infrawise 0.1.0 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Sidd27
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,5 +1,10 @@
 # Infrawise
 
+[![npm version](https://img.shields.io/npm/v/infrawise)](https://www.npmjs.com/package/infrawise)
+[![Publish to npm](https://github.com/Sidd27/infrawise/actions/workflows/npm-publish.yml/badge.svg)](https://github.com/Sidd27/infrawise/actions/workflows/npm-publish.yml)
+[![CI](https://github.com/Sidd27/infrawise/actions/workflows/ci.yml/badge.svg)](https://github.com/Sidd27/infrawise/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
 **Understand your infrastructure, not just your code.**
 
 Infrawise is a CLI tool that scans your TypeScript codebase, maps every function-to-database relationship into a graph, detects anti-patterns (full table scans, missing indexes, hot partitions, N+1 queries), and exposes all of it as an MCP server — so AI coding assistants like Claude Code have live, deterministic knowledge of your infrastructure when helping you write database code.
@@ -137,16 +142,23 @@ Alternatively, let Claude Code manage the server lifecycle automatically:
 
 ### Step 3: What Claude can now do
 
-Claude gains four tools it calls silently while helping you:
+Claude gains 13 tools it calls silently while helping you:
 
 | Tool | What it gives Claude |
 |---|---|
-| `get_graph_summary` | Full infrastructure graph — tables, GSIs, function relationships, all findings |
-| `analyze_function` | Issues introduced by a specific function — scans, missing indexes, N+1 |
+| `get_infra_overview` | Complete snapshot — all services, counts, and high-severity findings |
+| `get_graph_summary` | Full infrastructure graph — all nodes, edges, and findings |
+| `analyze_function` | Issues in a specific function — scans, missing indexes, N+1 |
 | `suggest_gsi` | Exact GSI config for a DynamoDB table + attribute |
 | `postgres_index_suggestions` | Exact `CREATE INDEX` SQL for your actual table |
 | `suggest_mongo_index` | Exact `createIndex` command for a MongoDB collection + field |
 | `mysql_index_suggestions` | Exact `ALTER TABLE ADD INDEX` SQL for your MySQL table |
+| `get_queue_details` | SQS queues — DLQ status, encryption, message counts |
+| `get_topic_details` | SNS topics — subscription counts and protocols |
+| `get_secrets_overview` | Secrets Manager — names and rotation status (values never included) |
+| `get_parameter_overview` | SSM Parameter Store — names, types, tiers (values never included) |
+| `get_lambda_overview` | Lambda functions — runtime, memory, timeout, env var key names |
+| `get_log_errors` | CloudWatch error patterns and counts (no raw log messages) |
 
 ### What changes in practice
 
@@ -182,7 +194,7 @@ Infrawise works with any editor or tool that supports MCP or can call an HTTP AP
 
 ## Configuration
 
-`infrawise.yaml` is generated by `infrawise init` and lives in your repo root:
+`infrawise.yaml` is generated by `infrawise init` and lives in your repo root. Every service must be explicitly `enabled: true` — infrawise never connects to anything not listed in config.
 
 ```yaml
 project: payments-service
@@ -192,6 +204,7 @@ aws:
   region: ap-south-1
 
 dynamodb:
+  enabled: true
   includeTables:            # omit to include all tables
     - Orders
     - Users
@@ -200,6 +213,38 @@ postgres:
   enabled: true
   connectionString: postgresql://infrawise_ro:password@host:5432/mydb
 
+mysql:
+  enabled: false
+  connectionString: ""
+
+mongodb:
+  enabled: false
+  connectionString: ""
+
+sqs:
+  enabled: true
+
+sns:
+  enabled: true
+
+ssm:
+  enabled: true
+  paths: []                 # filter by prefix e.g. ["/myapp/prod"]
+
+secretsManager:
+  enabled: true
+
+lambda:
+  enabled: true
+
+rds:
+  enabled: false
+
+cloudwatchLogs:
+  enabled: false
+  logGroupPrefixes: []
+  windowHours: 24
+
 analysis:
   sampleSize: 100
 ```
@@ -245,44 +290,52 @@ For Amazon RDS: allow inbound on port 5432 from your machine's IP in the securit
 
 ---
 
-## What gets analyzed
+## Language support
 
-### DynamoDB
+Infrawise has two analysis layers with different language requirements:
 
-| Analyzer | Severity | What it detects |
-|---|---|---|
-| Full Table Scan | High | `.scan()` calls without filters |
-| Missing GSI | Medium | Tables queried without a matching GSI |
-| Hot Partition | Medium | 5+ distinct code paths hitting the same table |
-
-### PostgreSQL
+### Infrastructure-level analysis — any project, any language
 
-| Analyzer | Severity | What it detects |
-|---|---|---|
-| Missing Index | Medium/High | Columns filtered without indexes |
-| N+1 Query | Medium | Repeated query patterns from ORM inefficiencies |
-| Large SELECT | Low | `SELECT *` usage |
+The following analyzers work purely from infrastructure metadata (AWS APIs, database schema introspection, IaC files). They have no dependency on your application code or language:
 
-### MySQL
+| Service | What it checks |
+|---|---|
+| DynamoDB schema | Tables, GSIs, partition keys |
+| PostgreSQL / MySQL schema | Tables, indexes, column types |
+| MongoDB schema | Collections, indexes |
+| SQS | Missing DLQs, unencrypted queues, large backlogs |
+| Secrets Manager | Missing secret rotation |
+| Lambda | Default memory (128 MB), high timeouts |
+| RDS | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ |
+| CloudWatch Logs | Log groups with no retention policy |
+| Terraform / CloudFormation / CDK | IaC drift vs deployed state |
 
-| Analyzer | Severity | What it detects |
-|---|---|---|
-| Missing MySQL Index | Medium | Tables queried without indexes |
-| MySQL Full Table Scan | High | Scan operations on MySQL tables |
+### Code-level analysis — TypeScript and JavaScript only
 
-### MongoDB
+The repository scanner uses [ts-morph](https://ts-morph.com/) for static AST analysis. It detects which functions call which tables and how, enabling pattern detection that requires correlating code with infrastructure:
 
 | Analyzer | Severity | What it detects |
 |---|---|---|
+| Full Table Scan (DynamoDB) | High | `.scan()` calls without filters |
+| Missing GSI | Medium | Queries on attributes without a matching GSI |
+| Hot Partition | Medium | 5+ distinct code paths hitting the same table |
+| Missing Index (PostgreSQL) | Medium | Tables queried without indexes |
+| N+1 Query | Medium | Repeated query patterns from ORM loops |
+| Large SELECT | Low | `SELECT *` usage |
+| Missing MySQL Index | Medium | MySQL tables queried without indexes |
+| MySQL Full Table Scan | High | Full table scan patterns in MySQL queries |
 | Missing Mongo Index | Medium | Collections queried without secondary indexes |
-| Collection Scan | High | Full collection scan operations |
+| Collection Scan | High | `find()` calls without filter predicates |
 
-### Terraform / CloudFormation (IaC Drift)
+**Non-TypeScript/JavaScript projects** still get full value from all infrastructure-level analyzers. The code correlation layer (which functions hit which tables, N+1 patterns) is skipped — run `infrawise analyze` and it will report 0 code operations while still surfacing all schema, configuration, and IaC findings.
 
-| Analyzer | Severity | What it detects |
-|---|---|---|
-| IaC Drift | Medium | DynamoDB tables defined in IaC but not deployed in AWS |
-| IaC Drift | Medium | DynamoDB tables deployed in AWS but not defined in IaC |
+The scanner detects these patterns in TypeScript and JavaScript files:
+
+- **DynamoDB** — AWS SDK v3 (`client.send(new QueryCommand(...))`) and v2-style (`dynamoDb.scan(...)`)
+- **PostgreSQL** — `pg` pool/client queries, Prisma, Knex
+- **MySQL** — `mysql2` connection/pool queries, Knex with MySQL dialect
+- **MongoDB** — driver `collection.find/findOne/aggregate`, Mongoose models
+- **SQS / SNS / SSM / Secrets / Lambda** — AWS SDK v3 command pattern
 
 ---
 
@@ -298,46 +351,46 @@ For Amazon RDS: allow inbound on port 5432 from your machine's IP in the securit
 ## Architecture
 
 ```
-Your TypeScript repo
-        ↓
-┌───────────────────────────────────────────────────────┐
+Your repo (any language)          Your repo (TS/JS only)
+        │                                  │
+        │                    Repository Scanner (ts-morph AST)
+        │                     which functions → which tables
+        │                                  │
+┌───────┴──────────────────────────────────┴────────────┐
 │  infrawise analyze                                    │
 │                                                       │
-│  Repository Scanner    AWS DynamoDB    PostgreSQL     │
-│  (ts-morph AST)             ↓              ↓         │
-│        ↓                    └──────┬───────┘          │
-│        └────────────────────►      │                  │
-│                          Graph Engine                 │
-│                        (nodes + edges)                │
-│                              ↓                        │
-│                       Analyzer Engine                 │
-│                    (rule-based, deterministic)        │
-└──────────────────────────────┬────────────────────────┘
-                               ↓
-                    ┌──────────────────┐
-                    │   MCP Server     │ ◄── Claude Code
-                    │  localhost:3000  │ ◄── Cursor
-                    └──────────────────┘ ◄── Windsurf
+│  AWS APIs / DB schema / IaC files  +  Code ops (opt)  │
+│         (works for any project)      (TS/JS only)     │
+│                          │                            │
+│                     Graph Engine                      │
+│                   (nodes + edges)                     │
+│                          │                            │
+│                   Analyzer Engine                     │
+│               (rule-based, deterministic)             │
+└─────────────────────────┬─────────────────────────────┘
+                          │
+               ┌──────────────────┐
+               │   MCP Server     │ ◄── Claude Code
+               │  localhost:3000  │ ◄── Cursor
+               └──────────────────┘ ◄── Windsurf
 ```
 
 The analysis is entirely deterministic — no LLM is involved in extracting or analyzing your infrastructure. AI is only at the consumption layer.
 
-### Package structure
+### Source layout
 
-| Package | Description |
-|---|---|
-| `@infrawise/shared` | Shared TypeScript types |
-| `@infrawise/core` | Config (Zod + YAML), logger (Pino), local cache |
-| `@infrawise/graph` | Graph engine — nodes, edges, builder |
-| `@infrawise/adapters-dynamodb` | DynamoDB extractor (AWS SDK v3) |
-| `@infrawise/adapters-postgres` | PostgreSQL extractor (pg) |
-| `@infrawise/adapters-mysql` | MySQL extractor (mysql2) |
-| `@infrawise/adapters-mongodb` | MongoDB extractor (mongodb driver) |
-| `@infrawise/adapters-terraform` | Terraform and CloudFormation IaC schema extractor |
-| `@infrawise/context` | Repository scanner (ts-morph AST) |
-| `@infrawise/analyzers` | 11 rule-based analyzers |
-| `@infrawise/server` | Fastify MCP HTTP server |
-| `infrawise` | CLI (Commander.js) |
+```
+src/
+  types.ts      Shared type definitions
+  core/         Config (Zod + YAML), logger (Pino), local cache
+  graph/        Graph engine — nodes, edges, builder
+  adapters/     Flat extractors: dynamodb.ts, postgres.ts, mysql.ts,
+                mongodb.ts, aws.ts, logs.ts, terraform.ts
+  analyzers/    23 rule-based analyzers
+  context/      Repository scanner (ts-morph AST)
+  server/       Fastify MCP HTTP server (plain JSON-RPC, no SDK)
+  cli/          CLI commands (Commander.js)
+```
 
 ---
 
@@ -359,7 +412,7 @@ The analysis is entirely deterministic — no LLM is involved in extracting or a
 
 | Requirement | Version |
 |---|---|
-| Node.js | 22+ |
+| Node.js | 24+ |
 | pnpm | 9+ |
 | AWS CLI | any (for integration testing) |
 
@@ -386,14 +439,16 @@ pnpm typecheck    # TypeScript strict check
 pnpm lint         # ESLint
 ```
 
-Tests live in:
-- `packages/core/src/__tests__/` — config validation
-- `packages/graph/src/__tests__/` — graph builder
-- `packages/analyzers/src/__tests__/` — all 6 analyzers
+Tests live in `src/**/__tests__/`:
+- `src/core/__tests__/` — config validation, cache
+- `src/graph/__tests__/` — graph builder
+- `src/analyzers/__tests__/` — all analyzers
+- `src/server/__tests__/` — MCP server (Fastify inject, all 13 tools)
+- `src/context/__tests__/` — repository scanner
 
 ### Adding a new analyzer
 
-1. Create your analyzer in `packages/analyzers/src/`
+1. Create your analyzer in `src/analyzers/`
 2. Implement the `Analyzer` interface:
 ```ts
 export class MyAnalyzer implements Analyzer {
@@ -401,20 +456,42 @@ export class MyAnalyzer implements Analyzer {
   async analyze(graph: SystemGraph): Promise<Finding[]> { ... }
 }
 ```
-3. Register it in `packages/analyzers/src/index.ts`
-4. Add tests in `packages/analyzers/src/__tests__/`
+3. Export it from `src/analyzers/index.ts`
+4. Add tests in `src/analyzers/__tests__/`
 
 ### Adding a new database adapter
 
-1. Create a new package under `packages/adapters/yourdb/`
+1. Create your extractor as `src/adapters/yourdb.ts`
 2. Export a function returning `Promise<YourTableMetadata[]>`
-3. Extend `SystemGraph` node types in `@infrawise/shared` if needed
-4. Wire it into `packages/cli/src/commands/analyze.ts`
+3. Add the metadata type to `src/types.ts` if needed
+4. Wire it into `src/cli/commands/analyze.ts`
+
+### Releasing
+
+The git tag is the source of truth. The version in root `package.json` and the tag must always match — the release script does both atomically.
+
+```bash
+pnpm release patch    # 0.1.2 → 0.1.3  (bug fixes)
+pnpm release minor    # 0.1.2 → 0.2.0  (new features, backwards compatible)
+pnpm release major    # 0.1.2 → 1.0.0  (breaking changes)
+pnpm release 1.5.0    # explicit version
+
+git push origin main --tags
+```
+
+**What happens after push:**
+
+1. `release.yml` fires on the `v*.*.*` tag → creates a **draft** GitHub release with auto-generated notes
+2. Review the draft on GitHub → click **Publish release**
+3. `npm-publish.yml` fires on publish → reads the version from the tag, stamps it onto `package.json`, builds, and publishes to npm
+
+The CLI reads its version from root `package.json` at runtime, so `infrawise --version` always matches the installed package.
 
 ### PR checklist
 
-- `pnpm test` passes
+- `pnpm lint` passes (no errors)
 - `pnpm typecheck` passes
+- `pnpm test` passes
 - New analyzers have unit tests with mock graph data
 - No hardcoded AWS regions or credentials
 

package/dist/adapters/aws.js

@@ -0,0 +1,255 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractSQSMetadata = extractSQSMetadata;
+exports.validateSQSAccess = validateSQSAccess;
+exports.extractSNSMetadata = extractSNSMetadata;
+exports.validateSNSAccess = validateSNSAccess;
+exports.extractSSMMetadata = extractSSMMetadata;
+exports.validateSSMAccess = validateSSMAccess;
+exports.extractSecretsMetadata = extractSecretsMetadata;
+exports.validateSecretsAccess = validateSecretsAccess;
+exports.extractLambdaMetadata = extractLambdaMetadata;
+exports.validateLambdaAccess = validateLambdaAccess;
+exports.extractRDSMetadata = extractRDSMetadata;
+exports.validateRDSAccess = validateRDSAccess;
+const client_sqs_1 = require("@aws-sdk/client-sqs");
+const client_sns_1 = require("@aws-sdk/client-sns");
+const client_ssm_1 = require("@aws-sdk/client-ssm");
+const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
+const client_lambda_1 = require("@aws-sdk/client-lambda");
+const client_rds_1 = require("@aws-sdk/client-rds");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const core_1 = require("../core");
+function clientConfig(cfg) {
+    const region = cfg.region ?? 'us-east-1';
+    return cfg.profile
+        ? { region, credentials: (0, credential_providers_1.fromIni)({ profile: cfg.profile }) }
+        : { region };
+}
+// ─── SQS ─────────────────────────────────────────────────────────────────────
+async function extractSQSMetadata(cfg = {}) {
+    const client = new client_sqs_1.SQSClient(clientConfig(cfg));
+    const queues = [];
+    try {
+        let nextToken;
+        const queueUrls = [];
+        do {
+            const res = await client.send(new client_sqs_1.ListQueuesCommand({ NextToken: nextToken, MaxResults: 1000 }));
+            queueUrls.push(...(res.QueueUrls ?? []));
+            nextToken = res.NextToken;
+        } while (nextToken);
+        for (const url of queueUrls) {
+            try {
+                const attrs = await client.send(new client_sqs_1.GetQueueAttributesCommand({
+                    QueueUrl: url,
+                    AttributeNames: [
+                        'QueueArn', 'VisibilityTimeout', 'MessageRetentionPeriod',
+                        'RedrivePolicy', 'KmsMasterKeyId', 'SqsManagedSseEnabled',
+                        'ApproximateNumberOfMessages', 'ApproximateNumberOfMessagesNotVisible',
+                    ],
+                }));
+                const a = attrs.Attributes ?? {};
+                const arn = a['QueueArn'] ?? '';
+                const name = arn.split(':').pop() ?? url.split('/').pop() ?? url;
+                const redrivePolicy = a['RedrivePolicy'];
+                const dlqArn = redrivePolicy
+                    ? JSON.parse(redrivePolicy).deadLetterTargetArn
+                    : undefined;
+                const encrypted = !!(a['KmsMasterKeyId'] || a['SqsManagedSseEnabled'] === 'true');
+                const retentionSeconds = parseInt(a['MessageRetentionPeriod'] ?? '345600', 10);
+                queues.push({
+                    name,
+                    url,
+                    arn,
+                    hasDLQ: !!dlqArn,
+                    dlqArn,
+                    encrypted,
+                    visibilityTimeoutSec: parseInt(a['VisibilityTimeout'] ?? '30', 10),
+                    retentionDays: Math.round(retentionSeconds / 86400),
+                    approximateMessages: parseInt(a['ApproximateNumberOfMessages'] ?? '0', 10),
+                    approximateInflight: parseInt(a['ApproximateNumberOfMessagesNotVisible'] ?? '0', 10),
+                });
+            }
+            catch (err) {
+                core_1.logger.warn(`SQS attrs failed for ${url}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+    }
+    catch (err) {
+        core_1.logger.warn(`SQS list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return queues;
+}
+async function validateSQSAccess(cfg = {}) {
+    await new client_sqs_1.SQSClient(clientConfig(cfg)).send(new client_sqs_1.ListQueuesCommand({ MaxResults: 1 }));
+}
+// ─── SNS ─────────────────────────────────────────────────────────────────────
+async function extractSNSMetadata(cfg = {}) {
+    const client = new client_sns_1.SNSClient(clientConfig(cfg));
+    const topics = [];
+    try {
+        let nextToken;
+        const topicArns = [];
+        do {
+            const res = await client.send(new client_sns_1.ListTopicsCommand({ NextToken: nextToken }));
+            topicArns.push(...(res.Topics ?? []).map((t) => t.TopicArn ?? '').filter(Boolean));
+            nextToken = res.NextToken;
+        } while (nextToken);
+        for (const arn of topicArns) {
+            try {
+                const [attrsRes, subsRes] = await Promise.all([
+                    client.send(new client_sns_1.GetTopicAttributesCommand({ TopicArn: arn })),
+                    client.send(new client_sns_1.ListSubscriptionsByTopicCommand({ TopicArn: arn })),
+                ]);
+                const attrs = attrsRes.Attributes ?? {};
+                const subs = subsRes.Subscriptions ?? [];
+                topics.push({
+                    name: arn.split(':').pop() ?? arn,
+                    arn,
+                    encrypted: !!attrs['KmsMasterKeyId'],
+                    subscriptionCount: subs.length,
+                    subscriptionProtocols: [...new Set(subs.map((s) => s.Protocol ?? 'unknown'))],
+                });
+            }
+            catch (err) {
+                core_1.logger.warn(`SNS attrs failed for ${arn}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+    }
+    catch (err) {
+        core_1.logger.warn(`SNS list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return topics;
+}
+async function validateSNSAccess(cfg = {}) {
+    await new client_sns_1.SNSClient(clientConfig(cfg)).send(new client_sns_1.ListTopicsCommand({}));
+}
+// ─── SSM Parameter Store ──────────────────────────────────────────────────────
+async function extractSSMMetadata(cfg = {}) {
+    const client = new client_ssm_1.SSMClient(clientConfig(cfg));
+    const parameters = [];
+    try {
+        let nextToken;
+        do {
+            const res = await client.send(new client_ssm_1.DescribeParametersCommand({
+                NextToken: nextToken,
+                MaxResults: 50,
+                // Only metadata — GetParameter/GetParameters would return values
+            }));
+            for (const p of res.Parameters ?? []) {
+                parameters.push({
+                    name: p.Name ?? '',
+                    type: p.Type ?? 'String',
+                    tier: p.Tier ?? 'Standard',
+                    lastModified: p.LastModifiedDate?.toISOString(),
+                    description: p.Description,
+                    keyId: p.KeyId,
+                });
+            }
+            nextToken = res.NextToken;
+        } while (nextToken && parameters.length < 500);
+    }
+    catch (err) {
+        core_1.logger.warn(`SSM list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return parameters;
+}
+async function validateSSMAccess(cfg = {}) {
+    await new client_ssm_1.SSMClient(clientConfig(cfg)).send(new client_ssm_1.DescribeParametersCommand({ MaxResults: 1 }));
+}
+// ─── Secrets Manager ──────────────────────────────────────────────────────────
+async function extractSecretsMetadata(cfg = {}) {
+    const client = new client_secrets_manager_1.SecretsManagerClient(clientConfig(cfg));
+    const secrets = [];
+    try {
+        let nextToken;
+        do {
+            // ListSecrets never returns secret values
+            const res = await client.send(new client_secrets_manager_1.ListSecretsCommand({ NextToken: nextToken, MaxResults: 100 }));
+            for (const s of res.SecretList ?? []) {
+                secrets.push({
+                    name: s.Name ?? '',
+                    arn: s.ARN ?? '',
+                    rotationEnabled: s.RotationEnabled ?? false,
+                    rotationDays: s.RotationRules?.AutomaticallyAfterDays,
+                    lastRotated: s.LastRotatedDate?.toISOString(),
+                    lastAccessed: s.LastAccessedDate?.toISOString(),
+                    description: s.Description,
+                });
+            }
+            nextToken = res.NextToken;
+        } while (nextToken && secrets.length < 200);
+    }
+    catch (err) {
+        core_1.logger.warn(`Secrets Manager list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return secrets;
+}
+async function validateSecretsAccess(cfg = {}) {
+    await new client_secrets_manager_1.SecretsManagerClient(clientConfig(cfg)).send(new client_secrets_manager_1.ListSecretsCommand({ MaxResults: 1 }));
+}
+// ─── Lambda ───────────────────────────────────────────────────────────────────
+async function extractLambdaMetadata(cfg = {}) {
+    const client = new client_lambda_1.LambdaClient(clientConfig(cfg));
+    const functions = [];
+    try {
+        let marker;
+        do {
+            const res = await client.send(new client_lambda_1.ListFunctionsCommand({ Marker: marker, MaxItems: 50 }));
+            for (const fn of res.Functions ?? []) {
+                functions.push({
+                    name: fn.FunctionName ?? '',
+                    arn: fn.FunctionArn ?? '',
+                    runtime: fn.Runtime,
+                    handler: fn.Handler,
+                    memoryMB: fn.MemorySize,
+                    timeoutSec: fn.Timeout,
+                    lastModified: fn.LastModified,
+                    envVarKeys: Object.keys(fn.Environment?.Variables ?? {}),
+                    layers: (fn.Layers ?? []).map((l) => l.Arn ?? '').filter(Boolean),
+                });
+            }
+            marker = res.NextMarker;
+        } while (marker && functions.length < 200);
+    }
+    catch (err) {
+        core_1.logger.warn(`Lambda list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return functions;
+}
+async function validateLambdaAccess(cfg = {}) {
+    await new client_lambda_1.LambdaClient(clientConfig(cfg)).send(new client_lambda_1.ListFunctionsCommand({ MaxItems: 1 }));
+}
+// ─── RDS ─────────────────────────────────────────────────────────────────────
+async function extractRDSMetadata(cfg = {}) {
+    const client = new client_rds_1.RDSClient(clientConfig(cfg));
+    const instances = [];
+    try {
+        let marker;
+        do {
+            const res = await client.send(new client_rds_1.DescribeDBInstancesCommand({ Marker: marker, MaxRecords: 100 }));
+            for (const db of res.DBInstances ?? []) {
+                instances.push({
+                    dbInstanceIdentifier: db.DBInstanceIdentifier ?? '',
+                    engine: db.Engine ?? '',
+                    engineVersion: db.EngineVersion ?? '',
+                    instanceClass: db.DBInstanceClass ?? '',
+                    publiclyAccessible: db.PubliclyAccessible ?? false,
+                    storageEncrypted: db.StorageEncrypted ?? false,
+                    backupRetentionPeriod: db.BackupRetentionPeriod ?? 0,
+                    deletionProtection: db.DeletionProtection ?? false,
+                    multiAZ: db.MultiAZ ?? false,
+                    dbInstanceStatus: db.DBInstanceStatus ?? '',
+                });
+            }
+            marker = res.Marker;
+        } while (marker && instances.length < 200);
+    }
+    catch (err) {
+        core_1.logger.warn(`RDS list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return instances;
+}
+async function validateRDSAccess(cfg = {}) {
+    await new client_rds_1.RDSClient(clientConfig(cfg)).send(new client_rds_1.DescribeDBInstancesCommand({ MaxRecords: 20 }));
+}