@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.4

package/dist/cli/logs/infra-logs.cli-command.impl.js

@@ -1,7 +1,28 @@
-import { getVibesRuntime } from '@vibesdotdev/runtime';
-import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { getRuntimePath } from '@vibesdotdev/paths';
+import { CapabilityError, requireRuntimeCwd, settle, settleNow, valueFreeFailure } from '@vibesdotdev/kernel';
+import { JsonObjectSchema, JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+import { hostArgv, requestCLIExit } from '@vibesdotdev/cli/providers';
+import { InfraLogsDescriptorSchema } from '@vibesdotdev/infra-core';
+import { z } from 'zod/v4';
 import { discoverDeployments } from "../shared/discover-deployments.js";
 import { streamWorkerTail } from "./stream-worker-tail.js";
+import { readCredentialSource } from "../shared/credential-source.js";
+import { loadDeploymentConfig } from "../../config-loader.js";
+const FiniteNumberSchema = z.number().finite();
+const TimestampSchema = FiniteNumberSchema.gt(1_000_000_000_000);
+const JsonListSchema = z.array(JsonValueSchema);
+const StatusSchema = z.enum(['ok', 'error', 'canceled']);
+const AssetOnlyWorkerPattern = /asset-only|no Worker script/i;
+/** The deployment provider whose deployed units a logs source observes, as its descriptor declares it. */
+const DeploymentProviderConfigSchema = z.object({ deploymentProvider: z.string().min(1) }).loose();
+const LogsReadySchema = z.object({
+    getAnalytics: z.function()
+});
+const AGGREGATE_QUERY_FAILED = 'Analytics query failed.';
+const TAIL_ATTACH_FAILED = 'Tail session could not be started.';
+const TAIL_STREAM_FAILED = 'Tail streaming failed.';
+const LOGS_RESOLVE_FAILED = 'Log implementation could not be resolved.';
+const LOGS_CREDENTIAL_CHOICE_UNSUPPORTED = 'This log source reads only its default credentials; it takes no --environment or --use-ambient-credentials.';
 /** Parse a duration suffix like "30s", "2m", "1h" → milliseconds. Falls back to 30s. */
 function parseDurationMs(input) {
     if (!input)
@@ -22,26 +43,663 @@ function parseDurationMs(input) {
     return 30_000;
 }
 function readString(v) {
-    if (typeof v === 'string')
-        return v.length > 0 ? v : undefined;
-    if (typeof v === 'number' && Number.isFinite(v))
-        return String(v);
+    const text = z.string().safeParse(v);
+    if (text.success)
+        return text.data.length > 0 ? text.data : undefined;
+    const numeric = FiniteNumberSchema.safeParse(v);
+    if (numeric.success)
+        return String(numeric.data);
     return undefined;
 }
 function readBoolean(v) {
-    return v === true || v === 'true';
+    if (v === true)
+        return true;
+    const text = z.string().safeParse(v);
+    return text.success && text.data === 'true';
+}
+function readStringArray(v) {
+    const list = JsonListSchema.safeParse(v);
+    if (list.success) {
+        return list.data.flatMap((entry) => {
+            const text = readString(entry);
+            return text === undefined ? [] : [text];
+        });
+    }
+    const single = readString(v);
+    return single ? [single] : [];
+}
+/**
+ * Analytics aggregates currently expose fleet totals only. Fail closed when a
+ * caller supplies event-level filters instead of returning an authoritative-
+ * looking but unfiltered number.
+ */
+export function unsupportedAggregateFilters(input) {
+    const flags = [];
+    if (input.search)
+        flags.push('--search');
+    if (input.path)
+        flags.push('--path');
+    if (input.method)
+        flags.push('--method');
+    if (input.statusCode)
+        flags.push('--status-code');
+    if (input.level)
+        flags.push('--level');
+    if (input.requestId)
+        flags.push('--request-id');
+    if (input.status)
+        flags.push('--status');
+    if (input.fields && input.fields.length > 0)
+        flags.push('--field');
+    if (input.from)
+        flags.push('--from');
+    if (input.to)
+        flags.push('--to');
+    if (input.regex)
+        flags.push('--regex');
+    if (input.matchCase)
+        flags.push('--match-case');
+    if (input.explicitLimit)
+        flags.push('--limit');
+    if (input.explicitTimeStart)
+        flags.push('--time-start');
+    return flags;
+}
+/**
+ * The source under one command's credential choice (`--use-ambient-credentials`,
+ * `--environment`) through the kind's `create`; the source refuses credentials
+ * it cannot resolve. A source without `create` cannot honour the choice, so it
+ * answers null rather than querying with credentials the operator did not pick.
+ */
+export async function withLogsSourceOptions(impl, options) {
+    return impl.create ? impl.create(options) : null;
+}
+function hasExplicitOption(argv, option) {
+    return argv.some((arg) => arg === option || arg.startsWith(`${option}=`));
+}
+function parseRelativeTimeMs(input) {
+    const m = /^(\d+)\s*(ms|s|m|h|d)$/i.exec(input.trim());
+    if (!m)
+        return null;
+    const n = Number.parseInt(m[1], 10);
+    const unit = m[2].toLowerCase();
+    if (unit === 'ms')
+        return n;
+    if (unit === 's')
+        return n * 1000;
+    if (unit === 'm')
+        return n * 60_000;
+    if (unit === 'h')
+        return n * 3_600_000;
+    if (unit === 'd')
+        return n * 86_400_000;
+    return null;
+}
+export function parseTelemetryTime(input, fallback, epochMs) {
+    if (!input)
+        return fallback;
+    const relative = parseRelativeTimeMs(input);
+    if (relative !== null)
+        return epochMs - relative;
+    const parsed = Date.parse(input);
+    if (Number.isFinite(parsed))
+        return parsed;
+    const numeric = Number(input);
+    if (Number.isFinite(numeric))
+        return numeric;
+    return fallback;
+}
+export function requireLogsWallClockMs(runtime) {
+    const readWallClock = runtime.localEnvironment.getWallClockMs;
+    if (readWallClock === undefined) {
+        throw new CapabilityError('The runtime wall clock is unavailable.', 'UNAVAILABLE', {
+            reason: 'runtime-clock-unavailable'
+        });
+    }
+    const epoch = readWallClock();
+    if (!Number.isFinite(epoch)) {
+        throw new CapabilityError('The runtime wall clock is not finite.', 'UNAVAILABLE', {
+            reason: 'runtime-clock-unavailable'
+        });
+    }
+    return epoch;
+}
+export function resolveHistoricalWindow(input, epochMs) {
+    const to = parseTelemetryTime(input.to, epochMs, epochMs);
+    const from = parseTelemetryTime(input.from ?? input.timeStart, to - 86_400_000, to);
+    return { from, to };
+}
+function parseFieldValue(raw) {
+    if (raw === 'true')
+        return { value: true, type: 'boolean' };
+    if (raw === 'false')
+        return { value: false, type: 'boolean' };
+    const numeric = Number(raw);
+    if (raw.trim() !== '' && Number.isFinite(numeric))
+        return { value: numeric, type: 'number' };
+    return { value: raw, type: 'string' };
+}
+function invalidFieldMessage(input) {
+    return `Invalid --field filter '${input}'. Use key=value, key~value, key!=value, key>number, key<number, or key?`;
+}
+function parseAdvancedFilter(input) {
+    if (input.endsWith('?')) {
+        return { ok: true, filter: { key: input.slice(0, -1), operation: 'exists' } };
+    }
+    const operators = [
+        { token: '!=', operation: 'neq' },
+        { token: '>=', operation: 'gte' },
+        { token: '<=', operation: 'lte' },
+        { token: '~', operation: 'includes' },
+        { token: '>', operation: 'gt' },
+        { token: '<', operation: 'lt' },
+        { token: '=', operation: 'eq' }
+    ];
+    for (const candidate of operators) {
+        const idx = input.indexOf(candidate.token);
+        if (idx <= 0)
+            continue;
+        const key = input.slice(0, idx).trim();
+        const raw = input.slice(idx + candidate.token.length).trim();
+        const parsed = parseFieldValue(raw);
+        return {
+            ok: true,
+            filter: { key, operation: candidate.operation, type: parsed.type, value: parsed.value }
+        };
+    }
+    return { ok: false, message: invalidFieldMessage(input) };
+}
+function asJsonObject(value) {
+    const parsed = JsonObjectSchema.safeParse(value);
+    return parsed.success ? parsed.data : undefined;
+}
+function asJsonList(value) {
+    const parsed = JsonListSchema.safeParse(value);
+    return parsed.success ? parsed.data : undefined;
+}
+function groupedInvocations(record) {
+    const grouped = [];
+    for (const [requestId, events] of Object.entries(record)) {
+        if (requestId === 'count' || requestId === 'fields' || requestId === 'series')
+            continue;
+        grouped.push({ requestId, events });
+    }
+    return grouped;
+}
+function extractTelemetryRows(result, view) {
+    const directList = asJsonList(result[view]);
+    if (directList)
+        return directList;
+    const directRecord = asJsonObject(result[view]);
+    if (directRecord) {
+        const nestedView = asJsonList(directRecord[view]);
+        if (nestedView)
+            return nestedView;
+        if (view === 'events') {
+            const events = asJsonList(directRecord.events);
+            if (events)
+                return events;
+        }
+        if (view === 'invocations') {
+            const invocations = asJsonList(directRecord.invocations);
+            if (invocations)
+                return invocations;
+            const grouped = groupedInvocations(directRecord);
+            if (grouped.length > 0)
+                return grouped;
+        }
+    }
+    const eventsRecord = asJsonObject(result.events);
+    if (eventsRecord) {
+        const nestedEvents = asJsonList(eventsRecord.events);
+        if (nestedEvents)
+            return nestedEvents;
+    }
+    const events = asJsonList(result.events);
+    if (events)
+        return events;
+    const invocationsRecord = asJsonObject(result.invocations);
+    if (invocationsRecord) {
+        const nestedInvocations = asJsonList(invocationsRecord.invocations);
+        if (nestedInvocations)
+            return nestedInvocations;
+        const grouped = groupedInvocations(invocationsRecord);
+        if (grouped.length > 0)
+            return grouped;
+    }
+    const invocations = asJsonList(result.invocations);
+    if (invocations)
+        return invocations;
+    const calculations = asJsonList(result.calculations);
+    if (calculations)
+        return calculations;
+    const rows = asJsonList(result.rows);
+    if (rows)
+        return rows;
+    const nested = asJsonObject(result.result);
+    if (nested) {
+        const nestedRows = extractTelemetryRows(nested, view);
+        if (nestedRows.length > 0)
+            return nestedRows;
+    }
+    return [];
+}
+function admitTelemetryField(target, key, value) {
+    if (value === undefined)
+        return;
+    if (Array.isArray(value)) {
+        const admitted = [];
+        for (const entry of value) {
+            const parsed = JsonValueSchema.safeParse(entry);
+            if (parsed.success)
+                admitted.push(parsed.data);
+        }
+        if (value.length === 0 || admitted.length > 0)
+            target[key] = admitted;
+        return;
+    }
+    const direct = JsonValueSchema.safeParse(value);
+    if (direct.success) {
+        target[key] = direct.data;
+        return;
+    }
+    const written = settleNow(() => JSON.stringify(value));
+    if (!written.ok)
+        return;
+    const parsed = settleNow(() => JSON.parse(written.value));
+    if (!parsed.ok)
+        return;
+    const json = JsonValueSchema.safeParse(parsed.value);
+    if (json.success)
+        target[key] = json.data;
+}
+function telemetryObject(result) {
+    const target = {};
+    admitTelemetryField(target, 'events', result.events);
+    admitTelemetryField(target, 'invocations', result.invocations);
+    admitTelemetryField(target, 'calculations', result.calculations);
+    admitTelemetryField(target, 'rows', result.rows);
+    admitTelemetryField(target, 'result', result.result);
+    if (result.queryId !== undefined)
+        target.queryId = result.queryId;
+    if (result.count !== undefined)
+        target.count = result.count;
+    if (result.matchedBeforeLimit !== undefined)
+        target.matchedBeforeLimit = result.matchedBeforeLimit;
+    return target;
+}
+function readPathSegment(current, segment) {
+    const list = JsonListSchema.safeParse(current);
+    if (list.success) {
+        if (!/^\d+$/.test(segment))
+            return undefined;
+        const index = Number.parseInt(segment, 10);
+        return list.data[index];
+    }
+    const object = JsonObjectSchema.safeParse(current);
+    if (!object.success)
+        return undefined;
+    return object.data[segment];
+}
+function getRecordPath(record, path) {
+    const segments = path.split('.');
+    let current = record;
+    for (const segment of segments) {
+        current = readPathSegment(current, segment);
+        if (current === undefined)
+            return undefined;
+    }
+    if (current === undefined || current === null)
+        return undefined;
+    return current;
+}
+function pickRecord(record, paths) {
+    for (const path of paths) {
+        const value = getRecordPath(record, path);
+        if (value !== undefined && value !== null && value !== '')
+            return value;
+    }
+    return null;
+}
+function jsonText(value) {
+    const written = settleNow(() => JSON.stringify(value));
+    return written.ok && written.value !== undefined ? written.value : '';
+}
+function stringifyCell(value, maxLength = 140) {
+    if (value === null || value === undefined)
+        return '';
+    const timestamp = TimestampSchema.safeParse(value);
+    let text;
+    if (timestamp.success) {
+        text = new Date(timestamp.data).toISOString();
+    }
+    else {
+        const asText = z.string().safeParse(value);
+        text = asText.success ? asText.data : jsonText(value);
+    }
+    return text.length > maxLength ? `${text.slice(0, maxLength - 1)}…` : text;
+}
+const SENSITIVE_FIELD_NAMES = new Set([
+    'accesscode',
+    'accesstoken',
+    'apikey',
+    'authorization',
+    'authorizationcode',
+    'bearer',
+    'clientsecret',
+    'code',
+    'idtoken',
+    'oauthcode',
+    'refreshtoken',
+    'secret',
+    'signature',
+    'state',
+    'token'
+]);
+const SENSITIVE_QUERY_PARAM_NAMES = new Set([
+    'access_token',
+    'api_key',
+    'authorization',
+    'client_secret',
+    'code',
+    'id_token',
+    'key',
+    'oauth_token',
+    'refresh_token',
+    'signature',
+    'state',
+    'token'
+]);
+function normalizeSecretName(name) {
+    return name.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+function shouldRedactFieldName(name) {
+    return SENSITIVE_FIELD_NAMES.has(normalizeSecretName(name));
+}
+function shouldRedactQueryParamName(name) {
+    return SENSITIVE_QUERY_PARAM_NAMES.has(name.toLowerCase());
+}
+function redactUrlLikeText(text) {
+    let redacted = text.replace(/([?&](?:access_token|api_key|authorization|client_secret|code|id_token|key|oauth_token|refresh_token|signature|state|token)=)[^&#\s"']+/gi, '$1[redacted]');
+    const parsed = settleNow(() => new URL(redacted));
+    if (parsed.ok) {
+        let changed = false;
+        for (const key of Array.from(parsed.value.searchParams.keys())) {
+            if (shouldRedactQueryParamName(key)) {
+                parsed.value.searchParams.set(key, '[redacted]');
+                changed = true;
+            }
+        }
+        if (changed)
+            redacted = parsed.value.toString();
+    }
+    return redacted;
+}
+function redactTelemetryValue(value, fieldName, depth = 0) {
+    if (fieldName && shouldRedactFieldName(fieldName))
+        return '[redacted]';
+    if (value === null || value === undefined)
+        return null;
+    const text = z.string().safeParse(value);
+    if (text.success)
+        return redactUrlLikeText(text.data);
+    const list = JsonListSchema.safeParse(value);
+    if (list.success) {
+        if (depth > 12)
+            return '[redacted-depth-limit]';
+        return list.data.map((entry) => redactTelemetryValue(entry, undefined, depth + 1));
+    }
+    const object = JsonObjectSchema.safeParse(value);
+    if (object.success) {
+        if (depth > 12)
+            return '[redacted-depth-limit]';
+        const redacted = {};
+        for (const [key, entry] of Object.entries(object.data)) {
+            redacted[key] = redactTelemetryValue(entry, key, depth + 1);
+        }
+        return redacted;
+    }
+    return value;
+}
+function unwrapTelemetryRecord(record) {
+    const object = JsonObjectSchema.safeParse(record);
+    if (!object.success)
+        return record;
+    const events = JsonListSchema.safeParse(object.data.events);
+    if (!events.success || events.data.length === 0)
+        return record;
+    const first = events.data[0];
+    return first === undefined ? record : first;
+}
+function telemetrySummaryJson(summary) {
+    return {
+        time: summary.time,
+        service: summary.service,
+        level: summary.level,
+        outcome: summary.outcome,
+        status: summary.status,
+        method: summary.method,
+        url: summary.url,
+        message: summary.message
+    };
+}
+function summarizeTelemetryRecord(record) {
+    const summaryRecord = unwrapTelemetryRecord(record);
+    return {
+        time: stringifyCell(pickRecord(summaryRecord, [
+            '$metadata.timestamp',
+            '$metadata.eventTimestamp',
+            'timestamp',
+            'eventTimestamp',
+            '$metadata.startTime',
+            'startTime'
+        ]), 36),
+        service: stringifyCell(pickRecord(summaryRecord, ['$metadata.service', '$workers.scriptName', 'service', 'scriptName']), 36),
+        level: stringifyCell(pickRecord(summaryRecord, ['$metadata.level', 'level']), 16),
+        outcome: stringifyCell(pickRecord(summaryRecord, ['$workers.outcome', 'outcome']), 24),
+        status: stringifyCell(pickRecord(summaryRecord, [
+            '$metadata.statusCode',
+            '$workers.event.response.status',
+            'event.response.status',
+            'response.status'
+        ]), 8),
+        method: stringifyCell(pickRecord(summaryRecord, [
+            '$metadata.method',
+            '$workers.event.request.method',
+            'event.request.method',
+            'request.method'
+        ]), 8),
+        url: stringifyCell(pickRecord(summaryRecord, [
+            '$metadata.url',
+            '$workers.event.request.url',
+            'event.request.url',
+            'request.url',
+            'url'
+        ]), 120),
+        message: stringifyCell(pickRecord(summaryRecord, [
+            '$metadata.message',
+            'message',
+            'logs.0.message',
+            'exceptions.0.message'
+        ]) ?? pickRecord(record, ['requestId']), 160)
+    };
+}
+export function buildTelemetryJsonPayload(input) {
+    const redactedRows = input.rows.map((row) => redactTelemetryValue(row));
+    const rows = input.compact
+        ? redactedRows.map((row) => telemetrySummaryJson(summarizeTelemetryRecord(row)))
+        : redactedRows;
+    return {
+        source: input.source,
+        worker: input.worker,
+        mode: input.mode,
+        from: new Date(input.from).toISOString(),
+        to: new Date(input.to).toISOString(),
+        count: input.count,
+        resultKeys: input.resultKeys,
+        compact: Boolean(input.compact),
+        rows
+    };
+}
+function scalarText(value) {
+    const text = z.string().safeParse(value);
+    if (text.success)
+        return text.data;
+    const numeric = FiniteNumberSchema.safeParse(value);
+    if (numeric.success)
+        return String(numeric.data);
+    const flag = z.boolean().safeParse(value);
+    if (flag.success)
+        return flag.data ? 'true' : 'false';
+    return undefined;
+}
+function matchesStringValue(value, expected, mode) {
+    const text = scalarText(value);
+    if (text === undefined)
+        return false;
+    return mode === 'eq' ? text === expected : text.includes(expected);
+}
+function matchesNumberValue(value, expected) {
+    const numeric = FiniteNumberSchema.safeParse(value);
+    if (numeric.success)
+        return numeric.data === expected;
+    const text = z.string().safeParse(value);
+    if (text.success)
+        return Number.parseInt(text.data, 10) === expected;
+    return false;
+}
+function isAssetOnlyWorker(failure) {
+    const text = failure instanceof Error ? failure.message : failure.description;
+    return text.includes('100311') || AssetOnlyWorkerPattern.test(text);
+}
+function readyLogsImplementation(impl) {
+    return LogsReadySchema.safeParse(impl).success ? impl : null;
+}
+function tailEntryMessage(entry) {
+    const parts = [];
+    for (const item of entry.message ?? []) {
+        const text = z.string().safeParse(item);
+        if (text.success) {
+            parts.push(text.data);
+            continue;
+        }
+        const json = JsonValueSchema.safeParse(item);
+        if (!json.success)
+            continue;
+        const written = settleNow(() => JSON.stringify(json.data));
+        if (written.ok && written.value !== undefined)
+            parts.push(written.value);
+    }
+    return parts.join(' ');
+}
+function telemetryRecordMatches(record, input) {
+    const summaryRecord = unwrapTelemetryRecord(record);
+    if (input.workerName) {
+        const service = pickRecord(summaryRecord, [
+            '$metadata.service',
+            '$workers.scriptName',
+            '$workers.script_name',
+            'service',
+            'scriptName',
+            'script_name'
+        ]);
+        // A record carrying NO service field at all comes from an adapter that
+        // scopes server-side — the DOKS source selects `namespace/podPrefix`
+        // before it reads a byte. Rejecting those here dropped every row it
+        // returned and reported the empty result as a successful query.
+        // Only reject when a service is present and disagrees.
+        if (service !== null && !matchesStringValue(service, input.workerName, 'eq')) {
+            return false;
+        }
+    }
+    if (input.pathFilter &&
+        !matchesStringValue(pickRecord(summaryRecord, [
+            '$metadata.url',
+            '$workers.event.request.url',
+            'event.request.url',
+            'request.url',
+            'url'
+        ]), input.pathFilter, 'includes')) {
+        return false;
+    }
+    if (input.methodFilter &&
+        !matchesStringValue(pickRecord(summaryRecord, [
+            '$metadata.method',
+            '$workers.event.request.method',
+            'event.request.method',
+            'request.method'
+        ]), input.methodFilter.toUpperCase(), 'eq')) {
+        return false;
+    }
+    if (input.statusCode !== undefined &&
+        !matchesNumberValue(pickRecord(summaryRecord, [
+            '$metadata.statusCode',
+            '$workers.event.response.status',
+            'event.response.status',
+            'response.status'
+        ]), input.statusCode)) {
+        return false;
+    }
+    if (input.levelFilter &&
+        !matchesStringValue(pickRecord(summaryRecord, ['$metadata.level', 'level']), input.levelFilter, 'eq')) {
+        return false;
+    }
+    if (input.requestId &&
+        !matchesStringValue(pickRecord(summaryRecord, [
+            '$metadata.requestId',
+            '$metadata.id',
+            '$workers.requestId',
+            '$workers.event.request.cf.ray',
+            'requestId',
+            'id'
+        ]), input.requestId, 'eq')) {
+        return false;
+    }
+    if (input.status) {
+        const outcome = pickRecord(summaryRecord, ['$workers.outcome', 'outcome']);
+        if (input.status === 'ok')
+            return matchesStringValue(outcome, 'ok', 'eq');
+        if (input.status === 'canceled')
+            return matchesStringValue(outcome, 'canceled', 'eq');
+        if (input.status === 'error') {
+            // Providers without a Workers outcome vocabulary say `error` plainly.
+            if (matchesStringValue(outcome, 'error', 'eq'))
+                return true;
+            if (matchesStringValue(outcome, 'exception', 'eq'))
+                return true;
+            if (matchesStringValue(outcome, 'exceededCpu', 'eq'))
+                return true;
+            if (matchesStringValue(outcome, 'exceededMemory', 'eq'))
+                return true;
+            if (pickRecord(summaryRecord, ['$metadata.error', 'error', 'exceptions.0.message']) !== null) {
+                return true;
+            }
+            return false;
+        }
+    }
+    return true;
 }
 function descriptorHasWorkerSource(descriptor, workerName) {
     return descriptor.sources?.some((s) => s.type === 'worker' && (s.name === workerName || descriptor.id === workerName)) ?? false;
 }
+export function resolveLogsTarget(descriptor, sourceName, workerName) {
+    if (workerName)
+        return { workerName, isExplicitWorker: true };
+    const sourceWorker = descriptor.sources?.find((s) => s.type === 'worker' && s.name === sourceName);
+    if (sourceWorker)
+        return { workerName: sourceWorker.name, isExplicitWorker: true };
+    const fallbackWorker = descriptor.sources?.find((s) => s.type === 'worker');
+    return { workerName: fallbackWorker?.name ?? sourceName, isExplicitWorker: false };
+}
 /**
- * Map an `infra/logs` descriptor adapter name to the deployment provider that
- * emits workers for it. Extend as new providers register infra/logs adapters.
+ * The deployment provider whose deployed units an `infra/logs` source
+ * observes: its descriptor's `adapterConfig.deploymentProvider`. A source
+ * that names none (a DOKS source's workloads are cluster state read at query
+ * time, not workspace deployments) folds in no discovered deployment.
  */
-function adapterToProvider(adapter) {
-    if (adapter === 'cloudflare-logs')
-        return 'cloudflare-workers';
-    return undefined;
+function observedDeploymentProvider(descriptor) {
+    const parsed = DeploymentProviderConfigSchema.safeParse(descriptor.adapterConfig);
+    return parsed.success ? parsed.data.deploymentProvider : undefined;
 }
 /**
  * Build the `sources` list a logs descriptor should expose at display time
@@ -50,11 +708,8 @@ function adapterToProvider(adapter) {
  * de-duped by name.
  */
 function mergeDescriptorSources(descriptor, discovered) {
-    const provider = adapterToProvider(descriptor.adapter);
-    const fromWorkspace = discovered
-        .filter((d) => !provider || d.provider === provider)
-        .filter((d) => Boolean(d.workerName))
-        .map((d) => ({ type: 'worker', name: d.workerName }));
+    const provider = observedDeploymentProvider(descriptor);
+    const fromWorkspace = provider === undefined ? [] : discovered.flatMap((d) => d.provider === provider && d.unitName ? [{ type: 'worker', name: d.unitName }] : []);
     const seen = new Set();
     const merged = [];
     for (const src of [...(descriptor.sources ?? []), ...fromWorkspace]) {
@@ -67,23 +722,111 @@ function mergeDescriptorSources(descriptor, discovered) {
     return merged;
 }
 export default {
-    async execute(args, opts) {
-        const runtime = await getVibesRuntime();
-        const ui = (await runtime.context('cli/ui'));
+    async execute(args, opts, context) {
+        const { runtime } = context;
+        const ui = await runtime.context('cli/ui');
         const sourceName = readString(args.source);
         const workerName = readString(args.worker);
         const output = readString(opts.output) ?? 'table';
         const showAnalytics = readBoolean(opts.analytics);
         const timeStart = readString(opts.timeStart) ?? '24h';
         const doTail = readBoolean(opts.tail);
-        const status = readString(opts.status);
+        const doAggregate = readBoolean(opts.aggregate);
+        const queryEvents = readBoolean(opts.events);
+        const queryInvocations = readBoolean(opts.invocations);
+        const statusText = readString(opts.status);
+        const parsedStatus = statusText === undefined ? undefined : StatusSchema.safeParse(statusText);
+        if (parsedStatus && !parsedStatus.success) {
+            ui.error(`Invalid --status '${statusText}'. Expected ok, error, or canceled.`);
+            requestCLIExit(1);
+            return;
+        }
+        const status = parsedStatus?.success ? parsedStatus.data : undefined;
         const limitRaw = readString(opts.limit) ?? '100';
         const limit = Number.parseInt(limitRaw, 10);
         const windowRaw = readString(opts.window);
         const windowMs = parseDurationMs(windowRaw);
-        // Get all infra/logs descriptors
-        const logsAssets = runtime.assets('infra/logs');
-        const rawDescriptors = logsAssets.descriptors();
+        const fromRaw = readString(opts.from);
+        const toRaw = readString(opts.to);
+        const search = readString(opts.search);
+        const pathFilter = readString(opts.path);
+        const methodFilter = readString(opts.method);
+        const statusCodeRaw = readString(opts.statusCode ?? opts['status-code']);
+        const levelFilter = readString(opts.level);
+        const requestId = readString(opts.requestId ?? opts['request-id']);
+        const compact = readBoolean(opts.compact);
+        const regex = readBoolean(opts.regex);
+        const matchCase = readBoolean(opts.matchCase ?? opts['match-case']);
+        const advancedFields = readStringArray(opts.field);
+        const isExplicitQuery = hostArgv(runtime).some(arg => arg.includes('--status') ||
+            arg.includes('--limit') ||
+            arg.includes('--window') ||
+            arg.includes('--tail') ||
+            arg.includes('--events') ||
+            arg.includes('--invocations') ||
+            arg.includes('--analytics') ||
+            arg.includes('--output') ||
+            arg.includes('-o'));
+        if (doAggregate) {
+            const unsupported = unsupportedAggregateFilters({
+                search,
+                path: pathFilter,
+                method: methodFilter,
+                statusCode: statusCodeRaw,
+                level: levelFilter,
+                requestId,
+                status,
+                fields: advancedFields,
+                from: fromRaw,
+                to: toRaw,
+                regex,
+                matchCase,
+                explicitLimit: hasExplicitOption(hostArgv(runtime), '--limit'),
+                explicitTimeStart: hasExplicitOption(hostArgv(runtime), '--time-start')
+            });
+            if (unsupported.length > 0) {
+                ui.error(`--aggregate does not support event filters (${unsupported.join(', ')}). ` +
+                    'Use --events or --invocations for filtered telemetry; aggregate filters are never silently ignored.');
+                requestCLIExit(1);
+                return;
+            }
+        }
+        // Each log source resolves its own credentials through the runtime's
+        // secrets stores, for `--environment` when given; `--use-ambient-credentials`
+        // hands the source the operator's opt-in instead (it refuses incomplete
+        // shell credentials and never opens a store). `--cwd` selects the app whose deployment config
+        // wires the secrets backend; its configs render under an empty
+        // projection, so ambient state never shapes them. Best-effort: an app
+        // without a loadable deployment config still queries.
+        const credCwd = readString(opts.cwd);
+        const credentialSource = readCredentialSource(opts);
+        const useAmbient = credentialSource === 'ambient';
+        const credentialEnvironment = readString(opts.environment);
+        // A relative `--cwd` resolves against the invocation cwd; a host without
+        // one fails here, typed, before any best-effort load.
+        const credAppDir = (await getRuntimePath(runtime)).resolve(requireRuntimeCwd(runtime), credCwd ?? '.');
+        const projectionEnvironment = {};
+        const loadedConfig = await settle(() => loadDeploymentConfig(credAppDir, { runtime, projectionEnvironment }));
+        if (!loadedConfig.ok) {
+            ui.info(useAmbient
+                ? 'Deployment config not loaded; using ambient credentials only (--use-ambient-credentials). The secrets store will not be consulted.'
+                : 'Deployment config not loaded; continuing with secrets-store credentials.');
+        }
+        // Get all infra/logs descriptors. One unreadable descriptor is skipped;
+        // the others still list.
+        const rawDescriptors = [];
+        let refusedDescriptors = 0;
+        for (const candidate of runtime.assets('infra/logs').descriptors()) {
+            const parsed = InfraLogsDescriptorSchema.safeParse(candidate);
+            if (!parsed.success) {
+                refusedDescriptors += 1;
+                continue;
+            }
+            rawDescriptors.push(parsed.data);
+        }
+        if (refusedDescriptors > 0) {
+            ui.info(`${refusedDescriptors} infra/logs descriptor(s) were refused because they did not match the logs schema.`);
+        }
         if (rawDescriptors.length === 0) {
             if (output === 'json')
                 ui.json([]);
@@ -95,7 +838,11 @@ export default {
         // workspace's deployment.config.ts files. Framework-registered
         // descriptors carry no app-name list — that inventory lives in
         // per-app deployment configs and is resolved here at call time.
-        const discovered = await discoverDeployments();
+        const discovered = await discoverDeployments({
+            runtime,
+            projectionEnvironment,
+            root: await runtime.context('runtime/workspace-path')
+        });
         const descriptors = rawDescriptors.map((d) => ({
             ...d,
             sources: mergeDescriptorSources(d, discovered)
@@ -103,27 +850,35 @@ export default {
         // Resolve implementations for each descriptor
         const implementations = [];
         for (const descriptor of descriptors) {
-            try {
-                const resolved = await runtime.query('infra/logs').withId(descriptor.id).resolve();
-                const resolvedObj = resolved;
-                // The resolved object may have implementation directly or nested
-                const impl = resolvedObj.implementation ??
-                    resolvedObj;
-                implementations.push({
-                    id: descriptor.id,
-                    descriptor,
-                    implementation: impl && typeof impl === 'object' && 'getAnalytics' in impl ? impl : null,
-                    error: impl && typeof impl === 'object' && 'getAnalytics' in impl ? undefined : 'Implementation not available'
-                });
-            }
-            catch (err) {
+            const resolved = await settle(() => runtime.query('infra/logs').withId(descriptor.id).resolve());
+            if (!resolved.ok) {
                 implementations.push({
                     id: descriptor.id,
                     descriptor,
                     implementation: null,
-                    error: err.message
+                    error: LOGS_RESOLVE_FAILED
                 });
+                continue;
             }
+            let impl = readyLogsImplementation(resolved.value);
+            // `--use-ambient-credentials` or `--environment` re-creates the source under that choice.
+            if (impl && (useAmbient || credentialEnvironment)) {
+                const options = credentialEnvironment
+                    ? { credentialSource, environment: credentialEnvironment, log: ui }
+                    : { credentialSource, log: ui };
+                const chosen = await withLogsSourceOptions(impl, options);
+                if (!chosen) {
+                    implementations.push({ id: descriptor.id, descriptor, implementation: null, error: LOGS_CREDENTIAL_CHOICE_UNSUPPORTED });
+                    continue;
+                }
+                impl = readyLogsImplementation(chosen);
+            }
+            implementations.push({
+                id: descriptor.id,
+                descriptor,
+                implementation: impl,
+                error: impl ? undefined : 'Implementation not available'
+            });
         }
         // If a specific source is requested, find it
         if (sourceName) {
@@ -132,16 +887,16 @@ export default {
             if (!implEntry) {
                 ui.error(`Log source '${sourceName}' not found. Available sources: ${implementations.map((impl) => impl.id).join(', ')}`);
                 requestCLIExit(1);
+                return;
             }
             const { implementation: logsImpl, descriptor, error } = implEntry;
             if (!logsImpl) {
-                ui.error(`Cannot access log source '${sourceName}': ${error ?? 'Implementation not available'}`);
-                ui.info('Make sure credentials are configured in your secrets store or environment.');
-                return;
+                throw new CapabilityError(`Cannot access log source '${sourceName}': ${error ?? 'Implementation not available'}`, 'UNAVAILABLE', { recoveryHint: 'Make sure credentials are configured in your secrets store or environment.' });
             }
-            let targetWorker;
-            if (workerName) {
-                const specific = descriptor.sources?.find(s => s.type === 'worker' && s.name === workerName);
+            const target = resolveLogsTarget(descriptor, sourceName, workerName);
+            const targetWorker = target.workerName ?? sourceName;
+            if (target.isExplicitWorker) {
+                const specific = descriptor.sources?.find((s) => s.type === 'worker' && s.name === targetWorker);
                 if (!specific) {
                     // Worker not in the discovered inventory — pass it through to
                     // the provider anyway so the user can target ad-hoc names
@@ -149,117 +904,409 @@ export default {
                     // preview environments, etc.). The provider will return a
                     // clean error if the worker truly doesn't exist.
                     const known = descriptor.sources?.map((s) => s.name).join(', ') || '(none discovered)';
-                    ui.info(`Worker '${workerName}' is not in the discovered inventory (known: ${known}). Passing through to the provider.`);
+                    ui.info(`Worker '${targetWorker}' is not in the discovered inventory (known: ${known}). Passing through to the provider.`);
                 }
-                targetWorker = workerName;
             }
-            else {
-                const workerSource = descriptor.sources?.find(s => s.type === 'worker');
-                targetWorker = workerSource?.name ?? sourceName;
+            // "Show me logs/errors" defaults to a HISTORICAL Workers Observability
+            // query (lookback, default 24h). The realtime 30s live-Tail capture is
+            // now opt-in behind --window: it only sees events DURING the window, so
+            // for any past incident it silently reads as "no logs" — which is what
+            // made `vibes infra logs <worker> --status error` look like history was
+            // unavailable. --events/--invocations force the historical path; --tail
+            // streams live; --window <dur> selects the realtime capture; --aggregate
+            // /--analytics return counts.
+            const explicitHistorical = queryEvents || queryInvocations;
+            // `--window` carries a default of "30s" in the descriptor, so `windowRaw`
+            // is always truthy — detect an EXPLICIT --window from argv to know the
+            // user actually opted into the realtime capture.
+            const explicitWindow = hostArgv(runtime).some((arg) => arg.includes('--window'));
+            const defaultHistorical = !explicitHistorical &&
+                !doTail &&
+                !doAggregate &&
+                !showAnalytics &&
+                !explicitWindow &&
+                Boolean(logsImpl.queryLogs) &&
+                (status !== undefined || target.isExplicitWorker || isExplicitQuery);
+            if (explicitHistorical || defaultHistorical) {
+                if (!logsImpl.queryLogs) {
+                    ui.error(`Log source '${descriptor.id}' does not support historical telemetry queries.`);
+                    requestCLIExit(1);
+                    return;
+                }
+                const view = queryInvocations ? 'invocations' : 'events';
+                const now = requireLogsWallClockMs(runtime);
+                const { from, to } = resolveHistoricalWindow({ from: fromRaw, to: toRaw, timeStart }, now);
+                const filters = [];
+                const localStatusCode = statusCodeRaw ? Number.parseInt(statusCodeRaw, 10) : undefined;
+                if (statusCodeRaw) {
+                    const code = Number.parseInt(statusCodeRaw, 10);
+                    if (!Number.isFinite(code)) {
+                        ui.error(`Invalid --status-code '${statusCodeRaw}'. Expected an integer.`);
+                        requestCLIExit(1);
+                        return;
+                    }
+                }
+                for (const field of advancedFields) {
+                    const parsedField = parseAdvancedFilter(field);
+                    if (!parsedField.ok) {
+                        ui.error(parsedField.message);
+                        requestCLIExit(1);
+                        return;
+                    }
+                    filters.push(parsedField.filter);
+                }
+                const queryWorker = target.isExplicitWorker ? targetWorker : undefined;
+                const needleValue = search ?? pathFilter;
+                const queryLimit = pathFilter || methodFilter || statusCodeRaw || levelFilter || requestId || status || queryWorker
+                    ? Math.max(limit, 500)
+                    : limit;
+                const result = await logsImpl.queryLogs(queryWorker ?? '', {
+                    view,
+                    from,
+                    to,
+                    limit: queryLimit,
+                    filters,
+                    filterCombination: 'and',
+                    needle: needleValue ? { value: needleValue, isRegex: regex && needleValue === search, matchCase } : undefined
+                });
+                const telemetry = telemetryObject(result);
+                const matchingRows = extractTelemetryRows(telemetry, view).filter((row) => telemetryRecordMatches(row, {
+                    workerName: queryWorker,
+                    pathFilter,
+                    methodFilter,
+                    statusCode: localStatusCode,
+                    levelFilter,
+                    requestId,
+                    status
+                }));
+                const rows = matchingRows.slice(0, limit);
+                if (output === 'json') {
+                    ui.json(buildTelemetryJsonPayload({
+                        source: descriptor.id,
+                        worker: queryWorker ?? null,
+                        mode: view,
+                        from,
+                        to,
+                        count: matchingRows.length,
+                        resultKeys: Object.keys(telemetry),
+                        rows,
+                        compact
+                    }));
+                }
+                else {
+                    ui.info(`Telemetry ${view} for ${queryWorker ?? 'all workers'} (${new Date(from).toISOString()} → ${new Date(to).toISOString()}, count=${rows.length})`);
+                    if (rows.length === 0) {
+                        ui.info('No matching telemetry rows.');
+                    }
+                    else {
+                        const redactedRows = rows.map((row) => redactTelemetryValue(row));
+                        ui.table(redactedRows.map((row) => summarizeTelemetryRecord(row)), {
+                            columns: ['time', 'service', 'level', 'outcome', 'status', 'method', 'url', 'message']
+                        });
+                    }
+                }
+                return;
             }
             if (doTail) {
-                // Real-time log streaming
                 const tailResult = await logsImpl.tailLogs(targetWorker, { status, limit });
                 ui.info(`Log tail started: ${tailResult.tailId} (worker=${targetWorker})`);
                 await streamWorkerTail({
+                    runtime,
                     url: tailResult.websocketUrl,
                     ui,
                     filterStatus: status,
                     limit
                 });
-                try {
-                    await logsImpl.stopTail(targetWorker, tailResult.tailId);
-                }
-                catch {
-                    // best-effort cleanup
+                const stopped = await settle(() => logsImpl.stopTail(targetWorker, tailResult.tailId));
+                if (!stopped.ok) {
+                    // The capture result stands. A failed stop is not the command outcome.
+                    valueFreeFailure(stopped.cause);
                 }
             }
-            else if (showAnalytics) {
-                // Analytics summary
-                const analytics = await logsImpl.getAnalytics(targetWorker, { timeStart });
+            else if (doAggregate) {
+                const aggWindow = windowRaw ?? '2h';
+                const targetWorkers = target.isExplicitWorker
+                    ? [targetWorker]
+                    : (descriptor.sources?.filter((s) => s.type === 'worker').map((s) => s.name) ?? []);
+                if (targetWorkers.length === 0) {
+                    ui.error(`No workers found in source '${descriptor.id}'`);
+                    requestCLIExit(1);
+                    return;
+                }
+                const results = await Promise.all(targetWorkers.map(async (worker) => {
+                    const analytics = await settle(() => logsImpl.getAnalytics(worker, { timeStart: aggWindow }));
+                    if (analytics.ok) {
+                        const row = {
+                            worker,
+                            invocations: analytics.value.totalInvocations,
+                            errors: analytics.value.errorCount,
+                            errorRate: analytics.value.errorRate,
+                            p99WallMs: analytics.value.p99DurationMs,
+                            skipped: false,
+                            error: null
+                        };
+                        return row;
+                    }
+                    if (isAssetOnlyWorker(analytics.cause)) {
+                        const skipped = {
+                            worker,
+                            invocations: 0,
+                            errors: 0,
+                            errorRate: 0,
+                            p99WallMs: 0,
+                            skipped: true,
+                            error: null
+                        };
+                        return skipped;
+                    }
+                    const failed = {
+                        worker,
+                        invocations: 0,
+                        errors: 0,
+                        errorRate: 0,
+                        p99WallMs: 0,
+                        skipped: false,
+                        error: AGGREGATE_QUERY_FAILED
+                    };
+                    return failed;
+                }));
+                const totalErrors = results.reduce((n, r) => n + r.errors, 0);
                 if (output === 'json') {
-                    ui.json(analytics);
+                    ui.json({
+                        source: descriptor.id,
+                        mode: 'aggregate',
+                        window: aggWindow,
+                        status: status ?? null,
+                        count: totalErrors,
+                        workers: results
+                    });
                 }
                 else {
-                    ui.info(`Analytics for ${targetWorker} (${timeStart}):`);
-                    ui.table([
-                        { metric: 'Total Invocations', value: analytics.totalInvocations.toString() },
-                        { metric: 'Error Count', value: analytics.errorCount.toString() },
-                        { metric: 'Error Rate', value: `${(analytics.errorRate * 100).toFixed(2)}%` },
-                        { metric: 'P50 Wall Time', value: `${analytics.avgDurationMs.toFixed(2)}ms` },
-                        { metric: 'P99 Wall Time', value: `${analytics.p99DurationMs.toFixed(2)}ms` },
-                        { metric: 'P50 CPU Time', value: `${analytics.totalCpuTimeMs.toFixed(2)}ms` }
-                    ], { columns: ['metric', 'value'] });
+                    ui.info(`Aggregate (${aggWindow}) for ${descriptor.id} — historical error counts:`);
+                    ui.table(results.map((r) => ({
+                        worker: r.worker,
+                        invocations: r.skipped ? 'skipped (asset-only)' : String(r.invocations),
+                        errors: r.skipped ? '-' : String(r.errors),
+                        rate: r.skipped ? '-' : `${(r.errorRate * 100).toFixed(2)}%`
+                    })), { columns: ['worker', 'invocations', 'errors', 'rate'] });
+                    const failed = results.filter((r) => r.error);
+                    if (failed.length > 0) {
+                        ui.info('\nErrors during query:');
+                        for (const f of failed)
+                            ui.error(`  ${f.worker}: ${f.error}`);
+                        requestCLIExit(1);
+                        return;
+                    }
                 }
+                return;
             }
-            else if (workerName) {
-                // Windowed query: a worker was named without --tail/--analytics.
-                // Cloudflare exposes only live Tail for per-event data, so we
-                // open a tail session, capture for `--window` (default 30s),
-                // then close. This is the closest thing to a batch query.
-                const tailResult = await logsImpl.tailLogs(targetWorker, { status, limit });
-                if (output !== 'json') {
-                    ui.info(`Log query: ${targetWorker} (window=${windowRaw ?? '30s'}, status=${status ?? 'any'}, limit=${limit}). ` +
-                        `Note: Cloudflare exposes only live Tail for per-event data — this captures errors during the window, not historical lookback.`);
+            else if (showAnalytics) {
+                if (target.isExplicitWorker) {
+                    const analytics = await logsImpl.getAnalytics(targetWorker, { timeStart });
+                    if (output === 'json') {
+                        ui.json(analytics);
+                    }
+                    else {
+                        ui.info(`Analytics for ${targetWorker} (${timeStart}):`);
+                        ui.table([
+                            { metric: 'Total Invocations', value: analytics.totalInvocations.toString() },
+                            { metric: 'Error Count', value: analytics.errorCount.toString() },
+                            { metric: 'Error Rate', value: `${(analytics.errorRate * 100).toFixed(2)}%` },
+                            { metric: 'P50 Wall Time', value: `${analytics.avgDurationMs.toFixed(2)}ms` },
+                            { metric: 'P99 Wall Time', value: `${analytics.p99DurationMs.toFixed(2)}ms` },
+                            { metric: 'P50 CPU Time', value: `${analytics.totalCpuTimeMs.toFixed(2)}ms` }
+                        ], { columns: ['metric', 'value'] });
+                    }
                 }
-                const records = await streamWorkerTail({
-                    url: tailResult.websocketUrl,
-                    ui,
-                    filterStatus: status,
-                    limit,
-                    windowMs,
-                    collect: true
-                });
-                try {
-                    await logsImpl.stopTail(targetWorker, tailResult.tailId);
+                else {
+                    const workers = descriptor.sources?.filter((s) => s.type === 'worker') ?? [];
+                    if (workers.length === 0) {
+                        if (output === 'json')
+                            ui.json([]);
+                        else
+                            ui.info('No worker sources configured.');
+                        return;
+                    }
+                    const results = await Promise.all(workers.map(async (w) => {
+                        const res = await settle(() => logsImpl.getAnalytics(w.name, { timeStart }));
+                        if (!res.ok) {
+                            return {
+                                worker: w.name,
+                                invocations: '-',
+                                errors: '-',
+                                rate: '-',
+                                p99Wall: '-',
+                                p50Cpu: '-',
+                                error: AGGREGATE_QUERY_FAILED
+                            };
+                        }
+                        return {
+                            worker: w.name,
+                            invocations: res.value.totalInvocations.toString(),
+                            errors: res.value.errorCount.toString(),
+                            rate: `${(res.value.errorRate * 100).toFixed(2)}%`,
+                            p99Wall: `${res.value.p99DurationMs.toFixed(2)}ms`,
+                            p50Cpu: `${res.value.totalCpuTimeMs.toFixed(2)}ms`,
+                            error: null
+                        };
+                    }));
+                    if (output === 'json') {
+                        ui.json({ source: descriptor.id, timeStart, results });
+                    }
+                    else {
+                        ui.info(`Analytics summary for ${descriptor.id} (${timeStart}):`);
+                        ui.table(results.map((r) => ({
+                            worker: r.worker,
+                            invocations: r.invocations,
+                            errors: r.errors,
+                            rate: r.rate,
+                            'P99 Wall': r.p99Wall,
+                            'P50 CPU': r.p50Cpu
+                        })), { columns: ['worker', 'invocations', 'errors', 'rate', 'P99 Wall', 'P50 CPU'] });
+                        const failed = results.filter((r) => r.error);
+                        if (failed.length > 0) {
+                            ui.info('\nErrors during query:');
+                            for (const f of failed) {
+                                ui.error(`  ${f.worker}: ${f.error}`);
+                            }
+                        }
+                    }
                 }
-                catch {
-                    // best-effort cleanup
+            }
+            else if (target.isExplicitWorker || status !== undefined || isExplicitQuery) {
+                // Windowed query: a worker was named OR a query is requested across all workers.
+                const targetWorkers = target.isExplicitWorker
+                    ? [targetWorker]
+                    : (descriptor.sources?.filter((s) => s.type === 'worker').map((s) => s.name) ?? []);
+                if (targetWorkers.length === 0) {
+                    throw new CapabilityError(`No workers found in source '${descriptor.id}'`, 'NOT_FOUND');
                 }
-                const entries = records.map((rec) => ({
+                if (output !== 'json') {
+                    ui.info(`Realtime capture: ${targetWorkers.join(', ')} (window=${windowRaw ?? '30s'}, status=${status ?? 'any'}, limit=${limit}). ` +
+                        `This is a live Tail window — it only sees events DURING the capture. For a past incident, drop --window to query historical Workers Observability telemetry (default 24h lookback; tune with --from/--to).`);
+                }
+                // Query all target workers in parallel. A worker whose tail fails to
+                // attach or stream is a CAPTURE FAILURE, not a quiet window — record it
+                // so `count: 0` can never mean "we silently watched nothing".
+                const captureFailures = [];
+                const allRecordsList = await Promise.all(targetWorkers.map(async (worker) => {
+                    const attached = await settle(() => logsImpl.tailLogs(worker, { status, limit }));
+                    if (!attached.ok) {
+                        captureFailures.push({ worker, stage: 'attach', error: TAIL_ATTACH_FAILED });
+                        if (output !== 'json') {
+                            ui.warn(`[${worker}] Failed to start tail session.`);
+                        }
+                        return [];
+                    }
+                    const tailSession = attached.value;
+                    try {
+                        const streamed = await settle(() => streamWorkerTail({
+                            runtime,
+                            url: tailSession.websocketUrl,
+                            ui,
+                            filterStatus: status,
+                            limit,
+                            windowMs,
+                            collect: true
+                        }));
+                        if (!streamed.ok) {
+                            captureFailures.push({ worker, stage: 'stream', error: TAIL_STREAM_FAILED });
+                            if (output !== 'json') {
+                                ui.error(`[${worker}] Tail streaming error.`);
+                            }
+                            return [];
+                        }
+                        return streamed.value.map((rec) => ({ ...rec, workerName: worker }));
+                    }
+                    finally {
+                        const stopped = await settle(() => logsImpl.stopTail(worker, tailSession.tailId));
+                        if (!stopped.ok) {
+                            // The capture result stands. A failed stop is not the command outcome.
+                            valueFreeFailure(stopped.cause);
+                        }
+                    }
+                }));
+                const combinedRecords = allRecordsList.flat();
+                const allWorkersFailed = captureFailures.length >= targetWorkers.length && targetWorkers.length > 0;
+                const entries = combinedRecords.map((rec) => ({
                     timestamp: rec.eventTimestamp ? new Date(rec.eventTimestamp).toISOString() : null,
                     outcome: rec.outcome ?? null,
-                    scriptName: rec.scriptName ?? targetWorker,
+                    scriptName: rec.scriptName ?? rec.workerName,
                     method: rec.event?.request?.method ?? null,
-                    url: rec.event?.request?.url ?? null,
+                    url: rec.event?.request?.url !== undefined ? redactUrlLikeText(rec.event.request.url) : null,
                     responseStatus: rec.event?.response?.status ?? null,
-                    trigger: rec.event?.cron ? `cron ${rec.event.cron}` :
-                        rec.event?.rpcMethod ? `rpc ${rec.event.rpcMethod}` :
-                            rec.event?.request ? 'request' : 'event',
+                    trigger: rec.event?.cron
+                        ? `cron ${rec.event.cron}`
+                        : rec.event?.rpcMethod
+                            ? `rpc ${rec.event.rpcMethod}`
+                            : rec.event?.request
+                                ? 'request'
+                                : 'event',
                     logs: (rec.logs ?? []).map((l) => ({
                         level: l.level ?? 'log',
-                        message: (l.message ?? []).map((m) => typeof m === 'string' ? m : (() => { try {
-                            return JSON.stringify(m);
-                        }
-                        catch {
-                            return String(m);
-                        } })()).join(' '),
+                        message: redactUrlLikeText(tailEntryMessage(l)),
                         timestamp: l.timestamp ? new Date(l.timestamp).toISOString() : null
                     })),
                     exceptions: (rec.exceptions ?? []).map((e) => ({
                         name: e.name ?? 'Error',
-                        message: e.message ?? '',
+                        message: e.message !== undefined ? redactUrlLikeText(e.message) : '',
                         timestamp: e.timestamp ? new Date(e.timestamp).toISOString() : null
                     }))
                 }));
+                // Sort entries chronologically ascending
+                entries.sort((a, b) => {
+                    if (!a.timestamp)
+                        return 1;
+                    if (!b.timestamp)
+                        return -1;
+                    return a.timestamp.localeCompare(b.timestamp);
+                });
                 if (output === 'json') {
                     ui.json({
                         source: descriptor.id,
-                        worker: targetWorker,
+                        workers: targetWorkers,
                         window: windowRaw ?? '30s',
                         status: status ?? null,
                         limit,
                         capturedAt: new Date().toISOString(),
+                        captureFailed: allWorkersFailed,
+                        failures: captureFailures,
                         count: entries.length,
                         entries
                     });
+                    if (allWorkersFailed) {
+                        requestCLIExit(1);
+                        return;
+                    }
                 }
                 else {
+                    if (allWorkersFailed) {
+                        ui.error(`Capture FAILED for all ${targetWorkers.length} worker(s) — no tail session attached, so this says nothing about actual traffic.`);
+                        for (const failure of captureFailures) {
+                            ui.error(`  [${failure.worker}] ${failure.stage}: ${failure.error}`);
+                        }
+                        requestCLIExit(1);
+                        return;
+                    }
+                    if (captureFailures.length > 0) {
+                        ui.warn(`Partial capture: ${captureFailures.length} of ${targetWorkers.length} worker(s) failed to tail (${captureFailures.map((f) => f.worker).join(', ')}).`);
+                    }
                     if (entries.length === 0) {
                         ui.info(`No log entries captured in the ${windowRaw ?? '30s'} window.`);
                     }
                     else {
                         ui.info(`Captured ${entries.length} entries.`);
+                        for (const entry of entries) {
+                            const time = entry.timestamp ? new Date(entry.timestamp).toLocaleTimeString() : 'unknown';
+                            const statusText = entry.outcome === 'ok' ? 'OK' : `ERR(${entry.outcome})`;
+                            ui.log(`[${time}] [${entry.scriptName}] [${statusText}] ${entry.method ?? ''} ${entry.url ?? ''}`);
+                            for (const ex of entry.exceptions) {
+                                ui.error(`  Exception: ${ex.name}: ${ex.message}`);
+                            }
+                            for (const log of entry.logs) {
+                                ui.log(`  [${log.level}] ${log.message}`);
+                            }
+                        }
                     }
                 }
             }
@@ -303,13 +1350,15 @@ export default {
             ui.table(rows, { columns: ['id', 'name', 'adapter', 'sources', 'status'] });
             ui.info('');
             ui.info('Usage:');
-            ui.info('  vibes infra logs <source>                       # Show source details');
-            ui.info('  vibes infra logs <source> <worker>              # Windowed query (30s capture)');
-            ui.info('  vibes infra logs <source> <worker> --analytics  # Aggregate analytics');
-            ui.info('  vibes infra logs <source> <worker> --tail       # Stream logs in real-time');
+            ui.info('  vibes infra logs <source>                          # Show source details');
+            ui.info('  vibes infra logs <source> <worker> --status=error  # Historical errors (default 24h lookback)');
+            ui.info('  vibes infra logs <source> <worker> --from=6h       # Historical events over a lookback window');
+            ui.info('  vibes infra logs <source> <worker> --window=60s    # Realtime capture (live Tail, only during the window)');
+            ui.info('  vibes infra logs <source> <worker> --analytics     # Aggregate analytics');
+            ui.info('  vibes infra logs <source> <worker> --tail          # Stream logs in real-time');
             ui.info('');
             ui.info('Examples:');
-            ui.info('  vibes infra logs cloudflare-logs vibes-auth --status=error --window=60s --output=json');
+            ui.info('  vibes infra logs cloudflare-logs vibes-auth --status=error --from=6h --output=json');
             ui.info('  vibes infra logs cloudflare-logs vibes-auth --analytics --timeStart=2h');
             ui.info('  vibes infra logs cloudflare-logs vibes-auth --tail --status=error');
             // Show errors if any