  artifactName: "canvas-staging-version",
-  artifactFileName: "canvas-staging-version.json",
-  workerName: "zk-design-web-staging"
+  throw new CliError(`Timed out waiting for workflow run in ${input2.repoFullName}`, 1);
 };
 
-// src/constants/ppe-lane-repos.ts
-var ppeLaneRepos = [
-  {
-    key: "tutti-server",
-    label: "tutti-server",
-    repoFullName: "tutti-lab/tutti-server",
-    deployWorkflowFile: "deploy-lane.yml",
-    destroyWorkflowFile: "destroy-lane.yml",
-    defaultRef: "main",
-    defaultDestroySelection: false,
-    cloudMapServiceId: "srv-izinli73rwxpf2dr",
-    serviceName: "tutti-server"
-  },
-  {
-    key: "zk-agent-engine",
-    label: "zk-agent-engine",
-    repoFullName: "zk-org-test/zk-agent-engine",
-    deployWorkflowFile: "deploy-lane.yml",
-    destroyWorkflowFile: "destroy-lane.yml",
-    defaultRef: "main",
-    cloudMapServiceId: "srv-gg2qso5pnqgykn7h",
-    serviceName: "agent-engine"
-  },
-  {
-    key: "zk-commerce",
-    label: "zk-commerce",
-    repoFullName: "zk-org-test/zk-commerce",
-    deployWorkflowFile: "deploy-lane.yml",
-    destroyWorkflowFile: "destroy-lane.yml",
-    defaultRef: "main",
-    cloudMapServiceId: "srv-tfl3t6duyoehwedi",
-    serviceName: "zk-commerce"
-  },
-  {
-    key: "zk-admin-server",
-    label: "zk-admin-server",
-    repoFullName: "zk-org-test/zk-admin-server",
-    deployWorkflowFile: "deploy-lane.yml",
-    destroyWorkflowFile: "destroy-lane.yml",
-    defaultRef: "main",
-    cloudMapServiceId: "srv-s4fn35h7nen4u5ci",
-    serviceName: "admin"
-  },
-  {
-    key: "design-project",
-    label: "design-project",
-    repoFullName: "zk-org-test/design-project",
-    deployWorkflowFile: "deploy-lane.yml",
-    destroyWorkflowFile: "destroy-lane.yml",
-    defaultRef: "main",
-    cloudMapServiceId: "srv-bjtdvtcxg2clgs6m",
-    serviceName: "design-project"
-  },
-  {
-    key: "account",
-    label: "account",
-    repoFullName: "zk-org-test/account",
-    deployWorkflowFile: "deploy-lane.yml",
-    destroyWorkflowFile: "destroy-lane.yml",
-    defaultRef: "main",
-    cloudMapServiceId: "srv-j2newpni247wsn7h",
-    serviceName: "account"
-  },
-  {
-    key: "zk-websocket",
-    label: "zk-websocket",
-    repoFullName: "zk-org-test/zk-websocket",
-    deployWorkflowFile: "deploy-lane.yml",
-    destroyWorkflowFile: "destroy-lane.yml",
-    defaultRef: "main",
-    cloudMapServiceId: "srv-34fi45edgao7tp2r",
-    serviceName: "zk-websocket"
-  }
-];
-
 // src/lib/ppe-lane.ts
 var PPE_LANE_MAX_LENGTH = 38;
 var PPE_LANE_PATTERN = /^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/;
@@ -4111,48 +3303,50 @@ var validatePpeLaneName = (value) => {
   return lane;
 };
 
+// src/lib/prerequisites.ts
+var ensureCommandInstalled = async (command, installHint) => {
+  const result = await runCommand(command, ["--version"]);
+  if (result.exitCode !== 0) {
+    throw new CliError(installHint, 1);
+  }
+};
+var ensurePrerequisites = async (input2) => {
+  const config = await loadConfig();
+  if (input2.needsGh) {
+    await ensureCommandInstalled("gh", "gh is required. Run nexight-devops onboard --set-mode gh");
+    await ensureGhAuthenticated();
+  }
+  if (input2.needsAws) {
+    await ensureCommandInstalled("aws", "aws is required. Run nexight-devops onboard --set-mode aws");
+    await ensureAwsAuthenticated(config.defaultAwsProfile);
+  }
+  return config;
+};
+
 // src/commands/ppe-lane/deploy.ts
 var getErrorMessage = (error) => error instanceof Error ? error.message : String(error);
 var renderAggregateProgress = (lane, selectedTargets, repoStates) => renderWorkflowProgressPanel({
   items: selectedTargets,
   states: repoStates,
-  title: lane ? `\u6B63\u5728\u53D1\u5E03 lane ${lane}` : "\u6B63\u5728\u53D1\u5E03\u6240\u9009\u76EE\u6807"
+  title: `\u6B63\u5728\u53D1\u5E03 lane ${lane}`
 });
 var runPpeLaneDeploy = async () => {
   const requestedRef = await ui.input({ message: "\u8BF7\u8F93\u5165\u76EE\u6807\u5206\u652F", default: "main" });
-  const deployTargetChoices = [
-    ...ppeLaneRepos.map((repo) => ({ value: repo.key, name: repo.label })),
-    { value: ppeLaneCanvasTarget.key, name: ppeLaneCanvasTarget.label }
-  ];
   const selectedKeys = await ui.checkbox({
-    message: "\u8BF7\u9009\u62E9\u9700\u8981\u53D1\u5E03\u7684\u76EE\u6807",
-    choices: deployTargetChoices
+    message: "\u8BF7\u9009\u62E9\u9700\u8981\u53D1\u5E03\u7684\u4ED3\u5E93",
+    choices: ppeLaneRepos.map((repo) => ({ value: repo.key, name: repo.label }))
   });
-  if (selectedKeys.length === 0) {
-    throw new CliError("At least one deploy target must be selected", 1);
-  }
   const selectedRepos = ppeLaneRepos.filter((repo) => selectedKeys.includes(repo.key));
-  const shouldDeployCanvas = selectedKeys.includes(ppeLaneCanvasTarget.key);
-  const lane = selectedRepos.length > 0 ? validatePpeLaneName(await ui.input({ message: "\u8BF7\u8F93\u5165 PPE lane \u540D\u79F0" })) : void 0;
-  const selectedTargets = [
-    ...selectedRepos.map((repo) => ({
-      defaultRef: repo.defaultRef,
-      key: repo.key,
-      kind: "backend",
-      repoFullName: repo.repoFullName,
-      workflowFile: repo.deployWorkflowFile
-    })),
-    ...shouldDeployCanvas ? [
-      {
-        defaultRef: ppeLaneCanvasTarget.defaultWorkflowRef,
-        key: ppeLaneCanvasTarget.key,
-        kind: "canvas",
-        repoFullName: ppeLaneCanvasTarget.repoFullName,
-        workflowFile: ppeLaneCanvasTarget.workflowFile
-      }
-    ] : []
-  ];
-  const config = await ensurePrerequisites({ needsAws: selectedRepos.length > 0, needsGh: true });
+  if (selectedRepos.length === 0) {
+    throw new CliError("At least one deploy repository must be selected", 1);
+  }
+  const lane = validatePpeLaneName(await ui.input({ message: "\u8BF7\u8F93\u5165 PPE lane \u540D\u79F0" }));
+  const selectedTargets = selectedRepos.map((repo) => ({
+    key: repo.key,
+    repoFullName: repo.repoFullName,
+    workflowFile: repo.deployWorkflowFile
+  }));
+  const config = await ensurePrerequisites({ needsAws: true, needsGh: true });
   const branchResults = await Promise.all(
     selectedRepos.map(
       (repo) => resolveBranchForRepo({
@@ -4177,12 +3371,11 @@ var runPpeLaneDeploy = async () => {
   const confirmationLines = [
     "\u786E\u8BA4\u5F00\u59CB\u90E8\u7F72\uFF1F",
     `  \u5206\u652F: ${requestedRef}`,
+    `  lane: ${lane}`,
+    "",
     "  \u5DF2\u9009\u62E9\u76EE\u6807:",
-    ...selectedKeys.map((key) => `  - ${key}`)
+    ...selectedRepos.map((repo) => `  - ${repo.key}`)
   ];
-  if (lane) {
-    confirmationLines.splice(2, 0, `  lane: ${lane}`, "");
-  }
   const confirmed = await ui.confirm({
     message: confirmationLines.join("\n"),
     default: true
@@ -4191,11 +3384,10 @@ var runPpeLaneDeploy = async () => {
     logger.warn("\u5DF2\u53D6\u6D88\u53D1\u5E03");
     return;
   }
-  const githubLogin = shouldDeployCanvas ? await getCurrentGitHubLogin() : void 0;
   const repoStates = /* @__PURE__ */ new Map();
   const results = await withProgressTask(
     {
-      initialText: lane ? `\u6B63\u5728\u53D1\u5E03 lane ${lane}` : "\u6B63\u5728\u53D1\u5E03\u6240\u9009\u76EE\u6807",
+      initialText: `\u6B63\u5728\u53D1\u5E03 lane ${lane}`,
       heartbeatMs: 1e3,
       heartbeatText: () => renderAggregateProgress(lane, selectedTargets, repoStates)
     },
@@ -4204,7 +3396,6 @@ var runPpeLaneDeploy = async () => {
         selectedTargets.map(async (target) => {
           const samples = await Promise.resolve(
             listSuccessfulWorkflowRunDurations({
-              ...target.kind === "canvas" ? { ref: target.defaultRef } : {},
               repoFullName: target.repoFullName,
               workflowFile: target.workflowFile
             })
@@ -4296,130 +3487,7 @@ var runPpeLaneDeploy = async () => {
           };
         }
       };
-      const deployCanvasTarget = async () => {
-        const currentState = repoStates.get(ppeLaneCanvasTarget.key) ?? { estimateMs: null, status: "idle" };
-        const targetRef = requestedRef;
-        const dispatchCreatedAt = (/* @__PURE__ */ new Date()).toISOString();
-        try {
-          repoStates.set(ppeLaneCanvasTarget.key, {
-            ...currentState,
-            conclusion: void 0,
-            startedAt: Date.now(),
-            status: "queued"
-          });
-          setText(renderAggregateProgress(lane, selectedTargets, repoStates));
-          const knownRunIds = await listWorkflowRunIds({
-            ref: ppeLaneCanvasTarget.defaultWorkflowRef,
-            repoFullName: ppeLaneCanvasTarget.repoFullName,
-            workflowFile: ppeLaneCanvasTarget.workflowFile
-          });
-          await dispatchCanvasStagingVersionWorkflow({
-            repoFullName: ppeLaneCanvasTarget.repoFullName,
-            targetRef,
-            workflowFile: ppeLaneCanvasTarget.workflowFile,
-            workflowRef: ppeLaneCanvasTarget.defaultWorkflowRef
-          });
-          logger.step(`${ppeLaneCanvasTarget.key} -> queued`);
-          const run = await pollWorkflowRun({
-            correlation: {
-              actorLogin: githubLogin,
-              createdAt: dispatchCreatedAt
-            },
-            knownRunIds,
-            ref: ppeLaneCanvasTarget.defaultWorkflowRef,
-            repoFullName: ppeLaneCanvasTarget.repoFullName,
-            workflowFile: ppeLaneCanvasTarget.workflowFile,
-            onUpdate: (update) => {
-              const nextState = repoStates.get(ppeLaneCanvasTarget.key) ?? currentState;
-              const runUrl = "htmlUrl" in update ? update.htmlUrl : nextState.runUrl;
-              repoStates.set(ppeLaneCanvasTarget.key, {
-                ...nextState,
-                conclusion: void 0,
-                detail: update.status === "completed" ? "downloading artifact" : update.status === "pending" ? "waiting for workflow" : void 0,
-                runUrl,
-                startedAt: nextState.startedAt ?? Date.now(),
-                status: update.status === "completed" ? "running" : update.status === "pending" ? "queued" : "running"
-              });
-              setText(renderAggregateProgress(lane, selectedTargets, repoStates));
-            }
-          });
-          logger.step(`${ppeLaneCanvasTarget.key} -> ${run.conclusion}`);
-          if (run.conclusion !== "success") {
-            repoStates.set(ppeLaneCanvasTarget.key, {
-              ...repoStates.get(ppeLaneCanvasTarget.key) ?? currentState,
-              conclusion: "failure",
-              detail: run.failureMessage ?? "workflow failed",
-              runUrl: run.htmlUrl,
-              startedAt: repoStates.get(ppeLaneCanvasTarget.key)?.startedAt ?? Date.now(),
-              status: "completed"
-            });
-            setText(renderAggregateProgress(lane, selectedTargets, repoStates));
-            return {
-              key: ppeLaneCanvasTarget.key,
-              ref: targetRef,
-              runUrl: run.htmlUrl,
-              status: run.status,
-              conclusion: run.conclusion,
-              failureDetail: run.failureMessage ?? "workflow failed"
-            };
-          }
-          repoStates.set(ppeLaneCanvasTarget.key, {
-            ...repoStates.get(ppeLaneCanvasTarget.key) ?? currentState,
-            conclusion: void 0,
-            detail: "downloading artifact",
-            runUrl: run.htmlUrl,
-            startedAt: repoStates.get(ppeLaneCanvasTarget.key)?.startedAt ?? Date.now(),
-            status: "running"
-          });
-          setText(renderAggregateProgress(lane, selectedTargets, repoStates));
-          const artifact = await fetchCanvasStagingVersionArtifact({
-            artifactFileName: ppeLaneCanvasTarget.artifactFileName,
-            artifactName: ppeLaneCanvasTarget.artifactName,
-            repoFullName: ppeLaneCanvasTarget.repoFullName,
-            runId: run.runId
-          });
-          repoStates.set(ppeLaneCanvasTarget.key, {
-            ...repoStates.get(ppeLaneCanvasTarget.key) ?? currentState,
-            conclusion: "success",
-            detail: void 0,
-            runUrl: artifact.workflowRunUrl,
-            startedAt: repoStates.get(ppeLaneCanvasTarget.key)?.startedAt ?? Date.now(),
-            status: "completed"
-          });
-          setText(renderAggregateProgress(lane, selectedTargets, repoStates));
-          return {
-            key: ppeLaneCanvasTarget.key,
-            ref: targetRef,
-            artifact,
-            runUrl: artifact.workflowRunUrl,
-            status: run.status,
-            conclusion: "success"
-          };
-        } catch (error) {
-          const failureState = repoStates.get(ppeLaneCanvasTarget.key) ?? currentState;
-          repoStates.set(ppeLaneCanvasTarget.key, {
-            ...failureState,
-            conclusion: "failure",
-            detail: getErrorMessage(error),
-            runUrl: failureState.runUrl,
-            startedAt: failureState.startedAt ?? Date.now(),
-            status: "completed"
-          });
-          setText(renderAggregateProgress(lane, selectedTargets, repoStates));
-          return {
-            key: ppeLaneCanvasTarget.key,
-            ref: targetRef,
-            runUrl: failureState.runUrl ?? "",
-            status: "completed",
-            conclusion: "failure",
-            failureDetail: getErrorMessage(error)
-          };
-        }
-      };
-      return Promise.all([
-        ...selectedRepos.map((repo, index) => deployBackendTarget(repo, index)),
-        ...shouldDeployCanvas ? [deployCanvasTarget()] : []
-      ]);
+      return Promise.all(selectedRepos.map((repo, index) => deployBackendTarget(repo, index)));
     }
   );
   results.forEach((result) => {
@@ -4427,28 +3495,14 @@ var runPpeLaneDeploy = async () => {
       `${result.key} | ${result.ref} | ${result.conclusion} | ${result.runUrl}${result.failureDetail ? ` | ${result.failureDetail}` : ""}`
     );
   });
-  const canvasResult = results.find((result) => result.key === ppeLaneCanvasTarget.key && result.conclusion === "success");
-  if (canvasResult?.artifact) {
-    logger.info(`canvas version id: ${canvasResult.artifact.versionId}`);
-    logger.info(`canvas workflow: ${canvasResult.artifact.workflowRunUrl}`);
-    logger.info(`override header: ${canvasResult.artifact.overrideHeader}`);
-    if (canvasResult.artifact.previewUrl) {
-      logger.info(`preview url: ${canvasResult.artifact.previewUrl}`);
-    }
-    if (canvasResult.artifact.previewAliasUrl) {
-      logger.info(`preview alias url: ${canvasResult.artifact.previewAliasUrl}`);
-    }
-  }
   if (results.some((result) => result.conclusion !== "success")) {
     throw new Error("One or more PPE lane deployments failed");
   }
-  logger.success(lane ? `PPE lane ${lane} \u53D1\u5E03\u5B8C\u6210` : "\u6240\u9009\u76EE\u6807\u53D1\u5E03\u5B8C\u6210");
-  if (selectedRepos.length > 0) {
-    logger.info("==================== \u91CD\u8981\u63D0\u793A ====================");
-    logger.info(`\u540E\u7EED\u8BF7\u6C42\u5982\u9700\u547D\u4E2D lane ${lane}\uFF0C\u8BF7\u6DFB\u52A0\u8BF7\u6C42\u5934\uFF1A`);
-    logger.info(`x-zk-ppe-lane: ${lane}`);
-    logger.info("=================================================");
-  }
+  logger.success(`PPE lane ${lane} \u53D1\u5E03\u5B8C\u6210`);
+  logger.info("==================== \u91CD\u8981\u63D0\u793A ====================");
+  logger.info(`\u540E\u7EED\u8BF7\u6C42\u5982\u9700\u547D\u4E2D lane ${lane}\uFF0C\u8BF7\u6DFB\u52A0\u8BF7\u6C42\u5934\uFF1A`);
+  logger.info(`x-zk-ppe-lane: ${lane}`);
+  logger.info("=================================================");
 };
 var registerPpeLaneDeployCommand = (program) => {
   program.command("deploy").description("Deploy selected repositories to a PPE lane; route traffic with x-zk-ppe-lane").addHelpText(
@@ -5098,8 +4152,8 @@ var registerReleasePrepareCommand = (program) => {
 
 // src/commands/release/rollback.ts
 import { mkdtemp as mkdtemp3, readFile as readFile3, rm as rm2 } from "fs/promises";
-import { tmpdir } from "os";
-import { join as join5 } from "path";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join6 } from "path";
 
 // src/constants/rollback-targets.ts
 var tuttiServerRollbackTarget = {
@@ -5107,7 +4161,12 @@ var tuttiServerRollbackTarget = {
   label: "tutti-server",
   repoFullName: "tutti-lab/tutti-server"
 };
-var rollbackTargets = [tuttiServerRollbackTarget];
+var platformWebRollbackTarget = {
+  key: "platform-web",
+  label: "platform-web",
+  repoFullName: "tutti-lab/tutti"
+};
+var rollbackTargets = [tuttiServerRollbackTarget, platformWebRollbackTarget];
 
 // src/commands/release/rollback-local.ts
 var CLUSTER = "arn:aws:eks:us-east-1:250509935467:cluster/nexight-ojo-us-east-1";
@@ -5195,9 +4254,137 @@ var fetchLocalRollbackCatalog = async () => {
   return buildLocalRollbackCatalog(history, deployment, manifests);
 };
 
+// src/commands/release/rollback-web.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { mkdtemp as mkdtemp2, readFile as readFile2, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join5 } from "path";
+var REPO = platformWebRollbackTarget.repoFullName;
+var WORKFLOW = "platform-web-rollback.yml";
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var SHA = /^[0-9a-f]{40}$/;
+var choiceTime = new Intl.DateTimeFormat("sv-SE", { timeZone: "Asia/Singapore", dateStyle: "short", timeStyle: "short" });
+var validDeployment = (value) => UUID.test(value?.id) && Array.isArray(value.versions) && value.versions.length > 0 && value.versions.every((item) => UUID.test(item.version_id) && Number.isFinite(item.percentage) && item.percentage > 0 && item.percentage <= 100) && Math.abs(value.versions.reduce((sum, item) => sum + item.percentage, 0) - 100) < 1e-3;
+var parseWebRollbackCatalog = (raw) => {
+  const data = JSON.parse(raw);
+  if (data.schema !== "tutti.web.rollback.catalog.v1" || data.environment !== "production" || !validDeployment(data.currentDeployment) || !Array.isArray(data.candidates) || data.candidates.length > 100) {
+    throw new CliError("Invalid Platform Web rollback catalog", 1);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const active = new Set(data.currentDeployment.versions.map((item) => item.version_id));
+  for (const candidate of data.candidates) {
+    if (!UUID.test(candidate.versionId) || !UUID.test(candidate.deploymentId) || !Number.isFinite(Date.parse(candidate.deployedAt)) || typeof candidate.current !== "boolean" || candidate.current !== active.has(candidate.versionId) || typeof candidate.withdrawn !== "boolean" || typeof candidate.fullTraffic !== "boolean" || !(candidate.sha === null || SHA.test(candidate.sha)) || !(candidate.runId === null || /^\d+$/.test(candidate.runId)) || seen.has(candidate.versionId)) {
+      throw new CliError("Invalid Platform Web deployment in rollback catalog", 1);
+    }
+    seen.add(candidate.versionId);
+  }
+  return data;
+};
+var buildWebRollbackChoices = (catalog) => catalog.candidates.filter((candidate) => !candidate.current && !candidate.withdrawn && candidate.fullTraffic).map((candidate) => ({
+  name: `${choiceTime.format(new Date(candidate.deployedAt))} SGT  ${candidate.versionId.slice(0, 8)}  ${candidate.sha?.slice(0, 12) ?? "SHA unknown"}${candidate.runId ? `  run ${candidate.runId}` : ""}`,
+  value: candidate.versionId
+}));
+var gh = async (args) => {
+  const result = await runCommand("gh", args);
+  if (result.exitCode !== 0) throw new CliError(result.stderr.trim() || result.stdout.trim() || "GitHub command failed", 1);
+  return result.stdout;
+};
+var dispatch = async (operation, inputs = {}) => {
+  const operationId = randomUUID3();
+  const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const knownRunIds = await listWorkflowRunIds({ repoFullName: REPO, workflowFile: WORKFLOW, ref: "main" });
+  const fields = { operation, operation_id: operationId, requested_at: requestedAt, ...inputs };
+  await gh(["workflow", "run", WORKFLOW, "--repo", REPO, "--ref", "main", ...Object.entries(fields).flatMap(([key, value]) => ["-f", `${key}=${value}`])]);
+  const progress = ui.spinner(operation === "execute" ? "\u7B49\u5F85 Platform Web \u56DE\u6EDA\u548C\u5165\u53E3\u9A8C\u8BC1..." : "\u8BFB\u53D6 Platform Web \u751F\u4EA7\u72B6\u6001...").start();
+  try {
+    const run = await pollWorkflowRun({
+      knownRunIds,
+      repoFullName: REPO,
+      workflowFile: WORKFLOW,
+      ref: "main",
+      intervalMs: 1e3,
+      maxAttempts: 600,
+      correlation: { runName: `Platform Web Rollback / ${operation} / ${operationId}`, createdAt: requestedAt },
+      onUpdate: (update) => {
+        if ("htmlUrl" in update) progress.text = update.htmlUrl;
+      }
+    });
+    const directory = await mkdtemp2(join5(tmpdir(), "platform-web-rollback-"));
+    try {
+      try {
+        await gh(["run", "download", String(run.runId), "--repo", REPO, "--name", "platform-web-rollback", "--dir", directory]);
+      } catch (error) {
+        throw new CliError(`Could not retrieve operation outcome; inspect actual production state at ${run.htmlUrl} before retrying: ${error instanceof Error ? error.message : String(error)}`, 1);
+      }
+      const result = JSON.parse(await readFile2(join5(directory, "rollback-result.json"), "utf8"));
+      if (result.schema !== "tutti.web.rollback.result.v1" || result.operationId !== operationId || !["success", "failure", "pending_verification"].includes(result.status) || !["unchanged", "switched", "unknown"].includes(result.deployment) || !result.verification || !result.timings || Object.values(result.timings).some((value) => !Number.isFinite(value) || value < 0) || result.actual && !validDeployment(result.actual)) {
+        throw new CliError(`Invalid rollback result: ${run.htmlUrl}`, 1);
+      }
+      if (run.conclusion !== "success" || result.status !== "success") {
+        const state = result.actual ? `${result.actual.id} / ${JSON.stringify(result.actual.versions)}` : "unknown";
+        throw new CliError(`Platform Web operation failed; deployment ${result.deployment}
+Actual production: ${state}
+${result.error ?? run.failureMessage ?? run.conclusion}
+${run.htmlUrl}`, 1);
+      }
+      if (operation === "execute" && (result.deployment !== "switched" || !result.actual || !UUID.test(result.targetVersionId ?? "") || result.actual.versions.length !== 1 || result.actual.versions[0]?.version_id !== result.targetVersionId || result.actual.versions[0]?.percentage !== 100)) {
+        throw new CliError(`Rollback did not confirm target version at 100%: ${run.htmlUrl}`, 1);
+      }
+      const catalog = operation === "list" ? parseWebRollbackCatalog(await readFile2(join5(directory, "rollback-catalog.json"), "utf8")) : void 0;
+      return { run, result, catalog };
+    } catch (error) {
+      if (error instanceof CliError) throw error;
+      throw new CliError(`Could not read actual operation state; inspect ${run.htmlUrl} before retrying: ${error instanceof Error ? error.message : String(error)}`, 1);
+    } finally {
+      await rm(directory, { recursive: true, force: true });
+    }
+  } finally {
+    progress.stop();
+  }
+};
+var runPlatformWebRollback = async (options) => {
+  if (options.previous && options.versionId || options.probe && (options.previous || options.versionId)) throw new CliError("Choose only one of --previous, --version-id, or --probe", 1);
+  if (options.versionId && !UUID.test(options.versionId)) throw new CliError("--version-id must be a Worker version UUID", 1);
+  if (options.reason && Buffer.byteLength(options.reason) > 200) throw new CliError("--reason must be at most 200 UTF-8 bytes", 1);
+  await ensurePrerequisites({ needsGh: true });
+  let inputs = { reason: options.reason ?? "operator rollback" };
+  if (options.probe) {
+    const { run: run2, result: result2 } = await dispatch("probe");
+    logger.info(`Read-only production probe: ${JSON.stringify(result2.timings)}`);
+    logger.info(`Verification: ${JSON.stringify(result2.verification)}`);
+    logger.info(run2.htmlUrl);
+    return;
+  }
+  if (options.yes && (options.previous || options.versionId)) {
+    inputs = { ...inputs, previous: String(Boolean(options.previous)), version_id: options.versionId ?? "" };
+  } else {
+    const { catalog } = await dispatch("list", options.versionId ? { version_id: options.versionId } : {});
+    if (!catalog) throw new CliError("Missing Platform Web rollback catalog", 1);
+    const choices = buildWebRollbackChoices(catalog);
+    if (!options.versionId && choices.length === 0) throw new CliError("No eligible recent production Web version is available", 1);
+    const versionId = options.versionId ?? (options.previous ? choices[0]?.value : await ui.select({ message: "Select a production Web version to restore", choices, pageSize: Math.min(choices.length, 15) }));
+    const selected = catalog.candidates.find((candidate) => candidate.versionId === versionId && !candidate.current);
+    if (!selected) throw new CliError("No eligible recent production Web version is available", 1);
+    logger.info(`Current deployment: ${catalog.currentDeployment.id}`);
+    logger.info(`Target version: ${selected.versionId} / SHA ${selected.sha ?? "unknown"}`);
+    if (selected.runId) logger.info(`Published by: https://github.com/${REPO}/actions/runs/${selected.runId}`);
+    if (selected.withdrawn) logger.warn("This version was previously withdrawn by a rollback.");
+    if (!options.yes && !await ui.confirm({ message: "Restore this Web version to production?", default: false })) {
+      logger.warn("Rollback cancelled");
+      return;
+    }
+    inputs = { ...inputs, previous: "false", version_id: selected.versionId, expected_deployment_id: catalog.currentDeployment.id };
+  }
+  const { run, result } = await dispatch("execute", inputs);
+  logger.success(`Platform Web switched to ${result.targetVersionId} at 100% traffic`);
+  logger.info(`Verification: ${JSON.stringify(result.verification)}`);
+  logger.info(`Timing (ms): ${JSON.stringify(result.timings)}`);
+  logger.info(run.htmlUrl);
+};
+
 // src/commands/release/rollback.ts
-var REPO = tuttiServerRollbackTarget.repoFullName;
-var WORKFLOW = "rollback.yml";
+var REPO2 = tuttiServerRollbackTarget.repoFullName;
+var WORKFLOW2 = "rollback.yml";
 var SHA256 = /^sha256:[0-9a-f]{64}$/;
 var SINGAPORE_TIME = new Intl.DateTimeFormat("sv-SE", {
   timeZone: "Asia/Singapore",
@@ -5221,7 +4408,7 @@ var buildRollbackChoices = (catalog) => catalog.candidates.filter((candidate) =>
   name: `${displayChoiceTime(candidate.deployedAt)} SGT  #${candidate.revision}  ${candidate.version}`,
   value: candidate.revision
 }));
-var gh = async (args) => {
+var gh2 = async (args) => {
   const result = await runCommand("gh", args);
   if (result.exitCode !== 0) {
     throw new CliError(result.stderr.trim() || result.stdout.trim() || `gh ${args[0]} failed`, 1);
@@ -5241,8 +4428,8 @@ var parseRollbackCatalog = (raw) => {
   return data;
 };
 var listActiveDeployments = async () => {
-  const runs = await Promise.all(["deploy.yml", WORKFLOW].map(async (workflow) => {
-    const raw = await gh(["api", `repos/${REPO}/actions/workflows/${workflow}/runs?per_page=30`]);
+  const runs = await Promise.all(["deploy.yml", WORKFLOW2].map(async (workflow) => {
+    const raw = await gh2(["api", `repos/${REPO2}/actions/workflows/${workflow}/runs?per_page=30`]);
     return JSON.parse(raw).workflow_runs;
   }));
   return runs.flat().filter(
@@ -5255,19 +4442,19 @@ var ensureNoActiveDeployment = async () => {
     throw new CliError(`Production deployment is already running: ${active[0]?.html_url}`, 1);
   }
 };
-var dispatch = async (operation, inputs = {}) => {
-  const knownRunIds = await listWorkflowRunIds({ repoFullName: REPO, workflowFile: WORKFLOW, ref: "main" });
-  const args = ["workflow", "run", WORKFLOW, "--repo", REPO, "--ref", "main", "-f", `operation=${operation}`];
+var dispatch2 = async (operation, inputs = {}) => {
+  const knownRunIds = await listWorkflowRunIds({ repoFullName: REPO2, workflowFile: WORKFLOW2, ref: "main" });
+  const args = ["workflow", "run", WORKFLOW2, "--repo", REPO2, "--ref", "main", "-f", `operation=${operation}`];
   for (const [key, value] of Object.entries(inputs)) {
     args.push("-f", `${key}=${value}`);
   }
-  await gh(args);
+  await gh2(args);
   const progress = ui.spinner(operation === "list" ? "\u8BFB\u53D6\u751F\u4EA7\u90E8\u7F72\u5386\u53F2..." : "\u7B49\u5F85\u751F\u4EA7\u56DE\u6EDA\u548C\u5065\u5EB7\u68C0\u67E5...").start();
   try {
     const run = await pollWorkflowRun({
       knownRunIds,
-      repoFullName: REPO,
-      workflowFile: WORKFLOW,
+      repoFullName: REPO2,
+      workflowFile: WORKFLOW2,
       ref: "main",
       maxAttempts: operation === "execute" ? 420 : 180,
       onUpdate: (update) => {
@@ -5277,11 +4464,11 @@ var dispatch = async (operation, inputs = {}) => {
     if (run.conclusion !== "success") {
       let state = "";
       if (operation === "execute") {
-        const dir = await mkdtemp3(join5(tmpdir(), "tutti-rollback-state-"));
+        const dir = await mkdtemp3(join6(tmpdir2(), "tutti-rollback-state-"));
         try {
-          await gh(["run", "download", String(run.runId), "--repo", REPO, "--name", "rollback-state", "--dir", dir]);
+          await gh2(["run", "download", String(run.runId), "--repo", REPO2, "--name", "rollback-state", "--dir", dir]);
           state = `
-${await readFile3(join5(dir, "rollback-state.txt"), "utf8")}`;
+${await readFile3(join6(dir, "rollback-state.txt"), "utf8")}`;
         } catch {
           state = "\nActual production state is available in the workflow logs.";
         } finally {
@@ -5297,10 +4484,10 @@ ${run.htmlUrl}${state}`, 1);
   }
 };
 var fetchCatalog = async (runId) => {
-  const dir = await mkdtemp3(join5(tmpdir(), "tutti-rollback-"));
+  const dir = await mkdtemp3(join6(tmpdir2(), "tutti-rollback-"));
   try {
-    await gh(["run", "download", String(runId), "--repo", REPO, "--name", "rollback-catalog", "--dir", dir]);
-    return parseRollbackCatalog(await readFile3(join5(dir, "rollback-catalog.json"), "utf8"));
+    await gh2(["run", "download", String(runId), "--repo", REPO2, "--name", "rollback-catalog", "--dir", dir]);
+    return parseRollbackCatalog(await readFile3(join6(dir, "rollback-catalog.json"), "utf8"));
   } finally {
     await rm2(dir, { recursive: true, force: true });
   }
@@ -5314,7 +4501,7 @@ var readCatalog = async () => {
     progress.stop();
   }
   logger.warn("\u672C\u673A\u65E0\u6CD5\u5B8C\u6574\u8BFB\u53D6\u751F\u4EA7\u90E8\u7F72\u5386\u53F2\uFF0C\u6539\u7528 GitHub Actions \u67E5\u8BE2\u3002");
-  const listRun = await dispatch("list");
+  const listRun = await dispatch2("list");
   return fetchCatalog(listRun.runId);
 };
 var runTuttiRollback = async (options) => {
@@ -5354,7 +4541,7 @@ var runTuttiRollback = async (options) => {
     return;
   }
   await ensureNoActiveDeployment();
-  const run = await dispatch("execute", {
+  const run = await dispatch2("execute", {
     revision: String(selected.revision),
     digest: selected.digest,
     expected_current_digest: catalog.currentDigest,
@@ -5364,14 +4551,18 @@ var runTuttiRollback = async (options) => {
   logger.info(run.htmlUrl);
 };
 var registerReleaseRollbackCommand = (program) => {
-  program.command("rollback").description("Restore a recent production image").argument("[repository]", "Rollback target; omit to choose interactively").option("--revision <number>", "Select a recent Helm revision without the chooser").option("--yes", "Skip the final confirmation").action(async (repository, options) => {
+  program.command("rollback").description("Restore a recent production deployment").argument("[repository]", "Rollback target; omit to choose interactively").option("--revision <number>", "Select a recent Helm revision without the chooser").option("--previous", "Restore the latest eligible previous Platform Web version").option("--version-id <uuid>", "Select a previously deployed Platform Web Worker version").option("--reason <text>", "Record a Platform Web rollback reason").option("--probe", "Measure a read-only Platform Web production probe").option("--yes", "Skip the final confirmation").action(async (repository, options) => {
     const selected = repository ?? await ui.select({
       message: "Select a repository to roll back",
       choices: rollbackTargets.map((target) => ({ name: target.label, value: target.key }))
     });
-    if (selected !== tuttiServerRollbackTarget.key) {
-      throw new CliError("Only tutti-server is currently supported", 1);
+    if (selected === platformWebRollbackTarget.key) {
+      if (options.revision) throw new CliError("--revision applies only to tutti-server", 1);
+      await runPlatformWebRollback(options);
+      return;
     }
+    if (selected !== tuttiServerRollbackTarget.key) throw new CliError(`Unsupported rollback target: ${selected}`, 1);
+    if (options.previous || options.versionId || options.reason || options.probe) throw new CliError("--previous, --version-id, --reason and --probe apply only to platform-web", 1);
     await runTuttiRollback(options);
   });
 };
@@ -5401,7 +4592,7 @@ var readCliVersion = () => {
 
 // src/lib/version-check.ts
 import { realpath } from "fs/promises";
-import { join as join6, resolve as resolve3, sep } from "path";
+import { join as join7, resolve as resolve3, sep } from "path";
 var PACKAGE_NAME = "@tutti-os/nexight-devops";
 var AUTO_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_LOCALE = "zh-CN";
@@ -5470,7 +4661,7 @@ var isInsidePackageRoot = (entryPath, root) => {
   if (!entryPath || !root) {
     return false;
   }
-  const packageRoot = resolve3(join6(root, "@tutti-os", "nexight-devops"));
+  const packageRoot = resolve3(join7(root, "@tutti-os", "nexight-devops"));
   const targetPath = resolve3(entryPath);
   return targetPath === packageRoot || targetPath.startsWith(`${packageRoot}${sep}`);
 };
@@ -5480,7 +4671,7 @@ var isInsideBunGlobalBin = (entryPath, bunGlobalBin) => {
   }
   const targetPath = resolve3(entryPath);
   const binPath = resolve3(bunGlobalBin);
-  const expectedEntryPath = resolve3(join6(binPath, "nexight-devops"));
+  const expectedEntryPath = resolve3(join7(binPath, "nexight-devops"));
   return targetPath === expectedEntryPath;
 };
 var readGlobalPath = async (command, args) => {
@@ -5783,7 +4974,6 @@ var registerUpdateVersionCommand = (program) => {
 var registerCommands = (program) => {
   registerAdminCommand(program);
   registerDataFinderCommand(program);
-  registerDiagnoseCommand(program);
   registerDoctorCommand(program);
   registerOnboardCommand(program);
   registerPpeLaneCommand(program);