@vibesdotdev/infra-deploy 0.0.1 → 1.0.0-rc.4

package/dist/cli/audit/infra-audit.cli-command.impl.js

@@ -11,146 +11,584 @@
  * Read-only. Never modifies provider state. `--output json` emits a
  * structured payload for piping into ops dashboards.
  */
-import { getVibesRuntime } from '@vibesdotdev/runtime';
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { getRuntimePath } from '@vibesdotdev/paths';
+import { CapabilityError, CaughtFailureSchema, settle, settleNow, valueFreeFailure } from '@vibesdotdev/kernel';
+import { generateId } from '@vibesdotdev/shared/utils';
+import { z } from 'zod/v4';
+import { pathExists, requirePathFileURL } from "../npm/publish/fs-paths.js";
 import {} from '@vibesdotdev/cli/providers';
+import { createSanitizedInfraProviderError, formatInfraAuthorityFingerprint, mergeInfraAuthorityFingerprints, sanitizeInfraProviderFailure } from '@vibesdotdev/infra-core';
+import { InfraAlertsDescriptorSchema } from '@vibesdotdev/infra-core/kinds';
+import { discoverInventoryWorkspace } from "../shared/discover-deployments.js";
+import { OBSERVABILITY_BLIND_SPOT_REMEDY, observabilityBlindSpots } from "../observability/blind-spots.js";
 function readString(v) {
-    return typeof v === 'string' && v.length > 0 ? v : undefined;
+    const parsed = z.string().min(1).safeParse(v);
+    return parsed.success ? parsed.data : undefined;
 }
-async function gatherAlerts(runtime) {
-    const section = { providers: [], gaps: [] };
+const AUDIT_ENVIRONMENTS = {
+    local: true,
+    dev: true,
+    staging: true,
+    production: true
+};
+export function assertAuditEnvironment(environment) {
+    if (!(environment in AUDIT_ENVIRONMENTS)) {
+        throw new Error(`Unsupported infra audit environment "${environment}". Use one of: local, dev, staging, production.`);
+    }
+}
+/**
+ * Critical alert categories every account should keep covered. Absence of any
+ * of these — even when *other* policies exist — is a real gap (the prior
+ * cron-dead incident hid behind incidental DDoS/tunnel policies while there was
+ * zero error-rate alerting).
+ */
+const CRITICAL_ALERT_CATEGORIES = ['budget', 'usage', 'error-rate'];
+/**
+ * Each infra/alerts descriptor declares which categories its live policy listing
+ * cannot represent; audit uses that owner metadata when computing policy drift.
+ */
+const MARKER_ALERT_TYPES = ['scheduled-event-missing', 'log-marker'];
+function alertCategoryImpact(category) {
+    switch (category) {
+        case 'budget':
+            return 'a runaway cost would not page anyone';
+        case 'usage':
+            return 'usage ceilings are off — a request/storage spike goes unflagged';
+        case 'error-rate':
+            return 'a 5xx spike or a failing/never-firing cron would go undetected';
+        default:
+            return 'this category is unmonitored';
+    }
+}
+export function evaluateAlertCoverage(input) {
+    const { adapter, declared, live, categoryDiagnostics = {}, unrepresentedCategories = [] } = input;
+    const gaps = [];
+    const driftNotes = [];
+    const liveTypes = new Set((live ?? []).map((p) => p.type));
+    const declaredTypes = new Set(declared.map((p) => p.type));
+    const liveCount = live?.length ?? 0;
+    // True "zero" only when nothing is declared, nothing is live, and live was
+    // readable. Otherwise declared policies steer the verdict away from "zero".
+    if (declared.length === 0 && live !== null && liveCount === 0) {
+        gaps.push(`${adapter}: zero policies configured. Budget/usage/error-rate alerts are not in place.`);
+        return { gaps, driftNotes };
+    }
+    // Per-category coverage is only assertable when we could actually read the
+    // live set. With live unreadable (no creds), we don't know what's applied —
+    // emit no per-category gap and let the section note say coverage was computed
+    // from declarations only (rather than falsely claim "not applied").
+    if (live !== null) {
+        for (const category of CRITICAL_ALERT_CATEGORIES) {
+            if (liveTypes.has(category))
+                continue; // covered on the account
+            if (declaredTypes.has(category)) {
+                const diagnostic = categoryDiagnostics[category];
+                if (diagnostic) {
+                    gaps.push(`${adapter}: ${diagnostic}`);
+                }
+                else {
+                    gaps.push(`${adapter}: ${category} alerts are declared in infra/account.config.ts but not applied to this provider — run \`vibes infra alerts create ${category}\`.`);
+                }
+            }
+            else {
+                gaps.push(`${adapter}: no ${category} alerts configured — ${alertCategoryImpact(category)}.`);
+            }
+        }
+    }
+    if (live !== null) {
+        const liveNames = new Set(live.map((p) => p.name));
+        const declaredNames = new Set(declared.map((p) => p.name));
+        // Declaration-only types have no live policy representation, so they are
+        // never expected to appear in the provider's policy list. Their owning
+        // observability surfaces are reported as explicit coverage gaps above.
+        const declaredOnly = declared.filter((p) => !unrepresentedCategories.includes(p.type) && !liveNames.has(p.name));
+        const liveOnly = live.filter((p) => !declaredNames.has(p.name));
+        if (declaredOnly.length > 0) {
+            driftNotes.push(`${declaredOnly.length} declared policy(ies) not yet applied to ${adapter}: ${declaredOnly
+                .map((p) => p.name)
+                .join(', ')}`);
+        }
+        if (liveOnly.length > 0) {
+            driftNotes.push(`${liveOnly.length} live policy(ies) not declared in infra/account.config.ts: ${liveOnly
+                .map((p) => p.name)
+                .join(', ')}`);
+        }
+    }
+    return { gaps, driftNotes };
+}
+const LoadedAccountModuleSchema = z.looseObject({
+    default: z.unknown().optional()
+});
+/**
+ * Load the declared account-wide alert policies from the bound workspace's
+ * `infra/account.config.ts` (read-only). Nothing walks up for it. An unbound
+ * host or a workspace without the file declares none; a file that exists but
+ * cannot be evaluated or parsed fails the audit rather than silently
+ * dropping declared coverage.
+ */
+async function loadDeclaredAccountAlerts(runtime) {
+    let workspaceRoot;
+    try {
+        workspaceRoot = await runtime.context('runtime/workspace-path');
+    }
+    catch (error) {
+        if (error instanceof Error && CapabilityError.isAbsenceOf(error, 'context', 'runtime/workspace-path'))
+            return null;
+        throw error;
+    }
+    const paths = await getRuntimePath(runtime);
+    const path = paths.join(workspaceRoot, 'infra', 'account.config.ts');
+    if (!(await pathExists(runtime, path)))
+        return null;
+    const url = requirePathFileURL(paths, path);
+    url.searchParams.set('vibesAuditLoad', generateId());
+    let raw;
+    try {
+        const mod = LoadedAccountModuleSchema.parse(await import(__rewriteRelativeImportExtension(url.href)));
+        raw = mod.default ?? mod;
+    }
+    catch (error) {
+        throw new CapabilityError(`${path} could not be evaluated.`, 'INTERNAL', {
+            reason: 'load-failed',
+            details: { path },
+            cause: valueFreeFailure(CaughtFailureSchema.parse(error))
+        });
+    }
+    const parsed = InfraAlertsDescriptorSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new CapabilityError(`${path} is not a valid infra/alerts descriptor.`, 'INVALID_INPUT', {
+            reason: 'descriptor-invalid',
+            details: { path },
+            cause: valueFreeFailure(parsed.error)
+        });
+    }
+    return parsed.data;
+}
+/**
+ * Provider filters accept either one exact implementation id or a provider
+ * family prefix. Thus `cloudflare` selects every Cloudflare audit adapter,
+ * while `cloudflare-alerts` selects only that implementation.
+ */
+export function auditProviderMatches(requestedProvider, candidates) {
+    const requested = requestedProvider?.trim().toLowerCase();
+    if (!requested)
+        return true;
+    return candidates.some((candidate) => {
+        const normalized = candidate.trim().toLowerCase();
+        return (normalized === requested ||
+            normalized.startsWith(`${requested}-`) ||
+            normalized.startsWith(`${requested}:`) ||
+            normalized.startsWith(`${requested}/`) ||
+            normalized.startsWith(`${requested}.`));
+    });
+}
+async function resolveAuditImplementation(runtime, kind, id, environment, extraOpts) {
+    const resolved = await runtime
+        .query(kind)
+        .withId(id)
+        .resolve();
+    if ('create' in resolved) {
+        const opts = {
+            environment
+        };
+        if (extraOpts?.declaredWorkerNames) {
+            opts.declaredWorkerNames = extraOpts.declaredWorkerNames;
+        }
+        return await resolved.create(opts);
+    }
+    return resolved;
+}
+async function gatherAlerts(runtime, options = {}) {
+    const section = { providers: [], gaps: [], notes: [] };
     if (!runtime.hasKind('infra/alerts')) {
         section.gaps.push('infra/alerts kind not registered — no provider plugin loaded for alerting.');
         return section;
     }
-    const descriptors = runtime.assets('infra/alerts').descriptors();
+    const descriptors = runtime.assets('infra/alerts').descriptors().filter((descriptor) => auditProviderMatches(options.provider, [descriptor.id, descriptor.adapter]));
     if (descriptors.length === 0) {
-        section.gaps.push('No infra/alerts descriptors registered.');
+        if (!options.provider)
+            section.gaps.push('No infra/alerts descriptors registered.');
         return section;
     }
+    // Declared policies live in infra/account.config.ts (the account-wide home).
+    // FS-discovery does not register repo-root config into the CLI runtime, so
+    // load it explicitly (read-only) and attribute its policies to the matching
+    // adapter. This is what makes declaring policies change the audit verdict.
+    const declaredAccount = await loadDeclaredAccountAlerts(runtime);
     for (const d of descriptors) {
-        try {
-            const impl = (await runtime
-                .query('infra/alerts')
-                .withId(d.id)
-                .resolve());
-            const policies = await impl.listPolicies();
-            section.providers.push({ descriptorId: d.id, adapter: d.adapter, policies });
-            if (policies.length === 0) {
-                section.gaps.push(`${d.adapter}: zero policies configured. Budget/usage/error-rate alerts are not in place.`);
-            }
-        }
-        catch (err) {
+        const outcome = await settle(async () => {
+            const impl = await resolveAuditImplementation(runtime, 'infra/alerts', d.id, options.environment ?? 'local');
+            const liveOutcome = await settle(() => impl.listPolicies());
+            const live = liveOutcome.ok ? liveOutcome.value : null;
+            const liveError = liveOutcome.ok ? undefined : renderAuditProviderFailureText(liveOutcome.cause);
+            const authority = live === null ? undefined : await impl.getAuthority?.();
+            const declared = [
+                ...(d.policies ?? []),
+                ...(declaredAccount && declaredAccount.adapter === d.adapter ? declaredAccount.policies : [])
+            ];
+            const coverage = evaluateAlertCoverage({
+                adapter: d.adapter,
+                declared,
+                live,
+                categoryDiagnostics: d.auditDiagnostics?.category,
+                unrepresentedCategories: d.auditDiagnostics?.unrepresentedCategories
+            });
+            return { live, liveError, authority, declared, coverage };
+        });
+        if (outcome.ok) {
+            const { live, liveError, authority, declared, coverage } = outcome.value;
+            section.providers.push({
+                descriptorId: d.id,
+                adapter: d.adapter,
+                policies: live ?? [],
+                declaredCount: declared.length,
+                liveError,
+                driftNotes: coverage.driftNotes,
+                authority
+            });
+            section.gaps.push(...coverage.gaps);
+            if (liveError) {
+                section.notes.push(`${d.adapter}: live policy listing unavailable (${liveError.split('\n')[0]}); coverage computed from declared policies only.`);
+            }
+            const markerWatchers = declared
+                .filter((p) => MARKER_ALERT_TYPES.includes(p.type))
+                .map((p) => p.filters.marker ?? p.filters.worker ?? p.name)
+                .filter((m) => Boolean(m));
+            if (markerWatchers.length > 0) {
+                section.notes.push(`${d.adapter}: ${markerWatchers.length} structured-marker alert(s) declared (${d.auditDiagnostics?.markerDelivery ?? 'delivery depends on the provider adapter'}): ${markerWatchers.join(', ')}.`);
+            }
+        }
+        else {
             section.providers.push({
                 descriptorId: d.id,
                 adapter: d.adapter,
                 policies: [],
-                error: err instanceof Error ? err.message : String(err)
+                declaredCount: 0,
+                driftNotes: [],
+                error: renderAuditProviderFailureText(outcome.cause)
             });
         }
     }
     return section;
 }
-async function gatherObservability(runtime) {
+async function gatherObservability(runtime, options = {}) {
     const section = { providers: [], gaps: [] };
     if (!runtime.hasKind('infra/observability')) {
         section.gaps.push('infra/observability kind not registered — no provider plugin loaded.');
         return section;
     }
-    const descriptors = runtime
-        .assets('infra/observability')
-        .descriptors();
+    const descriptors = runtime.assets('infra/observability').descriptors().filter((descriptor) => auditProviderMatches(options.provider, [descriptor.id, descriptor.adapter]));
     for (const d of descriptors) {
-        try {
-            const impl = (await runtime
-                .query('infra/observability')
-                .withId(d.id)
-                .resolve());
-            const snapshots = (await impl.getStatus({ kind: 'account-wide' }));
-            const samples = snapshots
+        const outcome = await settle(async () => {
+            const impl = await resolveAuditImplementation(runtime, 'infra/observability', d.id, options.environment ?? 'local');
+            const snapshots = await impl.getStatus({ kind: 'account-wide' });
+            const readable = snapshots.filter((snapshot) => !snapshot.failure);
+            const failedWorkers = snapshots.flatMap((snapshot) => snapshot.failure
+                ? [{ workerName: snapshot.workerName, ...snapshot.failure }]
+                : []);
+            const authority = failedWorkers.length > 0 && readable.length === 0
+                ? undefined
+                : await impl.getAuthority?.();
+            const samples = readable
                 .map((s) => s.settings.logs?.headSamplingRate)
                 .filter((r) => typeof r === 'number');
-            const overSampled = snapshots
-                .filter((s) => (s.settings.logs?.headSamplingRate ?? 0) >= 1)
-                .map((s) => s.workerName);
-            section.providers.push({
+            const blindSpots = observabilityBlindSpots(readable);
+            return { readable, samples, blindSpots, failedWorkers, authority };
+        });
+        if (outcome.ok) {
+            const { readable, samples, blindSpots, failedWorkers, authority } = outcome.value;
+            const providerEntry = {
                 descriptorId: d.id,
                 adapter: d.adapter,
-                workerCount: snapshots.length,
+                workerCount: readable.length,
                 minSampling: samples.length ? Math.min(...samples) : undefined,
                 maxSampling: samples.length ? Math.max(...samples) : undefined,
-                avgSampling: samples.length ? samples.reduce((a, b) => a + b, 0) / samples.length : undefined,
-                overSampledWorkers: overSampled
-            });
-            if (overSampled.length > 0) {
-                section.gaps.push(`${d.adapter}: ${overSampled.length} worker(s) at 100% log sampling — runaway-cost risk under the new CF Observability metering.`);
+                avgSampling: samples.length
+                    ? samples.reduce((a, b) => a + b, 0) / samples.length
+                    : undefined,
+                blindSpotWorkers: blindSpots,
+                failedWorkers,
+                authority
+            };
+            if (failedWorkers.length > 0) {
+                providerEntry.error = `${failedWorkers.length} worker observability setting(s) were unreadable.`;
+            }
+            section.providers.push(providerEntry);
+            if (failedWorkers.length > 0) {
+                section.gaps.push(`${d.adapter}: ${failedWorkers.length} worker observability setting(s) unreadable; fleet sampling coverage is incomplete.`);
+            }
+            if (blindSpots.length > 0) {
+                section.gaps.push(`${d.adapter}: ${blindSpots.length} worker(s) miss invocations (logs off or sampled below 100%): ${blindSpots.join(', ')}.`);
             }
         }
-        catch (err) {
+        else {
             section.providers.push({
                 descriptorId: d.id,
                 adapter: d.adapter,
                 workerCount: 0,
-                overSampledWorkers: [],
-                error: err instanceof Error ? err.message : String(err)
+                blindSpotWorkers: [],
+                failedWorkers: [],
+                error: renderAuditProviderFailureText(outcome.cause)
             });
         }
     }
     return section;
 }
-async function gatherLogs(runtime) {
+async function gatherLogs(runtime, options = {}) {
     const section = { providers: [] };
     if (!runtime.hasKind('infra/logs'))
         return section;
-    const descriptors = runtime.assets('infra/logs').descriptors();
+    const descriptors = runtime.assets('infra/logs').descriptors().filter((descriptor) => auditProviderMatches(options.provider, [descriptor.id, descriptor.adapter]));
     for (const d of descriptors) {
-        try {
-            await runtime.query('infra/logs').withId(d.id).resolve(); // probe resolves
+        const resolved = await settle(() => runtime.query('infra/logs').withId(d.id).resolve());
+        if (resolved.ok) {
             section.providers.push({
                 descriptorId: d.id,
                 adapter: d.adapter,
                 sources: d.sources ?? [],
-                retention: d.retention,
+                logRetention: d.logRetention,
                 alertsConfigured: (d.alerts ?? []).length
             });
         }
-        catch (err) {
+        else {
             section.providers.push({
                 descriptorId: d.id,
                 adapter: d.adapter,
                 sources: [],
                 alertsConfigured: 0,
-                error: err instanceof Error ? err.message : String(err)
+                error: renderAuditProviderFailureText(resolved.cause)
+            });
+        }
+    }
+    return section;
+}
+export function renderAuditProviderFailureText(error) {
+    return sanitizeInfraProviderFailure(error).message;
+}
+/**
+ * Live workers that expose a `scheduled` (cron) handler. A worker that runs a
+ * cron but has no error-rate / scheduled-event-missing alert is exactly how a
+ * dead cron stays invisible — gatherWorkers cross-checks coverage for these.
+ */
+export function detectScheduledWorkers(liveWorkers) {
+    return liveWorkers
+        .filter((worker) => (worker.handlers ?? []).includes('scheduled'))
+        .map((worker) => worker.workerName)
+        .sort();
+}
+export function buildWorkersProviderAudit(input) {
+    const declared = new Set(input.declaredWorkers);
+    const liveNames = new Set(input.liveWorkers.map((worker) => worker.workerName));
+    const liveWorkers = input.liveWorkers
+        .slice()
+        .sort((a, b) => a.workerName.localeCompare(b.workerName))
+        .map((worker) => ({
+        workerName: worker.workerName,
+        lastDeployed: worker.lastDeployed,
+        usageModel: worker.usageModel,
+        handlers: worker.handlers,
+        declared: declared.has(worker.workerName)
+    }));
+    return {
+        descriptorId: input.descriptorId,
+        adapter: input.adapter,
+        accountId: input.account,
+        liveWorkerCount: liveWorkers.length,
+        declaredWorkerCount: input.declaredWorkers.length,
+        liveWorkers,
+        declaredWorkers: input.declaredWorkers,
+        missingLiveWorkers: input.declaredWorkers.filter((name) => !liveNames.has(name)),
+        unmanagedLiveWorkers: liveWorkers
+            .filter((worker) => !worker.declared)
+            .map((worker) => worker.workerName),
+        scheduledWorkers: detectScheduledWorkers(liveWorkers)
+    };
+}
+const WorkerRawInventorySchema = z.looseObject({
+    modifiedOn: z.string().optional(),
+    usageModel: z.string().optional(),
+    handlers: z.array(z.string()).optional()
+});
+function workerFromInventory(resource) {
+    const parsed = WorkerRawInventorySchema.safeParse(resource.raw);
+    const raw = parsed.success ? parsed.data : undefined;
+    return {
+        workerName: resource.name ?? resource.id,
+        lastDeployed: raw?.modifiedOn,
+        usageModel: raw?.usageModel,
+        handlers: raw?.handlers ?? []
+    };
+}
+async function gatherWorkers(runtime, options = {}) {
+    const section = { providers: [], gaps: [] };
+    if (!runtime.hasKind('infra/inventory')) {
+        section.gaps.push('infra/inventory kind is not registered — no provider plugin loaded.');
+        return section;
+    }
+    const descriptors = runtime.assets('infra/inventory')
+        .descriptors()
+        .filter((descriptor) => descriptor.resourceKinds?.includes('infra/worker') === true &&
+        auditProviderMatches(options.provider, [
+            descriptor.id,
+            descriptor.provider ?? '',
+            ...(descriptor.providerAliases ?? [])
+        ]));
+    if (descriptors.length === 0) {
+        if (!options.provider)
+            section.gaps.push('No inventory descriptors declare infra/worker.');
+        return section;
+    }
+    for (const descriptor of descriptors) {
+        let implementation;
+        let credentialPath = 'unavailable';
+        let declaredWorkers = [];
+        const outcome = await settle(async () => {
+            const workspace = await discoverInventoryWorkspace(runtime, descriptor);
+            implementation = await resolveAuditImplementation(runtime, 'infra/inventory', descriptor.id, options.environment ?? 'local');
+            const snapshot = await implementation.collect({ kinds: ['infra/worker'], workspace });
+            credentialPath = snapshot.credentialPath ?? credentialPath;
+            declaredWorkers = (snapshot.declarations ?? [])
+                .filter((resource) => resource.kind === 'infra/worker')
+                .map((resource) => resource.name ?? resource.id);
+            const providerFailure = snapshot.resources.find((resource) => resource.kind === 'infra/inventory-error');
+            if (providerFailure) {
+                throw createSanitizedInfraProviderError({
+                    code: 'PROVIDER_UNAVAILABLE',
+                    message: 'Provider inventory returned degraded evidence.'
+                });
+            }
+            if (!snapshot.authority) {
+                throw new Error('Provider inventory omitted authority evidence.');
+            }
+            const liveWorkers = snapshot.resources
+                .filter((resource) => resource.kind === 'infra/worker')
+                .map(workerFromInventory);
+            const provider = buildWorkersProviderAudit({
+                descriptorId: descriptor.id,
+                adapter: snapshot.provider,
+                account: snapshot.authority.account,
+                declaredWorkers,
+                liveWorkers
+            });
+            provider.credentialPath = credentialPath;
+            return { authority: snapshot.authority, provider };
+        });
+        if (outcome.ok) {
+            const { authority, provider } = outcome.value;
+            section.authority = mergeInfraAuthorityFingerprints([...(section.authority ? [section.authority] : []), authority]);
+            section.providers.push(provider);
+            if (provider.missingLiveWorkers.length > 0) {
+                section.gaps.push(`${provider.adapter}: ${provider.missingLiveWorkers.length} declared worker(s) were not found live in this provider.`);
+            }
+            if (provider.unmanagedLiveWorkers.length > 0) {
+                section.gaps.push(`${provider.adapter}: ${provider.unmanagedLiveWorkers.length} live worker(s) are not declared in deployment configs or infra/worker descriptors.`);
+            }
+            if (provider.liveWorkerCount === 0) {
+                section.gaps.push(`${provider.adapter}: returned zero workers for this account.`);
+            }
+            if (provider.scheduledWorkers.length > 0) {
+                section.gaps.push(`${provider.adapter}: ${provider.scheduledWorkers.length} live worker(s) run scheduled handlers. Confirm their alert coverage with ` +
+                    `the provider's alert capability and that each scheduled worker emits fresh heartbeat evidence.`);
+            }
+        }
+        else {
+            const error = renderAuditProviderFailureText(outcome.cause);
+            const diagnosticOutcome = settleNow(() => implementation?.auditDiagnostic?.(error));
+            if (!diagnosticOutcome.ok)
+                throw diagnosticOutcome.cause;
+            const diagnostic = diagnosticOutcome.value;
+            section.providers.push({
+                descriptorId: descriptor.id,
+                adapter: descriptor.provider ?? descriptor.id,
+                accountId: 'unverified',
+                liveWorkerCount: 0,
+                declaredWorkerCount: declaredWorkers.length,
+                liveWorkers: [],
+                declaredWorkers,
+                missingLiveWorkers: [],
+                unmanagedLiveWorkers: [],
+                scheduledWorkers: [],
+                credentialPath,
+                error,
+                diagnostic: diagnostic
+                    ? `credential-path=${credentialPath}; ${diagnostic}`
+                    : undefined
             });
+            section.gaps.push(`${descriptor.provider ?? descriptor.id}: live worker inventory unavailable.`);
         }
     }
     return section;
 }
+export async function collectInfraAuditReport(runtime, include, now = new Date(), options = {}) {
+    const environment = options.environment ?? 'local';
+    assertAuditEnvironment(environment);
+    const report = {
+        timestamp: now.toISOString(),
+        requestedProvider: options.provider,
+        environment,
+        notes: []
+    };
+    if (include.includes('alerts'))
+        report.alerts = await gatherAlerts(runtime, options);
+    if (include.includes('logs'))
+        report.logs = await gatherLogs(runtime, options);
+    if (include.includes('observability'))
+        report.observability = await gatherObservability(runtime, options);
+    if (include.includes('workers'))
+        report.workers = await gatherWorkers(runtime, options);
+    const authorities = [
+        ...(report.alerts?.providers.flatMap((provider) => provider.authority ? [provider.authority] : []) ?? []),
+        ...(report.observability?.providers.flatMap((provider) => provider.authority ? [provider.authority] : []) ?? []),
+        ...(report.workers?.authority ? [report.workers.authority] : [])
+    ];
+    report.authority = mergeInfraAuthorityFingerprints(authorities);
+    const matchedProviders = (report.alerts?.providers.length ?? 0) +
+        (report.logs?.providers.length ?? 0) +
+        (report.observability?.providers.length ?? 0) +
+        (report.workers?.providers.length ?? 0);
+    if (options.provider && matchedProviders === 0) {
+        report.notes.push(`No audit implementations matched provider "${options.provider}".`);
+    }
+    return report;
+}
+export function renderAuditAuthorityText(report) {
+    return report.authority
+        ? `Authority: ${formatInfraAuthorityFingerprint(report.authority)}`
+        : undefined;
+}
 export default {
-    async execute(_args, opts) {
-        const runtime = await getVibesRuntime();
-        const ui = (await runtime.context('cli/ui'));
+    async execute(_args, opts, context) {
+        const { runtime } = context;
+        const ui = await runtime.context('cli/ui');
         const include = (readString(opts.include) ?? 'alerts,logs,observability')
             .split(',')
             .map((s) => s.trim());
         const output = readString(opts.output) ?? 'text';
-        const report = { timestamp: new Date().toISOString(), notes: [] };
-        if (include.includes('alerts'))
-            report.alerts = await gatherAlerts(runtime);
-        if (include.includes('logs'))
-            report.logs = await gatherLogs(runtime);
-        if (include.includes('observability'))
-            report.observability = await gatherObservability(runtime);
-        if (include.includes('rum')) {
-            report.notes.push('infra/rum kind is not implemented yet (Phase 3 of design doc).');
-        }
-        if (include.includes('workers')) {
-            report.notes.push('Workers fleet audit not implemented yet — use `vibes infra deploy list` for the deployed-app inventory and CF dashboard for live request counts.');
-        }
+        const provider = readString(opts.provider);
+        const environment = readString(opts.environment) ?? 'local';
+        const report = await collectInfraAuditReport(runtime, include, new Date(), {
+            provider,
+            environment
+        });
         if (output === 'json') {
             ui.json(report);
             return;
         }
-        ui.info(`=== Infra audit (${report.timestamp}) ===\n`);
+        ui.info(`=== Infra audit (${report.timestamp}) ===`);
+        ui.info(`Provider: ${report.requestedProvider ?? 'all'}`);
+        ui.info(`Environment: ${report.environment}`);
+        const authorityText = renderAuditAuthorityText(report);
+        if (authorityText)
+            ui.info(authorityText);
+        ui.info('');
         if (report.alerts) {
             ui.info('## Alerts');
             for (const p of report.alerts.providers) {
@@ -159,20 +597,29 @@ export default {
                     ui.error(`  ${p.error}`);
                     continue;
                 }
-                if (p.policies.length === 0) {
-                    ui.warn('  (no policies — billing / usage / error-rate alerts are off)');
-                    continue;
+                if (p.liveError) {
+                    ui.warn(`  live policy listing unavailable: ${p.liveError}`);
+                }
+                if (p.policies.length === 0 && !p.liveError) {
+                    ui.warn(`  no live policies (declared=${p.declaredCount})`);
                 }
                 for (const policy of p.policies) {
                     const mech = policy.mechanisms.map((m) => `${m.kind}:${m.target}`).join(', ');
                     ui.info(`  ${policy.enabled ? '✓' : '✗'} ${policy.type.padEnd(12)} ${policy.name.padEnd(40)} threshold=${policy.threshold} → ${mech}`);
                 }
+                for (const drift of p.driftNotes)
+                    ui.warn(`  drift: ${drift}`);
             }
             if (report.alerts.gaps.length > 0) {
                 ui.info('\nGaps:');
                 for (const gap of report.alerts.gaps)
                     ui.warn(`  • ${gap}`);
             }
+            if (report.alerts.notes.length > 0) {
+                ui.info('Notes:');
+                for (const note of report.alerts.notes)
+                    ui.info(`  ${note}`);
+            }
         }
         if (report.logs) {
             ui.info('\n## Logs');
@@ -183,8 +630,8 @@ export default {
                     continue;
                 }
                 ui.info(`  sources=${p.sources.length} alerts=${p.alertsConfigured}`);
-                if (p.retention) {
-                    ui.info(`  retention: hot=${p.retention.hotDays}d cold=${p.retention.coldDays}d`);
+                if (p.logRetention) {
+                    ui.info(`  retention: hot=${p.logRetention.hotDays}d cold=${p.logRetention.coldDays}d`);
                 }
             }
         }
@@ -195,12 +642,16 @@ export default {
                 ui.info(`\n[${p.adapter}] (${p.descriptorId})`);
                 if (p.error) {
                     ui.error(`  ${p.error}`);
-                    continue;
+                    for (const failure of p.failedWorkers) {
+                        ui.warn(`  ${failure.workerName}: ${failure.code} — ${failure.message}`);
+                    }
+                    if (p.workerCount === 0)
+                        continue;
                 }
                 ui.info(`  workers=${p.workerCount}  sampling min=${fmt(p.minSampling)} avg=${fmt(p.avgSampling)} max=${fmt(p.maxSampling)}`);
-                if (p.overSampledWorkers.length > 0) {
-                    ui.warn(`  ${p.overSampledWorkers.length} worker(s) at 100% sampling — tune with ` +
-                        '`vibes infra observability set --sampling 0.1 --filter "vibes-*"`');
+                if (p.blindSpotWorkers.length > 0) {
+                    ui.warn(`  ${p.blindSpotWorkers.length} worker(s) miss invocations; to capture fully, ` +
+                        OBSERVABILITY_BLIND_SPOT_REMEDY);
                 }
             }
             if (report.observability.gaps.length > 0) {
@@ -209,6 +660,36 @@ export default {
                     ui.warn(`  • ${gap}`);
             }
         }
+        if (report.workers) {
+            ui.info('\n## Workers');
+            for (const p of report.workers.providers) {
+                ui.info(`\n[${p.adapter}] (${p.descriptorId})`);
+                if (p.error) {
+                    ui.error(`  ${p.error}`);
+                    if (p.diagnostic)
+                        ui.warn(`  ${p.diagnostic}`);
+                    continue;
+                }
+                ui.info(`  account=${p.accountId} credentials=${p.credentialPath ?? 'unavailable'} live=${p.liveWorkerCount} declared=${p.declaredWorkerCount} unmanaged=${p.unmanagedLiveWorkers.length} missing=${p.missingLiveWorkers.length}`);
+                for (const worker of p.liveWorkers) {
+                    const marker = worker.declared ? '✓' : '!';
+                    const modified = worker.lastDeployed ? ` modified=${worker.lastDeployed}` : '';
+                    const usage = worker.usageModel ? ` usage=${worker.usageModel}` : '';
+                    ui.info(`  ${marker} ${worker.workerName}${usage}${modified}`);
+                }
+                if (p.missingLiveWorkers.length > 0) {
+                    ui.warn(`  missing live: ${p.missingLiveWorkers.join(', ')}`);
+                }
+                if (p.unmanagedLiveWorkers.length > 0) {
+                    ui.warn(`  unmanaged live: ${p.unmanagedLiveWorkers.join(', ')}`);
+                }
+            }
+            if (report.workers.gaps.length > 0) {
+                ui.info('\nGaps:');
+                for (const gap of report.workers.gaps)
+                    ui.warn(`  • ${gap}`);
+            }
+        }
         if (report.notes.length > 0) {
             ui.info('\n## Notes');
             for (const note of report.notes)