infrawise 0.1.2 → 0.2.0

package/dist/analyzers/terraform.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IaCDriftAnalyzer = void 0;
+class IaCDriftAnalyzer {
+    name = 'IaCDriftAnalyzer';
+    iacSchema = null;
+    setIaCSchema(schema) {
+        this.iacSchema = schema;
+    }
+    async analyze(graph) {
+        const findings = [];
+        if (!this.iacSchema)
+            return findings;
+        const iac = this.iacSchema;
+        // ── DynamoDB drift ───────────────────────────────────────────────────────
+        const deployedDynamo = new Set(graph.nodes
+            .filter((n) => n.type === 'table' && n.databaseType === 'dynamodb')
+            .map((n) => n.name));
+        const iacDynamo = new Map(iac.dynamoTables.map((t) => [t.name, t.filePath]));
+        for (const [name, fp] of iacDynamo) {
+            if (!deployedDynamo.has(name)) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `IaC drift: DynamoDB table "${name}" defined in IaC but not deployed`,
+                    description: `"${name}" is in ${fp} but not found in AWS. It may be undeployed or deleted manually.`,
+                    recommendation: 'Run `terraform apply` / deploy your stack, or remove the definition from IaC.',
+                    metadata: { resourceType: 'dynamodb_table', name, filePath: fp, driftType: 'defined_not_deployed' },
+                });
+            }
+        }
+        for (const name of deployedDynamo) {
+            if (!iacDynamo.has(name)) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `IaC drift: DynamoDB table "${name}" deployed but not in IaC`,
+                    description: `"${name}" exists in AWS DynamoDB but has no IaC definition. It may have been created manually.`,
+                    recommendation: 'Import the table with `terraform import` or add a CloudFormation resource, then track all future changes through IaC.',
+                    metadata: { resourceType: 'dynamodb_table', name, driftType: 'deployed_not_defined' },
+                });
+            }
+        }
+        // ── Queue drift ───────────────────────────────────────────────────────────
+        const deployedQueues = new Set(graph.nodes.filter((n) => n.type === 'queue').map((n) => n.name));
+        const iacQueues = new Map(iac.queues.map((q) => [q.name, q.filePath]));
+        for (const [name, fp] of iacQueues) {
+            if (!deployedQueues.has(name)) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `IaC drift: SQS queue "${name}" defined in IaC but not deployed`,
+                    description: `SQS queue "${name}" is defined in ${fp} but not found in the live account.`,
+                    recommendation: 'Deploy the queue via `terraform apply` or your CFN/CDK stack.',
+                    metadata: { resourceType: 'sqs_queue', name, filePath: fp, driftType: 'defined_not_deployed' },
+                });
+            }
+        }
+        for (const name of deployedQueues) {
+            if (!iacQueues.has(name)) {
+                findings.push({
+                    severity: 'low',
+                    issue: `IaC drift: SQS queue "${name}" deployed but not in IaC`,
+                    description: `SQS queue "${name}" exists in AWS but is not tracked in IaC. Manual resources can't be audited or reproduced reliably.`,
+                    recommendation: 'Import or define the queue in IaC to bring it under version control.',
+                    metadata: { resourceType: 'sqs_queue', name, driftType: 'deployed_not_defined' },
+                });
+            }
+        }
+        // ── Lambda drift ──────────────────────────────────────────────────────────
+        const deployedLambdas = new Set(graph.nodes.filter((n) => n.type === 'lambda').map((n) => n.name));
+        const iacLambdas = new Map(iac.lambdas.map((l) => [l.name, l.filePath]));
+        for (const [name, fp] of iacLambdas) {
+            if (!deployedLambdas.has(name)) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `IaC drift: Lambda "${name}" defined in IaC but not deployed`,
+                    description: `Lambda function "${name}" is defined in ${fp} but not found in the live account.`,
+                    recommendation: 'Deploy the function via `terraform apply` or your CFN/CDK stack.',
+                    metadata: { resourceType: 'lambda_function', name, filePath: fp, driftType: 'defined_not_deployed' },
+                });
+            }
+        }
+        for (const name of deployedLambdas) {
+            if (!iacLambdas.has(name)) {
+                findings.push({
+                    severity: 'low',
+                    issue: `IaC drift: Lambda "${name}" deployed but not in IaC`,
+                    description: `Lambda "${name}" exists in AWS but is not tracked in IaC.`,
+                    recommendation: 'Import the function into IaC or add it as a resource.',
+                    metadata: { resourceType: 'lambda_function', name, driftType: 'deployed_not_defined' },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.IaCDriftAnalyzer = IaCDriftAnalyzer;

package/dist/cli/commands/analyze.js

@@ -0,0 +1,319 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAnalyze = runAnalyze;
+const path = __importStar(require("path"));
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const core_1 = require("../../core");
+const dynamodb_1 = require("../../adapters/dynamodb");
+const postgres_1 = require("../../adapters/postgres");
+const mysql_1 = require("../../adapters/mysql");
+const mongodb_1 = require("../../adapters/mongodb");
+const terraform_1 = require("../../adapters/terraform");
+const aws_1 = require("../../adapters/aws");
+const logs_1 = require("../../adapters/logs");
+const context_1 = require("../../context");
+const graph_1 = require("../../graph");
+const analyzers_1 = require("../../analyzers");
+const utils_1 = require("../utils");
+async function runAnalyze(options = {}) {
+    (0, utils_1.printHeader)('Running Analysis');
+    let config;
+    try {
+        config = (0, core_1.loadConfig)(options.config);
+        utils_1.log.success('Config loaded', options.config ?? 'infrawise.yaml');
+    }
+    catch (err) {
+        console.error((0, core_1.formatError)(err));
+        process.exit(1);
+    }
+    const repoPath = options.repo ?? process.cwd();
+    const awsCfg = { region: config.aws?.region, profile: config.aws?.profile };
+    const dynamoMeta = [];
+    const postgresMeta = [];
+    const mysqlMeta = [];
+    const mongoMeta = [];
+    const servicesMeta = {};
+    // ── DynamoDB ────────────────────────────────────────────────────────────────
+    if (config.dynamodb?.enabled === true) {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting DynamoDB tables...'), color: 'cyan' }).start();
+        try {
+            const result = await (0, dynamodb_1.extractDynamoMetadata)(config);
+            dynamoMeta.push(...result);
+            spin.succeed(chalk_1.default.green('DynamoDB') + chalk_1.default.dim(`  ${result.length} table(s)`));
+        }
+        catch (err) {
+            spin.warn(chalk_1.default.yellow('DynamoDB skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
+    // ── PostgreSQL ──────────────────────────────────────────────────────────────
+    if (config.postgres?.enabled && config.postgres.connectionString) {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting PostgreSQL schema...'), color: 'cyan' }).start();
+        try {
+            const result = await (0, postgres_1.extractPostgresMetadata)(config.postgres.connectionString);
+            postgresMeta.push(...result);
+            spin.succeed(chalk_1.default.green('PostgreSQL') + chalk_1.default.dim(`  ${result.length} table(s)`));
+        }
+        catch (err) {
+            spin.warn(chalk_1.default.yellow('PostgreSQL skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
+    // ── MySQL ───────────────────────────────────────────────────────────────────
+    if (config.mysql?.enabled && config.mysql.connectionString) {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting MySQL schema...'), color: 'cyan' }).start();
+        try {
+            const result = await (0, mysql_1.extractMySQLMetadata)(config.mysql.connectionString);
+            mysqlMeta.push(...result);
+            spin.succeed(chalk_1.default.green('MySQL') + chalk_1.default.dim(`  ${result.length} table(s)`));
+        }
+        catch (err) {
+            spin.warn(chalk_1.default.yellow('MySQL skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
+    // ── MongoDB ─────────────────────────────────────────────────────────────────
+    if (config.mongodb?.enabled && config.mongodb.connectionString) {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting MongoDB schema...'), color: 'cyan' }).start();
+        try {
+            const result = await (0, mongodb_1.extractMongoMetadata)(config.mongodb.connectionString, config.mongodb.databases);
+            mongoMeta.push(...result);
+            spin.succeed(chalk_1.default.green('MongoDB') + chalk_1.default.dim(`  ${result.length} collection(s)`));
+        }
+        catch (err) {
+            spin.warn(chalk_1.default.yellow('MongoDB skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
+    // ── SQS ─────────────────────────────────────────────────────────────────────
+    if (config.sqs?.enabled === true) {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting SQS queues...'), color: 'cyan' }).start();
+        try {
+            const result = await (0, aws_1.extractSQSMetadata)(awsCfg);
+            servicesMeta.sqs = result;
+            spin.succeed(chalk_1.default.green('SQS') + chalk_1.default.dim(`  ${result.length} queue(s)`));
+        }
+        catch (err) {
+            spin.warn(chalk_1.default.yellow('SQS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
+    // ── SNS ─────────────────────────────────────────────────────────────────────
+    if (config.sns?.enabled === true) {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting SNS topics...'), color: 'cyan' }).start();
+        try {
+            const result = await (0, aws_1.extractSNSMetadata)(awsCfg);
+            servicesMeta.sns = result;
+            spin.succeed(chalk_1.default.green('SNS') + chalk_1.default.dim(`  ${result.length} topic(s)`));
+        }
+        catch (err) {
+            spin.warn(chalk_1.default.yellow('SNS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
+    // ── SSM Parameter Store ──────────────────────────────────────────────────────
+    if (config.ssm?.enabled === true) {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting SSM parameters...'), color: 'cyan' }).start();
+        try {
+            const result = await (0, aws_1.extractSSMMetadata)({ ...awsCfg, paths: config.ssm?.paths });
+            servicesMeta.ssm = result;
+            spin.succeed(chalk_1.default.green('SSM') + chalk_1.default.dim(`  ${result.length} parameter(s)  `) + chalk_1.default.dim('(metadata only, no values)'));
+        }
+        catch (err) {
+            spin.warn(chalk_1.default.yellow('SSM skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
+    // ── Secrets Manager ──────────────────────────────────────────────────────────
+    if (config.secretsManager?.enabled === true) {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting Secrets Manager metadata...'), color: 'cyan' }).start();
+        try {
+            const result = await (0, aws_1.extractSecretsMetadata)(awsCfg);
+            servicesMeta.secrets = result;
+            spin.succeed(chalk_1.default.green('Secrets Manager') + chalk_1.default.dim(`  ${result.length} secret(s)  `) + chalk_1.default.dim('(names/rotation only, no values)'));
+        }
+        catch (err) {
+            spin.warn(chalk_1.default.yellow('Secrets Manager skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
+    // ── Lambda ───────────────────────────────────────────────────────────────────
+    if (config.lambda?.enabled === true) {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting Lambda functions...'), color: 'cyan' }).start();
+        try {
+            const result = await (0, aws_1.extractLambdaMetadata)(awsCfg);
+            servicesMeta.lambda = result;
+            spin.succeed(chalk_1.default.green('Lambda') + chalk_1.default.dim(`  ${result.length} function(s)`));
+        }
+        catch (err) {
+            spin.warn(chalk_1.default.yellow('Lambda skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
+    // ── RDS ──────────────────────────────────────────────────────────────────────
+    if (config.rds?.enabled === true) {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting RDS instances...'), color: 'cyan' }).start();
+        try {
+            const result = await (0, aws_1.extractRDSMetadata)(awsCfg);
+            servicesMeta.rds = result;
+            spin.succeed(chalk_1.default.green('RDS') + chalk_1.default.dim(`  ${result.length} instance(s)`));
+        }
+        catch (err) {
+            spin.warn(chalk_1.default.yellow('RDS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
+    // ── CloudWatch Logs ──────────────────────────────────────────────────────────
+    if (config.cloudwatchLogs?.enabled) {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Sampling CloudWatch Logs (errors only, max 50 groups)...'), color: 'cyan' }).start();
+        try {
+            const result = await (0, logs_1.extractLogsSummary)({
+                ...awsCfg,
+                logGroupPrefixes: config.cloudwatchLogs.logGroupPrefixes,
+                windowHours: config.cloudwatchLogs.windowHours,
+            });
+            servicesMeta.logs = result;
+            const errorGroups = result.filter((lg) => lg.errorCount > 0).length;
+            spin.succeed(chalk_1.default.green('CloudWatch Logs') + chalk_1.default.dim(`  ${result.length} group(s), ${errorGroups} with errors`));
+        }
+        catch (err) {
+            spin.warn(chalk_1.default.yellow('CloudWatch Logs skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
+    // ── IaC schema (Terraform / CloudFormation / CDK) ────────────────────────────
+    let iacDriftAnalyzer;
+    {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting IaC schema (Terraform / CloudFormation / CDK)...'), color: 'cyan' }).start();
+        try {
+            const iacSchema = await (0, terraform_1.extractIaCSchema)(repoPath);
+            const total = iacSchema.dynamoTables.length + iacSchema.rdsInstances.length +
+                iacSchema.mongoClusters.length + iacSchema.queues.length + iacSchema.topics.length +
+                iacSchema.lambdas.length + iacSchema.buckets.length + iacSchema.parameters.length +
+                iacSchema.secrets.length + iacSchema.apiGateways.length;
+            iacDriftAnalyzer = new analyzers_1.IaCDriftAnalyzer();
+            iacDriftAnalyzer.setIaCSchema(iacSchema);
+            spin.succeed(chalk_1.default.green('IaC schema') + chalk_1.default.dim(`  ${total} resource(s) across TF/CFN/CDK`));
+        }
+        catch (err) {
+            spin.warn(chalk_1.default.yellow('IaC scan skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
+    // ── Repository scan ──────────────────────────────────────────────────────────
+    let operations;
+    {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim(`Scanning ${path.basename(repoPath)} for service usage...`), color: 'cyan' }).start();
+        try {
+            operations = await (0, context_1.scanRepository)(repoPath);
+            spin.succeed(chalk_1.default.green('Repository scanned') + chalk_1.default.dim(`  ${operations.length} service operation(s) found`));
+        }
+        catch (err) {
+            spin.warn(chalk_1.default.yellow('Repository scan failed') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            operations = [];
+        }
+    }
+    // ── Build graph ──────────────────────────────────────────────────────────────
+    let graph;
+    {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Building infrastructure graph...'), color: 'cyan' }).start();
+        graph = (0, graph_1.buildGraph)(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
+        spin.succeed(chalk_1.default.green('Graph built') + chalk_1.default.dim(`  ${graph.nodes.length} nodes, ${graph.edges.length} edges`));
+    }
+    // ── Run analyzers ────────────────────────────────────────────────────────────
+    let findings;
+    {
+        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Running analyzers...'), color: 'cyan' }).start();
+        const analyzers = [
+            ...(config.dynamodb?.enabled === true ? [
+                new analyzers_1.FullTableScanAnalyzer(),
+                new analyzers_1.MissingGSIAnalyzer(),
+                new analyzers_1.HotPartitionAnalyzer(),
+            ] : []),
+            ...(config.postgres?.enabled ? [
+                new analyzers_1.MissingIndexAnalyzer(),
+                new analyzers_1.NplusOneAnalyzer(),
+                new analyzers_1.LargeSelectAnalyzer(),
+            ] : []),
+            ...(config.mysql?.enabled ? [
+                new analyzers_1.MissingMySQLIndexAnalyzer(),
+                new analyzers_1.MySQLFullTableScanAnalyzer(),
+            ] : []),
+            ...(config.mongodb?.enabled ? [
+                new analyzers_1.MissingMongoIndexAnalyzer(),
+                new analyzers_1.MongoCollectionScanAnalyzer(),
+            ] : []),
+            ...(config.sqs?.enabled === true ? [
+                new analyzers_1.MissingDLQAnalyzer(),
+                new analyzers_1.UnencryptedQueueAnalyzer(),
+                new analyzers_1.LargeQueueBacklogAnalyzer(),
+            ] : []),
+            ...(config.secretsManager?.enabled === true ? [
+                new analyzers_1.MissingSecretRotationAnalyzer(),
+            ] : []),
+            ...(config.cloudwatchLogs?.enabled ? [
+                new analyzers_1.MissingLogRetentionAnalyzer(),
+            ] : []),
+            ...(config.lambda?.enabled === true ? [
+                new analyzers_1.LambdaDefaultMemoryAnalyzer(),
+                new analyzers_1.LambdaHighTimeoutAnalyzer(),
+            ] : []),
+            ...(config.rds?.enabled === true ? [
+                new analyzers_1.RDSPubliclyAccessibleAnalyzer(),
+                new analyzers_1.RDSNoBackupAnalyzer(),
+                new analyzers_1.RDSUnencryptedAnalyzer(),
+                new analyzers_1.RDSNoDeletionProtectionAnalyzer(),
+                new analyzers_1.RDSNoMultiAZAnalyzer(),
+            ] : []),
+            ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
+        ];
+        findings = await (0, analyzers_1.runAllAnalyzers)(graph, analyzers);
+        spin.succeed(chalk_1.default.green('Analysis complete') + chalk_1.default.dim(`  ${findings.length} finding(s)`));
+    }
+    // ── Cache ─────────────────────────────────────────────────────────────────────
+    (0, core_1.writeCache)('graph', graph);
+    (0, core_1.writeCache)('findings', findings);
+    (0, core_1.writeCache)('operations', operations);
+    // ── Output ────────────────────────────────────────────────────────────────────
+    console.log('');
+    if (findings.length === 0) {
+        console.log(`  ${chalk_1.default.green.bold('✓ No issues found!')}  ${chalk_1.default.dim('Your infrastructure looks clean.')}`);
+    }
+    else {
+        console.log(chalk_1.default.bold(`  Findings`) + chalk_1.default.dim(`  ${findings.length} total`));
+        findings.forEach((f, i) => (0, utils_1.printFinding)(f, i));
+        (0, utils_1.printSummaryBox)(findings);
+        if (findings.some((f) => f.severity === 'high')) {
+            console.log(`\n  ${chalk_1.default.red.bold('Action required:')} ${chalk_1.default.red('High severity issues detected.')}`);
+        }
+    }
+    console.log('');
+    utils_1.log.dim(`Results cached in .infrawise/cache/`);
+    utils_1.log.info(`Run ${chalk_1.default.cyan('infrawise dev')} to explore via the MCP server`);
+    console.log('');
+}

package/dist/cli/commands/auth.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAuth = runAuth;
+const chalk_1 = __importDefault(require("chalk"));
+const inquirer_1 = __importDefault(require("inquirer"));
+const ora_1 = __importDefault(require("ora"));
+const utils_1 = require("../utils");
+const dynamodb_1 = require("../../adapters/dynamodb");
+async function runAuth() {
+    (0, utils_1.printHeader)('AWS Authentication');
+    const profiles = (0, utils_1.readAWSProfiles)();
+    if (profiles.length === 0) {
+        utils_1.log.fail('No AWS profiles found');
+        console.log('');
+        utils_1.log.info('Run ' + chalk_1.default.cyan('aws configure') + ' to set up credentials');
+        utils_1.log.info('Or manually edit ' + chalk_1.default.dim('~/.aws/credentials'));
+        console.log('');
+        return;
+    }
+    utils_1.log.success(`Found ${profiles.length} profile(s)`);
+    console.log('');
+    const { selectedProfile } = await inquirer_1.default.prompt([
+        {
+            type: 'list',
+            name: 'selectedProfile',
+            message: 'Select a profile to validate:',
+            choices: profiles,
+        },
+    ]);
+    console.log('');
+    const spin = (0, ora_1.default)({ text: chalk_1.default.dim(`Validating "${selectedProfile}"...`), color: 'cyan' }).start();
+    const testConfig = {
+        project: 'auth-test',
+        aws: { profile: selectedProfile, region: 'us-east-1' },
+    };
+    const isValid = await (0, dynamodb_1.validateDynamoAccess)(testConfig);
+    if (isValid) {
+        spin.succeed(chalk_1.default.green(`Profile "${chalk_1.default.bold(selectedProfile)}" is valid`));
+        console.log('');
+        console.log(chalk_1.default.dim('  Update your infrawise.yaml:'));
+        console.log(chalk_1.default.cyan(`  aws:\n    profile: ${selectedProfile}`));
+    }
+    else {
+        spin.fail(chalk_1.default.red(`Profile "${chalk_1.default.bold(selectedProfile)}" cannot access DynamoDB`));
+        console.log('');
+        utils_1.log.warn('Possible causes:');
+        utils_1.log.dim('Missing IAM permissions — need dynamodb:ListTables, dynamodb:DescribeTable');
+        utils_1.log.dim('Expired SSO — run: aws sso login');
+        utils_1.log.dim('Wrong region — check your AWS config');
+        console.log('');
+        utils_1.log.info(`Run ${chalk_1.default.cyan('infrawise doctor')} for a full diagnostic`);
+    }
+    console.log('');
+}

package/dist/cli/commands/dev.js

@@ -0,0 +1,127 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDev = runDev;
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const core_1 = require("../../core");
+const server_1 = require("../../server");
+const utils_1 = require("../utils");
+const BOX_W = 52;
+const TOOL_MAP = [
+    { name: 'get_infra_overview' },
+    { name: 'get_graph_summary' },
+    { name: 'analyze_function' },
+    { name: 'suggest_gsi', service: 'dynamodb' },
+    { name: 'postgres_index_suggestions', service: 'postgres' },
+    { name: 'suggest_mongo_index', service: 'mongodb' },
+    { name: 'mysql_index_suggestions', service: 'mysql' },
+    { name: 'get_queue_details', service: 'sqs' },
+    { name: 'get_topic_details', service: 'sns' },
+    { name: 'get_secrets_overview', service: 'secretsManager' },
+    { name: 'get_parameter_overview', service: 'ssm' },
+    { name: 'get_lambda_overview', service: 'lambda' },
+    { name: 'get_log_errors', service: 'cloudwatchLogs' },
+];
+function isEnabled(cfg, service) {
+    if (!service)
+        return true;
+    const svc = cfg[service];
+    return svc?.enabled === true;
+}
+function boxLine(visibleContent, coloredContent) {
+    const padding = ' '.repeat(Math.max(0, BOX_W - visibleContent.length));
+    console.log(chalk_1.default.dim('  │') + coloredContent + padding + chalk_1.default.dim('│'));
+}
+function boxDivider() {
+    console.log(chalk_1.default.dim('  ├────────────────────────────────────────────────────┤'));
+}
+function groupTools(tools) {
+    const lines = [];
+    let i = 0;
+    while (i < tools.length) {
+        const a = tools[i];
+        const b = tools[i + 1];
+        if (b && `  ${a} · ${b}`.length <= BOX_W) {
+            lines.push(`${a} · ${b}`);
+            i += 2;
+        }
+        else {
+            lines.push(a);
+            i++;
+        }
+    }
+    return lines;
+}
+async function runDev(options = {}) {
+    const port = options.port ?? 3000;
+    (0, utils_1.printHeader)('MCP Server');
+    let config;
+    try {
+        config = (0, core_1.loadConfig)(options.config);
+        utils_1.log.success('Config loaded', options.config ?? 'infrawise.yaml');
+    }
+    catch (err) {
+        console.error((0, core_1.formatError)(err));
+        process.exit(1);
+    }
+    // Load cached state
+    const cachedGraph = (0, core_1.readCache)('graph');
+    const cachedFindings = (0, core_1.readCache)('findings');
+    if (cachedGraph && cachedFindings) {
+        utils_1.log.success('Cached analysis loaded', `${cachedGraph.nodes.length} nodes · ${cachedGraph.edges.length} edges · ${cachedFindings.length} finding(s)`);
+        (0, server_1.setGraphState)(cachedGraph, cachedFindings);
+    }
+    else {
+        utils_1.log.warn('No cached analysis found');
+        utils_1.log.dim(`Run ${chalk_1.default.cyan('infrawise analyze')} first for full results`);
+        (0, server_1.setGraphState)({ nodes: [], edges: [] }, []);
+    }
+    console.log('');
+    // Start server
+    const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Starting server...'), color: 'cyan' }).start();
+    const { start } = (0, server_1.createServer)(port);
+    await start();
+    spin.succeed(chalk_1.default.green('Server running'));
+    // Compute active/inactive tools from config
+    const activeTools = TOOL_MAP.filter((t) => isEnabled(config, t.service)).map((t) => t.name);
+    const inactiveTools = TOOL_MAP.filter((t) => !isEnabled(config, t.service)).map((t) => t.name);
+    // URL rows
+    const mcpUrl = `http://localhost:${port}/mcp`;
+    const toolsUrl = `http://localhost:${port}/mcp/tools`;
+    const healthUrl = `http://localhost:${port}/health`;
+    // Print box
+    console.log('');
+    console.log(chalk_1.default.dim('  ┌────────────────────────────────────────────────────┐'));
+    boxLine('  MCP Server', chalk_1.default.bold('  MCP Server'));
+    boxDivider();
+    boxLine(`  POST ${mcpUrl}`, `  ${chalk_1.default.dim('POST')} ${chalk_1.default.cyan(mcpUrl)}`);
+    boxLine(`  GET  ${toolsUrl}`, `  ${chalk_1.default.dim('GET')}  ${chalk_1.default.cyan(toolsUrl)}`);
+    boxLine(`  GET  ${healthUrl}`, `  ${chalk_1.default.dim('GET')}  ${chalk_1.default.cyan(healthUrl)}`);
+    boxDivider();
+    const activeLabel = `  Tools (${activeTools.length} active${inactiveTools.length > 0 ? ` · ${inactiveTools.length} off` : ''})`;
+    boxLine(activeLabel, chalk_1.default.dim(activeLabel));
+    for (const line of groupTools(activeTools)) {
+        boxLine(`  ${line}`, `  ${line}`);
+    }
+    if (inactiveTools.length > 0) {
+        boxDivider();
+        boxLine('  Off (enable in infrawise.yaml):', chalk_1.default.dim('  Off (enable in infrawise.yaml):'));
+        for (const line of groupTools(inactiveTools)) {
+            boxLine(`  ${line}`, chalk_1.default.dim(`  ${line}`));
+        }
+    }
+    console.log(chalk_1.default.dim('  └────────────────────────────────────────────────────┘'));
+    console.log('');
+    console.log(chalk_1.default.dim('  Add via CLI:'));
+    console.log(chalk_1.default.dim(`  claude mcp add --transport http infrawise ${mcpUrl}`));
+    console.log('');
+    console.log(chalk_1.default.dim('  Press Ctrl+C to stop\n'));
+    process.on('SIGINT', () => {
+        console.log(chalk_1.default.dim('\n  Shutting down...\n'));
+        process.exit(0);
+    });
+    await new Promise(() => { });
+}