infrawise 0.1.0 → 0.1.2

package/dist/index.js

@@ -81,9 +81,7 @@ var require_config = __commonJS({
         profile: zod_1.z.string().optional().default("default"),
         region: zod_1.z.string().optional().default("us-east-1")
       }).optional().default({}),
-      dynamodb: zod_1.z.object({
-        includeTables: zod_1.z.array(zod_1.z.string()).optional()
-      }).optional(),
+      dynamodb: zod_1.z.object({ includeTables: zod_1.z.array(zod_1.z.string()).optional() }).optional(),
       postgres: zod_1.z.object({
         enabled: zod_1.z.boolean().optional().default(false),
         connectionString: zod_1.z.string().optional()
@@ -97,8 +95,19 @@ var require_config = __commonJS({
         connectionString: zod_1.z.string().optional(),
         databases: zod_1.z.array(zod_1.z.string()).optional()
       }).optional(),
-      terraform: zod_1.z.object({
-        enabled: zod_1.z.boolean().optional().default(true)
+      terraform: zod_1.z.object({ enabled: zod_1.z.boolean().optional().default(true) }).optional(),
+      sqs: zod_1.z.object({ enabled: zod_1.z.boolean().optional().default(true) }).optional(),
+      sns: zod_1.z.object({ enabled: zod_1.z.boolean().optional().default(true) }).optional(),
+      ssm: zod_1.z.object({
+        enabled: zod_1.z.boolean().optional().default(true),
+        paths: zod_1.z.array(zod_1.z.string()).optional()
+      }).optional(),
+      secretsManager: zod_1.z.object({ enabled: zod_1.z.boolean().optional().default(true) }).optional(),
+      lambda: zod_1.z.object({ enabled: zod_1.z.boolean().optional().default(true) }).optional(),
+      cloudwatchLogs: zod_1.z.object({
+        enabled: zod_1.z.boolean().optional().default(false),
+        logGroupPrefixes: zod_1.z.array(zod_1.z.string()).optional(),
+        windowHours: zod_1.z.number().int().positive().optional().default(24)
       }).optional(),
       analysis: zod_1.z.object({
         sampleSize: zod_1.z.number().int().positive().optional().default(100)
@@ -125,19 +134,13 @@ var require_config = __commonJS({
       try {
         rawContent = fs4.readFileSync(resolvedPath, "utf-8");
       } catch (err) {
-        throw new ConfigError(`Unable to read configuration file: ${resolvedPath}`, [
-          "Check file permissions",
-          String(err)
-        ]);
+        throw new ConfigError(`Unable to read configuration file: ${resolvedPath}`, [String(err)]);
       }
       let parsedYaml;
       try {
         parsedYaml = yaml.load(rawContent);
       } catch (err) {
-        throw new ConfigError(`Invalid YAML in configuration file: ${resolvedPath}`, [
-          "Check the YAML syntax",
-          String(err)
-        ]);
+        throw new ConfigError(`Invalid YAML in configuration file: ${resolvedPath}`, [String(err)]);
       }
       const result = exports2.InfrawiseConfigSchema.safeParse(parsedYaml);
       if (!result.success) {
@@ -153,9 +156,7 @@ var require_config = __commonJS({
           profile: options?.aws?.profile ?? "default",
           region: options?.aws?.region ?? "us-east-1"
         },
-        dynamodb: {
-          includeTables: options?.dynamodb?.includeTables ?? []
-        },
+        dynamodb: { includeTables: options?.dynamodb?.includeTables ?? [] },
         postgres: {
           enabled: options?.postgres?.enabled ?? false,
           connectionString: options?.postgres?.connectionString ?? ""
@@ -169,12 +170,21 @@ var require_config = __commonJS({
           connectionString: options?.mongodb?.connectionString ?? "",
           databases: options?.mongodb?.databases ?? []
         },
-        terraform: {
-          enabled: options?.terraform?.enabled ?? true
+        terraform: { enabled: options?.terraform?.enabled ?? true },
+        sqs: { enabled: options?.sqs?.enabled ?? true },
+        sns: { enabled: options?.sns?.enabled ?? true },
+        ssm: {
+          enabled: options?.ssm?.enabled ?? true,
+          paths: options?.ssm?.paths ?? []
         },
-        analysis: {
-          sampleSize: options?.analysis?.sampleSize ?? 100
-        }
+        secretsManager: { enabled: options?.secretsManager?.enabled ?? true },
+        lambda: { enabled: options?.lambda?.enabled ?? true },
+        cloudwatchLogs: {
+          enabled: options?.cloudwatchLogs?.enabled ?? false,
+          logGroupPrefixes: options?.cloudwatchLogs?.logGroupPrefixes ?? [],
+          windowHours: options?.cloudwatchLogs?.windowHours ?? 24
+        },
+        analysis: { sampleSize: options?.analysis?.sampleSize ?? 100 }
       };
       return yaml.dump(config, { lineWidth: 120 });
     }
@@ -984,22 +994,37 @@ var require_dist6 = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.extractTerraformSchema = extractTerraformSchema;
     exports2.extractCloudFormationSchema = extractCloudFormationSchema;
+    exports2.extractCDKSchema = extractCDKSchema;
     exports2.extractIaCSchema = extractIaCSchema2;
     var fs4 = __importStar(require("fs"));
     var path5 = __importStar(require("path"));
     var js_yaml_1 = __importDefault(require("js-yaml"));
     var core_1 = require_dist();
-    function findFilesRecursively(dir, extensions) {
+    function emptySchema() {
+      return {
+        dynamoTables: [],
+        rdsInstances: [],
+        mongoClusters: [],
+        queues: [],
+        topics: [],
+        lambdas: [],
+        buckets: [],
+        parameters: [],
+        secrets: [],
+        apiGateways: []
+      };
+    }
+    function findFilesRecursively(dir, extensions, skipDirs = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".infrawise"])) {
       const results = [];
       if (!fs4.existsSync(dir))
         return results;
       const entries = fs4.readdirSync(dir, { withFileTypes: true });
       for (const entry of entries) {
-        if (entry.name === "node_modules" || entry.name === ".git" || entry.name === "dist")
+        if (skipDirs.has(entry.name))
           continue;
         const fullPath = path5.join(dir, entry.name);
         if (entry.isDirectory()) {
-          results.push(...findFilesRecursively(fullPath, extensions));
+          results.push(...findFilesRecursively(fullPath, extensions, skipDirs));
         } else if (extensions.some((ext) => entry.name.endsWith(ext))) {
           results.push(fullPath);
         }
@@ -1011,8 +1036,8 @@ var require_dist6 = __commonJS({
       const resourcePattern = /resource\s+"([^"]+)"\s+"([^"]+)"\s*\{/g;
       let match;
       while ((match = resourcePattern.exec(content)) !== null) {
-        const resourceType = match[1];
-        const resourceName = match[2];
+        const resourceType = match[1] ?? "";
+        const resourceName = match[2] ?? "";
         const startBrace = match.index + match[0].length - 1;
         let depth = 1;
         let i = startBrace + 1;
@@ -1023,30 +1048,31 @@ var require_dist6 = __commonJS({
             depth--;
           i++;
         }
-        const body = content.slice(startBrace + 1, i - 1);
-        results.push({ resourceType: resourceType ?? "", resourceName: resourceName ?? "", body });
+        results.push({ resourceType, resourceName, body: content.slice(startBrace + 1, i - 1) });
       }
       return results;
     }
-    function extractTerraformStringAttr(body, attr) {
-      const pattern = new RegExp(`${attr}\\s*=\\s*"([^"]*)"`, "i");
-      const m = body.match(pattern);
+    function tfStr(body, attr) {
+      const m = body.match(new RegExp(`${attr}\\s*=\\s*"([^"]*)"`, "i"));
       return m?.[1];
     }
-    function extractTerraformGSINames(body) {
+    function tfBool(body, attr) {
+      const m = body.match(new RegExp(`${attr}\\s*=\\s*(true|false)`, "i"));
+      return m?.[1] === "true";
+    }
+    function tfGSINames(body) {
       const names = [];
-      const gsiPattern = /global_secondary_index\s*\{([^}]*)\}/g;
+      const pat = /global_secondary_index\s*\{([^}]*)\}/g;
       let m;
-      while ((m = gsiPattern.exec(body)) !== null) {
-        const gsiBody = m[1];
-        const nameMatch = gsiBody.match(/name\s*=\s*"([^"]*)"/);
+      while ((m = pat.exec(body)) !== null) {
+        const nameMatch = m[1].match(/name\s*=\s*"([^"]*)"/);
         if (nameMatch?.[1])
           names.push(nameMatch[1]);
       }
       return names;
     }
     async function extractTerraformSchema(repoPath) {
-      const schema = { dynamoTables: [], rdsInstances: [], mongoClusters: [] };
+      const schema = emptySchema();
       const tfFiles = findFilesRecursively(repoPath, [".tf"]);
       core_1.logger.info(`Found ${tfFiles.length} Terraform file(s)`);
       for (const filePath of tfFiles) {
@@ -1056,38 +1082,88 @@ var require_dist6 = __commonJS({
         } catch {
           continue;
         }
-        const blocks = extractTerraformResourceBlocks(content);
-        for (const block of blocks) {
-          const { resourceType, resourceName, body } = block;
-          if (resourceType === "aws_dynamodb_table") {
-            const partitionKey = extractTerraformStringAttr(body, "hash_key");
-            const sortKey = extractTerraformStringAttr(body, "range_key");
-            const gsiNames = extractTerraformGSINames(body);
-            const tableName = extractTerraformStringAttr(body, "name") ?? resourceName;
-            schema.dynamoTables.push({
-              name: tableName,
-              partitionKey,
-              sortKey,
-              gsiNames,
-              source: "terraform",
-              filePath
-            });
-          } else if (resourceType === "aws_db_instance") {
-            const identifier = extractTerraformStringAttr(body, "identifier") ?? resourceName;
-            const engine = extractTerraformStringAttr(body, "engine") ?? "unknown";
-            schema.rdsInstances.push({
-              identifier,
-              engine,
-              source: "terraform",
-              filePath
-            });
-          } else if (resourceType === "aws_docdb_cluster") {
-            const identifier = extractTerraformStringAttr(body, "cluster_identifier") ?? resourceName;
-            schema.mongoClusters.push({
-              identifier,
-              source: "terraform",
-              filePath
-            });
+        for (const { resourceType, resourceName, body } of extractTerraformResourceBlocks(content)) {
+          switch (resourceType) {
+            case "aws_dynamodb_table":
+              schema.dynamoTables.push({
+                name: tfStr(body, "name") ?? resourceName,
+                partitionKey: tfStr(body, "hash_key"),
+                sortKey: tfStr(body, "range_key"),
+                gsiNames: tfGSINames(body),
+                source: "terraform",
+                filePath
+              });
+              break;
+            case "aws_db_instance":
+            case "aws_rds_cluster":
+              schema.rdsInstances.push({
+                identifier: tfStr(body, "identifier") ?? tfStr(body, "cluster_identifier") ?? resourceName,
+                engine: tfStr(body, "engine") ?? "unknown",
+                source: "terraform",
+                filePath
+              });
+              break;
+            case "aws_docdb_cluster":
+              schema.mongoClusters.push({
+                identifier: tfStr(body, "cluster_identifier") ?? resourceName,
+                source: "terraform",
+                filePath
+              });
+              break;
+            case "aws_sqs_queue": {
+              const name = tfStr(body, "name") ?? resourceName;
+              const hasDLQ = body.includes("redrive_policy");
+              const encrypted = body.includes("kms_master_key_id") || tfBool(body, "sqs_managed_sse_enabled");
+              schema.queues.push({ name, hasDLQ, encrypted, source: "terraform", filePath });
+              break;
+            }
+            case "aws_sns_topic":
+              schema.topics.push({
+                name: tfStr(body, "name") ?? resourceName,
+                encrypted: body.includes("kms_master_key_id"),
+                source: "terraform",
+                filePath
+              });
+              break;
+            case "aws_lambda_function":
+              schema.lambdas.push({
+                name: tfStr(body, "function_name") ?? resourceName,
+                runtime: tfStr(body, "runtime"),
+                source: "terraform",
+                filePath
+              });
+              break;
+            case "aws_s3_bucket":
+              schema.buckets.push({
+                name: tfStr(body, "bucket") ?? tfStr(body, "bucket_prefix") ?? resourceName,
+                versioned: body.includes("versioning") && body.includes("enabled = true"),
+                source: "terraform",
+                filePath
+              });
+              break;
+            case "aws_ssm_parameter":
+              schema.parameters.push({
+                name: tfStr(body, "name") ?? resourceName,
+                type: tfStr(body, "type") ?? "String",
+                source: "terraform",
+                filePath
+              });
+              break;
+            case "aws_secretsmanager_secret":
+              schema.secrets.push({
+                name: tfStr(body, "name") ?? resourceName,
+                source: "terraform",
+                filePath
+              });
+              break;
+            case "aws_api_gateway_rest_api":
+            case "aws_apigatewayv2_api":
+              schema.apiGateways.push({
+                name: tfStr(body, "name") ?? resourceName,
+                source: "terraform",
+                filePath
+              });
+              break;
           }
         }
       }
@@ -1106,16 +1182,11 @@ var require_dist6 = __commonJS({
       } catch {
         return null;
       }
-      if (!content.includes("AWSTemplateFormatVersion") && !content.includes("Resources")) {
+      if (!content.includes("AWSTemplateFormatVersion") && !content.includes("Resources"))
         return null;
-      }
       let parsed;
       try {
-        if (filePath.endsWith(".json")) {
-          parsed = JSON.parse(content);
-        } else {
-          parsed = js_yaml_1.default.load(content);
-        }
+        parsed = filePath.endsWith(".json") ? JSON.parse(content) : js_yaml_1.default.load(content);
       } catch {
         return null;
       }
@@ -1123,128 +1194,602 @@ var require_dist6 = __commonJS({
         return null;
       return parsed;
     }
-    function getStringProp(obj, ...keys) {
+    function cfnStr(props, ...keys) {
       for (const key of keys) {
-        if (typeof obj[key] === "string")
-          return obj[key];
+        if (typeof props[key] === "string")
+          return props[key];
       }
       return void 0;
     }
-    async function extractCloudFormationSchema(repoPath) {
-      const schema = { dynamoTables: [], rdsInstances: [], mongoClusters: [] };
-      const cfnFiles = findFilesRecursively(repoPath, [".yaml", ".yml", ".json"]);
-      core_1.logger.info(`Scanning ${cfnFiles.length} potential CloudFormation file(s)`);
-      for (const filePath of cfnFiles) {
-        const parsed = parseCFNFile(filePath);
-        if (!parsed)
-          continue;
-        const resources = parsed["Resources"];
-        if (!resources || typeof resources !== "object")
+    function cfnBool(props, key) {
+      return props[key] === true || props[key] === "true" || props[key] === "Enabled";
+    }
+    function processCFNResources(resources, schema, filePath, source) {
+      for (const [logicalId, rawResource] of Object.entries(resources)) {
+        if (typeof rawResource !== "object" || rawResource === null)
           continue;
-        for (const [logicalId, rawResource] of Object.entries(resources)) {
-          if (typeof rawResource !== "object" || rawResource === null)
-            continue;
-          const resource = rawResource;
-          const resourceType = resource["Type"];
-          const props = resource["Properties"] ?? {};
-          if (resourceType === "AWS::DynamoDB::Table") {
-            let partitionKey;
-            let sortKey;
+        const resource = rawResource;
+        const resourceType = resource["Type"];
+        const props = resource["Properties"] ?? {};
+        switch (resourceType) {
+          case "AWS::DynamoDB::Table": {
+            let pk, sk;
             const keySchema = props["KeySchema"];
             if (Array.isArray(keySchema)) {
-              for (const keyDef of keySchema) {
-                if (typeof keyDef !== "object" || keyDef === null)
+              for (const kd of keySchema) {
+                if (typeof kd !== "object" || kd === null)
                   continue;
-                const kd = keyDef;
-                if (kd["KeyType"] === "HASH")
-                  partitionKey = kd["AttributeName"];
-                if (kd["KeyType"] === "RANGE")
-                  sortKey = kd["AttributeName"];
+                const k = kd;
+                if (k["KeyType"] === "HASH")
+                  pk = k["AttributeName"];
+                if (k["KeyType"] === "RANGE")
+                  sk = k["AttributeName"];
               }
             }
             const gsiNames = [];
             const gsis = props["GlobalSecondaryIndexes"];
             if (Array.isArray(gsis)) {
-              for (const gsi of gsis) {
-                if (typeof gsi !== "object" || gsi === null)
-                  continue;
-                const g = gsi;
-                if (typeof g["IndexName"] === "string")
-                  gsiNames.push(g["IndexName"]);
+              for (const g of gsis) {
+                if (typeof g === "object" && g !== null) {
+                  const gi = g;
+                  if (typeof gi["IndexName"] === "string")
+                    gsiNames.push(gi["IndexName"]);
+                }
               }
             }
-            const tableName = getStringProp(props, "TableName") ?? logicalId;
             schema.dynamoTables.push({
-              name: tableName,
-              partitionKey,
-              sortKey,
+              name: cfnStr(props, "TableName") ?? logicalId,
+              partitionKey: pk,
+              sortKey: sk,
               gsiNames,
-              source: "cloudformation",
+              source,
               filePath
             });
-          } else if (resourceType === "AWS::RDS::DBInstance") {
-            const identifier = getStringProp(props, "DBInstanceIdentifier") ?? logicalId;
-            const engine = getStringProp(props, "Engine") ?? "unknown";
+            break;
+          }
+          case "AWS::RDS::DBInstance":
+            schema.rdsInstances.push({
+              identifier: cfnStr(props, "DBInstanceIdentifier") ?? logicalId,
+              engine: cfnStr(props, "Engine") ?? "unknown",
+              source,
+              filePath
+            });
+            break;
+          case "AWS::RDS::DBCluster":
             schema.rdsInstances.push({
-              identifier,
-              engine,
-              source: "cloudformation",
+              identifier: cfnStr(props, "DBClusterIdentifier") ?? logicalId,
+              engine: cfnStr(props, "Engine") ?? "aurora",
+              source,
               filePath
             });
-          } else if (resourceType === "AWS::DocDB::DBCluster") {
-            const identifier = getStringProp(props, "DBClusterIdentifier") ?? logicalId;
+            break;
+          case "AWS::DocDB::DBCluster":
             schema.mongoClusters.push({
-              identifier,
-              source: "cloudformation",
+              identifier: cfnStr(props, "DBClusterIdentifier") ?? logicalId,
+              source,
+              filePath
+            });
+            break;
+          case "AWS::SQS::Queue": {
+            const name = cfnStr(props, "QueueName") ?? logicalId;
+            const hasDLQ = !!props["RedrivePolicy"];
+            const encrypted = !!(props["KmsMasterKeyId"] || cfnBool(props, "SqsManagedSseEnabled"));
+            schema.queues.push({ name, hasDLQ, encrypted, source, filePath });
+            break;
+          }
+          case "AWS::SNS::Topic":
+            schema.topics.push({
+              name: cfnStr(props, "TopicName") ?? logicalId,
+              encrypted: !!props["KmsMasterKeyId"],
+              source,
+              filePath
+            });
+            break;
+          case "AWS::Lambda::Function":
+            schema.lambdas.push({
+              name: cfnStr(props, "FunctionName") ?? logicalId,
+              runtime: cfnStr(props, "Runtime"),
+              source,
+              filePath
+            });
+            break;
+          case "AWS::S3::Bucket": {
+            const versioningConfig = props["VersioningConfiguration"];
+            schema.buckets.push({
+              name: cfnStr(props, "BucketName") ?? logicalId,
+              versioned: versioningConfig?.["Status"] === "Enabled",
+              source,
               filePath
             });
+            break;
           }
+          case "AWS::SSM::Parameter":
+            schema.parameters.push({
+              name: cfnStr(props, "Name") ?? logicalId,
+              type: cfnStr(props, "Type") ?? "String",
+              source,
+              filePath
+            });
+            break;
+          case "AWS::SecretsManager::Secret":
+            schema.secrets.push({
+              name: cfnStr(props, "Name") ?? logicalId,
+              source,
+              filePath
+            });
+            break;
+          case "AWS::ApiGateway::RestApi":
+          case "AWS::ApiGatewayV2::Api":
+            schema.apiGateways.push({
+              name: cfnStr(props, "Name") ?? logicalId,
+              source,
+              filePath
+            });
+            break;
+        }
+      }
+    }
+    async function extractCloudFormationSchema(repoPath) {
+      const schema = emptySchema();
+      const cfnFiles = findFilesRecursively(repoPath, [".yaml", ".yml", ".json"]);
+      core_1.logger.info(`Scanning ${cfnFiles.length} potential CloudFormation file(s)`);
+      for (const filePath of cfnFiles) {
+        const parsed = parseCFNFile(filePath);
+        if (!parsed)
+          continue;
+        const resources = parsed["Resources"];
+        if (!resources)
+          continue;
+        processCFNResources(resources, schema, filePath, "cloudformation");
+      }
+      return schema;
+    }
+    async function extractCDKSchema(repoPath) {
+      const schema = emptySchema();
+      const cdkOutDir = path5.join(repoPath, "cdk.out");
+      if (fs4.existsSync(cdkOutDir)) {
+        const templateFiles = fs4.readdirSync(cdkOutDir).filter((f) => f.endsWith(".template.json")).map((f) => path5.join(cdkOutDir, f));
+        core_1.logger.info(`Found ${templateFiles.length} CDK synthesized template(s) in cdk.out/`);
+        for (const filePath of templateFiles) {
+          const parsed = parseCFNFile(filePath);
+          if (!parsed)
+            continue;
+          const resources = parsed["Resources"];
+          if (!resources)
+            continue;
+          processCFNResources(resources, schema, filePath, "cdk");
+        }
+      }
+      if (schema.queues.length === 0 && schema.topics.length === 0 && schema.lambdas.length === 0) {
+        const cdkJsonPath = path5.join(repoPath, "cdk.json");
+        if (fs4.existsSync(cdkJsonPath)) {
+          core_1.logger.info("CDK project detected (cdk.json found) \u2014 run `cdk synth` for full IaC analysis");
         }
       }
       return schema;
     }
+    function mergeSchemas(...schemas) {
+      const merged = emptySchema();
+      const seen = {
+        dynamo: /* @__PURE__ */ new Set(),
+        rds: /* @__PURE__ */ new Set(),
+        mongo: /* @__PURE__ */ new Set(),
+        queue: /* @__PURE__ */ new Set(),
+        topic: /* @__PURE__ */ new Set(),
+        lambda: /* @__PURE__ */ new Set(),
+        bucket: /* @__PURE__ */ new Set(),
+        param: /* @__PURE__ */ new Set(),
+        secret: /* @__PURE__ */ new Set(),
+        api: /* @__PURE__ */ new Set()
+      };
+      for (const schema of schemas) {
+        for (const t of schema.dynamoTables) {
+          const k = `${t.source}::${t.name}`;
+          if (!seen.dynamo.has(k)) {
+            seen.dynamo.add(k);
+            merged.dynamoTables.push(t);
+          }
+        }
+        for (const r of schema.rdsInstances) {
+          const k = `${r.source}::${r.identifier}`;
+          if (!seen.rds.has(k)) {
+            seen.rds.add(k);
+            merged.rdsInstances.push(r);
+          }
+        }
+        for (const m of schema.mongoClusters) {
+          const k = `${m.source}::${m.identifier}`;
+          if (!seen.mongo.has(k)) {
+            seen.mongo.add(k);
+            merged.mongoClusters.push(m);
+          }
+        }
+        for (const q of schema.queues) {
+          const k = `${q.source}::${q.name}`;
+          if (!seen.queue.has(k)) {
+            seen.queue.add(k);
+            merged.queues.push(q);
+          }
+        }
+        for (const t of schema.topics) {
+          const k = `${t.source}::${t.name}`;
+          if (!seen.topic.has(k)) {
+            seen.topic.add(k);
+            merged.topics.push(t);
+          }
+        }
+        for (const l of schema.lambdas) {
+          const k = `${l.source}::${l.name}`;
+          if (!seen.lambda.has(k)) {
+            seen.lambda.add(k);
+            merged.lambdas.push(l);
+          }
+        }
+        for (const b of schema.buckets) {
+          const k = `${b.source}::${b.name}`;
+          if (!seen.bucket.has(k)) {
+            seen.bucket.add(k);
+            merged.buckets.push(b);
+          }
+        }
+        for (const p of schema.parameters) {
+          const k = `${p.source}::${p.name}`;
+          if (!seen.param.has(k)) {
+            seen.param.add(k);
+            merged.parameters.push(p);
+          }
+        }
+        for (const s of schema.secrets) {
+          const k = `${s.source}::${s.name}`;
+          if (!seen.secret.has(k)) {
+            seen.secret.add(k);
+            merged.secrets.push(s);
+          }
+        }
+        for (const a of schema.apiGateways) {
+          const k = `${a.source}::${a.name}`;
+          if (!seen.api.has(k)) {
+            seen.api.add(k);
+            merged.apiGateways.push(a);
+          }
+        }
+      }
+      return merged;
+    }
     async function extractIaCSchema2(repoPath) {
-      const [tfSchema, cfnSchema] = await Promise.all([
+      const [tfSchema, cfnSchema, cdkSchema] = await Promise.all([
         extractTerraformSchema(repoPath),
-        extractCloudFormationSchema(repoPath)
+        extractCloudFormationSchema(repoPath),
+        extractCDKSchema(repoPath)
       ]);
-      const dynamoKey = (t) => `${t.source}::${t.name}`;
-      const rdsKey = (r) => `${r.source}::${r.identifier}`;
-      const mongoKey = (m) => `${m.source}::${m.identifier}`;
-      const seenDynamo = /* @__PURE__ */ new Set();
-      const seenRds = /* @__PURE__ */ new Set();
-      const seenMongo = /* @__PURE__ */ new Set();
-      const dynamoTables = [];
-      const rdsInstances = [];
-      const mongoClusters = [];
-      for (const t of [...tfSchema.dynamoTables, ...cfnSchema.dynamoTables]) {
-        const k = dynamoKey(t);
-        if (!seenDynamo.has(k)) {
-          seenDynamo.add(k);
-          dynamoTables.push(t);
-        }
-      }
-      for (const r of [...tfSchema.rdsInstances, ...cfnSchema.rdsInstances]) {
-        const k = rdsKey(r);
-        if (!seenRds.has(k)) {
-          seenRds.add(k);
-          rdsInstances.push(r);
-        }
-      }
-      for (const m of [...tfSchema.mongoClusters, ...cfnSchema.mongoClusters]) {
-        const k = mongoKey(m);
-        if (!seenMongo.has(k)) {
-          seenMongo.add(k);
-          mongoClusters.push(m);
-        }
-      }
-      return { dynamoTables, rdsInstances, mongoClusters };
+      const merged = mergeSchemas(tfSchema, cfnSchema, cdkSchema);
+      const total = merged.dynamoTables.length + merged.rdsInstances.length + merged.mongoClusters.length + merged.queues.length + merged.topics.length + merged.lambdas.length + merged.buckets.length + merged.parameters.length + merged.secrets.length + merged.apiGateways.length;
+      core_1.logger.info(`IaC schema total: ${total} resource(s) across TF/CFN/CDK`);
+      return merged;
     }
   }
 });
 
-// ../context/dist/index.js
+// ../adapters/aws-services/dist/index.js
 var require_dist7 = __commonJS({
+  "../adapters/aws-services/dist/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.extractSQSMetadata = extractSQSMetadata2;
+    exports2.validateSQSAccess = validateSQSAccess2;
+    exports2.extractSNSMetadata = extractSNSMetadata2;
+    exports2.validateSNSAccess = validateSNSAccess2;
+    exports2.extractSSMMetadata = extractSSMMetadata2;
+    exports2.validateSSMAccess = validateSSMAccess2;
+    exports2.extractSecretsMetadata = extractSecretsMetadata2;
+    exports2.validateSecretsAccess = validateSecretsAccess2;
+    exports2.extractLambdaMetadata = extractLambdaMetadata2;
+    exports2.validateLambdaAccess = validateLambdaAccess2;
+    var client_sqs_1 = require("@aws-sdk/client-sqs");
+    var client_sns_1 = require("@aws-sdk/client-sns");
+    var client_ssm_1 = require("@aws-sdk/client-ssm");
+    var client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
+    var client_lambda_1 = require("@aws-sdk/client-lambda");
+    var credential_providers_1 = require("@aws-sdk/credential-providers");
+    var core_1 = require_dist();
+    function clientConfig(cfg) {
+      const region = cfg.region ?? "us-east-1";
+      return cfg.profile ? { region, credentials: (0, credential_providers_1.fromIni)({ profile: cfg.profile }) } : { region };
+    }
+    async function extractSQSMetadata2(cfg = {}) {
+      const client = new client_sqs_1.SQSClient(clientConfig(cfg));
+      const queues = [];
+      try {
+        let nextToken;
+        const queueUrls = [];
+        do {
+          const res = await client.send(new client_sqs_1.ListQueuesCommand({ NextToken: nextToken, MaxResults: 1e3 }));
+          queueUrls.push(...res.QueueUrls ?? []);
+          nextToken = res.NextToken;
+        } while (nextToken);
+        for (const url of queueUrls) {
+          try {
+            const attrs = await client.send(new client_sqs_1.GetQueueAttributesCommand({
+              QueueUrl: url,
+              AttributeNames: [
+                "QueueArn",
+                "VisibilityTimeout",
+                "MessageRetentionPeriod",
+                "RedrivePolicy",
+                "KmsMasterKeyId",
+                "SqsManagedSseEnabled",
+                "ApproximateNumberOfMessages",
+                "ApproximateNumberOfMessagesNotVisible"
+              ]
+            }));
+            const a = attrs.Attributes ?? {};
+            const arn = a["QueueArn"] ?? "";
+            const name = arn.split(":").pop() ?? url.split("/").pop() ?? url;
+            const redrivePolicy = a["RedrivePolicy"];
+            const dlqArn = redrivePolicy ? JSON.parse(redrivePolicy).deadLetterTargetArn : void 0;
+            const encrypted = !!(a["KmsMasterKeyId"] || a["SqsManagedSseEnabled"] === "true");
+            const retentionSeconds = parseInt(a["MessageRetentionPeriod"] ?? "345600", 10);
+            queues.push({
+              name,
+              url,
+              arn,
+              hasDLQ: !!dlqArn,
+              dlqArn,
+              encrypted,
+              visibilityTimeoutSec: parseInt(a["VisibilityTimeout"] ?? "30", 10),
+              retentionDays: Math.round(retentionSeconds / 86400),
+              approximateMessages: parseInt(a["ApproximateNumberOfMessages"] ?? "0", 10),
+              approximateInflight: parseInt(a["ApproximateNumberOfMessagesNotVisible"] ?? "0", 10)
+            });
+          } catch (err) {
+            core_1.logger.warn(`SQS attrs failed for ${url}: ${err instanceof Error ? err.message : String(err)}`);
+          }
+        }
+      } catch (err) {
+        core_1.logger.warn(`SQS list failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+      return queues;
+    }
+    async function validateSQSAccess2(cfg = {}) {
+      await new client_sqs_1.SQSClient(clientConfig(cfg)).send(new client_sqs_1.ListQueuesCommand({ MaxResults: 1 }));
+    }
+    async function extractSNSMetadata2(cfg = {}) {
+      const client = new client_sns_1.SNSClient(clientConfig(cfg));
+      const topics = [];
+      try {
+        let nextToken;
+        const topicArns = [];
+        do {
+          const res = await client.send(new client_sns_1.ListTopicsCommand({ NextToken: nextToken }));
+          topicArns.push(...(res.Topics ?? []).map((t) => t.TopicArn ?? "").filter(Boolean));
+          nextToken = res.NextToken;
+        } while (nextToken);
+        for (const arn of topicArns) {
+          try {
+            const [attrsRes, subsRes] = await Promise.all([
+              client.send(new client_sns_1.GetTopicAttributesCommand({ TopicArn: arn })),
+              client.send(new client_sns_1.ListSubscriptionsByTopicCommand({ TopicArn: arn }))
+            ]);
+            const attrs = attrsRes.Attributes ?? {};
+            const subs = subsRes.Subscriptions ?? [];
+            topics.push({
+              name: arn.split(":").pop() ?? arn,
+              arn,
+              encrypted: !!attrs["KmsMasterKeyId"],
+              subscriptionCount: subs.length,
+              subscriptionProtocols: [...new Set(subs.map((s) => s.Protocol ?? "unknown"))]
+            });
+          } catch (err) {
+            core_1.logger.warn(`SNS attrs failed for ${arn}: ${err instanceof Error ? err.message : String(err)}`);
+          }
+        }
+      } catch (err) {
+        core_1.logger.warn(`SNS list failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+      return topics;
+    }
+    async function validateSNSAccess2(cfg = {}) {
+      await new client_sns_1.SNSClient(clientConfig(cfg)).send(new client_sns_1.ListTopicsCommand({}));
+    }
+    async function extractSSMMetadata2(cfg = {}) {
+      const client = new client_ssm_1.SSMClient(clientConfig(cfg));
+      const parameters = [];
+      try {
+        let nextToken;
+        do {
+          const res = await client.send(new client_ssm_1.DescribeParametersCommand({
+            NextToken: nextToken,
+            MaxResults: 50
+            // Only metadata — GetParameter/GetParameters would return values
+          }));
+          for (const p of res.Parameters ?? []) {
+            parameters.push({
+              name: p.Name ?? "",
+              type: p.Type ?? "String",
+              tier: p.Tier ?? "Standard",
+              lastModified: p.LastModifiedDate?.toISOString(),
+              description: p.Description,
+              keyId: p.KeyId
+            });
+          }
+          nextToken = res.NextToken;
+        } while (nextToken && parameters.length < 500);
+      } catch (err) {
+        core_1.logger.warn(`SSM list failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+      return parameters;
+    }
+    async function validateSSMAccess2(cfg = {}) {
+      await new client_ssm_1.SSMClient(clientConfig(cfg)).send(new client_ssm_1.DescribeParametersCommand({ MaxResults: 1 }));
+    }
+    async function extractSecretsMetadata2(cfg = {}) {
+      const client = new client_secrets_manager_1.SecretsManagerClient(clientConfig(cfg));
+      const secrets = [];
+      try {
+        let nextToken;
+        do {
+          const res = await client.send(new client_secrets_manager_1.ListSecretsCommand({ NextToken: nextToken, MaxResults: 100 }));
+          for (const s of res.SecretList ?? []) {
+            secrets.push({
+              name: s.Name ?? "",
+              arn: s.ARN ?? "",
+              rotationEnabled: s.RotationEnabled ?? false,
+              rotationDays: s.RotationRules?.AutomaticallyAfterDays,
+              lastRotated: s.LastRotatedDate?.toISOString(),
+              lastAccessed: s.LastAccessedDate?.toISOString(),
+              description: s.Description
+            });
+          }
+          nextToken = res.NextToken;
+        } while (nextToken && secrets.length < 200);
+      } catch (err) {
+        core_1.logger.warn(`Secrets Manager list failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+      return secrets;
+    }
+    async function validateSecretsAccess2(cfg = {}) {
+      await new client_secrets_manager_1.SecretsManagerClient(clientConfig(cfg)).send(new client_secrets_manager_1.ListSecretsCommand({ MaxResults: 1 }));
+    }
+    async function extractLambdaMetadata2(cfg = {}) {
+      const client = new client_lambda_1.LambdaClient(clientConfig(cfg));
+      const functions = [];
+      try {
+        let marker;
+        do {
+          const res = await client.send(new client_lambda_1.ListFunctionsCommand({ Marker: marker, MaxItems: 50 }));
+          for (const fn of res.Functions ?? []) {
+            functions.push({
+              name: fn.FunctionName ?? "",
+              arn: fn.FunctionArn ?? "",
+              runtime: fn.Runtime,
+              handler: fn.Handler,
+              memoryMB: fn.MemorySize,
+              timeoutSec: fn.Timeout,
+              lastModified: fn.LastModified,
+              envVarKeys: Object.keys(fn.Environment?.Variables ?? {}),
+              layers: (fn.Layers ?? []).map((l) => l.Arn ?? "").filter(Boolean)
+            });
+          }
+          marker = res.NextMarker;
+        } while (marker && functions.length < 200);
+      } catch (err) {
+        core_1.logger.warn(`Lambda list failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+      return functions;
+    }
+    async function validateLambdaAccess2(cfg = {}) {
+      await new client_lambda_1.LambdaClient(clientConfig(cfg)).send(new client_lambda_1.ListFunctionsCommand({ MaxItems: 1 }));
+    }
+  }
+});
+
+// ../adapters/logs/dist/index.js
+var require_dist8 = __commonJS({
+  "../adapters/logs/dist/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.extractLogsSummary = extractLogsSummary2;
+    exports2.validateLogsAccess = validateLogsAccess2;
+    var client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
+    var credential_providers_1 = require("@aws-sdk/credential-providers");
+    var core_1 = require_dist();
+    var MAX_LOG_GROUPS = 50;
+    var MAX_EVENTS_PER_GROUP = 50;
+    function clientConfig(cfg) {
+      const region = cfg.region ?? "us-east-1";
+      return cfg.profile ? { region, credentials: (0, credential_providers_1.fromIni)({ profile: cfg.profile }) } : { region };
+    }
+    function toPattern(message) {
+      return message.slice(0, 200).replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, "<UUID>").replace(/\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(\.\d+)?Z?/g, "<TIMESTAMP>").replace(/\b\d{5,}\b/g, "<NUM>").replace(/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g, "<IP>").replace(/Bearer\s+\S+/gi, "Bearer <TOKEN>").trim();
+    }
+    function topPatterns(messages, limit = 5) {
+      const counts = {};
+      for (const msg of messages) {
+        const p = toPattern(msg);
+        counts[p] = (counts[p] ?? 0) + 1;
+      }
+      return Object.entries(counts).sort((a, b) => b[1] - a[1]).slice(0, limit).map(([pattern, count]) => ({ pattern, count }));
+    }
+    async function extractLogsSummary2(cfg = {}) {
+      const client = new client_cloudwatch_logs_1.CloudWatchLogsClient(clientConfig(cfg));
+      const windowMs = (cfg.windowHours ?? 24) * 60 * 60 * 1e3;
+      const startTime = Date.now() - windowMs;
+      const summaries = [];
+      const logGroups = [];
+      try {
+        const prefixes = cfg.logGroupPrefixes?.length ? cfg.logGroupPrefixes : [void 0];
+        for (const prefix of prefixes) {
+          let nextToken;
+          do {
+            const res = await client.send(new client_cloudwatch_logs_1.DescribeLogGroupsCommand({
+              nextToken,
+              limit: Math.min(50, MAX_LOG_GROUPS - logGroups.length),
+              ...prefix ? { logGroupNamePrefix: prefix } : {}
+            }));
+            for (const lg of res.logGroups ?? []) {
+              logGroups.push({ name: lg.logGroupName ?? "", retentionDays: lg.retentionInDays });
+            }
+            nextToken = res.nextToken;
+            if (logGroups.length >= MAX_LOG_GROUPS)
+              break;
+          } while (nextToken);
+          if (logGroups.length >= MAX_LOG_GROUPS)
+            break;
+        }
+      } catch (err) {
+        core_1.logger.warn(`CloudWatch Logs discovery failed: ${err instanceof Error ? err.message : String(err)}`);
+        return summaries;
+      }
+      for (const lg of logGroups) {
+        const errorMessages = [];
+        const warnMessages = [];
+        let lastErrorTime;
+        for (const filterPattern of ["ERROR", "Exception", "WARN"]) {
+          if (errorMessages.length + warnMessages.length >= MAX_EVENTS_PER_GROUP)
+            break;
+          try {
+            const res = await client.send(new client_cloudwatch_logs_1.FilterLogEventsCommand({
+              logGroupName: lg.name,
+              filterPattern,
+              startTime,
+              limit: 25
+            }));
+            for (const event of res.events ?? []) {
+              const msg = event.message ?? "";
+              if (filterPattern === "WARN") {
+                warnMessages.push(msg);
+              } else {
+                errorMessages.push(msg);
+                if (event.timestamp) {
+                  const ts = new Date(event.timestamp).toISOString();
+                  if (!lastErrorTime || ts > lastErrorTime)
+                    lastErrorTime = ts;
+                }
+              }
+            }
+          } catch {
+          }
+        }
+        summaries.push({
+          logGroupName: lg.name,
+          retentionDays: lg.retentionDays,
+          errorCount: errorMessages.length,
+          warnCount: warnMessages.length,
+          topErrorPatterns: topPatterns(errorMessages),
+          lastErrorTime
+        });
+      }
+      core_1.logger.info(`CloudWatch Logs: sampled ${summaries.length} log group(s)`);
+      return summaries;
+    }
+    async function validateLogsAccess2(cfg = {}) {
+      await new client_cloudwatch_logs_1.CloudWatchLogsClient(clientConfig(cfg)).send(new client_cloudwatch_logs_1.DescribeLogGroupsCommand({ limit: 1 }));
+    }
+  }
+});
+
+// ../context/dist/index.js
+var require_dist9 = __commonJS({
   "../context/dist/index.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
@@ -1329,6 +1874,16 @@ var require_dist7 = __commonJS({
       "estimatedDocumentCount"
     ]);
     var MONGO_COLLECTION_METHODS = /* @__PURE__ */ new Set(["collection"]);
+    var SQS_COMMANDS = /* @__PURE__ */ new Set(["SendMessageCommand", "SendMessageBatchCommand", "ReceiveMessageCommand", "DeleteMessageCommand", "sendMessage", "sendMessageBatch", "receiveMessage"]);
+    var SNS_COMMANDS = /* @__PURE__ */ new Set(["PublishCommand", "PublishBatchCommand", "publish", "publishBatch"]);
+    var SSM_COMMANDS = /* @__PURE__ */ new Set(["GetParameterCommand", "GetParametersCommand", "GetParametersByPathCommand", "getParameter", "getParameters", "getParametersByPath"]);
+    var SECRETS_COMMANDS = /* @__PURE__ */ new Set(["GetSecretValueCommand", "getSecretValue"]);
+    var LAMBDA_COMMANDS = /* @__PURE__ */ new Set(["InvokeCommand", "InvokeAsyncCommand", "invoke", "invokeAsync"]);
+    var SQS_ARG_KEYS = ["QueueUrl", "QueueName"];
+    var SNS_ARG_KEYS = ["TopicArn", "TargetArn"];
+    var SSM_ARG_KEYS = ["Name", "Path"];
+    var SECRETS_ARG_KEYS = ["SecretId", "SecretName"];
+    var LAMBDA_ARG_KEYS = ["FunctionName"];
     var PRISMA_METHODS = /* @__PURE__ */ new Set([
       "findMany",
       "findFirst",
@@ -1603,67 +2158,192 @@ var require_dist7 = __commonJS({
       }
       return null;
     }
-    async function scanRepository2(repoPath) {
-      const resolvedPath = path5.resolve(repoPath);
-      if (!fs4.existsSync(resolvedPath)) {
-        throw new core_1.RepositoryScanError(`Path does not exist: ${resolvedPath}`);
-      }
-      const tsconfigPath = path5.join(resolvedPath, "tsconfig.json");
-      const hasTsConfig = fs4.existsSync(tsconfigPath);
-      const project = new ts_morph_1.Project({
-        tsConfigFilePath: hasTsConfig ? tsconfigPath : void 0,
-        compilerOptions: hasTsConfig ? void 0 : {
-          target: 99,
-          allowJs: true
-        },
-        skipAddingFilesFromTsConfig: !hasTsConfig
-      });
-      if (!hasTsConfig) {
-        project.addSourceFilesAtPaths([
-          path5.join(resolvedPath, "**/*.ts"),
-          path5.join(resolvedPath, "**/*.tsx"),
-          `!${path5.join(resolvedPath, "**/node_modules/**")}`,
-          `!${path5.join(resolvedPath, "**/dist/**")}`
-        ]);
-      }
-      const sourceFiles = project.getSourceFiles();
-      core_1.logger.info(`Scanning ${sourceFiles.length} TypeScript file(s) in ${resolvedPath}`);
-      const operations = [];
-      for (const sourceFile of sourceFiles) {
-        const filePath = sourceFile.getFilePath();
-        if (filePath.includes("node_modules") || filePath.includes("/dist/"))
-          continue;
-        const callExpressions = sourceFile.getDescendantsOfKind(ts_morph_1.SyntaxKind.CallExpression);
-        for (const callExpr of callExpressions) {
-          const dynamoOp = detectDynamoOperations(callExpr, filePath);
-          if (dynamoOp) {
-            operations.push(dynamoOp);
-            continue;
-          }
-          const postgresOp = detectPostgresOperations(callExpr, filePath);
-          if (postgresOp) {
-            operations.push(postgresOp);
-            continue;
-          }
-          const mysqlOp = detectMySQLOperations(callExpr, filePath);
-          if (mysqlOp) {
-            operations.push(mysqlOp);
-            continue;
-          }
-          const mongoOp = detectMongoOperations(callExpr, filePath);
-          if (mongoOp) {
-            operations.push(mongoOp);
+    function extractArgValue(arg, ...keys) {
+      if (ts_morph_1.Node.isObjectLiteralExpression(arg)) {
+        for (const prop of arg.getProperties()) {
+          if (ts_morph_1.Node.isPropertyAssignment(prop) && keys.includes(prop.getName())) {
+            const init = prop.getInitializer();
+            if (init && ts_morph_1.Node.isStringLiteral(init)) {
+              const val = init.getLiteralValue();
+              return val.includes(":") ? val.split(":").pop() ?? val : val;
+            }
           }
         }
       }
-      core_1.logger.info(`Extracted ${operations.length} database operation(s)`);
-      return operations;
+      return "unknown";
+    }
+    function detectAWSServiceOperations(callExpr, filePath) {
+      const expr = callExpr.getExpression();
+      const args = callExpr.getArguments();
+      if (ts_morph_1.Node.isPropertyAccessExpression(expr) && expr.getName() === "send" && args.length > 0) {
+        const firstArg = args[0];
+        if (ts_morph_1.Node.isNewExpression(firstArg)) {
+          const className = firstArg.getExpression().getText();
+          const cmdArgs = firstArg.getArguments();
+          if (SQS_COMMANDS.has(className)) {
+            return {
+              functionName: getEnclosingFunctionName(callExpr),
+              operationType: className,
+              databaseType: "sqs",
+              target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SQS_ARG_KEYS) : "unknown",
+              filePath
+            };
+          }
+          if (SNS_COMMANDS.has(className)) {
+            return {
+              functionName: getEnclosingFunctionName(callExpr),
+              operationType: className,
+              databaseType: "sns",
+              target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SNS_ARG_KEYS) : "unknown",
+              filePath
+            };
+          }
+          if (SSM_COMMANDS.has(className)) {
+            return {
+              functionName: getEnclosingFunctionName(callExpr),
+              operationType: className,
+              databaseType: "ssm",
+              target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SSM_ARG_KEYS) : "unknown",
+              filePath
+            };
+          }
+          if (SECRETS_COMMANDS.has(className)) {
+            return {
+              functionName: getEnclosingFunctionName(callExpr),
+              operationType: className,
+              databaseType: "secretsmanager",
+              target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SECRETS_ARG_KEYS) : "unknown",
+              filePath
+            };
+          }
+          if (LAMBDA_COMMANDS.has(className)) {
+            return {
+              functionName: getEnclosingFunctionName(callExpr),
+              operationType: className,
+              databaseType: "lambda",
+              target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...LAMBDA_ARG_KEYS) : "unknown",
+              filePath
+            };
+          }
+        }
+      }
+      if (ts_morph_1.Node.isPropertyAccessExpression(expr)) {
+        const methodName = expr.getName();
+        const objText = expr.getExpression().getText().toLowerCase();
+        if (SQS_COMMANDS.has(methodName) && (objText.includes("sqs") || objText.includes("queue"))) {
+          return {
+            functionName: getEnclosingFunctionName(callExpr),
+            operationType: methodName,
+            databaseType: "sqs",
+            target: args.length > 0 ? extractArgValue(args[0], ...SQS_ARG_KEYS) : "unknown",
+            filePath
+          };
+        }
+        if (SNS_COMMANDS.has(methodName) && (objText.includes("sns") || objText.includes("topic"))) {
+          return {
+            functionName: getEnclosingFunctionName(callExpr),
+            operationType: methodName,
+            databaseType: "sns",
+            target: args.length > 0 ? extractArgValue(args[0], ...SNS_ARG_KEYS) : "unknown",
+            filePath
+          };
+        }
+        if (SSM_COMMANDS.has(methodName) && (objText.includes("ssm") || objText.includes("parameter"))) {
+          return {
+            functionName: getEnclosingFunctionName(callExpr),
+            operationType: methodName,
+            databaseType: "ssm",
+            target: args.length > 0 ? extractArgValue(args[0], ...SSM_ARG_KEYS) : "unknown",
+            filePath
+          };
+        }
+        if (SECRETS_COMMANDS.has(methodName) && (objText.includes("secret") || objText.includes("secrets"))) {
+          return {
+            functionName: getEnclosingFunctionName(callExpr),
+            operationType: methodName,
+            databaseType: "secretsmanager",
+            target: args.length > 0 ? extractArgValue(args[0], ...SECRETS_ARG_KEYS) : "unknown",
+            filePath
+          };
+        }
+        if (LAMBDA_COMMANDS.has(methodName) && (objText.includes("lambda") || objText.includes("fn"))) {
+          return {
+            functionName: getEnclosingFunctionName(callExpr),
+            operationType: methodName,
+            databaseType: "lambda",
+            target: args.length > 0 ? extractArgValue(args[0], ...LAMBDA_ARG_KEYS) : "unknown",
+            filePath
+          };
+        }
+      }
+      return null;
+    }
+    async function scanRepository2(repoPath) {
+      const resolvedPath = path5.resolve(repoPath);
+      if (!fs4.existsSync(resolvedPath)) {
+        throw new core_1.RepositoryScanError(`Path does not exist: ${resolvedPath}`);
+      }
+      const tsconfigPath = path5.join(resolvedPath, "tsconfig.json");
+      const hasTsConfig = fs4.existsSync(tsconfigPath);
+      const project = new ts_morph_1.Project({
+        tsConfigFilePath: hasTsConfig ? tsconfigPath : void 0,
+        compilerOptions: hasTsConfig ? void 0 : {
+          target: 99,
+          allowJs: true
+        },
+        skipAddingFilesFromTsConfig: !hasTsConfig
+      });
+      if (!hasTsConfig) {
+        project.addSourceFilesAtPaths([
+          path5.join(resolvedPath, "**/*.ts"),
+          path5.join(resolvedPath, "**/*.tsx"),
+          `!${path5.join(resolvedPath, "**/node_modules/**")}`,
+          `!${path5.join(resolvedPath, "**/dist/**")}`
+        ]);
+      }
+      const sourceFiles = project.getSourceFiles();
+      core_1.logger.info(`Scanning ${sourceFiles.length} TypeScript file(s) in ${resolvedPath}`);
+      const operations = [];
+      for (const sourceFile of sourceFiles) {
+        const filePath = sourceFile.getFilePath();
+        if (filePath.includes("node_modules") || filePath.includes("/dist/"))
+          continue;
+        const callExpressions = sourceFile.getDescendantsOfKind(ts_morph_1.SyntaxKind.CallExpression);
+        for (const callExpr of callExpressions) {
+          const dynamoOp = detectDynamoOperations(callExpr, filePath);
+          if (dynamoOp) {
+            operations.push(dynamoOp);
+            continue;
+          }
+          const postgresOp = detectPostgresOperations(callExpr, filePath);
+          if (postgresOp) {
+            operations.push(postgresOp);
+            continue;
+          }
+          const mysqlOp = detectMySQLOperations(callExpr, filePath);
+          if (mysqlOp) {
+            operations.push(mysqlOp);
+            continue;
+          }
+          const mongoOp = detectMongoOperations(callExpr, filePath);
+          if (mongoOp) {
+            operations.push(mongoOp);
+            continue;
+          }
+          const awsOp = detectAWSServiceOperations(callExpr, filePath);
+          if (awsOp) {
+            operations.push(awsOp);
+          }
+        }
+      }
+      core_1.logger.info(`Extracted ${operations.length} database operation(s)`);
+      return operations;
     }
   }
 });
 
 // ../graph/dist/index.js
-var require_dist8 = __commonJS({
+var require_dist10 = __commonJS({
   "../graph/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -1671,157 +2351,200 @@ var require_dist8 = __commonJS({
     exports2.getTableNodes = getTableNodes;
     exports2.getFunctionNodes = getFunctionNodes;
     exports2.getIndexNodes = getIndexNodes;
+    exports2.getQueueNodes = getQueueNodes;
+    exports2.getTopicNodes = getTopicNodes;
+    exports2.getSecretNodes = getSecretNodes;
+    exports2.getParameterNodes = getParameterNodes;
+    exports2.getLogGroupNodes = getLogGroupNodes;
+    exports2.getLambdaNodes = getLambdaNodes;
     exports2.getEdgesForNode = getEdgesForNode;
     exports2.getOutgoingEdges = getOutgoingEdges;
     exports2.getIncomingEdges = getIncomingEdges;
     exports2.getScanEdges = getScanEdges;
     exports2.getEdgeFrequency = getEdgeFrequency;
-    function buildGraph2(operations, dynamoMeta, postgresMeta, mysqlMeta = [], mongoMeta = []) {
+    function buildGraph2(operations, dynamoMeta, postgresMeta, mysqlMeta = [], mongoMeta = [], servicesMeta = {}) {
       const nodes = [];
       const edges = [];
       const nodeIds = /* @__PURE__ */ new Set();
+      function addNode(node) {
+        if (!nodeIds.has(node.id)) {
+          nodes.push(node);
+          nodeIds.add(node.id);
+        }
+      }
       for (const table of dynamoMeta) {
         const nodeId = `table:dynamo:${table.tableName}`;
-        if (!nodeIds.has(nodeId)) {
-          nodes.push({
-            id: nodeId,
-            type: "table",
-            name: table.tableName,
-            databaseType: "dynamodb"
-          });
-          nodeIds.add(nodeId);
-        }
+        addNode({ id: nodeId, type: "table", name: table.tableName, databaseType: "dynamodb" });
         for (const indexName of table.indexes) {
           const indexNodeId = `index:${table.tableName}:${indexName}`;
-          if (!nodeIds.has(indexNodeId)) {
-            nodes.push({ id: indexNodeId, type: "index", name: indexName });
-            nodeIds.add(indexNodeId);
-          }
+          addNode({ id: indexNodeId, type: "index", name: indexName });
           edges.push({ from: nodeId, to: indexNodeId, type: "uses_index" });
         }
       }
       for (const table of postgresMeta) {
         const nodeId = `table:postgres:${table.schema}.${table.table}`;
-        if (!nodeIds.has(nodeId)) {
-          nodes.push({
-            id: nodeId,
-            type: "table",
-            name: `${table.schema}.${table.table}`,
-            databaseType: "postgres"
-          });
-          nodeIds.add(nodeId);
-        }
+        addNode({ id: nodeId, type: "table", name: `${table.schema}.${table.table}`, databaseType: "postgres" });
         for (const indexName of table.indexes) {
           const indexNodeId = `index:${table.schema}.${table.table}:${indexName}`;
-          if (!nodeIds.has(indexNodeId)) {
-            nodes.push({ id: indexNodeId, type: "index", name: indexName });
-            nodeIds.add(indexNodeId);
-          }
+          addNode({ id: indexNodeId, type: "index", name: indexName });
           edges.push({ from: nodeId, to: indexNodeId, type: "uses_index" });
         }
       }
       for (const table of mysqlMeta) {
         const nodeId = `table:mysql:${table.schema}.${table.table}`;
-        if (!nodeIds.has(nodeId)) {
-          nodes.push({
-            id: nodeId,
-            type: "table",
-            name: `${table.schema}.${table.table}`,
-            databaseType: "mysql"
-          });
-          nodeIds.add(nodeId);
-        }
+        addNode({ id: nodeId, type: "table", name: `${table.schema}.${table.table}`, databaseType: "mysql" });
         for (const indexName of table.indexes) {
           const indexNodeId = `index:${table.schema}.${table.table}:${indexName}`;
-          if (!nodeIds.has(indexNodeId)) {
-            nodes.push({ id: indexNodeId, type: "index", name: indexName });
-            nodeIds.add(indexNodeId);
-          }
+          addNode({ id: indexNodeId, type: "index", name: indexName });
           edges.push({ from: nodeId, to: indexNodeId, type: "uses_index" });
         }
       }
       for (const coll of mongoMeta) {
         const nodeId = `table:mongodb:${coll.database}.${coll.collection}`;
-        if (!nodeIds.has(nodeId)) {
-          nodes.push({
-            id: nodeId,
-            type: "table",
-            name: `${coll.database}.${coll.collection}`,
-            databaseType: "mongodb"
-          });
-          nodeIds.add(nodeId);
-        }
+        addNode({ id: nodeId, type: "table", name: `${coll.database}.${coll.collection}`, databaseType: "mongodb" });
         for (const idx of coll.indexes) {
           if (idx.name === "_id_")
             continue;
           const indexNodeId = `index:${coll.database}.${coll.collection}:${idx.name}`;
-          if (!nodeIds.has(indexNodeId)) {
-            nodes.push({ id: indexNodeId, type: "index", name: idx.name });
-            nodeIds.add(indexNodeId);
-          }
+          addNode({ id: indexNodeId, type: "index", name: idx.name });
           edges.push({ from: nodeId, to: indexNodeId, type: "uses_index" });
         }
       }
+      for (const q of servicesMeta.sqs ?? []) {
+        addNode({
+          id: `queue:aws:${q.name}`,
+          type: "queue",
+          name: q.name,
+          provider: "aws",
+          hasDLQ: q.hasDLQ,
+          encrypted: q.encrypted,
+          approximateMessages: q.approximateMessages,
+          retentionDays: q.retentionDays
+        });
+      }
+      for (const t of servicesMeta.sns ?? []) {
+        addNode({
+          id: `topic:aws:${t.name}`,
+          type: "topic",
+          name: t.name,
+          provider: "aws",
+          subscriptionCount: t.subscriptionCount,
+          encrypted: t.encrypted
+        });
+      }
+      for (const s of servicesMeta.secrets ?? []) {
+        addNode({
+          id: `secret:aws:${s.name}`,
+          type: "secret",
+          name: s.name,
+          provider: "aws",
+          rotationEnabled: s.rotationEnabled,
+          rotationDays: s.rotationDays
+        });
+      }
+      for (const p of servicesMeta.ssm ?? []) {
+        addNode({
+          id: `parameter:aws:${p.name}`,
+          type: "parameter",
+          name: p.name,
+          provider: "aws",
+          paramType: p.type,
+          tier: p.tier
+        });
+      }
+      for (const lg of servicesMeta.logs ?? []) {
+        addNode({
+          id: `log_group:aws:${lg.logGroupName}`,
+          type: "log_group",
+          name: lg.logGroupName,
+          provider: "aws",
+          retentionDays: lg.retentionDays,
+          errorCount: lg.errorCount,
+          topErrorPatterns: lg.topErrorPatterns
+        });
+      }
+      for (const fn of servicesMeta.lambda ?? []) {
+        addNode({
+          id: `lambda:aws:${fn.name}`,
+          type: "lambda",
+          name: fn.name,
+          runtime: fn.runtime,
+          memoryMB: fn.memoryMB,
+          timeoutSec: fn.timeoutSec,
+          envVarKeys: fn.envVarKeys
+        });
+      }
       for (const op of operations) {
         const funcNodeId = `function:${op.filePath}:${op.functionName}`;
         if (!nodeIds.has(funcNodeId)) {
-          nodes.push({
-            id: funcNodeId,
-            type: "function",
-            name: op.functionName,
-            file: op.filePath
-          });
+          nodes.push({ id: funcNodeId, type: "function", name: op.functionName, file: op.filePath });
           nodeIds.add(funcNodeId);
         }
+        if (op.databaseType === "sqs") {
+          const queueId = `queue:aws:${op.target}`;
+          if (!nodeIds.has(queueId)) {
+            addNode({ id: queueId, type: "queue", name: op.target, provider: "aws", hasDLQ: false, encrypted: false });
+          }
+          edges.push({ from: funcNodeId, to: queueId, type: "publishes_to" });
+          continue;
+        }
+        if (op.databaseType === "sns") {
+          const topicId = `topic:aws:${op.target}`;
+          if (!nodeIds.has(topicId)) {
+            addNode({ id: topicId, type: "topic", name: op.target, provider: "aws", encrypted: false });
+          }
+          edges.push({ from: funcNodeId, to: topicId, type: "publishes_to" });
+          continue;
+        }
+        if (op.databaseType === "ssm") {
+          const paramId = `parameter:aws:${op.target}`;
+          if (!nodeIds.has(paramId)) {
+            addNode({ id: paramId, type: "parameter", name: op.target, provider: "aws", paramType: "String", tier: "Standard" });
+          }
+          edges.push({ from: funcNodeId, to: paramId, type: "reads_parameter" });
+          continue;
+        }
+        if (op.databaseType === "secretsmanager") {
+          const secretId = `secret:aws:${op.target}`;
+          if (!nodeIds.has(secretId)) {
+            addNode({ id: secretId, type: "secret", name: op.target, provider: "aws", rotationEnabled: false });
+          }
+          edges.push({ from: funcNodeId, to: secretId, type: "reads_secret" });
+          continue;
+        }
+        if (op.databaseType === "lambda") {
+          const lambdaId = `lambda:aws:${op.target}`;
+          if (!nodeIds.has(lambdaId)) {
+            addNode({ id: lambdaId, type: "lambda", name: op.target });
+          }
+          edges.push({ from: funcNodeId, to: lambdaId, type: "triggers" });
+          continue;
+        }
         let tableNodeId;
         if (op.databaseType === "dynamodb") {
           tableNodeId = `table:dynamo:${op.target}`;
           if (!nodeIds.has(tableNodeId)) {
-            nodes.push({
-              id: tableNodeId,
-              type: "table",
-              name: op.target,
-              databaseType: "dynamodb"
-            });
-            nodeIds.add(tableNodeId);
+            addNode({ id: tableNodeId, type: "table", name: op.target, databaseType: "dynamodb" });
           }
         } else if (op.databaseType === "mysql") {
-          const qualifiedTarget = op.target.includes(".") ? op.target : `default.${op.target}`;
-          tableNodeId = `table:mysql:${qualifiedTarget}`;
+          const q = op.target.includes(".") ? op.target : `default.${op.target}`;
+          tableNodeId = `table:mysql:${q}`;
           if (!nodeIds.has(tableNodeId)) {
-            nodes.push({
-              id: tableNodeId,
-              type: "table",
-              name: qualifiedTarget,
-              databaseType: "mysql"
-            });
-            nodeIds.add(tableNodeId);
+            addNode({ id: tableNodeId, type: "table", name: q, databaseType: "mysql" });
           }
         } else if (op.databaseType === "mongodb") {
-          const qualifiedTarget = op.target.includes(".") ? op.target : `default.${op.target}`;
-          tableNodeId = `table:mongodb:${qualifiedTarget}`;
+          const q = op.target.includes(".") ? op.target : `default.${op.target}`;
+          tableNodeId = `table:mongodb:${q}`;
           if (!nodeIds.has(tableNodeId)) {
-            nodes.push({
-              id: tableNodeId,
-              type: "table",
-              name: qualifiedTarget,
-              databaseType: "mongodb"
-            });
-            nodeIds.add(tableNodeId);
+            addNode({ id: tableNodeId, type: "table", name: q, databaseType: "mongodb" });
           }
         } else {
-          const qualifiedTarget = op.target.includes(".") ? op.target : `public.${op.target}`;
-          tableNodeId = `table:postgres:${qualifiedTarget}`;
+          const q = op.target.includes(".") ? op.target : `public.${op.target}`;
+          tableNodeId = `table:postgres:${q}`;
           if (!nodeIds.has(tableNodeId)) {
-            const parts = qualifiedTarget.split(".");
-            nodes.push({
-              id: tableNodeId,
-              type: "table",
-              name: qualifiedTarget,
-              databaseType: "postgres"
-            });
-            nodeIds.add(tableNodeId);
-            if (!postgresMeta.find((t) => `${t.schema}.${t.table}` === qualifiedTarget)) {
+            const parts = q.split(".");
+            addNode({ id: tableNodeId, type: "table", name: q, databaseType: "postgres" });
+            if (!postgresMeta.find((t) => `${t.schema}.${t.table}` === q)) {
               postgresMeta.push({
                 schema: parts[0] ?? "public",
                 table: parts[1] ?? op.target,
@@ -1854,6 +2577,24 @@ var require_dist8 = __commonJS({
     function getIndexNodes(graph) {
       return graph.nodes.filter((n) => n.type === "index");
     }
+    function getQueueNodes(graph) {
+      return graph.nodes.filter((n) => n.type === "queue");
+    }
+    function getTopicNodes(graph) {
+      return graph.nodes.filter((n) => n.type === "topic");
+    }
+    function getSecretNodes(graph) {
+      return graph.nodes.filter((n) => n.type === "secret");
+    }
+    function getParameterNodes(graph) {
+      return graph.nodes.filter((n) => n.type === "parameter");
+    }
+    function getLogGroupNodes(graph) {
+      return graph.nodes.filter((n) => n.type === "log_group");
+    }
+    function getLambdaNodes(graph) {
+      return graph.nodes.filter((n) => n.type === "lambda");
+    }
     function getEdgesForNode(graph, nodeId) {
       return graph.edges.filter((e) => e.from === nodeId || e.to === nodeId);
     }
@@ -1883,7 +2624,7 @@ var require_dynamodb = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.HotPartitionAnalyzer = exports2.MissingGSIAnalyzer = exports2.FullTableScanAnalyzer = void 0;
-    var graph_1 = require_dist8();
+    var graph_1 = require_dist10();
     var FullTableScanAnalyzer = class {
       name = "FullTableScanAnalyzer";
       async analyze(graph) {
@@ -2136,7 +2877,7 @@ var require_mysql = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.MySQLFullTableScanAnalyzer = exports2.MissingMySQLIndexAnalyzer = void 0;
-    var graph_1 = require_dist8();
+    var graph_1 = require_dist10();
     var MissingMySQLIndexAnalyzer = class {
       name = "MissingMySQLIndexAnalyzer";
       async analyze(graph) {
@@ -2214,7 +2955,7 @@ var require_mongodb = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.MongoCollectionScanAnalyzer = exports2.MissingMongoIndexAnalyzer = void 0;
-    var graph_1 = require_dist8();
+    var graph_1 = require_dist10();
     var MissingMongoIndexAnalyzer = class {
       name = "MissingMongoIndexAnalyzer";
       async analyze(graph) {
@@ -2300,40 +3041,78 @@ var require_terraform = __commonJS({
       }
       async analyze(graph) {
         const findings = [];
-        if (!this.iacSchema) {
+        if (!this.iacSchema)
           return findings;
+        const iac = this.iacSchema;
+        const deployedDynamo = new Set(graph.nodes.filter((n) => n.type === "table" && n.databaseType === "dynamodb").map((n) => n.name));
+        const iacDynamo = new Map(iac.dynamoTables.map((t) => [t.name, t.filePath]));
+        for (const [name, fp] of iacDynamo) {
+          if (!deployedDynamo.has(name)) {
+            findings.push({
+              severity: "medium",
+              issue: `IaC drift: DynamoDB table "${name}" defined in IaC but not deployed`,
+              description: `"${name}" is in ${fp} but not found in AWS. It may be undeployed or deleted manually.`,
+              recommendation: "Run `terraform apply` / deploy your stack, or remove the definition from IaC.",
+              metadata: { resourceType: "dynamodb_table", name, filePath: fp, driftType: "defined_not_deployed" }
+            });
+          }
         }
-        const deployedDynamoTables = new Set(graph.nodes.filter((n) => n.type === "table" && n.databaseType === "dynamodb").map((n) => n.name));
-        const iacDynamoTables = /* @__PURE__ */ new Map();
-        for (const t of this.iacSchema.dynamoTables) {
-          iacDynamoTables.set(t.name, t.filePath);
+        for (const name of deployedDynamo) {
+          if (!iacDynamo.has(name)) {
+            findings.push({
+              severity: "medium",
+              issue: `IaC drift: DynamoDB table "${name}" deployed but not in IaC`,
+              description: `"${name}" exists in AWS DynamoDB but has no IaC definition. It may have been created manually.`,
+              recommendation: "Import the table with `terraform import` or add a CloudFormation resource, then track all future changes through IaC.",
+              metadata: { resourceType: "dynamodb_table", name, driftType: "deployed_not_defined" }
+            });
+          }
         }
-        for (const [tableName, filePath] of iacDynamoTables) {
-          if (!deployedDynamoTables.has(tableName)) {
+        const deployedQueues = new Set(graph.nodes.filter((n) => n.type === "queue").map((n) => n.name));
+        const iacQueues = new Map(iac.queues.map((q) => [q.name, q.filePath]));
+        for (const [name, fp] of iacQueues) {
+          if (!deployedQueues.has(name)) {
             findings.push({
               severity: "medium",
-              issue: `IaC drift: DynamoDB table "${tableName}" is defined in IaC but not found in AWS`,
-              description: `Table "${tableName}" is defined in ${filePath} but was not found among deployed AWS DynamoDB tables. It may not have been deployed yet, or may have been deleted from AWS without updating the IaC.`,
-              recommendation: "Run `terraform apply` or deploy your CloudFormation stack to create the missing table, or remove the definition from your IaC if the table is intentionally absent.",
-              metadata: {
-                tableName,
-                filePath,
-                driftType: "defined_not_deployed"
-              }
+              issue: `IaC drift: SQS queue "${name}" defined in IaC but not deployed`,
+              description: `SQS queue "${name}" is defined in ${fp} but not found in the live account.`,
+              recommendation: "Deploy the queue via `terraform apply` or your CFN/CDK stack.",
+              metadata: { resourceType: "sqs_queue", name, filePath: fp, driftType: "defined_not_deployed" }
             });
           }
         }
-        for (const tableName of deployedDynamoTables) {
-          if (!iacDynamoTables.has(tableName)) {
+        for (const name of deployedQueues) {
+          if (!iacQueues.has(name)) {
+            findings.push({
+              severity: "low",
+              issue: `IaC drift: SQS queue "${name}" deployed but not in IaC`,
+              description: `SQS queue "${name}" exists in AWS but is not tracked in IaC. Manual resources can't be audited or reproduced reliably.`,
+              recommendation: "Import or define the queue in IaC to bring it under version control.",
+              metadata: { resourceType: "sqs_queue", name, driftType: "deployed_not_defined" }
+            });
+          }
+        }
+        const deployedLambdas = new Set(graph.nodes.filter((n) => n.type === "lambda").map((n) => n.name));
+        const iacLambdas = new Map(iac.lambdas.map((l) => [l.name, l.filePath]));
+        for (const [name, fp] of iacLambdas) {
+          if (!deployedLambdas.has(name)) {
             findings.push({
               severity: "medium",
-              issue: `IaC drift: DynamoDB table "${tableName}" is deployed in AWS but not defined in IaC`,
-              description: `Table "${tableName}" exists in AWS DynamoDB but has no corresponding definition in Terraform or CloudFormation. This resource may have been created manually and is not tracked by IaC.`,
-              recommendation: "Import the table into your IaC using `terraform import` or add a CloudFormation resource definition. Untracked resources can lead to configuration drift and accidental deletion.",
-              metadata: {
-                tableName,
-                driftType: "deployed_not_defined"
-              }
+              issue: `IaC drift: Lambda "${name}" defined in IaC but not deployed`,
+              description: `Lambda function "${name}" is defined in ${fp} but not found in the live account.`,
+              recommendation: "Deploy the function via `terraform apply` or your CFN/CDK stack.",
+              metadata: { resourceType: "lambda_function", name, filePath: fp, driftType: "defined_not_deployed" }
+            });
+          }
+        }
+        for (const name of deployedLambdas) {
+          if (!iacLambdas.has(name)) {
+            findings.push({
+              severity: "low",
+              issue: `IaC drift: Lambda "${name}" deployed but not in IaC`,
+              description: `Lambda "${name}" exists in AWS but is not tracked in IaC.`,
+              recommendation: "Import the function into IaC or add it as a resource.",
+              metadata: { resourceType: "lambda_function", name, driftType: "deployed_not_defined" }
             });
           }
         }
@@ -2344,12 +3123,181 @@ var require_terraform = __commonJS({
   }
 });
 
+// ../analyzers/dist/aws-services.js
+var require_aws_services = __commonJS({
+  "../analyzers/dist/aws-services.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.LambdaHighTimeoutAnalyzer = exports2.LambdaDefaultMemoryAnalyzer = exports2.MissingLogRetentionAnalyzer = exports2.MissingSecretRotationAnalyzer = exports2.LargeQueueBacklogAnalyzer = exports2.UnencryptedQueueAnalyzer = exports2.MissingDLQAnalyzer = void 0;
+    var MissingDLQAnalyzer = class {
+      name = "MissingDLQAnalyzer";
+      async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+          if (node.type !== "queue")
+            continue;
+          if (!node.hasDLQ) {
+            findings.push({
+              severity: "high",
+              issue: `Queue "${node.name}" has no Dead Letter Queue`,
+              description: `SQS queue "${node.name}" has no DLQ configured. Failed messages will be discarded after maxReceiveCount retries, causing silent data loss.`,
+              recommendation: `Add a Dead Letter Queue to "${node.name}". Set maxReceiveCount to 3\u20135 retries before routing to DLQ. Alert on DLQ depth.`,
+              metadata: { queueName: node.name, provider: node.provider }
+            });
+          }
+        }
+        return findings;
+      }
+    };
+    exports2.MissingDLQAnalyzer = MissingDLQAnalyzer;
+    var UnencryptedQueueAnalyzer = class {
+      name = "UnencryptedQueueAnalyzer";
+      async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+          if (node.type !== "queue")
+            continue;
+          if (!node.encrypted) {
+            findings.push({
+              severity: "low",
+              issue: `Queue "${node.name}" is not encrypted`,
+              description: `SQS queue "${node.name}" does not have server-side encryption enabled. Messages at rest are unencrypted.`,
+              recommendation: `Enable SQS-managed SSE (SqsManagedSseEnabled=true) or bring your own KMS key for "${node.name}".`,
+              metadata: { queueName: node.name }
+            });
+          }
+        }
+        return findings;
+      }
+    };
+    exports2.UnencryptedQueueAnalyzer = UnencryptedQueueAnalyzer;
+    var LargeQueueBacklogAnalyzer = class {
+      name = "LargeQueueBacklogAnalyzer";
+      threshold;
+      constructor(threshold = 1e3) {
+        this.threshold = threshold;
+      }
+      async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+          if (node.type !== "queue")
+            continue;
+          const count = node.approximateMessages ?? 0;
+          if (count > this.threshold) {
+            findings.push({
+              severity: "medium",
+              issue: `Queue "${node.name}" has a large backlog (${count.toLocaleString()} messages)`,
+              description: `The approximate message count for "${node.name}" is ${count.toLocaleString()}, indicating consumers may be falling behind or stuck.`,
+              recommendation: `Check consumer health and scaling for "${node.name}". Consider auto-scaling consumers on queue depth. If messages are stale, investigate consumer errors in CloudWatch.`,
+              metadata: { queueName: node.name, messageCount: count }
+            });
+          }
+        }
+        return findings;
+      }
+    };
+    exports2.LargeQueueBacklogAnalyzer = LargeQueueBacklogAnalyzer;
+    var MissingSecretRotationAnalyzer = class {
+      name = "MissingSecretRotationAnalyzer";
+      async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+          if (node.type !== "secret")
+            continue;
+          if (!node.rotationEnabled) {
+            findings.push({
+              severity: "medium",
+              issue: `Secret "${node.name}" has no automatic rotation`,
+              description: `Secrets Manager secret "${node.name}" does not have automatic rotation enabled. Long-lived credentials increase the blast radius of a compromise.`,
+              recommendation: `Enable automatic rotation for "${node.name}" using a Lambda rotation function. AWS provides pre-built rotators for RDS, Redshift, and custom secrets.`,
+              metadata: { secretName: node.name, provider: node.provider }
+            });
+          }
+        }
+        return findings;
+      }
+    };
+    exports2.MissingSecretRotationAnalyzer = MissingSecretRotationAnalyzer;
+    var MissingLogRetentionAnalyzer = class {
+      name = "MissingLogRetentionAnalyzer";
+      async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+          if (node.type !== "log_group")
+            continue;
+          if (node.retentionDays === void 0) {
+            findings.push({
+              severity: "medium",
+              issue: `Log group "${node.name}" has no retention policy`,
+              description: `CloudWatch Log group "${node.name}" retains logs indefinitely. This increases storage costs and can expose sensitive data longer than necessary.`,
+              recommendation: `Set a retention policy on "${node.name}". 90 days is a common baseline; adjust based on compliance requirements (e.g., 365 days for SOC2/PCI).`,
+              metadata: { logGroupName: node.name }
+            });
+          } else if (node.retentionDays > 365) {
+            findings.push({
+              severity: "low",
+              issue: `Log group "${node.name}" retains logs for ${node.retentionDays} days`,
+              description: `Log group "${node.name}" has a ${node.retentionDays}-day retention period. Unless required by compliance, this may be longer than needed.`,
+              recommendation: `Review whether ${node.retentionDays} days of retention is required for "${node.name}". Consider archiving older logs to S3 Glacier for cost savings.`,
+              metadata: { logGroupName: node.name, retentionDays: node.retentionDays }
+            });
+          }
+        }
+        return findings;
+      }
+    };
+    exports2.MissingLogRetentionAnalyzer = MissingLogRetentionAnalyzer;
+    var LambdaDefaultMemoryAnalyzer = class {
+      name = "LambdaDefaultMemoryAnalyzer";
+      async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+          if (node.type !== "lambda")
+            continue;
+          if (node.memoryMB === 128) {
+            findings.push({
+              severity: "low",
+              issue: `Lambda "${node.name}" uses the default 128 MB memory`,
+              description: `"${node.name}" uses the default 128 MB. Undersized memory causes throttled CPU and higher durations. AWS Lambda pricing is duration \xD7 memory, so more memory often lowers cost by reducing duration.`,
+              recommendation: `Run Lambda Power Tuning on "${node.name}" to find the optimal memory/cost balance. Most workloads perform better at 512 MB\u20131 GB.`,
+              metadata: { functionName: node.name, memoryMB: node.memoryMB }
+            });
+          }
+        }
+        return findings;
+      }
+    };
+    exports2.LambdaDefaultMemoryAnalyzer = LambdaDefaultMemoryAnalyzer;
+    var LambdaHighTimeoutAnalyzer = class {
+      name = "LambdaHighTimeoutAnalyzer";
+      async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+          if (node.type !== "lambda")
+            continue;
+          if ((node.timeoutSec ?? 0) >= 300) {
+            findings.push({
+              severity: "low",
+              issue: `Lambda "${node.name}" has a very high timeout (${node.timeoutSec}s)`,
+              description: `"${node.name}" has a ${node.timeoutSec}-second timeout. High timeouts mask latency issues and increase worst-case cost when functions hang.`,
+              recommendation: `Review whether "${node.name}" truly needs ${node.timeoutSec}s. Add internal circuit-breakers or streaming patterns to avoid reaching the timeout. Set alarms on p99 duration.`,
+              metadata: { functionName: node.name, timeoutSec: node.timeoutSec }
+            });
+          }
+        }
+        return findings;
+      }
+    };
+    exports2.LambdaHighTimeoutAnalyzer = LambdaHighTimeoutAnalyzer;
+  }
+});
+
 // ../analyzers/dist/index.js
-var require_dist9 = __commonJS({
+var require_dist11 = __commonJS({
   "../analyzers/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.IaCDriftAnalyzer = exports2.MongoCollectionScanAnalyzer = exports2.MissingMongoIndexAnalyzer = exports2.MySQLFullTableScanAnalyzer = exports2.MissingMySQLIndexAnalyzer = exports2.LargeSelectAnalyzer = exports2.NplusOneAnalyzer = exports2.MissingIndexAnalyzer = exports2.HotPartitionAnalyzer = exports2.MissingGSIAnalyzer = exports2.FullTableScanAnalyzer = void 0;
+    exports2.LambdaHighTimeoutAnalyzer = exports2.LambdaDefaultMemoryAnalyzer = exports2.MissingLogRetentionAnalyzer = exports2.MissingSecretRotationAnalyzer = exports2.LargeQueueBacklogAnalyzer = exports2.UnencryptedQueueAnalyzer = exports2.MissingDLQAnalyzer = exports2.IaCDriftAnalyzer = exports2.MongoCollectionScanAnalyzer = exports2.MissingMongoIndexAnalyzer = exports2.MySQLFullTableScanAnalyzer = exports2.MissingMySQLIndexAnalyzer = exports2.LargeSelectAnalyzer = exports2.NplusOneAnalyzer = exports2.MissingIndexAnalyzer = exports2.HotPartitionAnalyzer = exports2.MissingGSIAnalyzer = exports2.FullTableScanAnalyzer = void 0;
     exports2.runAllAnalyzers = runAllAnalyzers2;
     exports2.summarizeFindings = summarizeFindings;
     var core_1 = require_dist();
@@ -2358,6 +3306,7 @@ var require_dist9 = __commonJS({
     var mysql_1 = require_mysql();
     var mongodb_1 = require_mongodb();
     var terraform_1 = require_terraform();
+    var aws_services_1 = require_aws_services();
     var dynamodb_2 = require_dynamodb();
     Object.defineProperty(exports2, "FullTableScanAnalyzer", { enumerable: true, get: function() {
       return dynamodb_2.FullTableScanAnalyzer;
@@ -2396,18 +3345,56 @@ var require_dist9 = __commonJS({
     Object.defineProperty(exports2, "IaCDriftAnalyzer", { enumerable: true, get: function() {
       return terraform_2.IaCDriftAnalyzer;
     } });
+    var aws_services_2 = require_aws_services();
+    Object.defineProperty(exports2, "MissingDLQAnalyzer", { enumerable: true, get: function() {
+      return aws_services_2.MissingDLQAnalyzer;
+    } });
+    Object.defineProperty(exports2, "UnencryptedQueueAnalyzer", { enumerable: true, get: function() {
+      return aws_services_2.UnencryptedQueueAnalyzer;
+    } });
+    Object.defineProperty(exports2, "LargeQueueBacklogAnalyzer", { enumerable: true, get: function() {
+      return aws_services_2.LargeQueueBacklogAnalyzer;
+    } });
+    Object.defineProperty(exports2, "MissingSecretRotationAnalyzer", { enumerable: true, get: function() {
+      return aws_services_2.MissingSecretRotationAnalyzer;
+    } });
+    Object.defineProperty(exports2, "MissingLogRetentionAnalyzer", { enumerable: true, get: function() {
+      return aws_services_2.MissingLogRetentionAnalyzer;
+    } });
+    Object.defineProperty(exports2, "LambdaDefaultMemoryAnalyzer", { enumerable: true, get: function() {
+      return aws_services_2.LambdaDefaultMemoryAnalyzer;
+    } });
+    Object.defineProperty(exports2, "LambdaHighTimeoutAnalyzer", { enumerable: true, get: function() {
+      return aws_services_2.LambdaHighTimeoutAnalyzer;
+    } });
     var DEFAULT_ANALYZERS = [
+      // DynamoDB
       new dynamodb_1.FullTableScanAnalyzer(),
       new dynamodb_1.MissingGSIAnalyzer(),
       new dynamodb_1.HotPartitionAnalyzer(),
+      // PostgreSQL
       new postgres_1.MissingIndexAnalyzer(),
       new postgres_1.NplusOneAnalyzer(),
       new postgres_1.LargeSelectAnalyzer(),
+      // MySQL
       new mysql_1.MissingMySQLIndexAnalyzer(),
       new mysql_1.MySQLFullTableScanAnalyzer(),
+      // MongoDB
       new mongodb_1.MissingMongoIndexAnalyzer(),
       new mongodb_1.MongoCollectionScanAnalyzer(),
-      new terraform_1.IaCDriftAnalyzer()
+      // IaC drift
+      new terraform_1.IaCDriftAnalyzer(),
+      // SQS / messaging
+      new aws_services_1.MissingDLQAnalyzer(),
+      new aws_services_1.UnencryptedQueueAnalyzer(),
+      new aws_services_1.LargeQueueBacklogAnalyzer(),
+      // Secrets Manager
+      new aws_services_1.MissingSecretRotationAnalyzer(),
+      // CloudWatch Logs
+      new aws_services_1.MissingLogRetentionAnalyzer(),
+      // Lambda
+      new aws_services_1.LambdaDefaultMemoryAnalyzer(),
+      new aws_services_1.LambdaHighTimeoutAnalyzer()
     ];
     async function runAllAnalyzers2(graph, analyzers = DEFAULT_ANALYZERS) {
       const allFindings = [];
@@ -2437,7 +3424,7 @@ var require_dist9 = __commonJS({
 });
 
 // ../server/dist/index.js
-var require_dist10 = __commonJS({
+var require_dist12 = __commonJS({
   "../server/dist/index.js"(exports2) {
     "use strict";
     var __importDefault = exports2 && exports2.__importDefault || function(mod) {
@@ -2450,7 +3437,7 @@ var require_dist10 = __commonJS({
     var fastify_1 = __importDefault(require("fastify"));
     var cors_1 = __importDefault(require("@fastify/cors"));
     var core_1 = require_dist();
-    var graph_1 = require_dist8();
+    var graph_1 = require_dist10();
     var currentGraph = { nodes: [], edges: [] };
     exports2.currentGraph = currentGraph;
     var currentFindings = [];
@@ -2460,25 +3447,20 @@ var require_dist10 = __commonJS({
       exports2.currentFindings = currentFindings = findings;
     }
     function createServer2(port = 3e3) {
-      const fastify = (0, fastify_1.default)({
-        logger: false
-        // We use pino directly
-      });
+      const fastify = (0, fastify_1.default)({ logger: false });
       fastify.register(cors_1.default, { origin: true });
-      fastify.get("/health", async () => {
-        return {
-          status: "ok",
-          version: "0.1.0",
-          graphNodes: currentGraph.nodes.length,
-          graphEdges: currentGraph.edges.length,
-          findings: currentFindings.length
-        };
-      });
+      fastify.get("/health", async () => ({
+        status: "ok",
+        version: "0.1.0",
+        graphNodes: currentGraph.nodes.length,
+        graphEdges: currentGraph.edges.length,
+        findings: currentFindings.length
+      }));
       fastify.post("/mcp", async (request, reply) => {
         const { tool, input } = request.body;
         if (!tool) {
           reply.status(400);
-          return { success: false, error: 'Missing "tool" field in request body' };
+          return { success: false, error: 'Missing "tool" field' };
         }
         core_1.logger.info(`MCP tool call: ${tool}`);
         try {
@@ -2487,64 +3469,142 @@ var require_dist10 = __commonJS({
         } catch (err) {
           core_1.logger.error(`MCP tool "${tool}" failed: ${err instanceof Error ? err.message : String(err)}`);
           reply.status(500);
-          return {
-            success: false,
-            error: err instanceof Error ? err.message : "Unknown error"
-          };
+          return { success: false, error: err instanceof Error ? err.message : "Unknown error" };
         }
       });
-      fastify.get("/mcp/tools", async () => {
-        return {
-          tools: [
-            {
-              name: "get_graph_summary",
-              description: "Returns the full infrastructure graph with all findings",
-              input: {}
-            },
-            {
-              name: "analyze_function",
-              description: "Analyze a specific function for database issues",
-              input: { function: "string \u2014 function name to analyze" }
-            },
-            {
-              name: "suggest_gsi",
-              description: "Get GSI suggestions for a DynamoDB table and attribute",
-              input: {
-                table: "string \u2014 DynamoDB table name",
-                attribute: "string \u2014 attribute to index"
-              }
-            },
-            {
-              name: "postgres_index_suggestions",
-              description: "Get PostgreSQL index suggestions for a table column",
-              input: {
-                table: "string \u2014 PostgreSQL table name",
-                column: "string \u2014 column to analyze"
-              }
-            },
-            {
-              name: "suggest_mongo_index",
-              description: "Get index suggestions for a MongoDB collection field",
-              input: {
-                collection: "string \u2014 MongoDB collection name",
-                field: "string \u2014 field to index"
-              }
-            },
-            {
-              name: "mysql_index_suggestions",
-              description: "Get MySQL index suggestions for a table column",
-              input: {
-                table: "string \u2014 MySQL table name",
-                column: "string \u2014 column to analyze"
-              }
+      fastify.get("/mcp/tools", async () => ({
+        tools: [
+          // ── Overview ──────────────────────────────────────────────────────────
+          {
+            name: "get_infra_overview",
+            description: "Returns a complete snapshot of all infrastructure: databases, queues, topics, secrets, parameters, log groups, lambdas, and all findings. Start here for a full picture.",
+            input: {}
+          },
+          {
+            name: "get_graph_summary",
+            description: "Returns the full infrastructure graph (all nodes and edges) plus findings summary.",
+            input: {}
+          },
+          // ── Code analysis ────────────────────────────────────────────────────
+          {
+            name: "analyze_function",
+            description: "Analyze a specific function for all infrastructure issues: DB queries, queue publishing, secret access, etc.",
+            input: { function: "string \u2014 function name" }
+          },
+          // ── Database helpers ─────────────────────────────────────────────────
+          {
+            name: "suggest_gsi",
+            description: "Get GSI suggestions for a DynamoDB table and attribute",
+            input: { table: "string", attribute: "string" }
+          },
+          {
+            name: "postgres_index_suggestions",
+            description: "Get PostgreSQL index suggestions for a table column",
+            input: { table: "string", column: "string" }
+          },
+          {
+            name: "suggest_mongo_index",
+            description: "Get index suggestions for a MongoDB collection field",
+            input: { collection: "string", field: "string" }
+          },
+          {
+            name: "mysql_index_suggestions",
+            description: "Get MySQL index suggestions for a table column",
+            input: { table: "string", column: "string" }
+          },
+          // ── Messaging ────────────────────────────────────────────────────────
+          {
+            name: "get_queue_details",
+            description: "Returns all SQS queues with DLQ status, encryption, message counts, and retention. Use to audit messaging infrastructure.",
+            input: {}
+          },
+          {
+            name: "get_topic_details",
+            description: "Returns all SNS topics with subscription counts and protocols.",
+            input: {}
+          },
+          // ── Secrets & config ─────────────────────────────────────────────────
+          {
+            name: "get_secrets_overview",
+            description: "Returns all Secrets Manager secrets: names, rotation status, last accessed. Secret VALUES are never included.",
+            input: {}
+          },
+          {
+            name: "get_parameter_overview",
+            description: "Returns all SSM Parameter Store parameters: names, types, tiers. Parameter VALUES are never included.",
+            input: {}
+          },
+          // ── Compute ──────────────────────────────────────────────────────────
+          {
+            name: "get_lambda_overview",
+            description: "Returns all Lambda functions: runtime, memory, timeout, env var key names (values never included).",
+            input: {}
+          },
+          // ── Observability ────────────────────────────────────────────────────
+          {
+            name: "get_log_errors",
+            description: "Returns recent error patterns from CloudWatch log groups. Returns pattern counts and frequencies \u2014 never raw log messages. Safe for context.",
+            input: {
+              logGroup: "string (optional) \u2014 filter to a specific log group name"
             }
-          ]
-        };
-      });
+          }
+        ]
+      }));
       return { fastify, start: () => startServer(fastify, port) };
     }
     async function handleToolCall(tool, input) {
       switch (tool) {
+        // ── Overview ─────────────────────────────────────────────────────────────
+        case "get_infra_overview": {
+          const tables = (0, graph_1.getTableNodes)(currentGraph);
+          const queues = (0, graph_1.getQueueNodes)(currentGraph);
+          const topics = (0, graph_1.getTopicNodes)(currentGraph);
+          const secrets = (0, graph_1.getSecretNodes)(currentGraph);
+          const parameters = (0, graph_1.getParameterNodes)(currentGraph);
+          const logGroups = (0, graph_1.getLogGroupNodes)(currentGraph);
+          const lambdas = (0, graph_1.getLambdaNodes)(currentGraph);
+          const functions = (0, graph_1.getFunctionNodes)(currentGraph);
+          return {
+            summary: {
+              tables: tables.length,
+              functions: functions.length,
+              queues: queues.length,
+              topics: topics.length,
+              secrets: secrets.length,
+              parameters: parameters.length,
+              logGroups: logGroups.length,
+              lambdas: lambdas.length,
+              totalNodes: currentGraph.nodes.length,
+              totalEdges: currentGraph.edges.length,
+              findings: {
+                total: currentFindings.length,
+                high: currentFindings.filter((f) => f.severity === "high").length,
+                medium: currentFindings.filter((f) => f.severity === "medium").length,
+                low: currentFindings.filter((f) => f.severity === "low").length
+              }
+            },
+            databases: tables.map((t) => ({ name: t.name, type: t.databaseType })),
+            queues: queues.map((q) => ({
+              name: q.name,
+              hasDLQ: q.hasDLQ,
+              encrypted: q.encrypted,
+              approximateMessages: q.approximateMessages
+            })),
+            topics: topics.map((t) => ({ name: t.name, subscriptions: t.subscriptionCount })),
+            secrets: secrets.map((s) => ({ name: s.name, rotationEnabled: s.rotationEnabled })),
+            parameters: parameters.map((p) => ({ name: p.name, type: p.paramType, tier: p.tier })),
+            lambdas: lambdas.map((l) => ({ name: l.name, runtime: l.runtime, memoryMB: l.memoryMB })),
+            logGroups: logGroups.map((lg) => ({
+              name: lg.name,
+              retentionDays: lg.retentionDays ?? "never",
+              errorCount: lg.errorCount
+            })),
+            highFindings: currentFindings.filter((f) => f.severity === "high").map((f) => ({
+              issue: f.issue,
+              recommendation: f.recommendation
+            }))
+          };
+        }
         case "get_graph_summary": {
           return {
             nodes: currentGraph.nodes,
@@ -2555,6 +3615,7 @@ var require_dist10 = __commonJS({
               totalEdges: currentGraph.edges.length,
               tables: (0, graph_1.getTableNodes)(currentGraph).length,
               functions: (0, graph_1.getFunctionNodes)(currentGraph).length,
+              queues: (0, graph_1.getQueueNodes)(currentGraph).length,
               scans: (0, graph_1.getScanEdges)(currentGraph).length,
               totalFindings: currentFindings.length,
               highSeverity: currentFindings.filter((f) => f.severity === "high").length,
@@ -2563,11 +3624,11 @@ var require_dist10 = __commonJS({
             }
           };
         }
+        // ── Code analysis ──────────────────────────────────────────────────────────
         case "analyze_function": {
           const functionName = String(input.function ?? "");
-          if (!functionName) {
+          if (!functionName)
             throw new Error("Missing input.function");
-          }
           const funcNode = currentGraph.nodes.find((n) => n.type === "function" && n.name === functionName);
           if (!funcNode) {
             return {
@@ -2580,141 +3641,203 @@ var require_dist10 = __commonJS({
           const outEdges = (0, graph_1.getOutgoingEdges)(currentGraph, funcNode.id);
           const relatedFindings = currentFindings.filter((f) => {
             const meta = f.metadata;
-            return meta?.functionName === functionName || meta?.callerFunctions?.toString().includes(functionName);
+            return meta?.functionName === functionName || String(meta?.callerFunctions ?? "").includes(functionName);
           });
-          const issues = relatedFindings.map((f) => ({
-            severity: f.severity,
-            issue: f.issue,
-            description: f.description
-          }));
-          const recommendations = relatedFindings.map((f) => f.recommendation);
-          const uniqueRecs = [...new Set(recommendations)];
           return {
             function: functionName,
             found: true,
             file: funcNode.type === "function" ? funcNode.file : void 0,
-            accessedTables: outEdges.map((e) => {
+            accesses: outEdges.map((e) => {
               const target = currentGraph.nodes.find((n) => n.id === e.to);
-              return { tableId: e.to, edgeType: e.type, tableName: target && "name" in target ? target.name : e.to };
+              return {
+                targetId: e.to,
+                edgeType: e.type,
+                targetName: target && "name" in target ? target.name : e.to,
+                targetType: target?.type
+              };
             }),
-            issues,
-            recommendations: uniqueRecs
+            issues: relatedFindings.map((f) => ({
+              severity: f.severity,
+              issue: f.issue,
+              description: f.description
+            })),
+            recommendations: [...new Set(relatedFindings.map((f) => f.recommendation))]
           };
         }
+        // ── Database helpers ───────────────────────────────────────────────────────
         case "suggest_gsi": {
           const tableName = String(input.table ?? "");
           const attribute = String(input.attribute ?? "");
-          if (!tableName || !attribute) {
+          if (!tableName || !attribute)
             throw new Error("Missing input.table or input.attribute");
-          }
           const tableNode = currentGraph.nodes.find((n) => n.type === "table" && n.databaseType === "dynamodb" && "name" in n && n.name === tableName);
-          if (!tableNode) {
-            return {
-              table: tableName,
-              attribute,
-              found: false,
-              message: `DynamoDB table "${tableName}" not found in analyzed graph`
-            };
-          }
           const sanitizedAttr = attribute.replace(/[^a-zA-Z0-9_]/g, "_");
           const indexName = `${tableName}-${sanitizedAttr}-index`;
           return {
             table: tableName,
             attribute,
-            index: {
-              name: indexName,
-              partitionKey: attribute,
-              projectionType: "ALL",
-              billingMode: "PAY_PER_REQUEST"
-            },
-            rationale: `Adding a GSI with partition key "${attribute}" will allow efficient Query operations instead of full table Scans when filtering by this attribute.`,
-            estimatedCost: "Approximately double the storage cost for the projected attributes.",
-            recommendation: `Add the following GSI to your CloudFormation/Terraform definition:
-
-GSI Name: ${indexName}
-Partition Key: ${attribute}
-Sort Key: (optional, add for range queries)
-Projection: ALL`
+            found: !!tableNode,
+            index: { name: indexName, partitionKey: attribute, projectionType: "ALL", billingMode: "PAY_PER_REQUEST" },
+            rationale: `A GSI on "${attribute}" allows Query instead of Scan when filtering by this attribute.`,
+            recommendation: `Add GSI "${indexName}" with partition key "${attribute}" to your IaC definition.`
           };
         }
         case "postgres_index_suggestions": {
           const tableName = String(input.table ?? "");
           const column = String(input.column ?? "");
-          if (!tableName || !column) {
+          if (!tableName || !column)
             throw new Error("Missing input.table or input.column");
-          }
-          const tableNode = currentGraph.nodes.find((n) => n.type === "table" && n.databaseType === "postgres" && "name" in n && (n.name === tableName || n.name.endsWith(`.${tableName}`)));
           const sanitizedCol = column.replace(/[^a-zA-Z0-9_]/g, "_");
           const sanitizedTable = tableName.replace(/[^a-zA-Z0-9_]/g, "_");
           const indexName = `idx_${sanitizedTable}_${sanitizedCol}`;
           return {
             table: tableName,
             column,
-            found: !!tableNode,
             recommendation: `CREATE INDEX CONCURRENTLY ${indexName} ON ${tableName} (${column});`,
-            rationale: `An index on column "${column}" of table "${tableName}" will eliminate sequential scans when filtering on this column.`,
+            rationale: `An index on "${column}" eliminates sequential scans when filtering on this column.`,
             notes: [
-              "Use CONCURRENTLY to avoid locking the table during index creation",
-              "Consider a partial index if the column has high cardinality and you commonly filter on specific values",
-              "Run ANALYZE after creating the index to update statistics",
-              `Example partial index: CREATE INDEX CONCURRENTLY ${indexName}_partial ON ${tableName} (${column}) WHERE ${column} IS NOT NULL;`
+              "Use CONCURRENTLY to avoid locking the table",
+              "Run ANALYZE after creation",
+              `Partial index: CREATE INDEX CONCURRENTLY ${indexName}_partial ON ${tableName} (${column}) WHERE ${column} IS NOT NULL;`
             ]
           };
         }
         case "suggest_mongo_index": {
           const collection = String(input.collection ?? "");
           const field = String(input.field ?? "");
-          if (!collection || !field) {
+          if (!collection || !field)
             throw new Error("Missing input.collection or input.field");
-          }
-          const sanitizedField = field.replace(/[^a-zA-Z0-9_.]/g, "_");
           return {
             collection,
             field,
             recommendation: `db.${collection}.createIndex({ ${field}: 1 })`,
-            rationale: `An index on field "${field}" of collection "${collection}" will eliminate full collection scans when filtering on this field.`,
+            rationale: `An index on "${field}" eliminates full collection scans when filtering on this field.`,
             notes: [
-              "Use { background: true } in MongoDB < 4.2 to avoid blocking reads during index creation",
-              `For compound queries, consider a compound index: db.${collection}.createIndex({ ${field}: 1, otherField: 1 })`,
-              `For text search, use a text index: db.${collection}.createIndex({ ${sanitizedField}: "text" })`,
-              `Run db.${collection}.explain("executionStats").find({ ${field}: value }) to verify the index is used`
+              `Compound: db.${collection}.createIndex({ ${field}: 1, otherField: 1 })`,
+              `Text: db.${collection}.createIndex({ ${field}: "text" })`,
+              `Verify: db.${collection}.explain("executionStats").find({ ${field}: value })`
             ]
           };
         }
         case "mysql_index_suggestions": {
           const tableName = String(input.table ?? "");
           const column = String(input.column ?? "");
-          if (!tableName || !column) {
+          if (!tableName || !column)
             throw new Error("Missing input.table or input.column");
-          }
           const sanitizedCol = column.replace(/[^a-zA-Z0-9_]/g, "_");
           const sanitizedTable = tableName.replace(/[^a-zA-Z0-9_]/g, "_");
           const indexName = `idx_${sanitizedTable}_${sanitizedCol}`;
-          const tableNode = currentGraph.nodes.find((n) => n.type === "table" && n.databaseType === "mysql" && "name" in n && (n.name === tableName || n.name.endsWith(`.${tableName}`)));
           return {
             table: tableName,
             column,
-            found: !!tableNode,
             recommendation: `ALTER TABLE ${tableName} ADD INDEX ${indexName} (${column});`,
-            rationale: `An index on column "${column}" of table "${tableName}" will eliminate full table scans when filtering on this column.`,
+            rationale: `An index on "${column}" eliminates full table scans when filtering on this column.`,
             notes: [
-              "MySQL adds indexes online (no full table lock for InnoDB with MySQL 5.6+)",
-              `Consider a composite index if you filter on multiple columns together`,
-              `Use EXPLAIN SELECT ... to verify the index is used after adding it`,
-              `Example composite: ALTER TABLE ${tableName} ADD INDEX idx_${sanitizedTable}_composite (${column}, other_column);`
+              "MySQL InnoDB adds indexes online (no full lock for 5.6+)",
+              `EXPLAIN SELECT ... to verify after adding`,
+              `Composite: ALTER TABLE ${tableName} ADD INDEX idx_composite (${column}, other_column);`
             ]
           };
         }
+        // ── Messaging ─────────────────────────────────────────────────────────────
+        case "get_queue_details": {
+          const queues = (0, graph_1.getQueueNodes)(currentGraph);
+          const queueFindings = currentFindings.filter((f) => f.metadata?.queueName);
+          return {
+            total: queues.length,
+            queues: queues.map((q) => ({
+              name: q.name,
+              provider: q.provider,
+              hasDLQ: q.hasDLQ,
+              encrypted: q.encrypted,
+              approximateMessages: q.approximateMessages,
+              retentionDays: q.retentionDays,
+              findings: queueFindings.filter((f) => f.metadata.queueName === q.name).map((f) => ({ severity: f.severity, issue: f.issue }))
+            }))
+          };
+        }
+        case "get_topic_details": {
+          const topics = (0, graph_1.getTopicNodes)(currentGraph);
+          return {
+            total: topics.length,
+            topics: topics.map((t) => ({
+              name: t.name,
+              provider: t.provider,
+              subscriptionCount: t.subscriptionCount,
+              encrypted: t.encrypted
+            }))
+          };
+        }
+        // ── Secrets & config ──────────────────────────────────────────────────────
+        case "get_secrets_overview": {
+          const secrets = (0, graph_1.getSecretNodes)(currentGraph);
+          const secretFindings = currentFindings.filter((f) => f.metadata?.secretName);
+          return {
+            total: secrets.length,
+            note: "Secret values are never included in this response.",
+            secrets: secrets.map((s) => ({
+              name: s.name,
+              provider: s.provider,
+              rotationEnabled: s.rotationEnabled,
+              rotationDays: s.rotationDays,
+              findings: secretFindings.filter((f) => f.metadata.secretName === s.name).map((f) => ({ severity: f.severity, issue: f.issue }))
+            }))
+          };
+        }
+        case "get_parameter_overview": {
+          const parameters = (0, graph_1.getParameterNodes)(currentGraph);
+          return {
+            total: parameters.length,
+            note: "Parameter values are never included in this response.",
+            parameters: parameters.map((p) => ({
+              name: p.name,
+              provider: p.provider,
+              type: p.paramType,
+              tier: p.tier
+            }))
+          };
+        }
+        // ── Compute ───────────────────────────────────────────────────────────────
+        case "get_lambda_overview": {
+          const lambdas = (0, graph_1.getLambdaNodes)(currentGraph);
+          const lambdaFindings = currentFindings.filter((f) => f.metadata?.functionName);
+          return {
+            total: lambdas.length,
+            note: "Environment variable values are never included.",
+            lambdas: lambdas.map((l) => ({
+              name: l.name,
+              runtime: l.runtime,
+              memoryMB: l.memoryMB,
+              timeoutSec: l.timeoutSec,
+              envVarCount: l.envVarKeys?.length ?? 0,
+              envVarKeys: l.envVarKeys,
+              findings: lambdaFindings.filter((f) => f.metadata.functionName === l.name).map((f) => ({ severity: f.severity, issue: f.issue }))
+            }))
+          };
+        }
+        // ── Observability ─────────────────────────────────────────────────────────
+        case "get_log_errors": {
+          const filterName = input.logGroup ? String(input.logGroup) : void 0;
+          const logGroups = (0, graph_1.getLogGroupNodes)(currentGraph).filter((lg) => !filterName || lg.name.includes(filterName));
+          return {
+            note: "Only error patterns and counts are returned \u2014 no raw log messages.",
+            windowHours: 24,
+            logGroups: logGroups.map((lg) => ({
+              name: lg.name,
+              retentionDays: lg.retentionDays ?? "never-expires",
+              errorCount: lg.errorCount,
+              topErrorPatterns: lg.topErrorPatterns
+            }))
+          };
+        }
         default:
-          throw new Error(`Unknown tool: "${tool}". Available tools: get_graph_summary, analyze_function, suggest_gsi, postgres_index_suggestions, suggest_mongo_index, mysql_index_suggestions`);
+          throw new Error(`Unknown tool: "${tool}". Call GET /mcp/tools for the list of available tools.`);
       }
     }
     async function startServer(fastify, port) {
       try {
         await fastify.listen({ port, host: "0.0.0.0" });
         core_1.logger.info(`Infrawise MCP server running at http://localhost:${port}`);
-        core_1.logger.info(`MCP endpoint: http://localhost:${port}/mcp`);
-        core_1.logger.info(`Available tools: http://localhost:${port}/mcp/tools`);
       } catch (err) {
         core_1.logger.error(`Failed to start server: ${err instanceof Error ? err.message : String(err)}`);
         process.exit(1);
@@ -2810,18 +3933,7 @@ function severityBadge(severity) {
       return import_chalk.default.bgCyan.black.bold(` LOW  `);
   }
 }
-function severityColor(severity) {
-  switch (severity) {
-    case "high":
-      return import_chalk.default.red;
-    case "medium":
-      return import_chalk.default.yellow;
-    case "low":
-      return import_chalk.default.cyan;
-  }
-}
 function printFinding(finding, index) {
-  const color = severityColor(finding.severity);
   const badge = severityBadge(finding.severity);
   const num = import_chalk.default.dim(`${index + 1}.`);
   console.log(`
@@ -2869,7 +3981,7 @@ async function runInit(options = {}) {
   log.success(`Type`, repoType);
   log.success(`AWS profiles found`, String(profiles.length));
   console.log("");
-  const answers = await import_inquirer.default.prompt([
+  const core = await import_inquirer.default.prompt([
     {
       type: "input",
       name: "project",
@@ -2888,13 +4000,16 @@ async function runInit(options = {}) {
       name: "region",
       message: "AWS region:",
       default: detectedRegion
-    },
+    }
+  ]);
+  console.log("\n  " + import_chalk2.default.bold("Databases"));
+  const databases = await import_inquirer.default.prompt([
     {
       type: "input",
       name: "dynamoTables",
       message: "DynamoDB tables to include:",
       default: "",
-      suffix: import_chalk2.default.dim(" (comma-separated, leave blank for all)")
+      suffix: import_chalk2.default.dim(" (comma-separated, blank = all)")
     },
     {
       type: "confirm",
@@ -2936,21 +4051,80 @@ async function runInit(options = {}) {
       when: (a) => a.mongoEnabled
     }
   ]);
-  const includeTables = answers.dynamoTables ? answers.dynamoTables.split(",").map((t) => t.trim()).filter(Boolean) : [];
-  const configContent = (0, import_core.generateDefaultConfig)(answers.project, {
-    aws: { profile: answers.awsProfile, region: answers.region },
-    dynamodb: { includeTables },
-    postgres: {
-      enabled: answers.pgEnabled,
-      connectionString: answers.pgConnectionString ?? ""
+  console.log("\n  " + import_chalk2.default.bold("AWS Services"));
+  console.log(import_chalk2.default.dim("  Infrawise will introspect these services \u2014 credentials from the AWS profile above."));
+  const services = await import_inquirer.default.prompt([
+    {
+      type: "confirm",
+      name: "sqsEnabled",
+      message: "Introspect SQS queues?",
+      default: true
+    },
+    {
+      type: "confirm",
+      name: "snsEnabled",
+      message: "Introspect SNS topics?",
+      default: true
     },
-    mysql: {
-      enabled: answers.mysqlEnabled,
-      connectionString: answers.mysqlConnectionString ?? ""
+    {
+      type: "confirm",
+      name: "ssmEnabled",
+      message: "Introspect SSM Parameter Store? (metadata only, no values)",
+      default: true
+    },
+    {
+      type: "input",
+      name: "ssmPaths",
+      message: "SSM path prefixes to filter:",
+      default: "",
+      suffix: import_chalk2.default.dim(" (comma-separated, blank = all  e.g. /myapp/prod)"),
+      when: (a) => a.ssmEnabled
     },
-    mongodb: {
-      enabled: answers.mongoEnabled,
-      connectionString: answers.mongoConnectionString ?? ""
+    {
+      type: "confirm",
+      name: "secretsEnabled",
+      message: "Introspect Secrets Manager? (names & rotation only, no values)",
+      default: true
+    },
+    {
+      type: "confirm",
+      name: "lambdaEnabled",
+      message: "Introspect Lambda functions?",
+      default: true
+    },
+    {
+      type: "confirm",
+      name: "logsEnabled",
+      message: "Sample CloudWatch Logs? (error patterns only, no raw logs)",
+      default: false
+    },
+    {
+      type: "input",
+      name: "logGroupPrefixes",
+      message: "CloudWatch log group prefixes:",
+      default: "",
+      suffix: import_chalk2.default.dim(" (comma-separated, blank = all)"),
+      when: (a) => a.logsEnabled
+    }
+  ]);
+  const includeTables = databases.dynamoTables ? databases.dynamoTables.split(",").map((t) => t.trim()).filter(Boolean) : [];
+  const ssmPaths = services.ssmPaths ? services.ssmPaths.split(",").map((p) => p.trim()).filter(Boolean) : [];
+  const logGroupPrefixes = services.logGroupPrefixes ? services.logGroupPrefixes.split(",").map((p) => p.trim()).filter(Boolean) : [];
+  const configContent = (0, import_core.generateDefaultConfig)(core.project, {
+    aws: { profile: core.awsProfile, region: core.region },
+    dynamodb: { includeTables },
+    postgres: { enabled: databases.pgEnabled, connectionString: databases.pgConnectionString ?? "" },
+    mysql: { enabled: databases.mysqlEnabled, connectionString: databases.mysqlConnectionString ?? "" },
+    mongodb: { enabled: databases.mongoEnabled, connectionString: databases.mongoConnectionString ?? "" },
+    sqs: { enabled: services.sqsEnabled },
+    sns: { enabled: services.snsEnabled },
+    ssm: { enabled: services.ssmEnabled, paths: ssmPaths },
+    secretsManager: { enabled: services.secretsEnabled },
+    lambda: { enabled: services.lambdaEnabled },
+    cloudwatchLogs: {
+      enabled: services.logsEnabled,
+      logGroupPrefixes,
+      windowHours: 24
     }
   });
   fs2.writeFileSync(configPath, configContent, "utf-8");
@@ -3026,9 +4200,11 @@ var import_adapters_postgres = __toESM(require_dist3());
 var import_adapters_mysql = __toESM(require_dist4());
 var import_adapters_mongodb = __toESM(require_dist5());
 var import_adapters_terraform = __toESM(require_dist6());
-var import_context = __toESM(require_dist7());
-var import_graph = __toESM(require_dist8());
-var import_analyzers = __toESM(require_dist9());
+var import_adapters_aws_services = __toESM(require_dist7());
+var import_adapters_logs = __toESM(require_dist8());
+var import_context = __toESM(require_dist9());
+var import_graph = __toESM(require_dist10());
+var import_analyzers = __toESM(require_dist11());
 async function runAnalyze(options = {}) {
   printHeader("Running Analysis");
   let config;
@@ -3040,16 +4216,18 @@ async function runAnalyze(options = {}) {
     process.exit(1);
   }
   const repoPath = options.repo ?? process.cwd();
+  const awsCfg = { region: config.aws?.region, profile: config.aws?.profile };
   const dynamoMeta = [];
   const postgresMeta = [];
   const mysqlMeta = [];
   const mongoMeta = [];
+  const servicesMeta = {};
   {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting DynamoDB table metadata..."), color: "cyan" }).start();
+    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting DynamoDB tables..."), color: "cyan" }).start();
     try {
       const result = await (0, import_adapters_dynamodb2.extractDynamoMetadata)(config);
       dynamoMeta.push(...result);
-      spin.succeed(import_chalk4.default.green("DynamoDB") + import_chalk4.default.dim(`  ${result.length} table(s) found`));
+      spin.succeed(import_chalk4.default.green("DynamoDB") + import_chalk4.default.dim(`  ${result.length} table(s)`));
     } catch (err) {
       spin.warn(import_chalk4.default.yellow("DynamoDB skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
     }
@@ -3059,7 +4237,7 @@ async function runAnalyze(options = {}) {
     try {
       const result = await (0, import_adapters_postgres.extractPostgresMetadata)(config.postgres.connectionString);
       postgresMeta.push(...result);
-      spin.succeed(import_chalk4.default.green("PostgreSQL") + import_chalk4.default.dim(`  ${result.length} table(s) found`));
+      spin.succeed(import_chalk4.default.green("PostgreSQL") + import_chalk4.default.dim(`  ${result.length} table(s)`));
     } catch (err) {
       spin.warn(import_chalk4.default.yellow("PostgreSQL skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
     }
@@ -3069,7 +4247,7 @@ async function runAnalyze(options = {}) {
     try {
       const result = await (0, import_adapters_mysql.extractMySQLMetadata)(config.mysql.connectionString);
       mysqlMeta.push(...result);
-      spin.succeed(import_chalk4.default.green("MySQL") + import_chalk4.default.dim(`  ${result.length} table(s) found`));
+      spin.succeed(import_chalk4.default.green("MySQL") + import_chalk4.default.dim(`  ${result.length} table(s)`));
     } catch (err) {
       spin.warn(import_chalk4.default.yellow("MySQL skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
     }
@@ -3077,43 +4255,106 @@ async function runAnalyze(options = {}) {
   if (config.mongodb?.enabled && config.mongodb.connectionString) {
     const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting MongoDB schema..."), color: "cyan" }).start();
     try {
-      const result = await (0, import_adapters_mongodb.extractMongoMetadata)(
-        config.mongodb.connectionString,
-        config.mongodb.databases
-      );
+      const result = await (0, import_adapters_mongodb.extractMongoMetadata)(config.mongodb.connectionString, config.mongodb.databases);
       mongoMeta.push(...result);
-      spin.succeed(import_chalk4.default.green("MongoDB") + import_chalk4.default.dim(`  ${result.length} collection(s) found`));
+      spin.succeed(import_chalk4.default.green("MongoDB") + import_chalk4.default.dim(`  ${result.length} collection(s)`));
     } catch (err) {
       spin.warn(import_chalk4.default.yellow("MongoDB skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
     }
   }
+  if (config.sqs?.enabled !== false) {
+    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting SQS queues..."), color: "cyan" }).start();
+    try {
+      const result = await (0, import_adapters_aws_services.extractSQSMetadata)(awsCfg);
+      servicesMeta.sqs = result;
+      spin.succeed(import_chalk4.default.green("SQS") + import_chalk4.default.dim(`  ${result.length} queue(s)`));
+    } catch (err) {
+      spin.warn(import_chalk4.default.yellow("SQS skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+    }
+  }
+  if (config.sns?.enabled !== false) {
+    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting SNS topics..."), color: "cyan" }).start();
+    try {
+      const result = await (0, import_adapters_aws_services.extractSNSMetadata)(awsCfg);
+      servicesMeta.sns = result;
+      spin.succeed(import_chalk4.default.green("SNS") + import_chalk4.default.dim(`  ${result.length} topic(s)`));
+    } catch (err) {
+      spin.warn(import_chalk4.default.yellow("SNS skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+    }
+  }
+  if (config.ssm?.enabled !== false) {
+    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting SSM parameters..."), color: "cyan" }).start();
+    try {
+      const result = await (0, import_adapters_aws_services.extractSSMMetadata)({ ...awsCfg, paths: config.ssm?.paths });
+      servicesMeta.ssm = result;
+      spin.succeed(import_chalk4.default.green("SSM") + import_chalk4.default.dim(`  ${result.length} parameter(s)  `) + import_chalk4.default.dim("(metadata only, no values)"));
+    } catch (err) {
+      spin.warn(import_chalk4.default.yellow("SSM skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+    }
+  }
+  if (config.secretsManager?.enabled !== false) {
+    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting Secrets Manager metadata..."), color: "cyan" }).start();
+    try {
+      const result = await (0, import_adapters_aws_services.extractSecretsMetadata)(awsCfg);
+      servicesMeta.secrets = result;
+      spin.succeed(import_chalk4.default.green("Secrets Manager") + import_chalk4.default.dim(`  ${result.length} secret(s)  `) + import_chalk4.default.dim("(names/rotation only, no values)"));
+    } catch (err) {
+      spin.warn(import_chalk4.default.yellow("Secrets Manager skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+    }
+  }
+  if (config.lambda?.enabled !== false) {
+    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting Lambda functions..."), color: "cyan" }).start();
+    try {
+      const result = await (0, import_adapters_aws_services.extractLambdaMetadata)(awsCfg);
+      servicesMeta.lambda = result;
+      spin.succeed(import_chalk4.default.green("Lambda") + import_chalk4.default.dim(`  ${result.length} function(s)`));
+    } catch (err) {
+      spin.warn(import_chalk4.default.yellow("Lambda skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+    }
+  }
+  if (config.cloudwatchLogs?.enabled) {
+    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Sampling CloudWatch Logs (errors only, max 50 groups)..."), color: "cyan" }).start();
+    try {
+      const result = await (0, import_adapters_logs.extractLogsSummary)({
+        ...awsCfg,
+        logGroupPrefixes: config.cloudwatchLogs.logGroupPrefixes,
+        windowHours: config.cloudwatchLogs.windowHours
+      });
+      servicesMeta.logs = result;
+      const errorGroups = result.filter((lg) => lg.errorCount > 0).length;
+      spin.succeed(import_chalk4.default.green("CloudWatch Logs") + import_chalk4.default.dim(`  ${result.length} group(s), ${errorGroups} with errors`));
+    } catch (err) {
+      spin.warn(import_chalk4.default.yellow("CloudWatch Logs skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+    }
+  }
   let iacDriftAnalyzer;
   {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting IaC schema (Terraform/CloudFormation)..."), color: "cyan" }).start();
+    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting IaC schema (Terraform / CloudFormation / CDK)..."), color: "cyan" }).start();
     try {
       const iacSchema = await (0, import_adapters_terraform.extractIaCSchema)(repoPath);
-      const totalIaC = iacSchema.dynamoTables.length + iacSchema.rdsInstances.length + iacSchema.mongoClusters.length;
+      const total = iacSchema.dynamoTables.length + iacSchema.rdsInstances.length + iacSchema.mongoClusters.length + iacSchema.queues.length + iacSchema.topics.length + iacSchema.lambdas.length + iacSchema.buckets.length + iacSchema.parameters.length + iacSchema.secrets.length + iacSchema.apiGateways.length;
       iacDriftAnalyzer = new import_analyzers.IaCDriftAnalyzer();
       iacDriftAnalyzer.setIaCSchema(iacSchema);
-      spin.succeed(import_chalk4.default.green("IaC schema") + import_chalk4.default.dim(`  ${totalIaC} resource(s) found`));
+      spin.succeed(import_chalk4.default.green("IaC schema") + import_chalk4.default.dim(`  ${total} resource(s) across TF/CFN/CDK`));
     } catch (err) {
       spin.warn(import_chalk4.default.yellow("IaC scan skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
     }
   }
   let operations;
   {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim(`Scanning ${path3.basename(repoPath)}...`), color: "cyan" }).start();
+    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim(`Scanning ${path3.basename(repoPath)} for service usage...`), color: "cyan" }).start();
     try {
       operations = await (0, import_context.scanRepository)(repoPath);
-      spin.succeed(import_chalk4.default.green("Repository scanned") + import_chalk4.default.dim(`  ${operations.length} database operation(s) found`));
+      spin.succeed(import_chalk4.default.green("Repository scanned") + import_chalk4.default.dim(`  ${operations.length} service operation(s) found`));
     } catch (err) {
       spin.warn(import_chalk4.default.yellow("Repository scan failed") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
       operations = [];
     }
   }
+  let graph;
   {
     const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Building infrastructure graph..."), color: "cyan" }).start();
-    var graph = (0, import_graph.buildGraph)(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta);
+    graph = (0, import_graph.buildGraph)(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
     spin.succeed(import_chalk4.default.green("Graph built") + import_chalk4.default.dim(`  ${graph.nodes.length} nodes, ${graph.edges.length} edges`));
   }
   const findings = await (async () => {
@@ -3128,8 +4369,15 @@ async function runAnalyze(options = {}) {
       MissingMySQLIndexAnalyzer,
       MySQLFullTableScanAnalyzer,
       MissingMongoIndexAnalyzer,
-      MongoCollectionScanAnalyzer
-    } = await Promise.resolve().then(() => __toESM(require_dist9()));
+      MongoCollectionScanAnalyzer,
+      MissingDLQAnalyzer,
+      UnencryptedQueueAnalyzer,
+      LargeQueueBacklogAnalyzer,
+      MissingSecretRotationAnalyzer,
+      MissingLogRetentionAnalyzer,
+      LambdaDefaultMemoryAnalyzer,
+      LambdaHighTimeoutAnalyzer
+    } = await Promise.resolve().then(() => __toESM(require_dist11()));
     const analyzers = [
       new FullTableScanAnalyzer(),
       new MissingGSIAnalyzer(),
@@ -3141,6 +4389,13 @@ async function runAnalyze(options = {}) {
       new MySQLFullTableScanAnalyzer(),
       new MissingMongoIndexAnalyzer(),
       new MongoCollectionScanAnalyzer(),
+      new MissingDLQAnalyzer(),
+      new UnencryptedQueueAnalyzer(),
+      new LargeQueueBacklogAnalyzer(),
+      new MissingSecretRotationAnalyzer(),
+      new MissingLogRetentionAnalyzer(),
+      new LambdaDefaultMemoryAnalyzer(),
+      new LambdaHighTimeoutAnalyzer(),
       ...iacDriftAnalyzer ? [iacDriftAnalyzer] : []
     ];
     const result = await (0, import_analyzers.runAllAnalyzers)(graph, analyzers);
@@ -3172,13 +4427,12 @@ async function runAnalyze(options = {}) {
 var import_chalk5 = __toESM(require("chalk"));
 var import_ora3 = __toESM(require("ora"));
 var import_core3 = __toESM(require_dist());
-var import_server = __toESM(require_dist10());
+var import_server = __toESM(require_dist12());
 async function runDev(options = {}) {
   const port = options.port ?? 3e3;
   printHeader("MCP Server");
-  let config;
   try {
-    config = (0, import_core3.loadConfig)(options.config);
+    (0, import_core3.loadConfig)(options.config);
     log.success("Config loaded", options.config ?? "infrawise.yaml");
   } catch (err) {
     console.error((0, import_core3.formatError)(err));
@@ -3235,6 +4489,7 @@ async function runDev(options = {}) {
 // src/commands/doctor.ts
 var fs3 = __toESM(require("fs"));
 var path4 = __toESM(require("path"));
+var os2 = __toESM(require("os"));
 var import_chalk6 = __toESM(require("chalk"));
 var import_ora4 = __toESM(require("ora"));
 var import_core4 = __toESM(require_dist());
@@ -3242,7 +4497,8 @@ var import_adapters_dynamodb3 = __toESM(require_dist2());
 var import_adapters_postgres2 = __toESM(require_dist3());
 var import_adapters_mysql2 = __toESM(require_dist4());
 var import_adapters_mongodb2 = __toESM(require_dist5());
-var os2 = __toESM(require("os"));
+var import_adapters_aws_services2 = __toESM(require_dist7());
+var import_adapters_logs2 = __toESM(require_dist8());
 async function runCheck(label, fn) {
   const spin = (0, import_ora4.default)({ text: import_chalk6.default.dim(label), color: "cyan" }).start();
   const result = await fn();
@@ -3260,9 +4516,7 @@ async function runCheck(label, fn) {
       spin.info(import_chalk6.default.dim(`${result.name}  ${result.message}`));
       break;
   }
-  if (result.detail) {
-    console.log(import_chalk6.default.dim(`       ${result.detail}`));
-  }
+  if (result.detail) console.log(import_chalk6.default.dim(`       ${result.detail}`));
   return result;
 }
 async function runDoctor(options = {}) {
@@ -3280,9 +4534,7 @@ async function runDoctor(options = {}) {
   }));
   let config;
   results.push(await runCheck("Validating config...", async () => {
-    if (!fs3.existsSync(configPath)) {
-      return { name: "Config validation", status: "skip", message: "No config file" };
-    }
+    if (!fs3.existsSync(configPath)) return { name: "Config validation", status: "skip", message: "No config file" };
     try {
       config = (0, import_core4.loadConfig)(options.config);
       return { name: "Config validation", status: "pass", message: `project: ${config.project}` };
@@ -3305,21 +4557,102 @@ async function runDoctor(options = {}) {
       detail: hasCreds ? void 0 : "Run: aws configure"
     };
   }));
+  const awsCfg = { region: config?.aws?.region, profile: config?.aws?.profile };
   results.push(await runCheck("Testing DynamoDB access...", async () => {
-    if (!config) return { name: "DynamoDB access", status: "skip", message: "No valid config" };
+    if (!config) return { name: "DynamoDB", status: "skip", message: "No valid config" };
     try {
       const ok = await (0, import_adapters_dynamodb3.validateDynamoAccess)(config);
       return {
-        name: "DynamoDB access",
+        name: "DynamoDB",
         status: ok ? "pass" : "fail",
         message: ok ? `Connected (profile: ${config.aws?.profile ?? "default"})` : "Cannot connect",
         detail: ok ? void 0 : "Check IAM: dynamodb:ListTables, dynamodb:DescribeTable"
       };
+    } catch (err) {
+      return { name: "DynamoDB", status: "fail", message: err instanceof Error ? err.message : String(err) };
+    }
+  }));
+  results.push(await runCheck("Testing SQS access...", async () => {
+    if (config?.sqs?.enabled === false) return { name: "SQS", status: "skip", message: "Disabled in config" };
+    try {
+      await (0, import_adapters_aws_services2.validateSQSAccess)(awsCfg);
+      return { name: "SQS", status: "pass", message: "Connected" };
     } catch (err) {
       return {
-        name: "DynamoDB access",
-        status: "fail",
-        message: err instanceof Error ? err.message : String(err)
+        name: "SQS",
+        status: "warn",
+        message: err instanceof Error ? err.message : String(err),
+        detail: "Check IAM: sqs:ListQueues, sqs:GetQueueAttributes"
+      };
+    }
+  }));
+  results.push(await runCheck("Testing SNS access...", async () => {
+    if (config?.sns?.enabled === false) return { name: "SNS", status: "skip", message: "Disabled in config" };
+    try {
+      await (0, import_adapters_aws_services2.validateSNSAccess)(awsCfg);
+      return { name: "SNS", status: "pass", message: "Connected" };
+    } catch (err) {
+      return {
+        name: "SNS",
+        status: "warn",
+        message: err instanceof Error ? err.message : String(err),
+        detail: "Check IAM: sns:ListTopics, sns:GetTopicAttributes, sns:ListSubscriptionsByTopic"
+      };
+    }
+  }));
+  results.push(await runCheck("Testing SSM Parameter Store access...", async () => {
+    if (config?.ssm?.enabled === false) return { name: "SSM", status: "skip", message: "Disabled in config" };
+    try {
+      await (0, import_adapters_aws_services2.validateSSMAccess)(awsCfg);
+      return { name: "SSM", status: "pass", message: "Connected (metadata only)" };
+    } catch (err) {
+      return {
+        name: "SSM",
+        status: "warn",
+        message: err instanceof Error ? err.message : String(err),
+        detail: "Check IAM: ssm:DescribeParameters"
+      };
+    }
+  }));
+  results.push(await runCheck("Testing Secrets Manager access...", async () => {
+    if (config?.secretsManager?.enabled === false) return { name: "Secrets Manager", status: "skip", message: "Disabled in config" };
+    try {
+      await (0, import_adapters_aws_services2.validateSecretsAccess)(awsCfg);
+      return { name: "Secrets Manager", status: "pass", message: "Connected (names/rotation only)" };
+    } catch (err) {
+      return {
+        name: "Secrets Manager",
+        status: "warn",
+        message: err instanceof Error ? err.message : String(err),
+        detail: "Check IAM: secretsmanager:ListSecrets"
+      };
+    }
+  }));
+  results.push(await runCheck("Testing Lambda access...", async () => {
+    if (config?.lambda?.enabled === false) return { name: "Lambda", status: "skip", message: "Disabled in config" };
+    try {
+      await (0, import_adapters_aws_services2.validateLambdaAccess)(awsCfg);
+      return { name: "Lambda", status: "pass", message: "Connected" };
+    } catch (err) {
+      return {
+        name: "Lambda",
+        status: "warn",
+        message: err instanceof Error ? err.message : String(err),
+        detail: "Check IAM: lambda:ListFunctions"
+      };
+    }
+  }));
+  results.push(await runCheck("Testing CloudWatch Logs access...", async () => {
+    if (!config?.cloudwatchLogs?.enabled) return { name: "CloudWatch Logs", status: "skip", message: "Not enabled in config" };
+    try {
+      await (0, import_adapters_logs2.validateLogsAccess)(awsCfg);
+      return { name: "CloudWatch Logs", status: "pass", message: "Connected" };
+    } catch (err) {
+      return {
+        name: "CloudWatch Logs",
+        status: "warn",
+        message: err instanceof Error ? err.message : String(err),
+        detail: "Check IAM: logs:DescribeLogGroups, logs:FilterLogEvents"
       };
     }
   }));
@@ -3333,14 +4666,10 @@ async function runDoctor(options = {}) {
         name: "PostgreSQL",
         status: ok ? "pass" : "fail",
         message: ok ? "Connected" : "Cannot connect",
-        detail: ok ? void 0 : "Check connection string, security group, and credentials"
+        detail: ok ? void 0 : "Check connection string and security group"
       };
     } catch (err) {
-      return {
-        name: "PostgreSQL",
-        status: "fail",
-        message: err instanceof Error ? err.message : String(err)
-      };
+      return { name: "PostgreSQL", status: "fail", message: err instanceof Error ? err.message : String(err) };
     }
   }));
   results.push(await runCheck("Testing MySQL...", async () => {
@@ -3353,14 +4682,10 @@ async function runDoctor(options = {}) {
         name: "MySQL",
         status: ok ? "pass" : "fail",
         message: ok ? "Connected" : "Cannot connect",
-        detail: ok ? void 0 : "Check connection string, host, port 3306, and credentials"
+        detail: ok ? void 0 : "Check connection string, host, port 3306"
       };
     } catch (err) {
-      return {
-        name: "MySQL",
-        status: "fail",
-        message: err instanceof Error ? err.message : String(err)
-      };
+      return { name: "MySQL", status: "fail", message: err instanceof Error ? err.message : String(err) };
     }
   }));
   results.push(await runCheck("Testing MongoDB...", async () => {
@@ -3373,14 +4698,10 @@ async function runDoctor(options = {}) {
         name: "MongoDB",
         status: ok ? "pass" : "fail",
         message: ok ? "Connected" : "Cannot connect",
-        detail: ok ? void 0 : "Check connection string, host, port 27017, and credentials"
+        detail: ok ? void 0 : "Check connection string and port 27017"
       };
     } catch (err) {
-      return {
-        name: "MongoDB",
-        status: "fail",
-        message: err instanceof Error ? err.message : String(err)
-      };
+      return { name: "MongoDB", status: "fail", message: err instanceof Error ? err.message : String(err) };
     }
   }));
   results.push(await runCheck("Detecting project type...", async () => {
@@ -3389,10 +4710,27 @@ async function runDoctor(options = {}) {
     return {
       name: "Project type",
       status: hasTsConfig ? "pass" : "warn",
-      message: hasTsConfig ? "TypeScript (tsconfig.json found)" : hasPkg ? "JavaScript (no tsconfig.json)" : "Unknown project",
+      message: hasTsConfig ? "TypeScript" : hasPkg ? "JavaScript (no tsconfig.json)" : "Unknown",
       detail: hasTsConfig ? void 0 : "Scanner works best with TypeScript projects"
     };
   }));
+  results.push(await runCheck("Detecting IaC files...", async () => {
+    const cwd = process.cwd();
+    const hasTF = fs3.existsSync(path4.join(cwd, "main.tf")) || fs3.readdirSync(cwd).some((f) => f.endsWith(".tf"));
+    const hasCFN = fs3.existsSync(path4.join(cwd, "template.yaml")) || fs3.existsSync(path4.join(cwd, "template.json"));
+    const hasCDK = fs3.existsSync(path4.join(cwd, "cdk.json"));
+    const hasCDKOut = fs3.existsSync(path4.join(cwd, "cdk.out"));
+    const found = [];
+    if (hasTF) found.push("Terraform");
+    if (hasCFN) found.push("CloudFormation");
+    if (hasCDK) found.push(`CDK${hasCDKOut ? " (synthesized)" : " (run cdk synth)"}`);
+    return {
+      name: "IaC files",
+      status: found.length > 0 ? "pass" : "warn",
+      message: found.length > 0 ? found.join(", ") : "No Terraform/CFN/CDK files detected",
+      detail: found.length === 0 ? "IaC analysis will be skipped without TF/CFN/CDK files" : void 0
+    };
+  }));
   results.push(await runCheck("Checking analysis cache...", async () => {
     const cached = fs3.existsSync(path4.join(process.cwd(), ".infrawise", "cache", "graph.json"));
     return {