@tutti-os/nexight-devops 0.6.0 → 0.6.2

package/README.md

@@ -48,6 +48,10 @@ nexight-devops release hotfix
 nexight-devops release approve
 nexight-devops release rollback
 nexight-devops release rollback tutti-server
+nexight-devops release rollback platform-web
+nexight-devops release rollback platform-web --previous --yes --reason "entry failure"
+nexight-devops release rollback platform-web --version-id <uuid> --yes
+nexight-devops release rollback platform-web --probe
 ```
 
 ### Function overview
@@ -66,7 +70,8 @@ nexight-devops release rollback tutti-server
 - `ppe-lane destroy` checks existing lane instances and triggers destroy workflows after a lane-name confirmation. `tutti-server` must be selected explicitly for destruction.
 - `ppe-lane status` queries AWS Cloud Map for one lane, or all lanes with `--all`, including `tutti-server`.
 - `release prepare`, `release hotfix`, and `release approve` run the controlled release lifecycle through GitHub Actions and approval issues.
-- `release rollback` lets you choose `tutti-server` interactively; `release rollback tutti-server` selects it directly. The command reads the current production image and up to ten recent Helm deployments directly when local read access to the production cluster is available. Otherwise it retrieves the verified list through GitHub Actions. The selected image is always revalidated and restored by GitHub Actions, followed by health checks. Use `--revision <number> --yes` with the explicit repository for scripted selection and confirmation.
+- `release rollback` lets you choose `tutti-server` or `platform-web` interactively. For `tutti-server`, the command reads the current production image and up to ten recent Helm deployments directly when local cluster read access is available, otherwise through GitHub Actions. The selected image is revalidated and restored by GitHub Actions, followed by health checks. Use `--revision <number> --yes` for scripted selection.
+- `release rollback platform-web` restores a retained, previously deployed Cloudflare Worker version through Tutti's lightweight `platform-web-rollback.yml`. It does not build, test, install packages, upload assets, or roll back ingress/storage. The interactive flow binds your confirmation to the displayed deployment ID; if production changes, execution refuses the stale selection. `--previous --yes` starts only one workflow and selects the latest eligible previous version from live history under the writer lock, excluding versions withdrawn by earlier recorded rollbacks. `--version-id <uuid> --yes` explicitly selects a previously deployed version, including a withdrawn version. `--yes` skips confirmation only. `--reason` records up to 200 UTF-8 bytes; missing historical SHA/run mappings remain unknown. Results distinguish deployment switching, public entry/assets, version/content identity, and unverified Room behavior, and include queue/setup, switch, verification, and total timings. `--probe` measures the same read-only production checks without changing traffic. The CLI needs GitHub access; Cloudflare credentials remain in the production environment's GitHub Secrets.
 
 ## Controlled Release
 

package/dist/cli.js

@@ -6,17 +6,6 @@ import { resolve as resolve4 } from "path";
 import { fileURLToPath, pathToFileURL as pathToFileURL2 } from "url";
 import { Command } from "commander";
 
-// src/constants/admin.ts
-var DEFAULT_ADMIN_API_ORIGIN = "https://tutti.sh";
-
-// src/lib/admin-computer.ts
-import { randomUUID } from "crypto";
-import { createWriteStream } from "fs";
-import { link, mkdir, rename, stat, unlink } from "fs/promises";
-import { basename, dirname, join, resolve } from "path";
-import { Readable } from "stream";
-import { pipeline } from "stream/promises";
-
 // src/lib/errors.ts
 var CliError = class extends Error {
   exitCode;
@@ -45,7 +34,36 @@ var toExitCode = (error) => {
   return 1;
 };
 
+// src/lib/ppe-lane.ts
+var PPE_LANE_MAX_LENGTH = 38;
+var PPE_LANE_PATTERN = /^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/;
+var validatePpeLaneName = (value) => {
+  const lane = value.trim();
+  if (!lane) {
+    throw new CliError("PPE lane name is required", 1);
+  }
+  if (lane.length > PPE_LANE_MAX_LENGTH) {
+    throw new CliError(`PPE lane name must be ${PPE_LANE_MAX_LENGTH} characters or fewer`, 1);
+  }
+  if (!PPE_LANE_PATTERN.test(lane)) {
+    throw new CliError(
+      "PPE lane name must use lowercase letters, digits, or hyphens, and start and end with a letter or digit",
+      1
+    );
+  }
+  return lane;
+};
+
+// src/constants/admin.ts
+var DEFAULT_ADMIN_API_ORIGIN = "https://tutti.sh";
+
 // src/lib/admin-computer.ts
+import { randomUUID } from "crypto";
+import { createWriteStream } from "fs";
+import { link, mkdir, rename, stat, unlink } from "fs/promises";
+import { basename, dirname, join, resolve } from "path";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
 var TUTTI_COMPUTER_API_BASE_PATH = "/api/desktop/v2/admin/tutti-v2/computers";
 var TUTTI_COMPUTER_CONNECTION_WIRE_VALUE = {
   online: 1,
@@ -127,6 +145,12 @@ var parseTuttiComputer = (value) => {
   const owner = objectValue(root.owner);
   return {
     computerId: stringField(root, "computerId", "computer_id"),
+    ...field(root, "canCollect", "can_collect") !== void 0 ? {
+      canCollect: booleanField(root, "canCollect", "can_collect"),
+      collectionBlockedReason: stringField(root, "collectionBlockedReason", "collection_blocked_reason"),
+      computerKind: stringField(root, "computerKind", "computer_kind"),
+      computerVersion: stringField(root, "computerVersion", "computer_version")
+    } : {},
     displayName: stringField(root, "displayName", "display_name"),
     reportedName: stringField(root, "reportedName", "reported_name"),
     owner: {
@@ -356,6 +380,9 @@ var AdminApi = class {
   constructor(runtime, fetchImpl = fetch) {
     this.runtime = runtime;
     this.fetchImpl = fetchImpl;
+    if (runtime.ppeLane !== void 0) {
+      this.runtime = { ...runtime, ppeLane: validatePpeLaneName(runtime.ppeLane) };
+    }
   }
   async request(method, path, body) {
     const headers = {
@@ -364,6 +391,9 @@ var AdminApi = class {
     if (this.runtime.token) {
       headers.authorization = `Bearer ${this.runtime.token}`;
     }
+    if (this.runtime.ppeLane) {
+      headers["x-zk-ppe-lane"] = this.runtime.ppeLane;
+    }
     let payload;
     if (body !== void 0) {
       headers["content-type"] = "application/json";
@@ -372,9 +402,22 @@ var AdminApi = class {
     const response = await this.fetchImpl(`${this.runtime.apiOrigin}${path}`, {
       method,
       headers,
-      body: payload
+      body: payload,
+      ...this.runtime.ppeLane ? { redirect: "error" } : {}
     });
     const parsed = await parseResponseBody(response);
+    if (this.runtime.ppeLane) {
+      const hit = response.headers.get("x-zk-ppe-lane-hit");
+      const fallback = response.headers.get("x-tutti-server-route-fallback");
+      if (hit !== this.runtime.ppeLane || fallback) {
+        const detail = adminApiErrorDetail(parsed);
+        throw new AdminApiError(
+          `PPE \u8DEF\u7531\u4E0D\u5339\u914D: \u8BF7\u6C42 ${this.runtime.ppeLane}\uFF0C\u5B9E\u9645 ${hit || "\u672A\u786E\u8BA4\u6CF3\u9053\uFF08\u6B63\u5F0F\u73AF\u5883\u56DE\u843D\u6216\u7F3A\u5C11\u547D\u4E2D\u54CD\u5E94\u5934\uFF09"}${fallback ? `\uFF0CServer \u56DE\u843D\u539F\u56E0 ${fallback}` : ""}; ${method} ${path}; HTTP ${response.status}${detail ? `: ${detail}` : ""}`,
+          response.status,
+          parsed
+        );
+      }
+    }
     if (!response.ok) {
       const detail = adminApiErrorDetail(parsed);
       throw new AdminApiError(
@@ -658,7 +701,7 @@ var logger = {
 };
 
 // src/commands/admin/shared.ts
-var addAdminConnectionOptions = (command) => command.option("--admin-url <url>", "management API URL or admin.tutti.sh page URL").option("--json", "print the response as JSON without CLI decorations");
+var addAdminConnectionOptions = (command) => command.option("--admin-url <url>", "management API URL or admin.tutti.sh page URL").option("--ppe-lane <lane>", "route every management request to this exact PPE lane").option("--json", "print the response as JSON without CLI decorations");
 var resolveAdminContext = async (options = {}, tokenOverride) => {
   const config = await loadConfig();
   const apiOrigin = normalizeAdminApiOrigin(options.adminUrl ?? config.admin?.apiOrigin);
@@ -667,7 +710,7 @@ var resolveAdminContext = async (options = {}, tokenOverride) => {
     throw new CliError("\u7BA1\u7406\u540E\u53F0 Token \u672A\u914D\u7F6E\uFF0C\u8BF7\u5148\u8FD0\u884C nexight-devops admin auth login", 1);
   }
   return {
-    api: new AdminApi({ apiOrigin, token }),
+    api: new AdminApi({ apiOrigin, token, ppeLane: options.ppeLane }),
     apiOrigin,
     config,
     token
@@ -852,6 +895,14 @@ var resolveRuntimeLogRecallSelection = (input2, now = /* @__PURE__ */ new Date()
 var isUUID = (value) => /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(
   value
 );
+var assertComputerCollectable = (computer) => {
+  if (computer.canCollect === false) {
+    throw new CliError(`Computer ${computer.computerId} \u65E0\u6CD5\u91C7\u96C6\u65E5\u5FD7: ${computer.collectionBlockedReason || "\u670D\u52A1\u7AEF\u672A\u63D0\u4F9B\u963B\u585E\u539F\u56E0"}`, 1);
+  }
+  if (computer.canCollect === void 0 && computer.connectionStatus !== "online") {
+    throw new CliError(`Computer ${computer.computerId} \u5F53\u524D\u4E0D\u5728\u7EBF\uFF0C\u65E0\u6CD5\u53EC\u56DE\u65E5\u5FD7`, 1);
+  }
+};
 var computerNameMatches = (computer, selector) => {
   const expected = selector.trim().toLowerCase();
   return [computer.displayName, computer.reportedName].map((value) => value.trim().toLowerCase()).includes(expected);
@@ -863,9 +914,7 @@ var resolveOnlineTuttiComputer = async (api, selector) => {
   }
   if (isUUID(normalized)) {
     const computer = await api.getTuttiComputer(normalized);
-    if (computer.connectionStatus !== "online") {
-      throw new CliError(`Computer ${normalized} \u5F53\u524D\u4E0D\u5728\u7EBF\uFF0C\u65E0\u6CD5\u53EC\u56DE\u65E5\u5FD7`, 1);
-    }
+    assertComputerCollectable(computer);
     return computer;
   }
   const matches = [];
@@ -977,6 +1026,7 @@ var recallComputerRuntimeLogs = async (input2, dependencies) => {
   const selector = input2.ownerQuery ? `\u7528\u6237\u540D/\u90AE\u7BB1 ${input2.ownerQuery}` : `Computer ${input2.computer}`;
   progress(`\u6B63\u5728\u89E3\u6790\u552F\u4E00\u5728\u7EBF Computer: ${selector}`);
   const computer = await resolveOnlineTuttiComputerForLogs(dependencies.api, input2);
+  assertComputerCollectable(computer);
   progress(
     `\u5DF2\u5339\u914D ${computer.displayName || computer.reportedName} (${computer.computerId})\uFF0Cdesktopd ${computer.desktopdVersion || "\u672A\u77E5"}`
   );
@@ -3142,6 +3192,9 @@ var matchesWorkflowRunCorrelation = (run, correlation) => {
   if (correlation.actorLogin && run.actor?.login !== correlation.actorLogin) {
     return false;
   }
+  if (correlation.runName && run.display_title !== correlation.runName) {
+    return false;
+  }
   if (!isRunCreatedAtOrAfter(run.created_at, correlation.createdAt)) {
     return false;
   }
@@ -3280,26 +3333,6 @@ var pollWorkflowRun = async (input2) => {
   throw new CliError(`Timed out waiting for workflow run in ${input2.repoFullName}`, 1);
 };
 
-// src/lib/ppe-lane.ts
-var PPE_LANE_MAX_LENGTH = 38;
-var PPE_LANE_PATTERN = /^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/;
-var validatePpeLaneName = (value) => {
-  const lane = value.trim();
-  if (!lane) {
-    throw new CliError("PPE lane name is required", 1);
-  }
-  if (lane.length > PPE_LANE_MAX_LENGTH) {
-    throw new CliError(`PPE lane name must be ${PPE_LANE_MAX_LENGTH} characters or fewer`, 1);
-  }
-  if (!PPE_LANE_PATTERN.test(lane)) {
-    throw new CliError(
-      "PPE lane name must use lowercase letters, digits, or hyphens, and start and end with a letter or digit",
-      1
-    );
-  }
-  return lane;
-};
-
 // src/lib/prerequisites.ts
 var ensureCommandInstalled = async (command, installHint) => {
   const result = await runCommand(command, ["--version"]);
@@ -4148,9 +4181,9 @@ var registerReleasePrepareCommand = (program) => {
 };
 
 // src/commands/release/rollback.ts
-import { mkdtemp as mkdtemp2, readFile as readFile2, rm } from "fs/promises";
-import { tmpdir } from "os";
-import { join as join5 } from "path";
+import { mkdtemp as mkdtemp3, readFile as readFile3, rm as rm2 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join6 } from "path";
 
 // src/constants/rollback-targets.ts
 var tuttiServerRollbackTarget = {
@@ -4158,7 +4191,12 @@ var tuttiServerRollbackTarget = {
   label: "tutti-server",
   repoFullName: "tutti-lab/tutti-server"
 };
-var rollbackTargets = [tuttiServerRollbackTarget];
+var platformWebRollbackTarget = {
+  key: "platform-web",
+  label: "platform-web",
+  repoFullName: "tutti-lab/tutti"
+};
+var rollbackTargets = [tuttiServerRollbackTarget, platformWebRollbackTarget];
 
 // src/commands/release/rollback-local.ts
 var CLUSTER = "arn:aws:eks:us-east-1:250509935467:cluster/nexight-ojo-us-east-1";
@@ -4246,9 +4284,137 @@ var fetchLocalRollbackCatalog = async () => {
   return buildLocalRollbackCatalog(history, deployment, manifests);
 };
 
+// src/commands/release/rollback-web.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { mkdtemp as mkdtemp2, readFile as readFile2, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join5 } from "path";
+var REPO = platformWebRollbackTarget.repoFullName;
+var WORKFLOW = "platform-web-rollback.yml";
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var SHA = /^[0-9a-f]{40}$/;
+var choiceTime = new Intl.DateTimeFormat("sv-SE", { timeZone: "Asia/Singapore", dateStyle: "short", timeStyle: "short" });
+var validDeployment = (value) => UUID.test(value?.id) && Array.isArray(value.versions) && value.versions.length > 0 && value.versions.every((item) => UUID.test(item.version_id) && Number.isFinite(item.percentage) && item.percentage > 0 && item.percentage <= 100) && Math.abs(value.versions.reduce((sum, item) => sum + item.percentage, 0) - 100) < 1e-3;
+var parseWebRollbackCatalog = (raw) => {
+  const data = JSON.parse(raw);
+  if (data.schema !== "tutti.web.rollback.catalog.v1" || data.environment !== "production" || !validDeployment(data.currentDeployment) || !Array.isArray(data.candidates) || data.candidates.length > 100) {
+    throw new CliError("Invalid Platform Web rollback catalog", 1);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const active = new Set(data.currentDeployment.versions.map((item) => item.version_id));
+  for (const candidate of data.candidates) {
+    if (!UUID.test(candidate.versionId) || !UUID.test(candidate.deploymentId) || !Number.isFinite(Date.parse(candidate.deployedAt)) || typeof candidate.current !== "boolean" || candidate.current !== active.has(candidate.versionId) || typeof candidate.withdrawn !== "boolean" || typeof candidate.fullTraffic !== "boolean" || !(candidate.sha === null || SHA.test(candidate.sha)) || !(candidate.runId === null || /^\d+$/.test(candidate.runId)) || seen.has(candidate.versionId)) {
+      throw new CliError("Invalid Platform Web deployment in rollback catalog", 1);
+    }
+    seen.add(candidate.versionId);
+  }
+  return data;
+};
+var buildWebRollbackChoices = (catalog) => catalog.candidates.filter((candidate) => !candidate.current && !candidate.withdrawn && candidate.fullTraffic).map((candidate) => ({
+  name: `${choiceTime.format(new Date(candidate.deployedAt))} SGT  ${candidate.versionId.slice(0, 8)}  ${candidate.sha?.slice(0, 12) ?? "SHA unknown"}${candidate.runId ? `  run ${candidate.runId}` : ""}`,
+  value: candidate.versionId
+}));
+var gh = async (args) => {
+  const result = await runCommand("gh", args);
+  if (result.exitCode !== 0) throw new CliError(result.stderr.trim() || result.stdout.trim() || "GitHub command failed", 1);
+  return result.stdout;
+};
+var dispatch = async (operation, inputs = {}) => {
+  const operationId = randomUUID3();
+  const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const knownRunIds = await listWorkflowRunIds({ repoFullName: REPO, workflowFile: WORKFLOW, ref: "main" });
+  const fields = { operation, operation_id: operationId, requested_at: requestedAt, ...inputs };
+  await gh(["workflow", "run", WORKFLOW, "--repo", REPO, "--ref", "main", ...Object.entries(fields).flatMap(([key, value]) => ["-f", `${key}=${value}`])]);
+  const progress = ui.spinner(operation === "execute" ? "\u7B49\u5F85 Platform Web \u56DE\u6EDA\u548C\u5165\u53E3\u9A8C\u8BC1..." : "\u8BFB\u53D6 Platform Web \u751F\u4EA7\u72B6\u6001...").start();
+  try {
+    const run = await pollWorkflowRun({
+      knownRunIds,
+      repoFullName: REPO,
+      workflowFile: WORKFLOW,
+      ref: "main",
+      intervalMs: 1e3,
+      maxAttempts: 600,
+      correlation: { runName: `Platform Web Rollback / ${operation} / ${operationId}`, createdAt: requestedAt },
+      onUpdate: (update) => {
+        if ("htmlUrl" in update) progress.text = update.htmlUrl;
+      }
+    });
+    const directory = await mkdtemp2(join5(tmpdir(), "platform-web-rollback-"));
+    try {
+      try {
+        await gh(["run", "download", String(run.runId), "--repo", REPO, "--name", "platform-web-rollback", "--dir", directory]);
+      } catch (error) {
+        throw new CliError(`Could not retrieve operation outcome; inspect actual production state at ${run.htmlUrl} before retrying: ${error instanceof Error ? error.message : String(error)}`, 1);
+      }
+      const result = JSON.parse(await readFile2(join5(directory, "rollback-result.json"), "utf8"));
+      if (result.schema !== "tutti.web.rollback.result.v1" || result.operationId !== operationId || !["success", "failure", "pending_verification"].includes(result.status) || !["unchanged", "switched", "unknown"].includes(result.deployment) || !result.verification || !result.timings || Object.values(result.timings).some((value) => !Number.isFinite(value) || value < 0) || result.actual && !validDeployment(result.actual)) {
+        throw new CliError(`Invalid rollback result: ${run.htmlUrl}`, 1);
+      }
+      if (run.conclusion !== "success" || result.status !== "success") {
+        const state = result.actual ? `${result.actual.id} / ${JSON.stringify(result.actual.versions)}` : "unknown";
+        throw new CliError(`Platform Web operation failed; deployment ${result.deployment}
+Actual production: ${state}
+${result.error ?? run.failureMessage ?? run.conclusion}
+${run.htmlUrl}`, 1);
+      }
+      if (operation === "execute" && (result.deployment !== "switched" || !result.actual || !UUID.test(result.targetVersionId ?? "") || result.actual.versions.length !== 1 || result.actual.versions[0]?.version_id !== result.targetVersionId || result.actual.versions[0]?.percentage !== 100)) {
+        throw new CliError(`Rollback did not confirm target version at 100%: ${run.htmlUrl}`, 1);
+      }
+      const catalog = operation === "list" ? parseWebRollbackCatalog(await readFile2(join5(directory, "rollback-catalog.json"), "utf8")) : void 0;
+      return { run, result, catalog };
+    } catch (error) {
+      if (error instanceof CliError) throw error;
+      throw new CliError(`Could not read actual operation state; inspect ${run.htmlUrl} before retrying: ${error instanceof Error ? error.message : String(error)}`, 1);
+    } finally {
+      await rm(directory, { recursive: true, force: true });
+    }
+  } finally {
+    progress.stop();
+  }
+};
+var runPlatformWebRollback = async (options) => {
+  if (options.previous && options.versionId || options.probe && (options.previous || options.versionId)) throw new CliError("Choose only one of --previous, --version-id, or --probe", 1);
+  if (options.versionId && !UUID.test(options.versionId)) throw new CliError("--version-id must be a Worker version UUID", 1);
+  if (options.reason && Buffer.byteLength(options.reason) > 200) throw new CliError("--reason must be at most 200 UTF-8 bytes", 1);
+  await ensurePrerequisites({ needsGh: true });
+  let inputs = { reason: options.reason ?? "operator rollback" };
+  if (options.probe) {
+    const { run: run2, result: result2 } = await dispatch("probe");
+    logger.info(`Read-only production probe: ${JSON.stringify(result2.timings)}`);
+    logger.info(`Verification: ${JSON.stringify(result2.verification)}`);
+    logger.info(run2.htmlUrl);
+    return;
+  }
+  if (options.yes && (options.previous || options.versionId)) {
+    inputs = { ...inputs, previous: String(Boolean(options.previous)), version_id: options.versionId ?? "" };
+  } else {
+    const { catalog } = await dispatch("list", options.versionId ? { version_id: options.versionId } : {});
+    if (!catalog) throw new CliError("Missing Platform Web rollback catalog", 1);
+    const choices = buildWebRollbackChoices(catalog);
+    if (!options.versionId && choices.length === 0) throw new CliError("No eligible recent production Web version is available", 1);
+    const versionId = options.versionId ?? (options.previous ? choices[0]?.value : await ui.select({ message: "Select a production Web version to restore", choices, pageSize: Math.min(choices.length, 15) }));
+    const selected = catalog.candidates.find((candidate) => candidate.versionId === versionId && !candidate.current);
+    if (!selected) throw new CliError("No eligible recent production Web version is available", 1);
+    logger.info(`Current deployment: ${catalog.currentDeployment.id}`);
+    logger.info(`Target version: ${selected.versionId} / SHA ${selected.sha ?? "unknown"}`);
+    if (selected.runId) logger.info(`Published by: https://github.com/${REPO}/actions/runs/${selected.runId}`);
+    if (selected.withdrawn) logger.warn("This version was previously withdrawn by a rollback.");
+    if (!options.yes && !await ui.confirm({ message: "Restore this Web version to production?", default: false })) {
+      logger.warn("Rollback cancelled");
+      return;
+    }
+    inputs = { ...inputs, previous: "false", version_id: selected.versionId, expected_deployment_id: catalog.currentDeployment.id };
+  }
+  const { run, result } = await dispatch("execute", inputs);
+  logger.success(`Platform Web switched to ${result.targetVersionId} at 100% traffic`);
+  logger.info(`Verification: ${JSON.stringify(result.verification)}`);
+  logger.info(`Timing (ms): ${JSON.stringify(result.timings)}`);
+  logger.info(run.htmlUrl);
+};
+
 // src/commands/release/rollback.ts
-var REPO = tuttiServerRollbackTarget.repoFullName;
-var WORKFLOW = "rollback.yml";
+var REPO2 = tuttiServerRollbackTarget.repoFullName;
+var WORKFLOW2 = "rollback.yml";
 var SHA256 = /^sha256:[0-9a-f]{64}$/;
 var SINGAPORE_TIME = new Intl.DateTimeFormat("sv-SE", {
   timeZone: "Asia/Singapore",
@@ -4272,7 +4438,7 @@ var buildRollbackChoices = (catalog) => catalog.candidates.filter((candidate) =>
   name: `${displayChoiceTime(candidate.deployedAt)} SGT  #${candidate.revision}  ${candidate.version}`,
   value: candidate.revision
 }));
-var gh = async (args) => {
+var gh2 = async (args) => {
   const result = await runCommand("gh", args);
   if (result.exitCode !== 0) {
     throw new CliError(result.stderr.trim() || result.stdout.trim() || `gh ${args[0]} failed`, 1);
@@ -4292,8 +4458,8 @@ var parseRollbackCatalog = (raw) => {
   return data;
 };
 var listActiveDeployments = async () => {
-  const runs = await Promise.all(["deploy.yml", WORKFLOW].map(async (workflow) => {
-    const raw = await gh(["api", `repos/${REPO}/actions/workflows/${workflow}/runs?per_page=30`]);
+  const runs = await Promise.all(["deploy.yml", WORKFLOW2].map(async (workflow) => {
+    const raw = await gh2(["api", `repos/${REPO2}/actions/workflows/${workflow}/runs?per_page=30`]);
     return JSON.parse(raw).workflow_runs;
   }));
   return runs.flat().filter(
@@ -4306,19 +4472,19 @@ var ensureNoActiveDeployment = async () => {
     throw new CliError(`Production deployment is already running: ${active[0]?.html_url}`, 1);
   }
 };
-var dispatch = async (operation, inputs = {}) => {
-  const knownRunIds = await listWorkflowRunIds({ repoFullName: REPO, workflowFile: WORKFLOW, ref: "main" });
-  const args = ["workflow", "run", WORKFLOW, "--repo", REPO, "--ref", "main", "-f", `operation=${operation}`];
+var dispatch2 = async (operation, inputs = {}) => {
+  const knownRunIds = await listWorkflowRunIds({ repoFullName: REPO2, workflowFile: WORKFLOW2, ref: "main" });
+  const args = ["workflow", "run", WORKFLOW2, "--repo", REPO2, "--ref", "main", "-f", `operation=${operation}`];
   for (const [key, value] of Object.entries(inputs)) {
     args.push("-f", `${key}=${value}`);
   }
-  await gh(args);
+  await gh2(args);
   const progress = ui.spinner(operation === "list" ? "\u8BFB\u53D6\u751F\u4EA7\u90E8\u7F72\u5386\u53F2..." : "\u7B49\u5F85\u751F\u4EA7\u56DE\u6EDA\u548C\u5065\u5EB7\u68C0\u67E5...").start();
   try {
     const run = await pollWorkflowRun({
       knownRunIds,
-      repoFullName: REPO,
-      workflowFile: WORKFLOW,
+      repoFullName: REPO2,
+      workflowFile: WORKFLOW2,
       ref: "main",
       maxAttempts: operation === "execute" ? 420 : 180,
       onUpdate: (update) => {
@@ -4328,15 +4494,15 @@ var dispatch = async (operation, inputs = {}) => {
     if (run.conclusion !== "success") {
       let state = "";
       if (operation === "execute") {
-        const dir = await mkdtemp2(join5(tmpdir(), "tutti-rollback-state-"));
+        const dir = await mkdtemp3(join6(tmpdir2(), "tutti-rollback-state-"));
         try {
-          await gh(["run", "download", String(run.runId), "--repo", REPO, "--name", "rollback-state", "--dir", dir]);
+          await gh2(["run", "download", String(run.runId), "--repo", REPO2, "--name", "rollback-state", "--dir", dir]);
           state = `
-${await readFile2(join5(dir, "rollback-state.txt"), "utf8")}`;
+${await readFile3(join6(dir, "rollback-state.txt"), "utf8")}`;
         } catch {
           state = "\nActual production state is available in the workflow logs.";
         } finally {
-          await rm(dir, { recursive: true, force: true });
+          await rm2(dir, { recursive: true, force: true });
         }
       }
       throw new CliError(`Workflow failed: ${run.failureMessage ?? run.conclusion}
@@ -4348,12 +4514,12 @@ ${run.htmlUrl}${state}`, 1);
   }
 };
 var fetchCatalog = async (runId) => {
-  const dir = await mkdtemp2(join5(tmpdir(), "tutti-rollback-"));
+  const dir = await mkdtemp3(join6(tmpdir2(), "tutti-rollback-"));
   try {
-    await gh(["run", "download", String(runId), "--repo", REPO, "--name", "rollback-catalog", "--dir", dir]);
-    return parseRollbackCatalog(await readFile2(join5(dir, "rollback-catalog.json"), "utf8"));
+    await gh2(["run", "download", String(runId), "--repo", REPO2, "--name", "rollback-catalog", "--dir", dir]);
+    return parseRollbackCatalog(await readFile3(join6(dir, "rollback-catalog.json"), "utf8"));
   } finally {
-    await rm(dir, { recursive: true, force: true });
+    await rm2(dir, { recursive: true, force: true });
   }
 };
 var readCatalog = async () => {
@@ -4365,7 +4531,7 @@ var readCatalog = async () => {
     progress.stop();
   }
   logger.warn("\u672C\u673A\u65E0\u6CD5\u5B8C\u6574\u8BFB\u53D6\u751F\u4EA7\u90E8\u7F72\u5386\u53F2\uFF0C\u6539\u7528 GitHub Actions \u67E5\u8BE2\u3002");
-  const listRun = await dispatch("list");
+  const listRun = await dispatch2("list");
   return fetchCatalog(listRun.runId);
 };
 var runTuttiRollback = async (options) => {
@@ -4405,7 +4571,7 @@ var runTuttiRollback = async (options) => {
     return;
   }
   await ensureNoActiveDeployment();
-  const run = await dispatch("execute", {
+  const run = await dispatch2("execute", {
     revision: String(selected.revision),
     digest: selected.digest,
     expected_current_digest: catalog.currentDigest,
@@ -4415,14 +4581,18 @@ var runTuttiRollback = async (options) => {
   logger.info(run.htmlUrl);
 };
 var registerReleaseRollbackCommand = (program) => {
-  program.command("rollback").description("Restore a recent production image").argument("[repository]", "Rollback target; omit to choose interactively").option("--revision <number>", "Select a recent Helm revision without the chooser").option("--yes", "Skip the final confirmation").action(async (repository, options) => {
+  program.command("rollback").description("Restore a recent production deployment").argument("[repository]", "Rollback target; omit to choose interactively").option("--revision <number>", "Select a recent Helm revision without the chooser").option("--previous", "Restore the latest eligible previous Platform Web version").option("--version-id <uuid>", "Select a previously deployed Platform Web Worker version").option("--reason <text>", "Record a Platform Web rollback reason").option("--probe", "Measure a read-only Platform Web production probe").option("--yes", "Skip the final confirmation").action(async (repository, options) => {
     const selected = repository ?? await ui.select({
       message: "Select a repository to roll back",
       choices: rollbackTargets.map((target) => ({ name: target.label, value: target.key }))
     });
-    if (selected !== tuttiServerRollbackTarget.key) {
-      throw new CliError("Only tutti-server is currently supported", 1);
+    if (selected === platformWebRollbackTarget.key) {
+      if (options.revision) throw new CliError("--revision applies only to tutti-server", 1);
+      await runPlatformWebRollback(options);
+      return;
     }
+    if (selected !== tuttiServerRollbackTarget.key) throw new CliError(`Unsupported rollback target: ${selected}`, 1);
+    if (options.previous || options.versionId || options.reason || options.probe) throw new CliError("--previous, --version-id, --reason and --probe apply only to platform-web", 1);
     await runTuttiRollback(options);
   });
 };
@@ -4452,7 +4622,7 @@ var readCliVersion = () => {
 
 // src/lib/version-check.ts
 import { realpath } from "fs/promises";
-import { join as join6, resolve as resolve3, sep } from "path";
+import { join as join7, resolve as resolve3, sep } from "path";
 var PACKAGE_NAME = "@tutti-os/nexight-devops";
 var AUTO_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_LOCALE = "zh-CN";
@@ -4521,7 +4691,7 @@ var isInsidePackageRoot = (entryPath, root) => {
   if (!entryPath || !root) {
     return false;
   }
-  const packageRoot = resolve3(join6(root, "@tutti-os", "nexight-devops"));
+  const packageRoot = resolve3(join7(root, "@tutti-os", "nexight-devops"));
   const targetPath = resolve3(entryPath);
   return targetPath === packageRoot || targetPath.startsWith(`${packageRoot}${sep}`);
 };
@@ -4531,7 +4701,7 @@ var isInsideBunGlobalBin = (entryPath, bunGlobalBin) => {
   }
   const targetPath = resolve3(entryPath);
   const binPath = resolve3(bunGlobalBin);
-  const expectedEntryPath = resolve3(join6(binPath, "nexight-devops"));
+  const expectedEntryPath = resolve3(join7(binPath, "nexight-devops"));
   return targetPath === expectedEntryPath;
 };
 var readGlobalPath = async (command, args) => {