infrawise 0.1.2 → 0.2.1

package/dist/index.js

@@ -1,4800 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-
-// ../core/dist/config.js
-var require_config = __commonJS({
-  "../core/dist/config.js"(exports2) {
-    "use strict";
-    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m, k);
-      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
-      }
-      Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      o[k2] = m[k];
-    }));
-    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
-      Object.defineProperty(o, "default", { enumerable: true, value: v });
-    }) : function(o, v) {
-      o["default"] = v;
-    });
-    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
-      var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function(o2) {
-          var ar = [];
-          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
-          return ar;
-        };
-        return ownKeys(o);
-      };
-      return function(mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) {
-          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        }
-        __setModuleDefault(result, mod);
-        return result;
-      };
-    })();
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ConfigError = exports2.InfrawiseConfigSchema = void 0;
-    exports2.loadConfig = loadConfig4;
-    exports2.generateDefaultConfig = generateDefaultConfig2;
-    var zod_1 = require("zod");
-    var fs4 = __importStar(require("fs"));
-    var path5 = __importStar(require("path"));
-    var yaml = __importStar(require("js-yaml"));
-    exports2.InfrawiseConfigSchema = zod_1.z.object({
-      project: zod_1.z.string().min(1, "Project name is required"),
-      aws: zod_1.z.object({
-        profile: zod_1.z.string().optional().default("default"),
-        region: zod_1.z.string().optional().default("us-east-1")
-      }).optional().default({}),
-      dynamodb: zod_1.z.object({ includeTables: zod_1.z.array(zod_1.z.string()).optional() }).optional(),
-      postgres: zod_1.z.object({
-        enabled: zod_1.z.boolean().optional().default(false),
-        connectionString: zod_1.z.string().optional()
-      }).optional(),
-      mysql: zod_1.z.object({
-        enabled: zod_1.z.boolean().optional().default(false),
-        connectionString: zod_1.z.string().optional()
-      }).optional(),
-      mongodb: zod_1.z.object({
-        enabled: zod_1.z.boolean().optional().default(false),
-        connectionString: zod_1.z.string().optional(),
-        databases: zod_1.z.array(zod_1.z.string()).optional()
-      }).optional(),
-      terraform: zod_1.z.object({ enabled: zod_1.z.boolean().optional().default(true) }).optional(),
-      sqs: zod_1.z.object({ enabled: zod_1.z.boolean().optional().default(true) }).optional(),
-      sns: zod_1.z.object({ enabled: zod_1.z.boolean().optional().default(true) }).optional(),
-      ssm: zod_1.z.object({
-        enabled: zod_1.z.boolean().optional().default(true),
-        paths: zod_1.z.array(zod_1.z.string()).optional()
-      }).optional(),
-      secretsManager: zod_1.z.object({ enabled: zod_1.z.boolean().optional().default(true) }).optional(),
-      lambda: zod_1.z.object({ enabled: zod_1.z.boolean().optional().default(true) }).optional(),
-      cloudwatchLogs: zod_1.z.object({
-        enabled: zod_1.z.boolean().optional().default(false),
-        logGroupPrefixes: zod_1.z.array(zod_1.z.string()).optional(),
-        windowHours: zod_1.z.number().int().positive().optional().default(24)
-      }).optional(),
-      analysis: zod_1.z.object({
-        sampleSize: zod_1.z.number().int().positive().optional().default(100)
-      }).optional()
-    });
-    var ConfigError = class extends Error {
-      details;
-      constructor(message, details) {
-        super(message);
-        this.details = details;
-        this.name = "ConfigError";
-      }
-    };
-    exports2.ConfigError = ConfigError;
-    function loadConfig4(configPath) {
-      const resolvedPath = configPath ? path5.resolve(configPath) : path5.resolve(process.cwd(), "infrawise.yaml");
-      if (!fs4.existsSync(resolvedPath)) {
-        throw new ConfigError(`Configuration file not found at: ${resolvedPath}`, [
-          "Run `infrawise init` to generate a configuration file",
-          `Or specify a path with --config <path>`
-        ]);
-      }
-      let rawContent;
-      try {
-        rawContent = fs4.readFileSync(resolvedPath, "utf-8");
-      } catch (err) {
-        throw new ConfigError(`Unable to read configuration file: ${resolvedPath}`, [String(err)]);
-      }
-      let parsedYaml;
-      try {
-        parsedYaml = yaml.load(rawContent);
-      } catch (err) {
-        throw new ConfigError(`Invalid YAML in configuration file: ${resolvedPath}`, [String(err)]);
-      }
-      const result = exports2.InfrawiseConfigSchema.safeParse(parsedYaml);
-      if (!result.success) {
-        const details = result.error.errors.map((e) => `  - ${e.path.join(".")}: ${e.message}`);
-        throw new ConfigError("Configuration validation failed", details);
-      }
-      return result.data;
-    }
-    function generateDefaultConfig2(projectName, options) {
-      const config = {
-        project: projectName,
-        aws: {
-          profile: options?.aws?.profile ?? "default",
-          region: options?.aws?.region ?? "us-east-1"
-        },
-        dynamodb: { includeTables: options?.dynamodb?.includeTables ?? [] },
-        postgres: {
-          enabled: options?.postgres?.enabled ?? false,
-          connectionString: options?.postgres?.connectionString ?? ""
-        },
-        mysql: {
-          enabled: options?.mysql?.enabled ?? false,
-          connectionString: options?.mysql?.connectionString ?? ""
-        },
-        mongodb: {
-          enabled: options?.mongodb?.enabled ?? false,
-          connectionString: options?.mongodb?.connectionString ?? "",
-          databases: options?.mongodb?.databases ?? []
-        },
-        terraform: { enabled: options?.terraform?.enabled ?? true },
-        sqs: { enabled: options?.sqs?.enabled ?? true },
-        sns: { enabled: options?.sns?.enabled ?? true },
-        ssm: {
-          enabled: options?.ssm?.enabled ?? true,
-          paths: options?.ssm?.paths ?? []
-        },
-        secretsManager: { enabled: options?.secretsManager?.enabled ?? true },
-        lambda: { enabled: options?.lambda?.enabled ?? true },
-        cloudwatchLogs: {
-          enabled: options?.cloudwatchLogs?.enabled ?? false,
-          logGroupPrefixes: options?.cloudwatchLogs?.logGroupPrefixes ?? [],
-          windowHours: options?.cloudwatchLogs?.windowHours ?? 24
-        },
-        analysis: { sampleSize: options?.analysis?.sampleSize ?? 100 }
-      };
-      return yaml.dump(config, { lineWidth: 120 });
-    }
-  }
-});
-
-// ../core/dist/logger.js
-var require_logger = __commonJS({
-  "../core/dist/logger.js"(exports2) {
-    "use strict";
-    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { "default": mod };
-    };
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.logger = void 0;
-    var pino_1 = __importDefault(require("pino"));
-    function createLogger() {
-      const isDevelopment = process.env.NODE_ENV !== "production";
-      if (isDevelopment) {
-        return (0, pino_1.default)({
-          level: process.env.LOG_LEVEL ?? "info",
-          transport: {
-            target: "pino-pretty",
-            options: {
-              colorize: true,
-              translateTime: "HH:MM:ss",
-              ignore: "pid,hostname",
-              messageFormat: "{msg}"
-            }
-          }
-        });
-      }
-      return (0, pino_1.default)({
-        level: process.env.LOG_LEVEL ?? "info"
-      });
-    }
-    exports2.logger = createLogger();
-  }
-});
-
-// ../core/dist/errors.js
-var require_errors = __commonJS({
-  "../core/dist/errors.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ConfigError = exports2.RepositoryScanError = exports2.PostgresConnectionError = exports2.DynamoDBError = exports2.AWSConnectionError = exports2.InfrawiseError = void 0;
-    exports2.formatError = formatError3;
-    var InfrawiseError = class extends Error {
-      reasons;
-      remediation;
-      constructor(message, reasons, remediation) {
-        super(message);
-        this.reasons = reasons;
-        this.remediation = remediation;
-        this.name = "InfrawiseError";
-      }
-      format() {
-        const lines = [`
-${this.message}
-`];
-        if (this.reasons && this.reasons.length > 0) {
-          lines.push("Possible reasons:");
-          for (const reason of this.reasons) {
-            lines.push(`  - ${reason}`);
-          }
-          lines.push("");
-        }
-        if (this.remediation) {
-          lines.push(`Run: ${this.remediation}`);
-        }
-        return lines.join("\n");
-      }
-    };
-    exports2.InfrawiseError = InfrawiseError;
-    var AWSConnectionError = class extends InfrawiseError {
-      constructor(details) {
-        super("Unable to connect to AWS.", [
-          "Invalid or missing AWS credentials",
-          "Incorrect AWS profile specified",
-          "Network connectivity issues",
-          details ?? "Unexpected AWS error"
-        ], "infrawise doctor");
-        this.name = "AWSConnectionError";
-      }
-    };
-    exports2.AWSConnectionError = AWSConnectionError;
-    var DynamoDBError = class extends InfrawiseError {
-      constructor(details) {
-        super("Unable to access DynamoDB.", [
-          "Insufficient IAM permissions (need dynamodb:ListTables, dynamodb:DescribeTable)",
-          "Wrong AWS region configured",
-          "DynamoDB endpoint not reachable",
-          details ?? "Unexpected DynamoDB error"
-        ], "infrawise doctor");
-        this.name = "DynamoDBError";
-      }
-    };
-    exports2.DynamoDBError = DynamoDBError;
-    var PostgresConnectionError = class extends InfrawiseError {
-      constructor(details) {
-        super("Unable to connect to PostgreSQL.", [
-          "Invalid connection string",
-          "Security group restrictions",
-          "Expired credentials",
-          details ?? "Unexpected PostgreSQL error"
-        ], "infrawise doctor");
-        this.name = "PostgresConnectionError";
-      }
-    };
-    exports2.PostgresConnectionError = PostgresConnectionError;
-    var RepositoryScanError = class extends InfrawiseError {
-      constructor(details) {
-        super("Unable to scan repository.", [
-          "Path does not exist or is not accessible",
-          "Not a valid TypeScript project",
-          "tsconfig.json not found",
-          details ?? "Unexpected scan error"
-        ], "infrawise doctor");
-        this.name = "RepositoryScanError";
-      }
-    };
-    exports2.RepositoryScanError = RepositoryScanError;
-    var ConfigError = class extends InfrawiseError {
-      constructor(details) {
-        super("Invalid or missing configuration.", [
-          "infrawise.yaml not found in current directory",
-          "Missing required fields in configuration",
-          details ?? "Unexpected config error"
-        ], "infrawise init");
-        this.name = "ConfigError";
-      }
-    };
-    exports2.ConfigError = ConfigError;
-    function formatError3(err) {
-      if (err instanceof InfrawiseError) {
-        return err.format();
-      }
-      if (err instanceof Error) {
-        return `
-Unexpected error: ${err.message}
-`;
-      }
-      return `
-Unexpected error: ${String(err)}
-`;
-    }
-  }
-});
-
-// ../core/dist/cache.js
-var require_cache = __commonJS({
-  "../core/dist/cache.js"(exports2) {
-    "use strict";
-    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m, k);
-      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
-      }
-      Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      o[k2] = m[k];
-    }));
-    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
-      Object.defineProperty(o, "default", { enumerable: true, value: v });
-    }) : function(o, v) {
-      o["default"] = v;
-    });
-    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
-      var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function(o2) {
-          var ar = [];
-          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
-          return ar;
-        };
-        return ownKeys(o);
-      };
-      return function(mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) {
-          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        }
-        __setModuleDefault(result, mod);
-        return result;
-      };
-    })();
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.writeCache = writeCache2;
-    exports2.readCache = readCache2;
-    exports2.clearCache = clearCache;
-    var fs4 = __importStar(require("fs"));
-    var path5 = __importStar(require("path"));
-    var CACHE_VERSION = "1.0.0";
-    var CACHE_DIR = path5.join(process.cwd(), ".infrawise", "cache");
-    function ensureCacheDir() {
-      if (!fs4.existsSync(CACHE_DIR)) {
-        fs4.mkdirSync(CACHE_DIR, { recursive: true });
-      }
-    }
-    function writeCache2(key, data) {
-      ensureCacheDir();
-      const entry = {
-        timestamp: Date.now(),
-        data,
-        version: CACHE_VERSION
-      };
-      const filePath = path5.join(CACHE_DIR, `${key}.json`);
-      fs4.writeFileSync(filePath, JSON.stringify(entry, null, 2), "utf-8");
-    }
-    function readCache2(key, maxAgeMs = 36e5) {
-      const filePath = path5.join(CACHE_DIR, `${key}.json`);
-      if (!fs4.existsSync(filePath))
-        return null;
-      try {
-        const raw = fs4.readFileSync(filePath, "utf-8");
-        const entry = JSON.parse(raw);
-        if (entry.version !== CACHE_VERSION)
-          return null;
-        if (Date.now() - entry.timestamp > maxAgeMs)
-          return null;
-        return entry.data;
-      } catch {
-        return null;
-      }
-    }
-    function clearCache(key) {
-      if (key) {
-        const filePath = path5.join(CACHE_DIR, `${key}.json`);
-        if (fs4.existsSync(filePath))
-          fs4.unlinkSync(filePath);
-      } else {
-        if (fs4.existsSync(CACHE_DIR)) {
-          const files = fs4.readdirSync(CACHE_DIR);
-          for (const file of files) {
-            fs4.unlinkSync(path5.join(CACHE_DIR, file));
-          }
-        }
-      }
-    }
-  }
-});
-
-// ../core/dist/index.js
-var require_dist = __commonJS({
-  "../core/dist/index.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.clearCache = exports2.readCache = exports2.writeCache = exports2.formatError = exports2.ConfigError = exports2.RepositoryScanError = exports2.PostgresConnectionError = exports2.DynamoDBError = exports2.AWSConnectionError = exports2.InfrawiseError = exports2.logger = exports2.ConfigValidationError = exports2.InfrawiseConfigSchema = exports2.generateDefaultConfig = exports2.loadConfig = void 0;
-    var config_1 = require_config();
-    Object.defineProperty(exports2, "loadConfig", { enumerable: true, get: function() {
-      return config_1.loadConfig;
-    } });
-    Object.defineProperty(exports2, "generateDefaultConfig", { enumerable: true, get: function() {
-      return config_1.generateDefaultConfig;
-    } });
-    Object.defineProperty(exports2, "InfrawiseConfigSchema", { enumerable: true, get: function() {
-      return config_1.InfrawiseConfigSchema;
-    } });
-    Object.defineProperty(exports2, "ConfigValidationError", { enumerable: true, get: function() {
-      return config_1.ConfigError;
-    } });
-    var logger_1 = require_logger();
-    Object.defineProperty(exports2, "logger", { enumerable: true, get: function() {
-      return logger_1.logger;
-    } });
-    var errors_1 = require_errors();
-    Object.defineProperty(exports2, "InfrawiseError", { enumerable: true, get: function() {
-      return errors_1.InfrawiseError;
-    } });
-    Object.defineProperty(exports2, "AWSConnectionError", { enumerable: true, get: function() {
-      return errors_1.AWSConnectionError;
-    } });
-    Object.defineProperty(exports2, "DynamoDBError", { enumerable: true, get: function() {
-      return errors_1.DynamoDBError;
-    } });
-    Object.defineProperty(exports2, "PostgresConnectionError", { enumerable: true, get: function() {
-      return errors_1.PostgresConnectionError;
-    } });
-    Object.defineProperty(exports2, "RepositoryScanError", { enumerable: true, get: function() {
-      return errors_1.RepositoryScanError;
-    } });
-    Object.defineProperty(exports2, "ConfigError", { enumerable: true, get: function() {
-      return errors_1.ConfigError;
-    } });
-    Object.defineProperty(exports2, "formatError", { enumerable: true, get: function() {
-      return errors_1.formatError;
-    } });
-    var cache_1 = require_cache();
-    Object.defineProperty(exports2, "writeCache", { enumerable: true, get: function() {
-      return cache_1.writeCache;
-    } });
-    Object.defineProperty(exports2, "readCache", { enumerable: true, get: function() {
-      return cache_1.readCache;
-    } });
-    Object.defineProperty(exports2, "clearCache", { enumerable: true, get: function() {
-      return cache_1.clearCache;
-    } });
-  }
-});
-
-// ../adapters/dynamodb/dist/index.js
-var require_dist2 = __commonJS({
-  "../adapters/dynamodb/dist/index.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.extractDynamoMetadata = extractDynamoMetadata2;
-    exports2.validateDynamoAccess = validateDynamoAccess3;
-    var client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
-    var credential_providers_1 = require("@aws-sdk/credential-providers");
-    var core_1 = require_dist();
-    function createDynamoClient(config) {
-      const region = config.aws?.region ?? "us-east-1";
-      const profile = config.aws?.profile;
-      const clientConfig = { region };
-      if (profile) {
-        clientConfig.credentials = (0, credential_providers_1.fromIni)({ profile });
-      }
-      return new client_dynamodb_1.DynamoDBClient(clientConfig);
-    }
-    function parseTableDescription(desc) {
-      const tableName = desc.TableName ?? "unknown";
-      const partitionKey = desc.KeySchema?.find((k) => k.KeyType === "HASH")?.AttributeName;
-      const sortKey = desc.KeySchema?.find((k) => k.KeyType === "RANGE")?.AttributeName;
-      const indexes = [];
-      if (desc.GlobalSecondaryIndexes) {
-        for (const gsi of desc.GlobalSecondaryIndexes) {
-          if (gsi.IndexName)
-            indexes.push(gsi.IndexName);
-        }
-      }
-      if (desc.LocalSecondaryIndexes) {
-        for (const lsi of desc.LocalSecondaryIndexes) {
-          if (lsi.IndexName)
-            indexes.push(lsi.IndexName);
-        }
-      }
-      return { tableName, partitionKey, sortKey, indexes };
-    }
-    async function listAllTables(client) {
-      const tableNames = [];
-      let lastEvaluatedTableName;
-      do {
-        const command = new client_dynamodb_1.ListTablesCommand({
-          ExclusiveStartTableName: lastEvaluatedTableName,
-          Limit: 100
-        });
-        const response = await client.send(command);
-        if (response.TableNames) {
-          tableNames.push(...response.TableNames);
-        }
-        lastEvaluatedTableName = response.LastEvaluatedTableName;
-      } while (lastEvaluatedTableName);
-      return tableNames;
-    }
-    async function extractDynamoMetadata2(config) {
-      const client = createDynamoClient(config);
-      const includeTables = config.dynamodb?.includeTables;
-      let tableNames;
-      try {
-        const allTables = await listAllTables(client);
-        if (includeTables && includeTables.length > 0) {
-          tableNames = allTables.filter((name) => includeTables.includes(name));
-          core_1.logger.debug(`Filtered to ${tableNames.length} tables from config`);
-        } else {
-          tableNames = allTables;
-        }
-        core_1.logger.info(`Found ${tableNames.length} DynamoDB table(s)`);
-      } catch (err) {
-        throw new core_1.DynamoDBError(err instanceof Error ? err.message : "Failed to list DynamoDB tables");
-      }
-      const results = [];
-      for (const tableName of tableNames) {
-        try {
-          const command = new client_dynamodb_1.DescribeTableCommand({ TableName: tableName });
-          const response = await client.send(command);
-          if (response.Table) {
-            results.push(parseTableDescription(response.Table));
-            core_1.logger.debug(`Described table: ${tableName}`);
-          }
-        } catch (err) {
-          core_1.logger.warn(`Failed to describe table ${tableName}: ${err instanceof Error ? err.message : String(err)}`);
-        }
-      }
-      return results;
-    }
-    async function validateDynamoAccess3(config) {
-      const client = createDynamoClient(config);
-      try {
-        await client.send(new client_dynamodb_1.ListTablesCommand({ Limit: 1 }));
-        return true;
-      } catch {
-        return false;
-      }
-    }
-  }
-});
-
-// ../adapters/postgres/dist/index.js
-var require_dist3 = __commonJS({
-  "../adapters/postgres/dist/index.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.extractPostgresMetadata = extractPostgresMetadata2;
-    exports2.validatePostgresAccess = validatePostgresAccess2;
-    var pg_1 = require("pg");
-    var core_1 = require_dist();
-    async function extractPostgresMetadata2(connectionString) {
-      const pool = new pg_1.Pool({
-        connectionString,
-        max: 1,
-        idleTimeoutMillis: 1e4,
-        connectionTimeoutMillis: 5e3
-      });
-      try {
-        const client = await pool.connect();
-        try {
-          const tablesResult = await client.query(`
-        SELECT table_schema, table_name
-        FROM information_schema.tables
-        WHERE table_type = 'BASE TABLE'
-          AND table_schema NOT IN ('pg_catalog', 'information_schema')
-        ORDER BY table_schema, table_name
-      `);
-          core_1.logger.info(`Found ${tablesResult.rows.length} PostgreSQL table(s)`);
-          const columnsResult = await client.query(`
-        SELECT table_schema, table_name, column_name
-        FROM information_schema.columns
-        WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
-        ORDER BY table_schema, table_name, ordinal_position
-      `);
-          const indexesResult = await client.query(`
-        SELECT schemaname, tablename, indexname
-        FROM pg_indexes
-        WHERE schemaname NOT IN ('pg_catalog', 'information_schema')
-        ORDER BY schemaname, tablename, indexname
-      `);
-          const primaryKeysResult = await client.query(`
-        SELECT
-          tc.table_schema,
-          tc.table_name,
-          kcu.column_name
-        FROM information_schema.table_constraints tc
-        JOIN information_schema.key_column_usage kcu
-          ON tc.constraint_name = kcu.constraint_name
-          AND tc.table_schema = kcu.table_schema
-        WHERE tc.constraint_type = 'PRIMARY KEY'
-          AND tc.table_schema NOT IN ('pg_catalog', 'information_schema')
-        ORDER BY tc.table_schema, tc.table_name
-      `);
-          const columnMap = /* @__PURE__ */ new Map();
-          for (const row of columnsResult.rows) {
-            const key = `${row.table_schema}.${row.table_name}`;
-            if (!columnMap.has(key))
-              columnMap.set(key, []);
-            columnMap.get(key).push(row.column_name);
-          }
-          const indexMap = /* @__PURE__ */ new Map();
-          for (const row of indexesResult.rows) {
-            const key = `${row.schemaname}.${row.tablename}`;
-            if (!indexMap.has(key))
-              indexMap.set(key, []);
-            indexMap.get(key).push(row.indexname);
-          }
-          const pkMap = /* @__PURE__ */ new Map();
-          for (const row of primaryKeysResult.rows) {
-            const key = `${row.table_schema}.${row.table_name}`;
-            if (!pkMap.has(key))
-              pkMap.set(key, []);
-            pkMap.get(key).push(row.column_name);
-          }
-          const results = [];
-          for (const table of tablesResult.rows) {
-            const key = `${table.table_schema}.${table.table_name}`;
-            results.push({
-              schema: table.table_schema,
-              table: table.table_name,
-              columns: columnMap.get(key) ?? [],
-              indexes: indexMap.get(key) ?? [],
-              primaryKeys: pkMap.get(key) ?? []
-            });
-          }
-          return results;
-        } finally {
-          client.release();
-        }
-      } catch (err) {
-        if (err instanceof core_1.PostgresConnectionError)
-          throw err;
-        throw new core_1.PostgresConnectionError(err instanceof Error ? err.message : "Unknown error connecting to PostgreSQL");
-      } finally {
-        await pool.end();
-      }
-    }
-    async function validatePostgresAccess2(connectionString) {
-      const pool = new pg_1.Pool({
-        connectionString,
-        max: 1,
-        connectionTimeoutMillis: 5e3
-      });
-      try {
-        const client = await pool.connect();
-        await client.query("SELECT 1");
-        client.release();
-        return true;
-      } catch {
-        return false;
-      } finally {
-        await pool.end();
-      }
-    }
-  }
-});
-
-// ../adapters/mysql/dist/index.js
-var require_dist4 = __commonJS({
-  "../adapters/mysql/dist/index.js"(exports2) {
-    "use strict";
-    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { "default": mod };
-    };
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.MySQLConnectionError = void 0;
-    exports2.extractMySQLMetadata = extractMySQLMetadata2;
-    exports2.validateMySQLAccess = validateMySQLAccess2;
-    var promise_1 = __importDefault(require("mysql2/promise"));
-    var core_1 = require_dist();
-    var SYSTEM_SCHEMAS = /* @__PURE__ */ new Set(["information_schema", "performance_schema", "mysql", "sys"]);
-    var MySQLConnectionError = class extends core_1.InfrawiseError {
-      constructor(details) {
-        super("Unable to connect to MySQL.\n\nPossible reasons:\n- invalid connection string\n- port 3306 not accessible\n- wrong credentials\n\nRun: infrawise doctor", void 0, void 0);
-        this.name = "MySQLConnectionError";
-        if (details) {
-          this.message = `Unable to connect to MySQL.
-
-Possible reasons:
-- invalid connection string
-- port 3306 not accessible
-- wrong credentials
-
-Run: infrawise doctor
-
-Detail: ${details}`;
-        }
-      }
-    };
-    exports2.MySQLConnectionError = MySQLConnectionError;
-    async function extractMySQLMetadata2(connectionString) {
-      let connection;
-      try {
-        connection = await promise_1.default.createConnection(connectionString);
-        const [tableRows] = await connection.execute(`
-      SELECT TABLE_SCHEMA, TABLE_NAME, ENGINE
-      FROM information_schema.tables
-      WHERE TABLE_TYPE = 'BASE TABLE'
-        AND TABLE_SCHEMA NOT IN (${[...SYSTEM_SCHEMAS].map(() => "?").join(", ")})
-      ORDER BY TABLE_SCHEMA, TABLE_NAME
-    `, [...SYSTEM_SCHEMAS]);
-        core_1.logger.info(`Found ${tableRows.length} MySQL table(s)`);
-        const [columnRows] = await connection.execute(`
-      SELECT TABLE_SCHEMA, TABLE_NAME, COLUMN_NAME
-      FROM information_schema.columns
-      WHERE TABLE_SCHEMA NOT IN (${[...SYSTEM_SCHEMAS].map(() => "?").join(", ")})
-      ORDER BY TABLE_SCHEMA, TABLE_NAME, ORDINAL_POSITION
-    `, [...SYSTEM_SCHEMAS]);
-        const [indexRows] = await connection.execute(`
-      SELECT TABLE_SCHEMA, TABLE_NAME, INDEX_NAME
-      FROM information_schema.statistics
-      WHERE TABLE_SCHEMA NOT IN (${[...SYSTEM_SCHEMAS].map(() => "?").join(", ")})
-      GROUP BY TABLE_SCHEMA, TABLE_NAME, INDEX_NAME
-      ORDER BY TABLE_SCHEMA, TABLE_NAME, INDEX_NAME
-    `, [...SYSTEM_SCHEMAS]);
-        const [pkRows] = await connection.execute(`
-      SELECT TABLE_SCHEMA, TABLE_NAME, COLUMN_NAME
-      FROM information_schema.key_column_usage
-      WHERE CONSTRAINT_NAME = 'PRIMARY'
-        AND TABLE_SCHEMA NOT IN (${[...SYSTEM_SCHEMAS].map(() => "?").join(", ")})
-      ORDER BY TABLE_SCHEMA, TABLE_NAME, ORDINAL_POSITION
-    `, [...SYSTEM_SCHEMAS]);
-        const columnMap = /* @__PURE__ */ new Map();
-        for (const row of columnRows) {
-          const key = `${row["TABLE_SCHEMA"]}.${row["TABLE_NAME"]}`;
-          if (!columnMap.has(key))
-            columnMap.set(key, []);
-          columnMap.get(key).push(row["COLUMN_NAME"]);
-        }
-        const indexMap = /* @__PURE__ */ new Map();
-        for (const row of indexRows) {
-          const key = `${row["TABLE_SCHEMA"]}.${row["TABLE_NAME"]}`;
-          if (!indexMap.has(key))
-            indexMap.set(key, []);
-          const idxName = row["INDEX_NAME"];
-          if (!indexMap.get(key).includes(idxName)) {
-            indexMap.get(key).push(idxName);
-          }
-        }
-        const pkMap = /* @__PURE__ */ new Map();
-        for (const row of pkRows) {
-          const key = `${row["TABLE_SCHEMA"]}.${row["TABLE_NAME"]}`;
-          if (!pkMap.has(key))
-            pkMap.set(key, []);
-          pkMap.get(key).push(row["COLUMN_NAME"]);
-        }
-        const results = [];
-        for (const row of tableRows) {
-          const schema = row["TABLE_SCHEMA"];
-          const table = row["TABLE_NAME"];
-          const engine = row["ENGINE"] ?? "InnoDB";
-          const key = `${schema}.${table}`;
-          results.push({
-            schema,
-            table,
-            columns: columnMap.get(key) ?? [],
-            indexes: indexMap.get(key) ?? [],
-            primaryKeys: pkMap.get(key) ?? [],
-            engine
-          });
-        }
-        return results;
-      } catch (err) {
-        if (err instanceof MySQLConnectionError)
-          throw err;
-        throw new MySQLConnectionError(err instanceof Error ? err.message : String(err));
-      } finally {
-        if (connection) {
-          await connection.end().catch(() => void 0);
-        }
-      }
-    }
-    async function validateMySQLAccess2(connectionString) {
-      let connection;
-      try {
-        connection = await promise_1.default.createConnection(connectionString);
-        await connection.execute("SELECT 1");
-        return true;
-      } catch {
-        return false;
-      } finally {
-        if (connection) {
-          await connection.end().catch(() => void 0);
-        }
-      }
-    }
-  }
-});
-
-// ../adapters/mongodb/dist/index.js
-var require_dist5 = __commonJS({
-  "../adapters/mongodb/dist/index.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.MongoConnectionError = void 0;
-    exports2.extractMongoMetadata = extractMongoMetadata2;
-    exports2.validateMongoAccess = validateMongoAccess2;
-    var mongodb_1 = require("mongodb");
-    var core_1 = require_dist();
-    var SYSTEM_DATABASES = /* @__PURE__ */ new Set(["admin", "local", "config"]);
-    var MongoConnectionError = class extends core_1.InfrawiseError {
-      constructor(details) {
-        super("Unable to connect to MongoDB.\n\nPossible reasons:\n- invalid connection string\n- port 27017 not accessible\n- wrong credentials\n\nRun: infrawise doctor", void 0, void 0);
-        this.name = "MongoConnectionError";
-        if (details) {
-          this.message = `Unable to connect to MongoDB.
-
-Possible reasons:
-- invalid connection string
-- port 27017 not accessible
-- wrong credentials
-
-Run: infrawise doctor
-
-Detail: ${details}`;
-        }
-      }
-    };
-    exports2.MongoConnectionError = MongoConnectionError;
-    async function extractMongoMetadata2(connectionString, databases) {
-      const client = new mongodb_1.MongoClient(connectionString, {
-        serverSelectionTimeoutMS: 5e3,
-        connectTimeoutMS: 5e3
-      });
-      try {
-        await client.connect();
-        let dbNames;
-        if (databases && databases.length > 0) {
-          dbNames = databases;
-        } else {
-          const adminDb = client.db("admin");
-          const dbList = await adminDb.admin().listDatabases();
-          dbNames = dbList.databases.map((d) => d.name).filter((name) => !SYSTEM_DATABASES.has(name));
-        }
-        core_1.logger.info(`Introspecting ${dbNames.length} MongoDB database(s)`);
-        const results = [];
-        for (const dbName of dbNames) {
-          const db = client.db(dbName);
-          let collectionNames;
-          try {
-            const collections = await db.listCollections().toArray();
-            collectionNames = collections.map((c) => c.name);
-          } catch (err) {
-            core_1.logger.warn(`Skipping database "${dbName}": ${err instanceof Error ? err.message : String(err)}`);
-            continue;
-          }
-          for (const collName of collectionNames) {
-            const collection = db.collection(collName);
-            let rawIndexes = [];
-            try {
-              rawIndexes = await collection.indexes();
-            } catch {
-              rawIndexes = [];
-            }
-            let estimatedCount = 0;
-            try {
-              estimatedCount = await collection.estimatedDocumentCount();
-            } catch {
-              estimatedCount = 0;
-            }
-            const indexes = rawIndexes.map((idx) => ({
-              name: String(idx["name"] ?? ""),
-              keys: idx["key"] ?? {},
-              unique: Boolean(idx["unique"]),
-              sparse: Boolean(idx["sparse"])
-            }));
-            results.push({
-              database: dbName,
-              collection: collName,
-              indexes,
-              estimatedCount
-            });
-          }
-        }
-        core_1.logger.info(`Found ${results.length} MongoDB collection(s)`);
-        return results;
-      } catch (err) {
-        if (err instanceof MongoConnectionError)
-          throw err;
-        throw new MongoConnectionError(err instanceof Error ? err.message : String(err));
-      } finally {
-        await client.close().catch(() => void 0);
-      }
-    }
-    async function validateMongoAccess2(connectionString) {
-      const client = new mongodb_1.MongoClient(connectionString, {
-        serverSelectionTimeoutMS: 5e3,
-        connectTimeoutMS: 5e3
-      });
-      try {
-        await client.connect();
-        await client.db("admin").command({ ping: 1 });
-        return true;
-      } catch {
-        return false;
-      } finally {
-        await client.close().catch(() => void 0);
-      }
-    }
-  }
-});
-
-// ../adapters/terraform/dist/index.js
-var require_dist6 = __commonJS({
-  "../adapters/terraform/dist/index.js"(exports2) {
-    "use strict";
-    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m, k);
-      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
-      }
-      Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      o[k2] = m[k];
-    }));
-    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
-      Object.defineProperty(o, "default", { enumerable: true, value: v });
-    }) : function(o, v) {
-      o["default"] = v;
-    });
-    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
-      var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function(o2) {
-          var ar = [];
-          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
-          return ar;
-        };
-        return ownKeys(o);
-      };
-      return function(mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) {
-          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        }
-        __setModuleDefault(result, mod);
-        return result;
-      };
-    })();
-    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { "default": mod };
-    };
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.extractTerraformSchema = extractTerraformSchema;
-    exports2.extractCloudFormationSchema = extractCloudFormationSchema;
-    exports2.extractCDKSchema = extractCDKSchema;
-    exports2.extractIaCSchema = extractIaCSchema2;
-    var fs4 = __importStar(require("fs"));
-    var path5 = __importStar(require("path"));
-    var js_yaml_1 = __importDefault(require("js-yaml"));
-    var core_1 = require_dist();
-    function emptySchema() {
-      return {
-        dynamoTables: [],
-        rdsInstances: [],
-        mongoClusters: [],
-        queues: [],
-        topics: [],
-        lambdas: [],
-        buckets: [],
-        parameters: [],
-        secrets: [],
-        apiGateways: []
-      };
-    }
-    function findFilesRecursively(dir, extensions, skipDirs = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".infrawise"])) {
-      const results = [];
-      if (!fs4.existsSync(dir))
-        return results;
-      const entries = fs4.readdirSync(dir, { withFileTypes: true });
-      for (const entry of entries) {
-        if (skipDirs.has(entry.name))
-          continue;
-        const fullPath = path5.join(dir, entry.name);
-        if (entry.isDirectory()) {
-          results.push(...findFilesRecursively(fullPath, extensions, skipDirs));
-        } else if (extensions.some((ext) => entry.name.endsWith(ext))) {
-          results.push(fullPath);
-        }
-      }
-      return results;
-    }
-    function extractTerraformResourceBlocks(content) {
-      const results = [];
-      const resourcePattern = /resource\s+"([^"]+)"\s+"([^"]+)"\s*\{/g;
-      let match;
-      while ((match = resourcePattern.exec(content)) !== null) {
-        const resourceType = match[1] ?? "";
-        const resourceName = match[2] ?? "";
-        const startBrace = match.index + match[0].length - 1;
-        let depth = 1;
-        let i = startBrace + 1;
-        while (i < content.length && depth > 0) {
-          if (content[i] === "{")
-            depth++;
-          else if (content[i] === "}")
-            depth--;
-          i++;
-        }
-        results.push({ resourceType, resourceName, body: content.slice(startBrace + 1, i - 1) });
-      }
-      return results;
-    }
-    function tfStr(body, attr) {
-      const m = body.match(new RegExp(`${attr}\\s*=\\s*"([^"]*)"`, "i"));
-      return m?.[1];
-    }
-    function tfBool(body, attr) {
-      const m = body.match(new RegExp(`${attr}\\s*=\\s*(true|false)`, "i"));
-      return m?.[1] === "true";
-    }
-    function tfGSINames(body) {
-      const names = [];
-      const pat = /global_secondary_index\s*\{([^}]*)\}/g;
-      let m;
-      while ((m = pat.exec(body)) !== null) {
-        const nameMatch = m[1].match(/name\s*=\s*"([^"]*)"/);
-        if (nameMatch?.[1])
-          names.push(nameMatch[1]);
-      }
-      return names;
-    }
-    async function extractTerraformSchema(repoPath) {
-      const schema = emptySchema();
-      const tfFiles = findFilesRecursively(repoPath, [".tf"]);
-      core_1.logger.info(`Found ${tfFiles.length} Terraform file(s)`);
-      for (const filePath of tfFiles) {
-        let content;
-        try {
-          content = fs4.readFileSync(filePath, "utf-8");
-        } catch {
-          continue;
-        }
-        for (const { resourceType, resourceName, body } of extractTerraformResourceBlocks(content)) {
-          switch (resourceType) {
-            case "aws_dynamodb_table":
-              schema.dynamoTables.push({
-                name: tfStr(body, "name") ?? resourceName,
-                partitionKey: tfStr(body, "hash_key"),
-                sortKey: tfStr(body, "range_key"),
-                gsiNames: tfGSINames(body),
-                source: "terraform",
-                filePath
-              });
-              break;
-            case "aws_db_instance":
-            case "aws_rds_cluster":
-              schema.rdsInstances.push({
-                identifier: tfStr(body, "identifier") ?? tfStr(body, "cluster_identifier") ?? resourceName,
-                engine: tfStr(body, "engine") ?? "unknown",
-                source: "terraform",
-                filePath
-              });
-              break;
-            case "aws_docdb_cluster":
-              schema.mongoClusters.push({
-                identifier: tfStr(body, "cluster_identifier") ?? resourceName,
-                source: "terraform",
-                filePath
-              });
-              break;
-            case "aws_sqs_queue": {
-              const name = tfStr(body, "name") ?? resourceName;
-              const hasDLQ = body.includes("redrive_policy");
-              const encrypted = body.includes("kms_master_key_id") || tfBool(body, "sqs_managed_sse_enabled");
-              schema.queues.push({ name, hasDLQ, encrypted, source: "terraform", filePath });
-              break;
-            }
-            case "aws_sns_topic":
-              schema.topics.push({
-                name: tfStr(body, "name") ?? resourceName,
-                encrypted: body.includes("kms_master_key_id"),
-                source: "terraform",
-                filePath
-              });
-              break;
-            case "aws_lambda_function":
-              schema.lambdas.push({
-                name: tfStr(body, "function_name") ?? resourceName,
-                runtime: tfStr(body, "runtime"),
-                source: "terraform",
-                filePath
-              });
-              break;
-            case "aws_s3_bucket":
-              schema.buckets.push({
-                name: tfStr(body, "bucket") ?? tfStr(body, "bucket_prefix") ?? resourceName,
-                versioned: body.includes("versioning") && body.includes("enabled = true"),
-                source: "terraform",
-                filePath
-              });
-              break;
-            case "aws_ssm_parameter":
-              schema.parameters.push({
-                name: tfStr(body, "name") ?? resourceName,
-                type: tfStr(body, "type") ?? "String",
-                source: "terraform",
-                filePath
-              });
-              break;
-            case "aws_secretsmanager_secret":
-              schema.secrets.push({
-                name: tfStr(body, "name") ?? resourceName,
-                source: "terraform",
-                filePath
-              });
-              break;
-            case "aws_api_gateway_rest_api":
-            case "aws_apigatewayv2_api":
-              schema.apiGateways.push({
-                name: tfStr(body, "name") ?? resourceName,
-                source: "terraform",
-                filePath
-              });
-              break;
-          }
-        }
-      }
-      return schema;
-    }
-    function isCloudFormationTemplate(parsed) {
-      if (typeof parsed !== "object" || parsed === null)
-        return false;
-      const obj = parsed;
-      return "AWSTemplateFormatVersion" in obj || "Resources" in obj && typeof obj["Resources"] === "object";
-    }
-    function parseCFNFile(filePath) {
-      let content;
-      try {
-        content = fs4.readFileSync(filePath, "utf-8");
-      } catch {
-        return null;
-      }
-      if (!content.includes("AWSTemplateFormatVersion") && !content.includes("Resources"))
-        return null;
-      let parsed;
-      try {
-        parsed = filePath.endsWith(".json") ? JSON.parse(content) : js_yaml_1.default.load(content);
-      } catch {
-        return null;
-      }
-      if (!isCloudFormationTemplate(parsed))
-        return null;
-      return parsed;
-    }
-    function cfnStr(props, ...keys) {
-      for (const key of keys) {
-        if (typeof props[key] === "string")
-          return props[key];
-      }
-      return void 0;
-    }
-    function cfnBool(props, key) {
-      return props[key] === true || props[key] === "true" || props[key] === "Enabled";
-    }
-    function processCFNResources(resources, schema, filePath, source) {
-      for (const [logicalId, rawResource] of Object.entries(resources)) {
-        if (typeof rawResource !== "object" || rawResource === null)
-          continue;
-        const resource = rawResource;
-        const resourceType = resource["Type"];
-        const props = resource["Properties"] ?? {};
-        switch (resourceType) {
-          case "AWS::DynamoDB::Table": {
-            let pk, sk;
-            const keySchema = props["KeySchema"];
-            if (Array.isArray(keySchema)) {
-              for (const kd of keySchema) {
-                if (typeof kd !== "object" || kd === null)
-                  continue;
-                const k = kd;
-                if (k["KeyType"] === "HASH")
-                  pk = k["AttributeName"];
-                if (k["KeyType"] === "RANGE")
-                  sk = k["AttributeName"];
-              }
-            }
-            const gsiNames = [];
-            const gsis = props["GlobalSecondaryIndexes"];
-            if (Array.isArray(gsis)) {
-              for (const g of gsis) {
-                if (typeof g === "object" && g !== null) {
-                  const gi = g;
-                  if (typeof gi["IndexName"] === "string")
-                    gsiNames.push(gi["IndexName"]);
-                }
-              }
-            }
-            schema.dynamoTables.push({
-              name: cfnStr(props, "TableName") ?? logicalId,
-              partitionKey: pk,
-              sortKey: sk,
-              gsiNames,
-              source,
-              filePath
-            });
-            break;
-          }
-          case "AWS::RDS::DBInstance":
-            schema.rdsInstances.push({
-              identifier: cfnStr(props, "DBInstanceIdentifier") ?? logicalId,
-              engine: cfnStr(props, "Engine") ?? "unknown",
-              source,
-              filePath
-            });
-            break;
-          case "AWS::RDS::DBCluster":
-            schema.rdsInstances.push({
-              identifier: cfnStr(props, "DBClusterIdentifier") ?? logicalId,
-              engine: cfnStr(props, "Engine") ?? "aurora",
-              source,
-              filePath
-            });
-            break;
-          case "AWS::DocDB::DBCluster":
-            schema.mongoClusters.push({
-              identifier: cfnStr(props, "DBClusterIdentifier") ?? logicalId,
-              source,
-              filePath
-            });
-            break;
-          case "AWS::SQS::Queue": {
-            const name = cfnStr(props, "QueueName") ?? logicalId;
-            const hasDLQ = !!props["RedrivePolicy"];
-            const encrypted = !!(props["KmsMasterKeyId"] || cfnBool(props, "SqsManagedSseEnabled"));
-            schema.queues.push({ name, hasDLQ, encrypted, source, filePath });
-            break;
-          }
-          case "AWS::SNS::Topic":
-            schema.topics.push({
-              name: cfnStr(props, "TopicName") ?? logicalId,
-              encrypted: !!props["KmsMasterKeyId"],
-              source,
-              filePath
-            });
-            break;
-          case "AWS::Lambda::Function":
-            schema.lambdas.push({
-              name: cfnStr(props, "FunctionName") ?? logicalId,
-              runtime: cfnStr(props, "Runtime"),
-              source,
-              filePath
-            });
-            break;
-          case "AWS::S3::Bucket": {
-            const versioningConfig = props["VersioningConfiguration"];
-            schema.buckets.push({
-              name: cfnStr(props, "BucketName") ?? logicalId,
-              versioned: versioningConfig?.["Status"] === "Enabled",
-              source,
-              filePath
-            });
-            break;
-          }
-          case "AWS::SSM::Parameter":
-            schema.parameters.push({
-              name: cfnStr(props, "Name") ?? logicalId,
-              type: cfnStr(props, "Type") ?? "String",
-              source,
-              filePath
-            });
-            break;
-          case "AWS::SecretsManager::Secret":
-            schema.secrets.push({
-              name: cfnStr(props, "Name") ?? logicalId,
-              source,
-              filePath
-            });
-            break;
-          case "AWS::ApiGateway::RestApi":
-          case "AWS::ApiGatewayV2::Api":
-            schema.apiGateways.push({
-              name: cfnStr(props, "Name") ?? logicalId,
-              source,
-              filePath
-            });
-            break;
-        }
-      }
-    }
-    async function extractCloudFormationSchema(repoPath) {
-      const schema = emptySchema();
-      const cfnFiles = findFilesRecursively(repoPath, [".yaml", ".yml", ".json"]);
-      core_1.logger.info(`Scanning ${cfnFiles.length} potential CloudFormation file(s)`);
-      for (const filePath of cfnFiles) {
-        const parsed = parseCFNFile(filePath);
-        if (!parsed)
-          continue;
-        const resources = parsed["Resources"];
-        if (!resources)
-          continue;
-        processCFNResources(resources, schema, filePath, "cloudformation");
-      }
-      return schema;
-    }
-    async function extractCDKSchema(repoPath) {
-      const schema = emptySchema();
-      const cdkOutDir = path5.join(repoPath, "cdk.out");
-      if (fs4.existsSync(cdkOutDir)) {
-        const templateFiles = fs4.readdirSync(cdkOutDir).filter((f) => f.endsWith(".template.json")).map((f) => path5.join(cdkOutDir, f));
-        core_1.logger.info(`Found ${templateFiles.length} CDK synthesized template(s) in cdk.out/`);
-        for (const filePath of templateFiles) {
-          const parsed = parseCFNFile(filePath);
-          if (!parsed)
-            continue;
-          const resources = parsed["Resources"];
-          if (!resources)
-            continue;
-          processCFNResources(resources, schema, filePath, "cdk");
-        }
-      }
-      if (schema.queues.length === 0 && schema.topics.length === 0 && schema.lambdas.length === 0) {
-        const cdkJsonPath = path5.join(repoPath, "cdk.json");
-        if (fs4.existsSync(cdkJsonPath)) {
-          core_1.logger.info("CDK project detected (cdk.json found) \u2014 run `cdk synth` for full IaC analysis");
-        }
-      }
-      return schema;
-    }
-    function mergeSchemas(...schemas) {
-      const merged = emptySchema();
-      const seen = {
-        dynamo: /* @__PURE__ */ new Set(),
-        rds: /* @__PURE__ */ new Set(),
-        mongo: /* @__PURE__ */ new Set(),
-        queue: /* @__PURE__ */ new Set(),
-        topic: /* @__PURE__ */ new Set(),
-        lambda: /* @__PURE__ */ new Set(),
-        bucket: /* @__PURE__ */ new Set(),
-        param: /* @__PURE__ */ new Set(),
-        secret: /* @__PURE__ */ new Set(),
-        api: /* @__PURE__ */ new Set()
-      };
-      for (const schema of schemas) {
-        for (const t of schema.dynamoTables) {
-          const k = `${t.source}::${t.name}`;
-          if (!seen.dynamo.has(k)) {
-            seen.dynamo.add(k);
-            merged.dynamoTables.push(t);
-          }
-        }
-        for (const r of schema.rdsInstances) {
-          const k = `${r.source}::${r.identifier}`;
-          if (!seen.rds.has(k)) {
-            seen.rds.add(k);
-            merged.rdsInstances.push(r);
-          }
-        }
-        for (const m of schema.mongoClusters) {
-          const k = `${m.source}::${m.identifier}`;
-          if (!seen.mongo.has(k)) {
-            seen.mongo.add(k);
-            merged.mongoClusters.push(m);
-          }
-        }
-        for (const q of schema.queues) {
-          const k = `${q.source}::${q.name}`;
-          if (!seen.queue.has(k)) {
-            seen.queue.add(k);
-            merged.queues.push(q);
-          }
-        }
-        for (const t of schema.topics) {
-          const k = `${t.source}::${t.name}`;
-          if (!seen.topic.has(k)) {
-            seen.topic.add(k);
-            merged.topics.push(t);
-          }
-        }
-        for (const l of schema.lambdas) {
-          const k = `${l.source}::${l.name}`;
-          if (!seen.lambda.has(k)) {
-            seen.lambda.add(k);
-            merged.lambdas.push(l);
-          }
-        }
-        for (const b of schema.buckets) {
-          const k = `${b.source}::${b.name}`;
-          if (!seen.bucket.has(k)) {
-            seen.bucket.add(k);
-            merged.buckets.push(b);
-          }
-        }
-        for (const p of schema.parameters) {
-          const k = `${p.source}::${p.name}`;
-          if (!seen.param.has(k)) {
-            seen.param.add(k);
-            merged.parameters.push(p);
-          }
-        }
-        for (const s of schema.secrets) {
-          const k = `${s.source}::${s.name}`;
-          if (!seen.secret.has(k)) {
-            seen.secret.add(k);
-            merged.secrets.push(s);
-          }
-        }
-        for (const a of schema.apiGateways) {
-          const k = `${a.source}::${a.name}`;
-          if (!seen.api.has(k)) {
-            seen.api.add(k);
-            merged.apiGateways.push(a);
-          }
-        }
-      }
-      return merged;
-    }
-    async function extractIaCSchema2(repoPath) {
-      const [tfSchema, cfnSchema, cdkSchema] = await Promise.all([
-        extractTerraformSchema(repoPath),
-        extractCloudFormationSchema(repoPath),
-        extractCDKSchema(repoPath)
-      ]);
-      const merged = mergeSchemas(tfSchema, cfnSchema, cdkSchema);
-      const total = merged.dynamoTables.length + merged.rdsInstances.length + merged.mongoClusters.length + merged.queues.length + merged.topics.length + merged.lambdas.length + merged.buckets.length + merged.parameters.length + merged.secrets.length + merged.apiGateways.length;
-      core_1.logger.info(`IaC schema total: ${total} resource(s) across TF/CFN/CDK`);
-      return merged;
-    }
-  }
-});
-
-// ../adapters/aws-services/dist/index.js
-var require_dist7 = __commonJS({
-  "../adapters/aws-services/dist/index.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.extractSQSMetadata = extractSQSMetadata2;
-    exports2.validateSQSAccess = validateSQSAccess2;
-    exports2.extractSNSMetadata = extractSNSMetadata2;
-    exports2.validateSNSAccess = validateSNSAccess2;
-    exports2.extractSSMMetadata = extractSSMMetadata2;
-    exports2.validateSSMAccess = validateSSMAccess2;
-    exports2.extractSecretsMetadata = extractSecretsMetadata2;
-    exports2.validateSecretsAccess = validateSecretsAccess2;
-    exports2.extractLambdaMetadata = extractLambdaMetadata2;
-    exports2.validateLambdaAccess = validateLambdaAccess2;
-    var client_sqs_1 = require("@aws-sdk/client-sqs");
-    var client_sns_1 = require("@aws-sdk/client-sns");
-    var client_ssm_1 = require("@aws-sdk/client-ssm");
-    var client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
-    var client_lambda_1 = require("@aws-sdk/client-lambda");
-    var credential_providers_1 = require("@aws-sdk/credential-providers");
-    var core_1 = require_dist();
-    function clientConfig(cfg) {
-      const region = cfg.region ?? "us-east-1";
-      return cfg.profile ? { region, credentials: (0, credential_providers_1.fromIni)({ profile: cfg.profile }) } : { region };
-    }
-    async function extractSQSMetadata2(cfg = {}) {
-      const client = new client_sqs_1.SQSClient(clientConfig(cfg));
-      const queues = [];
-      try {
-        let nextToken;
-        const queueUrls = [];
-        do {
-          const res = await client.send(new client_sqs_1.ListQueuesCommand({ NextToken: nextToken, MaxResults: 1e3 }));
-          queueUrls.push(...res.QueueUrls ?? []);
-          nextToken = res.NextToken;
-        } while (nextToken);
-        for (const url of queueUrls) {
-          try {
-            const attrs = await client.send(new client_sqs_1.GetQueueAttributesCommand({
-              QueueUrl: url,
-              AttributeNames: [
-                "QueueArn",
-                "VisibilityTimeout",
-                "MessageRetentionPeriod",
-                "RedrivePolicy",
-                "KmsMasterKeyId",
-                "SqsManagedSseEnabled",
-                "ApproximateNumberOfMessages",
-                "ApproximateNumberOfMessagesNotVisible"
-              ]
-            }));
-            const a = attrs.Attributes ?? {};
-            const arn = a["QueueArn"] ?? "";
-            const name = arn.split(":").pop() ?? url.split("/").pop() ?? url;
-            const redrivePolicy = a["RedrivePolicy"];
-            const dlqArn = redrivePolicy ? JSON.parse(redrivePolicy).deadLetterTargetArn : void 0;
-            const encrypted = !!(a["KmsMasterKeyId"] || a["SqsManagedSseEnabled"] === "true");
-            const retentionSeconds = parseInt(a["MessageRetentionPeriod"] ?? "345600", 10);
-            queues.push({
-              name,
-              url,
-              arn,
-              hasDLQ: !!dlqArn,
-              dlqArn,
-              encrypted,
-              visibilityTimeoutSec: parseInt(a["VisibilityTimeout"] ?? "30", 10),
-              retentionDays: Math.round(retentionSeconds / 86400),
-              approximateMessages: parseInt(a["ApproximateNumberOfMessages"] ?? "0", 10),
-              approximateInflight: parseInt(a["ApproximateNumberOfMessagesNotVisible"] ?? "0", 10)
-            });
-          } catch (err) {
-            core_1.logger.warn(`SQS attrs failed for ${url}: ${err instanceof Error ? err.message : String(err)}`);
-          }
-        }
-      } catch (err) {
-        core_1.logger.warn(`SQS list failed: ${err instanceof Error ? err.message : String(err)}`);
-      }
-      return queues;
-    }
-    async function validateSQSAccess2(cfg = {}) {
-      await new client_sqs_1.SQSClient(clientConfig(cfg)).send(new client_sqs_1.ListQueuesCommand({ MaxResults: 1 }));
-    }
-    async function extractSNSMetadata2(cfg = {}) {
-      const client = new client_sns_1.SNSClient(clientConfig(cfg));
-      const topics = [];
-      try {
-        let nextToken;
-        const topicArns = [];
-        do {
-          const res = await client.send(new client_sns_1.ListTopicsCommand({ NextToken: nextToken }));
-          topicArns.push(...(res.Topics ?? []).map((t) => t.TopicArn ?? "").filter(Boolean));
-          nextToken = res.NextToken;
-        } while (nextToken);
-        for (const arn of topicArns) {
-          try {
-            const [attrsRes, subsRes] = await Promise.all([
-              client.send(new client_sns_1.GetTopicAttributesCommand({ TopicArn: arn })),
-              client.send(new client_sns_1.ListSubscriptionsByTopicCommand({ TopicArn: arn }))
-            ]);
-            const attrs = attrsRes.Attributes ?? {};
-            const subs = subsRes.Subscriptions ?? [];
-            topics.push({
-              name: arn.split(":").pop() ?? arn,
-              arn,
-              encrypted: !!attrs["KmsMasterKeyId"],
-              subscriptionCount: subs.length,
-              subscriptionProtocols: [...new Set(subs.map((s) => s.Protocol ?? "unknown"))]
-            });
-          } catch (err) {
-            core_1.logger.warn(`SNS attrs failed for ${arn}: ${err instanceof Error ? err.message : String(err)}`);
-          }
-        }
-      } catch (err) {
-        core_1.logger.warn(`SNS list failed: ${err instanceof Error ? err.message : String(err)}`);
-      }
-      return topics;
-    }
-    async function validateSNSAccess2(cfg = {}) {
-      await new client_sns_1.SNSClient(clientConfig(cfg)).send(new client_sns_1.ListTopicsCommand({}));
-    }
-    async function extractSSMMetadata2(cfg = {}) {
-      const client = new client_ssm_1.SSMClient(clientConfig(cfg));
-      const parameters = [];
-      try {
-        let nextToken;
-        do {
-          const res = await client.send(new client_ssm_1.DescribeParametersCommand({
-            NextToken: nextToken,
-            MaxResults: 50
-            // Only metadata — GetParameter/GetParameters would return values
-          }));
-          for (const p of res.Parameters ?? []) {
-            parameters.push({
-              name: p.Name ?? "",
-              type: p.Type ?? "String",
-              tier: p.Tier ?? "Standard",
-              lastModified: p.LastModifiedDate?.toISOString(),
-              description: p.Description,
-              keyId: p.KeyId
-            });
-          }
-          nextToken = res.NextToken;
-        } while (nextToken && parameters.length < 500);
-      } catch (err) {
-        core_1.logger.warn(`SSM list failed: ${err instanceof Error ? err.message : String(err)}`);
-      }
-      return parameters;
-    }
-    async function validateSSMAccess2(cfg = {}) {
-      await new client_ssm_1.SSMClient(clientConfig(cfg)).send(new client_ssm_1.DescribeParametersCommand({ MaxResults: 1 }));
-    }
-    async function extractSecretsMetadata2(cfg = {}) {
-      const client = new client_secrets_manager_1.SecretsManagerClient(clientConfig(cfg));
-      const secrets = [];
-      try {
-        let nextToken;
-        do {
-          const res = await client.send(new client_secrets_manager_1.ListSecretsCommand({ NextToken: nextToken, MaxResults: 100 }));
-          for (const s of res.SecretList ?? []) {
-            secrets.push({
-              name: s.Name ?? "",
-              arn: s.ARN ?? "",
-              rotationEnabled: s.RotationEnabled ?? false,
-              rotationDays: s.RotationRules?.AutomaticallyAfterDays,
-              lastRotated: s.LastRotatedDate?.toISOString(),
-              lastAccessed: s.LastAccessedDate?.toISOString(),
-              description: s.Description
-            });
-          }
-          nextToken = res.NextToken;
-        } while (nextToken && secrets.length < 200);
-      } catch (err) {
-        core_1.logger.warn(`Secrets Manager list failed: ${err instanceof Error ? err.message : String(err)}`);
-      }
-      return secrets;
-    }
-    async function validateSecretsAccess2(cfg = {}) {
-      await new client_secrets_manager_1.SecretsManagerClient(clientConfig(cfg)).send(new client_secrets_manager_1.ListSecretsCommand({ MaxResults: 1 }));
-    }
-    async function extractLambdaMetadata2(cfg = {}) {
-      const client = new client_lambda_1.LambdaClient(clientConfig(cfg));
-      const functions = [];
-      try {
-        let marker;
-        do {
-          const res = await client.send(new client_lambda_1.ListFunctionsCommand({ Marker: marker, MaxItems: 50 }));
-          for (const fn of res.Functions ?? []) {
-            functions.push({
-              name: fn.FunctionName ?? "",
-              arn: fn.FunctionArn ?? "",
-              runtime: fn.Runtime,
-              handler: fn.Handler,
-              memoryMB: fn.MemorySize,
-              timeoutSec: fn.Timeout,
-              lastModified: fn.LastModified,
-              envVarKeys: Object.keys(fn.Environment?.Variables ?? {}),
-              layers: (fn.Layers ?? []).map((l) => l.Arn ?? "").filter(Boolean)
-            });
-          }
-          marker = res.NextMarker;
-        } while (marker && functions.length < 200);
-      } catch (err) {
-        core_1.logger.warn(`Lambda list failed: ${err instanceof Error ? err.message : String(err)}`);
-      }
-      return functions;
-    }
-    async function validateLambdaAccess2(cfg = {}) {
-      await new client_lambda_1.LambdaClient(clientConfig(cfg)).send(new client_lambda_1.ListFunctionsCommand({ MaxItems: 1 }));
-    }
-  }
-});
-
-// ../adapters/logs/dist/index.js
-var require_dist8 = __commonJS({
-  "../adapters/logs/dist/index.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.extractLogsSummary = extractLogsSummary2;
-    exports2.validateLogsAccess = validateLogsAccess2;
-    var client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
-    var credential_providers_1 = require("@aws-sdk/credential-providers");
-    var core_1 = require_dist();
-    var MAX_LOG_GROUPS = 50;
-    var MAX_EVENTS_PER_GROUP = 50;
-    function clientConfig(cfg) {
-      const region = cfg.region ?? "us-east-1";
-      return cfg.profile ? { region, credentials: (0, credential_providers_1.fromIni)({ profile: cfg.profile }) } : { region };
-    }
-    function toPattern(message) {
-      return message.slice(0, 200).replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, "<UUID>").replace(/\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(\.\d+)?Z?/g, "<TIMESTAMP>").replace(/\b\d{5,}\b/g, "<NUM>").replace(/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g, "<IP>").replace(/Bearer\s+\S+/gi, "Bearer <TOKEN>").trim();
-    }
-    function topPatterns(messages, limit = 5) {
-      const counts = {};
-      for (const msg of messages) {
-        const p = toPattern(msg);
-        counts[p] = (counts[p] ?? 0) + 1;
-      }
-      return Object.entries(counts).sort((a, b) => b[1] - a[1]).slice(0, limit).map(([pattern, count]) => ({ pattern, count }));
-    }
-    async function extractLogsSummary2(cfg = {}) {
-      const client = new client_cloudwatch_logs_1.CloudWatchLogsClient(clientConfig(cfg));
-      const windowMs = (cfg.windowHours ?? 24) * 60 * 60 * 1e3;
-      const startTime = Date.now() - windowMs;
-      const summaries = [];
-      const logGroups = [];
-      try {
-        const prefixes = cfg.logGroupPrefixes?.length ? cfg.logGroupPrefixes : [void 0];
-        for (const prefix of prefixes) {
-          let nextToken;
-          do {
-            const res = await client.send(new client_cloudwatch_logs_1.DescribeLogGroupsCommand({
-              nextToken,
-              limit: Math.min(50, MAX_LOG_GROUPS - logGroups.length),
-              ...prefix ? { logGroupNamePrefix: prefix } : {}
-            }));
-            for (const lg of res.logGroups ?? []) {
-              logGroups.push({ name: lg.logGroupName ?? "", retentionDays: lg.retentionInDays });
-            }
-            nextToken = res.nextToken;
-            if (logGroups.length >= MAX_LOG_GROUPS)
-              break;
-          } while (nextToken);
-          if (logGroups.length >= MAX_LOG_GROUPS)
-            break;
-        }
-      } catch (err) {
-        core_1.logger.warn(`CloudWatch Logs discovery failed: ${err instanceof Error ? err.message : String(err)}`);
-        return summaries;
-      }
-      for (const lg of logGroups) {
-        const errorMessages = [];
-        const warnMessages = [];
-        let lastErrorTime;
-        for (const filterPattern of ["ERROR", "Exception", "WARN"]) {
-          if (errorMessages.length + warnMessages.length >= MAX_EVENTS_PER_GROUP)
-            break;
-          try {
-            const res = await client.send(new client_cloudwatch_logs_1.FilterLogEventsCommand({
-              logGroupName: lg.name,
-              filterPattern,
-              startTime,
-              limit: 25
-            }));
-            for (const event of res.events ?? []) {
-              const msg = event.message ?? "";
-              if (filterPattern === "WARN") {
-                warnMessages.push(msg);
-              } else {
-                errorMessages.push(msg);
-                if (event.timestamp) {
-                  const ts = new Date(event.timestamp).toISOString();
-                  if (!lastErrorTime || ts > lastErrorTime)
-                    lastErrorTime = ts;
-                }
-              }
-            }
-          } catch {
-          }
-        }
-        summaries.push({
-          logGroupName: lg.name,
-          retentionDays: lg.retentionDays,
-          errorCount: errorMessages.length,
-          warnCount: warnMessages.length,
-          topErrorPatterns: topPatterns(errorMessages),
-          lastErrorTime
-        });
-      }
-      core_1.logger.info(`CloudWatch Logs: sampled ${summaries.length} log group(s)`);
-      return summaries;
-    }
-    async function validateLogsAccess2(cfg = {}) {
-      await new client_cloudwatch_logs_1.CloudWatchLogsClient(clientConfig(cfg)).send(new client_cloudwatch_logs_1.DescribeLogGroupsCommand({ limit: 1 }));
-    }
-  }
-});
-
-// ../context/dist/index.js
-var require_dist9 = __commonJS({
-  "../context/dist/index.js"(exports2) {
-    "use strict";
-    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m, k);
-      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
-      }
-      Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      o[k2] = m[k];
-    }));
-    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
-      Object.defineProperty(o, "default", { enumerable: true, value: v });
-    }) : function(o, v) {
-      o["default"] = v;
-    });
-    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
-      var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function(o2) {
-          var ar = [];
-          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
-          return ar;
-        };
-        return ownKeys(o);
-      };
-      return function(mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) {
-          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        }
-        __setModuleDefault(result, mod);
-        return result;
-      };
-    })();
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.scanRepository = scanRepository2;
-    var path5 = __importStar(require("path"));
-    var fs4 = __importStar(require("fs"));
-    var ts_morph_1 = require("ts-morph");
-    var core_1 = require_dist();
-    var DYNAMO_OPERATIONS = /* @__PURE__ */ new Set([
-      "query",
-      "scan",
-      "getItem",
-      "putItem",
-      "updateItem",
-      "deleteItem",
-      "batchGetItem",
-      "batchWriteItem",
-      "transactGetItems",
-      "transactWriteItems",
-      // Also handle command class names (AWS SDK v3)
-      "QueryCommand",
-      "ScanCommand",
-      "GetItemCommand",
-      "PutItemCommand",
-      "UpdateItemCommand",
-      "DeleteItemCommand"
-    ]);
-    var DYNAMO_CLIENT_PATTERNS = ["DynamoDBClient", "DynamoDB", "dynamoDB", "dynamo", "ddb"];
-    var POSTGRES_QUERY_METHODS = /* @__PURE__ */ new Set(["query", "execute", "exec"]);
-    var KNEX_METHODS = /* @__PURE__ */ new Set(["select", "where", "join", "from", "insert", "update", "delete", "del"]);
-    var MYSQL_QUERY_METHODS = /* @__PURE__ */ new Set(["query", "execute", "exec"]);
-    var MYSQL_CLIENT_PATTERNS = ["mysql", "mysql2", "connection", "pool", "conn"];
-    var MONGO_READ_METHODS = /* @__PURE__ */ new Set([
-      "find",
-      "findOne",
-      "findById",
-      "insertOne",
-      "insertMany",
-      "updateOne",
-      "updateMany",
-      "deleteOne",
-      "deleteMany",
-      "aggregate",
-      "countDocuments",
-      "estimatedDocumentCount"
-    ]);
-    var MONGO_COLLECTION_METHODS = /* @__PURE__ */ new Set(["collection"]);
-    var SQS_COMMANDS = /* @__PURE__ */ new Set(["SendMessageCommand", "SendMessageBatchCommand", "ReceiveMessageCommand", "DeleteMessageCommand", "sendMessage", "sendMessageBatch", "receiveMessage"]);
-    var SNS_COMMANDS = /* @__PURE__ */ new Set(["PublishCommand", "PublishBatchCommand", "publish", "publishBatch"]);
-    var SSM_COMMANDS = /* @__PURE__ */ new Set(["GetParameterCommand", "GetParametersCommand", "GetParametersByPathCommand", "getParameter", "getParameters", "getParametersByPath"]);
-    var SECRETS_COMMANDS = /* @__PURE__ */ new Set(["GetSecretValueCommand", "getSecretValue"]);
-    var LAMBDA_COMMANDS = /* @__PURE__ */ new Set(["InvokeCommand", "InvokeAsyncCommand", "invoke", "invokeAsync"]);
-    var SQS_ARG_KEYS = ["QueueUrl", "QueueName"];
-    var SNS_ARG_KEYS = ["TopicArn", "TargetArn"];
-    var SSM_ARG_KEYS = ["Name", "Path"];
-    var SECRETS_ARG_KEYS = ["SecretId", "SecretName"];
-    var LAMBDA_ARG_KEYS = ["FunctionName"];
-    var PRISMA_METHODS = /* @__PURE__ */ new Set([
-      "findMany",
-      "findFirst",
-      "findUnique",
-      "create",
-      "update",
-      "upsert",
-      "delete",
-      "deleteMany",
-      "updateMany"
-    ]);
-    function getEnclosingFunctionName(node) {
-      let current = node.getParent();
-      while (current) {
-        if (ts_morph_1.Node.isFunctionDeclaration(current) || ts_morph_1.Node.isFunctionExpression(current) || ts_morph_1.Node.isArrowFunction(current) || ts_morph_1.Node.isMethodDeclaration(current)) {
-          if (ts_morph_1.Node.isFunctionDeclaration(current) || ts_morph_1.Node.isMethodDeclaration(current)) {
-            return current.getName() ?? "<anonymous>";
-          }
-          const parent = current.getParent();
-          if (parent && ts_morph_1.Node.isVariableDeclaration(parent)) {
-            return parent.getName();
-          }
-          if (parent && ts_morph_1.Node.isPropertyAssignment(parent)) {
-            return parent.getName();
-          }
-          return "<anonymous>";
-        }
-        current = current.getParent();
-      }
-      return "<module>";
-    }
-    function extractTableNameFromArg(arg) {
-      if (ts_morph_1.Node.isStringLiteral(arg)) {
-        return arg.getLiteralValue();
-      }
-      if (ts_morph_1.Node.isObjectLiteralExpression(arg)) {
-        for (const prop of arg.getProperties()) {
-          if (ts_morph_1.Node.isPropertyAssignment(prop) && prop.getName() === "TableName") {
-            const init = prop.getInitializer();
-            if (init && ts_morph_1.Node.isStringLiteral(init)) {
-              return init.getLiteralValue();
-            }
-          }
-        }
-      }
-      return "unknown";
-    }
-    function detectDynamoOperations(callExpr, filePath) {
-      const expr = callExpr.getExpression();
-      const args = callExpr.getArguments();
-      if (ts_morph_1.Node.isPropertyAccessExpression(expr)) {
-        const methodName = expr.getName();
-        if (methodName === "send" && args.length > 0) {
-          const firstArg = args[0];
-          if (ts_morph_1.Node.isNewExpression(firstArg)) {
-            const className = firstArg.getExpression().getText();
-            if (DYNAMO_OPERATIONS.has(className)) {
-              const cmdArgs = firstArg.getArguments();
-              const tableName = cmdArgs.length > 0 ? extractTableNameFromArg(cmdArgs[0]) : "unknown";
-              return {
-                functionName: getEnclosingFunctionName(callExpr),
-                operationType: className,
-                databaseType: "dynamodb",
-                target: tableName,
-                filePath
-              };
-            }
-          }
-        }
-        if (DYNAMO_OPERATIONS.has(methodName)) {
-          const objText = expr.getExpression().getText().toLowerCase();
-          if (DYNAMO_CLIENT_PATTERNS.some((p) => objText.includes(p.toLowerCase()))) {
-            const tableName = args.length > 0 ? extractTableNameFromArg(args[0]) : "unknown";
-            return {
-              functionName: getEnclosingFunctionName(callExpr),
-              operationType: methodName,
-              databaseType: "dynamodb",
-              target: tableName,
-              filePath
-            };
-          }
-        }
-      }
-      return null;
-    }
-    function extractSqlTableName(sql) {
-      const patterns = [
-        /FROM\s+["']?(\w+)["']?/i,
-        /INTO\s+["']?(\w+)["']?/i,
-        /UPDATE\s+["']?(\w+)["']?/i,
-        /JOIN\s+["']?(\w+)["']?/i
-      ];
-      for (const pattern of patterns) {
-        const match = sql.match(pattern);
-        if (match?.[1])
-          return match[1];
-      }
-      return "unknown";
-    }
-    function detectPostgresOperations(callExpr, filePath) {
-      const expr = callExpr.getExpression();
-      const args = callExpr.getArguments();
-      if (!ts_morph_1.Node.isPropertyAccessExpression(expr))
-        return null;
-      const methodName = expr.getName();
-      const objExpr = expr.getExpression();
-      if (POSTGRES_QUERY_METHODS.has(methodName)) {
-        const objText = objExpr.getText().toLowerCase();
-        if (objText.includes("pool") || objText.includes("client") || objText.includes("db") || objText.includes("pg") || objText.includes("conn")) {
-          let tableName = "unknown";
-          if (args.length > 0) {
-            const firstArg = args[0];
-            if (ts_morph_1.Node.isStringLiteral(firstArg)) {
-              tableName = extractSqlTableName(firstArg.getLiteralValue());
-            } else if (ts_morph_1.Node.isNoSubstitutionTemplateLiteral(firstArg)) {
-              tableName = extractSqlTableName(firstArg.getLiteralText());
-            } else if (ts_morph_1.Node.isTemplateExpression(firstArg)) {
-              tableName = extractSqlTableName(firstArg.getHead().getLiteralText());
-            }
-          }
-          return {
-            functionName: getEnclosingFunctionName(callExpr),
-            operationType: "query",
-            databaseType: "postgres",
-            target: tableName,
-            filePath
-          };
-        }
-      }
-      if (PRISMA_METHODS.has(methodName)) {
-        const accessChain = objExpr;
-        if (ts_morph_1.Node.isPropertyAccessExpression(accessChain)) {
-          const modelName = accessChain.getName();
-          const rootObj = accessChain.getExpression().getText().toLowerCase();
-          if (rootObj.includes("prisma")) {
-            return {
-              functionName: getEnclosingFunctionName(callExpr),
-              operationType: methodName,
-              databaseType: "postgres",
-              target: modelName,
-              filePath
-            };
-          }
-        }
-      }
-      if (KNEX_METHODS.has(methodName)) {
-        const calleeText = objExpr.getText();
-        if (calleeText.includes("knex") || calleeText.includes("db(") || calleeText.includes("trx(")) {
-          return {
-            functionName: getEnclosingFunctionName(callExpr),
-            operationType: methodName,
-            databaseType: "postgres",
-            target: "unknown",
-            filePath
-          };
-        }
-        if (ts_morph_1.Node.isCallExpression(objExpr)) {
-          const innerExpr = objExpr.getExpression();
-          if (innerExpr.getText().toLowerCase().match(/knex|db|trx/)) {
-            const innerArgs = objExpr.getArguments();
-            const tableName = innerArgs.length > 0 && ts_morph_1.Node.isStringLiteral(innerArgs[0]) ? innerArgs[0].getLiteralValue() : "unknown";
-            return {
-              functionName: getEnclosingFunctionName(callExpr),
-              operationType: methodName,
-              databaseType: "postgres",
-              target: tableName,
-              filePath
-            };
-          }
-        }
-      }
-      return null;
-    }
-    function detectMySQLOperations(callExpr, filePath) {
-      const expr = callExpr.getExpression();
-      const args = callExpr.getArguments();
-      if (!ts_morph_1.Node.isPropertyAccessExpression(expr))
-        return null;
-      const methodName = expr.getName();
-      const objExpr = expr.getExpression();
-      const objText = objExpr.getText().toLowerCase();
-      if (MYSQL_QUERY_METHODS.has(methodName)) {
-        const isMysqlClient = MYSQL_CLIENT_PATTERNS.some((p) => objText.includes(p.toLowerCase()));
-        if (isMysqlClient) {
-          let tableName = "unknown";
-          if (args.length > 0) {
-            const firstArg = args[0];
-            if (ts_morph_1.Node.isStringLiteral(firstArg)) {
-              tableName = extractSqlTableName(firstArg.getLiteralValue());
-            } else if (ts_morph_1.Node.isNoSubstitutionTemplateLiteral(firstArg)) {
-              tableName = extractSqlTableName(firstArg.getLiteralText());
-            } else if (ts_morph_1.Node.isTemplateExpression(firstArg)) {
-              tableName = extractSqlTableName(firstArg.getHead().getLiteralText());
-            }
-          }
-          return {
-            functionName: getEnclosingFunctionName(callExpr),
-            operationType: "query",
-            databaseType: "mysql",
-            target: tableName,
-            filePath
-          };
-        }
-      }
-      if (KNEX_METHODS.has(methodName)) {
-        if (objText.includes("mysql") || objText.includes("knex")) {
-          let tableName = "unknown";
-          if (ts_morph_1.Node.isCallExpression(objExpr)) {
-            const innerArgs = objExpr.getArguments();
-            if (innerArgs.length > 0 && ts_morph_1.Node.isStringLiteral(innerArgs[0])) {
-              tableName = innerArgs[0].getLiteralValue();
-            }
-          }
-          return {
-            functionName: getEnclosingFunctionName(callExpr),
-            operationType: methodName,
-            databaseType: "mysql",
-            target: tableName,
-            filePath
-          };
-        }
-      }
-      return null;
-    }
-    function detectMongoOperations(callExpr, filePath) {
-      const expr = callExpr.getExpression();
-      if (!ts_morph_1.Node.isPropertyAccessExpression(expr))
-        return null;
-      const methodName = expr.getName();
-      const objExpr = expr.getExpression();
-      if (MONGO_READ_METHODS.has(methodName)) {
-        const objText = objExpr.getText().toLowerCase();
-        if (objText.includes("collection") || objText.includes("col") || objText.includes("db.") || objText.includes("model") || // Mongoose: User.find(), Order.findOne()
-        /^[A-Z][a-zA-Z]+$/.test(objExpr.getText())) {
-          let collectionName = "unknown";
-          if (ts_morph_1.Node.isCallExpression(objExpr)) {
-            const innerExpr = objExpr.getExpression();
-            if (ts_morph_1.Node.isPropertyAccessExpression(innerExpr) && MONGO_COLLECTION_METHODS.has(innerExpr.getName())) {
-              const innerArgs = objExpr.getArguments();
-              if (innerArgs.length > 0 && ts_morph_1.Node.isStringLiteral(innerArgs[0])) {
-                collectionName = innerArgs[0].getLiteralValue();
-              }
-            }
-          } else if (ts_morph_1.Node.isPropertyAccessExpression(objExpr)) {
-            collectionName = objExpr.getName();
-          } else {
-            collectionName = objExpr.getText();
-          }
-          const opType = methodName === "find" || methodName === "aggregate" ? "scan" : "query";
-          return {
-            functionName: getEnclosingFunctionName(callExpr),
-            operationType: opType,
-            databaseType: "mongodb",
-            target: collectionName,
-            filePath
-          };
-        }
-      }
-      if (MONGO_COLLECTION_METHODS.has(methodName)) {
-        const args = callExpr.getArguments();
-        const objText = objExpr.getText().toLowerCase();
-        if (objText.includes("db") || objText.includes("mongo")) {
-          const collectionName = args.length > 0 && ts_morph_1.Node.isStringLiteral(args[0]) ? args[0].getLiteralValue() : "unknown";
-          return {
-            functionName: getEnclosingFunctionName(callExpr),
-            operationType: "query",
-            databaseType: "mongodb",
-            target: collectionName,
-            filePath
-          };
-        }
-      }
-      return null;
-    }
-    function extractArgValue(arg, ...keys) {
-      if (ts_morph_1.Node.isObjectLiteralExpression(arg)) {
-        for (const prop of arg.getProperties()) {
-          if (ts_morph_1.Node.isPropertyAssignment(prop) && keys.includes(prop.getName())) {
-            const init = prop.getInitializer();
-            if (init && ts_morph_1.Node.isStringLiteral(init)) {
-              const val = init.getLiteralValue();
-              return val.includes(":") ? val.split(":").pop() ?? val : val;
-            }
-          }
-        }
-      }
-      return "unknown";
-    }
-    function detectAWSServiceOperations(callExpr, filePath) {
-      const expr = callExpr.getExpression();
-      const args = callExpr.getArguments();
-      if (ts_morph_1.Node.isPropertyAccessExpression(expr) && expr.getName() === "send" && args.length > 0) {
-        const firstArg = args[0];
-        if (ts_morph_1.Node.isNewExpression(firstArg)) {
-          const className = firstArg.getExpression().getText();
-          const cmdArgs = firstArg.getArguments();
-          if (SQS_COMMANDS.has(className)) {
-            return {
-              functionName: getEnclosingFunctionName(callExpr),
-              operationType: className,
-              databaseType: "sqs",
-              target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SQS_ARG_KEYS) : "unknown",
-              filePath
-            };
-          }
-          if (SNS_COMMANDS.has(className)) {
-            return {
-              functionName: getEnclosingFunctionName(callExpr),
-              operationType: className,
-              databaseType: "sns",
-              target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SNS_ARG_KEYS) : "unknown",
-              filePath
-            };
-          }
-          if (SSM_COMMANDS.has(className)) {
-            return {
-              functionName: getEnclosingFunctionName(callExpr),
-              operationType: className,
-              databaseType: "ssm",
-              target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SSM_ARG_KEYS) : "unknown",
-              filePath
-            };
-          }
-          if (SECRETS_COMMANDS.has(className)) {
-            return {
-              functionName: getEnclosingFunctionName(callExpr),
-              operationType: className,
-              databaseType: "secretsmanager",
-              target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SECRETS_ARG_KEYS) : "unknown",
-              filePath
-            };
-          }
-          if (LAMBDA_COMMANDS.has(className)) {
-            return {
-              functionName: getEnclosingFunctionName(callExpr),
-              operationType: className,
-              databaseType: "lambda",
-              target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...LAMBDA_ARG_KEYS) : "unknown",
-              filePath
-            };
-          }
-        }
-      }
-      if (ts_morph_1.Node.isPropertyAccessExpression(expr)) {
-        const methodName = expr.getName();
-        const objText = expr.getExpression().getText().toLowerCase();
-        if (SQS_COMMANDS.has(methodName) && (objText.includes("sqs") || objText.includes("queue"))) {
-          return {
-            functionName: getEnclosingFunctionName(callExpr),
-            operationType: methodName,
-            databaseType: "sqs",
-            target: args.length > 0 ? extractArgValue(args[0], ...SQS_ARG_KEYS) : "unknown",
-            filePath
-          };
-        }
-        if (SNS_COMMANDS.has(methodName) && (objText.includes("sns") || objText.includes("topic"))) {
-          return {
-            functionName: getEnclosingFunctionName(callExpr),
-            operationType: methodName,
-            databaseType: "sns",
-            target: args.length > 0 ? extractArgValue(args[0], ...SNS_ARG_KEYS) : "unknown",
-            filePath
-          };
-        }
-        if (SSM_COMMANDS.has(methodName) && (objText.includes("ssm") || objText.includes("parameter"))) {
-          return {
-            functionName: getEnclosingFunctionName(callExpr),
-            operationType: methodName,
-            databaseType: "ssm",
-            target: args.length > 0 ? extractArgValue(args[0], ...SSM_ARG_KEYS) : "unknown",
-            filePath
-          };
-        }
-        if (SECRETS_COMMANDS.has(methodName) && (objText.includes("secret") || objText.includes("secrets"))) {
-          return {
-            functionName: getEnclosingFunctionName(callExpr),
-            operationType: methodName,
-            databaseType: "secretsmanager",
-            target: args.length > 0 ? extractArgValue(args[0], ...SECRETS_ARG_KEYS) : "unknown",
-            filePath
-          };
-        }
-        if (LAMBDA_COMMANDS.has(methodName) && (objText.includes("lambda") || objText.includes("fn"))) {
-          return {
-            functionName: getEnclosingFunctionName(callExpr),
-            operationType: methodName,
-            databaseType: "lambda",
-            target: args.length > 0 ? extractArgValue(args[0], ...LAMBDA_ARG_KEYS) : "unknown",
-            filePath
-          };
-        }
-      }
-      return null;
-    }
-    async function scanRepository2(repoPath) {
-      const resolvedPath = path5.resolve(repoPath);
-      if (!fs4.existsSync(resolvedPath)) {
-        throw new core_1.RepositoryScanError(`Path does not exist: ${resolvedPath}`);
-      }
-      const tsconfigPath = path5.join(resolvedPath, "tsconfig.json");
-      const hasTsConfig = fs4.existsSync(tsconfigPath);
-      const project = new ts_morph_1.Project({
-        tsConfigFilePath: hasTsConfig ? tsconfigPath : void 0,
-        compilerOptions: hasTsConfig ? void 0 : {
-          target: 99,
-          allowJs: true
-        },
-        skipAddingFilesFromTsConfig: !hasTsConfig
-      });
-      if (!hasTsConfig) {
-        project.addSourceFilesAtPaths([
-          path5.join(resolvedPath, "**/*.ts"),
-          path5.join(resolvedPath, "**/*.tsx"),
-          `!${path5.join(resolvedPath, "**/node_modules/**")}`,
-          `!${path5.join(resolvedPath, "**/dist/**")}`
-        ]);
-      }
-      const sourceFiles = project.getSourceFiles();
-      core_1.logger.info(`Scanning ${sourceFiles.length} TypeScript file(s) in ${resolvedPath}`);
-      const operations = [];
-      for (const sourceFile of sourceFiles) {
-        const filePath = sourceFile.getFilePath();
-        if (filePath.includes("node_modules") || filePath.includes("/dist/"))
-          continue;
-        const callExpressions = sourceFile.getDescendantsOfKind(ts_morph_1.SyntaxKind.CallExpression);
-        for (const callExpr of callExpressions) {
-          const dynamoOp = detectDynamoOperations(callExpr, filePath);
-          if (dynamoOp) {
-            operations.push(dynamoOp);
-            continue;
-          }
-          const postgresOp = detectPostgresOperations(callExpr, filePath);
-          if (postgresOp) {
-            operations.push(postgresOp);
-            continue;
-          }
-          const mysqlOp = detectMySQLOperations(callExpr, filePath);
-          if (mysqlOp) {
-            operations.push(mysqlOp);
-            continue;
-          }
-          const mongoOp = detectMongoOperations(callExpr, filePath);
-          if (mongoOp) {
-            operations.push(mongoOp);
-            continue;
-          }
-          const awsOp = detectAWSServiceOperations(callExpr, filePath);
-          if (awsOp) {
-            operations.push(awsOp);
-          }
-        }
-      }
-      core_1.logger.info(`Extracted ${operations.length} database operation(s)`);
-      return operations;
-    }
-  }
-});
-
-// ../graph/dist/index.js
-var require_dist10 = __commonJS({
-  "../graph/dist/index.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.buildGraph = buildGraph2;
-    exports2.getTableNodes = getTableNodes;
-    exports2.getFunctionNodes = getFunctionNodes;
-    exports2.getIndexNodes = getIndexNodes;
-    exports2.getQueueNodes = getQueueNodes;
-    exports2.getTopicNodes = getTopicNodes;
-    exports2.getSecretNodes = getSecretNodes;
-    exports2.getParameterNodes = getParameterNodes;
-    exports2.getLogGroupNodes = getLogGroupNodes;
-    exports2.getLambdaNodes = getLambdaNodes;
-    exports2.getEdgesForNode = getEdgesForNode;
-    exports2.getOutgoingEdges = getOutgoingEdges;
-    exports2.getIncomingEdges = getIncomingEdges;
-    exports2.getScanEdges = getScanEdges;
-    exports2.getEdgeFrequency = getEdgeFrequency;
-    function buildGraph2(operations, dynamoMeta, postgresMeta, mysqlMeta = [], mongoMeta = [], servicesMeta = {}) {
-      const nodes = [];
-      const edges = [];
-      const nodeIds = /* @__PURE__ */ new Set();
-      function addNode(node) {
-        if (!nodeIds.has(node.id)) {
-          nodes.push(node);
-          nodeIds.add(node.id);
-        }
-      }
-      for (const table of dynamoMeta) {
-        const nodeId = `table:dynamo:${table.tableName}`;
-        addNode({ id: nodeId, type: "table", name: table.tableName, databaseType: "dynamodb" });
-        for (const indexName of table.indexes) {
-          const indexNodeId = `index:${table.tableName}:${indexName}`;
-          addNode({ id: indexNodeId, type: "index", name: indexName });
-          edges.push({ from: nodeId, to: indexNodeId, type: "uses_index" });
-        }
-      }
-      for (const table of postgresMeta) {
-        const nodeId = `table:postgres:${table.schema}.${table.table}`;
-        addNode({ id: nodeId, type: "table", name: `${table.schema}.${table.table}`, databaseType: "postgres" });
-        for (const indexName of table.indexes) {
-          const indexNodeId = `index:${table.schema}.${table.table}:${indexName}`;
-          addNode({ id: indexNodeId, type: "index", name: indexName });
-          edges.push({ from: nodeId, to: indexNodeId, type: "uses_index" });
-        }
-      }
-      for (const table of mysqlMeta) {
-        const nodeId = `table:mysql:${table.schema}.${table.table}`;
-        addNode({ id: nodeId, type: "table", name: `${table.schema}.${table.table}`, databaseType: "mysql" });
-        for (const indexName of table.indexes) {
-          const indexNodeId = `index:${table.schema}.${table.table}:${indexName}`;
-          addNode({ id: indexNodeId, type: "index", name: indexName });
-          edges.push({ from: nodeId, to: indexNodeId, type: "uses_index" });
-        }
-      }
-      for (const coll of mongoMeta) {
-        const nodeId = `table:mongodb:${coll.database}.${coll.collection}`;
-        addNode({ id: nodeId, type: "table", name: `${coll.database}.${coll.collection}`, databaseType: "mongodb" });
-        for (const idx of coll.indexes) {
-          if (idx.name === "_id_")
-            continue;
-          const indexNodeId = `index:${coll.database}.${coll.collection}:${idx.name}`;
-          addNode({ id: indexNodeId, type: "index", name: idx.name });
-          edges.push({ from: nodeId, to: indexNodeId, type: "uses_index" });
-        }
-      }
-      for (const q of servicesMeta.sqs ?? []) {
-        addNode({
-          id: `queue:aws:${q.name}`,
-          type: "queue",
-          name: q.name,
-          provider: "aws",
-          hasDLQ: q.hasDLQ,
-          encrypted: q.encrypted,
-          approximateMessages: q.approximateMessages,
-          retentionDays: q.retentionDays
-        });
-      }
-      for (const t of servicesMeta.sns ?? []) {
-        addNode({
-          id: `topic:aws:${t.name}`,
-          type: "topic",
-          name: t.name,
-          provider: "aws",
-          subscriptionCount: t.subscriptionCount,
-          encrypted: t.encrypted
-        });
-      }
-      for (const s of servicesMeta.secrets ?? []) {
-        addNode({
-          id: `secret:aws:${s.name}`,
-          type: "secret",
-          name: s.name,
-          provider: "aws",
-          rotationEnabled: s.rotationEnabled,
-          rotationDays: s.rotationDays
-        });
-      }
-      for (const p of servicesMeta.ssm ?? []) {
-        addNode({
-          id: `parameter:aws:${p.name}`,
-          type: "parameter",
-          name: p.name,
-          provider: "aws",
-          paramType: p.type,
-          tier: p.tier
-        });
-      }
-      for (const lg of servicesMeta.logs ?? []) {
-        addNode({
-          id: `log_group:aws:${lg.logGroupName}`,
-          type: "log_group",
-          name: lg.logGroupName,
-          provider: "aws",
-          retentionDays: lg.retentionDays,
-          errorCount: lg.errorCount,
-          topErrorPatterns: lg.topErrorPatterns
-        });
-      }
-      for (const fn of servicesMeta.lambda ?? []) {
-        addNode({
-          id: `lambda:aws:${fn.name}`,
-          type: "lambda",
-          name: fn.name,
-          runtime: fn.runtime,
-          memoryMB: fn.memoryMB,
-          timeoutSec: fn.timeoutSec,
-          envVarKeys: fn.envVarKeys
-        });
-      }
-      for (const op of operations) {
-        const funcNodeId = `function:${op.filePath}:${op.functionName}`;
-        if (!nodeIds.has(funcNodeId)) {
-          nodes.push({ id: funcNodeId, type: "function", name: op.functionName, file: op.filePath });
-          nodeIds.add(funcNodeId);
-        }
-        if (op.databaseType === "sqs") {
-          const queueId = `queue:aws:${op.target}`;
-          if (!nodeIds.has(queueId)) {
-            addNode({ id: queueId, type: "queue", name: op.target, provider: "aws", hasDLQ: false, encrypted: false });
-          }
-          edges.push({ from: funcNodeId, to: queueId, type: "publishes_to" });
-          continue;
-        }
-        if (op.databaseType === "sns") {
-          const topicId = `topic:aws:${op.target}`;
-          if (!nodeIds.has(topicId)) {
-            addNode({ id: topicId, type: "topic", name: op.target, provider: "aws", encrypted: false });
-          }
-          edges.push({ from: funcNodeId, to: topicId, type: "publishes_to" });
-          continue;
-        }
-        if (op.databaseType === "ssm") {
-          const paramId = `parameter:aws:${op.target}`;
-          if (!nodeIds.has(paramId)) {
-            addNode({ id: paramId, type: "parameter", name: op.target, provider: "aws", paramType: "String", tier: "Standard" });
-          }
-          edges.push({ from: funcNodeId, to: paramId, type: "reads_parameter" });
-          continue;
-        }
-        if (op.databaseType === "secretsmanager") {
-          const secretId = `secret:aws:${op.target}`;
-          if (!nodeIds.has(secretId)) {
-            addNode({ id: secretId, type: "secret", name: op.target, provider: "aws", rotationEnabled: false });
-          }
-          edges.push({ from: funcNodeId, to: secretId, type: "reads_secret" });
-          continue;
-        }
-        if (op.databaseType === "lambda") {
-          const lambdaId = `lambda:aws:${op.target}`;
-          if (!nodeIds.has(lambdaId)) {
-            addNode({ id: lambdaId, type: "lambda", name: op.target });
-          }
-          edges.push({ from: funcNodeId, to: lambdaId, type: "triggers" });
-          continue;
-        }
-        let tableNodeId;
-        if (op.databaseType === "dynamodb") {
-          tableNodeId = `table:dynamo:${op.target}`;
-          if (!nodeIds.has(tableNodeId)) {
-            addNode({ id: tableNodeId, type: "table", name: op.target, databaseType: "dynamodb" });
-          }
-        } else if (op.databaseType === "mysql") {
-          const q = op.target.includes(".") ? op.target : `default.${op.target}`;
-          tableNodeId = `table:mysql:${q}`;
-          if (!nodeIds.has(tableNodeId)) {
-            addNode({ id: tableNodeId, type: "table", name: q, databaseType: "mysql" });
-          }
-        } else if (op.databaseType === "mongodb") {
-          const q = op.target.includes(".") ? op.target : `default.${op.target}`;
-          tableNodeId = `table:mongodb:${q}`;
-          if (!nodeIds.has(tableNodeId)) {
-            addNode({ id: tableNodeId, type: "table", name: q, databaseType: "mongodb" });
-          }
-        } else {
-          const q = op.target.includes(".") ? op.target : `public.${op.target}`;
-          tableNodeId = `table:postgres:${q}`;
-          if (!nodeIds.has(tableNodeId)) {
-            const parts = q.split(".");
-            addNode({ id: tableNodeId, type: "table", name: q, databaseType: "postgres" });
-            if (!postgresMeta.find((t) => `${t.schema}.${t.table}` === q)) {
-              postgresMeta.push({
-                schema: parts[0] ?? "public",
-                table: parts[1] ?? op.target,
-                columns: [],
-                indexes: [],
-                primaryKeys: []
-              });
-            }
-          }
-        }
-        const edgeType = resolveEdgeType(op.operationType);
-        edges.push({ from: funcNodeId, to: tableNodeId, type: edgeType });
-      }
-      return { nodes, edges };
-    }
-    function resolveEdgeType(operationType) {
-      const op = operationType.toLowerCase();
-      if (op === "scan" || op === "scancommand")
-        return "scan";
-      if (op === "join" || op === "joins")
-        return "joins";
-      return "query";
-    }
-    function getTableNodes(graph) {
-      return graph.nodes.filter((n) => n.type === "table");
-    }
-    function getFunctionNodes(graph) {
-      return graph.nodes.filter((n) => n.type === "function");
-    }
-    function getIndexNodes(graph) {
-      return graph.nodes.filter((n) => n.type === "index");
-    }
-    function getQueueNodes(graph) {
-      return graph.nodes.filter((n) => n.type === "queue");
-    }
-    function getTopicNodes(graph) {
-      return graph.nodes.filter((n) => n.type === "topic");
-    }
-    function getSecretNodes(graph) {
-      return graph.nodes.filter((n) => n.type === "secret");
-    }
-    function getParameterNodes(graph) {
-      return graph.nodes.filter((n) => n.type === "parameter");
-    }
-    function getLogGroupNodes(graph) {
-      return graph.nodes.filter((n) => n.type === "log_group");
-    }
-    function getLambdaNodes(graph) {
-      return graph.nodes.filter((n) => n.type === "lambda");
-    }
-    function getEdgesForNode(graph, nodeId) {
-      return graph.edges.filter((e) => e.from === nodeId || e.to === nodeId);
-    }
-    function getOutgoingEdges(graph, nodeId) {
-      return graph.edges.filter((e) => e.from === nodeId);
-    }
-    function getIncomingEdges(graph, nodeId) {
-      return graph.edges.filter((e) => e.to === nodeId);
-    }
-    function getScanEdges(graph) {
-      return graph.edges.filter((e) => e.type === "scan");
-    }
-    function getEdgeFrequency(graph) {
-      const freq = /* @__PURE__ */ new Map();
-      for (const edge of graph.edges) {
-        const key = `${edge.from}->${edge.to}`;
-        freq.set(key, (freq.get(key) ?? 0) + 1);
-      }
-      return freq;
-    }
-  }
-});
-
-// ../analyzers/dist/dynamodb.js
-var require_dynamodb = __commonJS({
-  "../analyzers/dist/dynamodb.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.HotPartitionAnalyzer = exports2.MissingGSIAnalyzer = exports2.FullTableScanAnalyzer = void 0;
-    var graph_1 = require_dist10();
-    var FullTableScanAnalyzer = class {
-      name = "FullTableScanAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        const scanEdges = (0, graph_1.getScanEdges)(graph);
-        const scannedTableIds = /* @__PURE__ */ new Set();
-        for (const edge of scanEdges) {
-          const targetNode = graph.nodes.find((n) => n.id === edge.to);
-          if (targetNode?.type === "table" && targetNode.databaseType === "dynamodb") {
-            scannedTableIds.add(targetNode.id);
-          }
-        }
-        for (const tableId of scannedTableIds) {
-          const tableNode = graph.nodes.find((n) => n.id === tableId);
-          if (!tableNode)
-            continue;
-          const tableScanEdges = scanEdges.filter((e) => e.to === tableId);
-          const callerFunctions = tableScanEdges.map((e) => {
-            const node = graph.nodes.find((n) => n.id === e.from);
-            return node?.type === "function" ? node.name : e.from;
-          }).join(", ");
-          findings.push({
-            severity: "high",
-            issue: `Full table scan detected on DynamoDB table "${tableNode.name}"`,
-            description: `The table "${tableNode.name}" is being scanned without any filter, which reads every item. This is expensive and slow for large tables. Called from: ${callerFunctions || "unknown"}`,
-            recommendation: "Replace Scan with a Query operation using a partition key or GSI. If filtering is required on non-key attributes, add a Global Secondary Index (GSI).",
-            metadata: {
-              tableName: tableNode.name,
-              scanCount: tableScanEdges.length,
-              callerFunctions
-            }
-          });
-        }
-        return findings;
-      }
-    };
-    exports2.FullTableScanAnalyzer = FullTableScanAnalyzer;
-    var MissingGSIAnalyzer = class {
-      name = "MissingGSIAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        const dynamoTables = graph.nodes.filter((n) => n.type === "table" && n.databaseType === "dynamodb");
-        for (const table of dynamoTables) {
-          const incomingEdges = graph.edges.filter((e) => e.to === table.id);
-          const queryEdges = incomingEdges.filter((e) => e.type === "query");
-          const hasGSI = graph.edges.some((e) => e.from === table.id && e.type === "uses_index");
-          if (queryEdges.length > 0 && !hasGSI) {
-            const callerFunctions = queryEdges.map((e) => {
-              const node = graph.nodes.find((n) => n.id === e.from);
-              return node?.type === "function" ? node.name : e.from;
-            }).join(", ");
-            findings.push({
-              severity: "medium",
-              issue: `DynamoDB table "${table.name}" has no GSIs but is queried by multiple functions`,
-              description: `Table "${table.name}" is accessed by ${queryEdges.length} function(s) (${callerFunctions}) but has no Global Secondary Indexes defined. If queries filter on non-partition-key attributes, this will degrade to full scans.`,
-              recommendation: "Analyze query access patterns and add GSIs for frequently filtered attributes. Consider using single-table design patterns with composite sort keys.",
-              metadata: {
-                tableName: table.name,
-                queryCount: queryEdges.length,
-                callerFunctions
-              }
-            });
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.MissingGSIAnalyzer = MissingGSIAnalyzer;
-    var HotPartitionAnalyzer = class {
-      name = "HotPartitionAnalyzer";
-      hotThreshold;
-      constructor(hotThreshold = 5) {
-        this.hotThreshold = hotThreshold;
-      }
-      async analyze(graph) {
-        const findings = [];
-        const edgeFrequency = (0, graph_1.getEdgeFrequency)(graph);
-        const tableAccessCount = /* @__PURE__ */ new Map();
-        for (const edge of graph.edges) {
-          const targetNode = graph.nodes.find((n) => n.id === edge.to);
-          if (targetNode?.type !== "table" || targetNode.databaseType !== "dynamodb")
-            continue;
-          if (!tableAccessCount.has(edge.to)) {
-            tableAccessCount.set(edge.to, /* @__PURE__ */ new Set());
-          }
-          tableAccessCount.get(edge.to).add(edge.from);
-        }
-        for (const [tableId, accessors] of tableAccessCount) {
-          if (accessors.size >= this.hotThreshold) {
-            const tableNode = graph.nodes.find((n) => n.id === tableId);
-            if (!tableNode)
-              continue;
-            let maxFreq = 0;
-            for (const [key, freq] of edgeFrequency) {
-              if (key.includes(tableId))
-                maxFreq = Math.max(maxFreq, freq);
-            }
-            findings.push({
-              severity: "medium",
-              issue: `Potential hot partition detected on DynamoDB table "${tableNode.name}"`,
-              description: `Table "${tableNode.name}" is accessed by ${accessors.size} distinct code paths, which may create hot partition issues at scale. High access concentration on the same partition key can throttle requests.`,
-              recommendation: "Consider adding a random suffix or timestamp to partition keys (write sharding). Use DynamoDB DAX for read-heavy workloads. Distribute access patterns across multiple partition key values.",
-              metadata: {
-                tableName: tableNode.name,
-                accessorCount: accessors.size,
-                maxEdgeFrequency: maxFreq
-              }
-            });
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.HotPartitionAnalyzer = HotPartitionAnalyzer;
-  }
-});
-
-// ../analyzers/dist/postgres.js
-var require_postgres = __commonJS({
-  "../analyzers/dist/postgres.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.LargeSelectAnalyzer = exports2.NplusOneAnalyzer = exports2.MissingIndexAnalyzer = void 0;
-    var MissingIndexAnalyzer = class {
-      name = "MissingIndexAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        const postgresTables = graph.nodes.filter((n) => n.type === "table" && n.databaseType === "postgres");
-        for (const table of postgresTables) {
-          const indexEdges = graph.edges.filter((e) => e.from === table.id && e.type === "uses_index");
-          const hasIndexes = indexEdges.length > 0;
-          const queryEdges = graph.edges.filter((e) => e.to === table.id && (e.type === "query" || e.type === "scan"));
-          if (queryEdges.length > 0 && !hasIndexes) {
-            const callerFunctions = queryEdges.map((e) => {
-              const node = graph.nodes.find((n) => n.id === e.from);
-              return node?.type === "function" ? node.name : e.from;
-            }).join(", ");
-            findings.push({
-              severity: "medium",
-              issue: `PostgreSQL table "${table.name}" has no indexes but is queried by ${queryEdges.length} function(s)`,
-              description: `Table "${table.name}" is accessed by functions (${callerFunctions}) but has no secondary indexes defined. Queries on non-primary-key columns will result in sequential scans.`,
-              recommendation: "Add indexes on columns used in WHERE clauses. Use EXPLAIN ANALYZE to identify slow queries. Consider composite indexes for multi-column filters.",
-              metadata: {
-                tableName: table.name,
-                queryCount: queryEdges.length,
-                callerFunctions
-              }
-            });
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.MissingIndexAnalyzer = MissingIndexAnalyzer;
-    var NplusOneAnalyzer = class {
-      name = "NplusOneAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        const functionTableAccess = /* @__PURE__ */ new Map();
-        for (const edge of graph.edges) {
-          if (edge.type !== "query")
-            continue;
-          const fromNode = graph.nodes.find((n) => n.id === edge.from);
-          const toNode = graph.nodes.find((n) => n.id === edge.to);
-          if (fromNode?.type !== "function" || toNode?.type !== "table")
-            continue;
-          if (toNode.databaseType !== "postgres")
-            continue;
-          if (!functionTableAccess.has(edge.from)) {
-            functionTableAccess.set(edge.from, /* @__PURE__ */ new Map());
-          }
-          const tableAccess = functionTableAccess.get(edge.from);
-          tableAccess.set(edge.to, (tableAccess.get(edge.to) ?? 0) + 1);
-        }
-        for (const [funcId, tableAccess] of functionTableAccess) {
-          for (const [tableId, count] of tableAccess) {
-            if (count >= 2) {
-              const funcNode = graph.nodes.find((n) => n.id === funcId);
-              const tableNode = graph.nodes.find((n) => n.id === tableId);
-              if (!funcNode || !tableNode)
-                continue;
-              findings.push({
-                severity: "high",
-                issue: `Potential N+1 query pattern in function "${funcNode.name}"`,
-                description: `Function "${funcNode.name}" in ${funcNode.file} appears to query table "${tableNode.name}" ${count} time(s), suggesting a potential N+1 query pattern. This can lead to exponential database load when called in a loop.`,
-                recommendation: "Batch multiple queries into a single query using IN clauses, JOIN operations, or DataLoader patterns. Consider using a bulk-fetch approach and filtering in application code.",
-                metadata: {
-                  functionName: funcNode.name,
-                  filePath: funcNode.file,
-                  tableName: tableNode.name,
-                  queryCount: count
-                }
-              });
-            }
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.NplusOneAnalyzer = NplusOneAnalyzer;
-    var LargeSelectAnalyzer = class {
-      name = "LargeSelectAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        const queryNodes = graph.nodes.filter((n) => n.type === "query");
-        for (const queryNode of queryNodes) {
-          if (queryNode.operation.toLowerCase().includes("select *") || queryNode.operation.toLowerCase().includes("select_all")) {
-            findings.push({
-              severity: "low",
-              issue: `SELECT * usage detected in query "${queryNode.operation}"`,
-              description: "Using SELECT * reads all columns from the table, which can be expensive for wide tables. It also prevents index-only scans and increases network transfer.",
-              recommendation: "Specify only the columns you need. For frequently accessed subsets of columns, consider creating a covering index that includes those columns.",
-              metadata: {
-                operation: queryNode.operation
-              }
-            });
-          }
-        }
-        const postgresTables = graph.nodes.filter((n) => n.type === "table" && n.databaseType === "postgres");
-        for (const table of postgresTables) {
-          const scanEdges = graph.edges.filter((e) => e.to === table.id && e.type === "scan");
-          if (scanEdges.length > 0) {
-            const callerFunctions = scanEdges.map((e) => {
-              const node = graph.nodes.find((n) => n.id === e.from);
-              return node?.type === "function" ? node.name : e.from;
-            }).filter((v, i, arr) => arr.indexOf(v) === i).join(", ");
-            findings.push({
-              severity: "medium",
-              issue: `Sequential scan detected on PostgreSQL table "${table.name}"`,
-              description: `Table "${table.name}" is accessed via sequential scan by ${scanEdges.length} operation(s) from: ${callerFunctions}. Sequential scans read the entire table and are very slow on large tables.`,
-              recommendation: "Add appropriate indexes to support the WHERE conditions in these queries. Run EXPLAIN ANALYZE to understand the query plan. Consider partial indexes for filtered queries.",
-              metadata: {
-                tableName: table.name,
-                scanCount: scanEdges.length,
-                callerFunctions
-              }
-            });
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.LargeSelectAnalyzer = LargeSelectAnalyzer;
-  }
-});
-
-// ../analyzers/dist/mysql.js
-var require_mysql = __commonJS({
-  "../analyzers/dist/mysql.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.MySQLFullTableScanAnalyzer = exports2.MissingMySQLIndexAnalyzer = void 0;
-    var graph_1 = require_dist10();
-    var MissingMySQLIndexAnalyzer = class {
-      name = "MissingMySQLIndexAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        const mysqlTables = graph.nodes.filter((n) => n.type === "table" && n.databaseType === "mysql");
-        for (const table of mysqlTables) {
-          const indexEdges = graph.edges.filter((e) => e.from === table.id && e.type === "uses_index");
-          const hasIndexes = indexEdges.length > 0;
-          const queryEdges = graph.edges.filter((e) => e.to === table.id && (e.type === "query" || e.type === "scan"));
-          if (queryEdges.length > 0 && !hasIndexes) {
-            const callerFunctions = queryEdges.map((e) => {
-              const node = graph.nodes.find((n) => n.id === e.from);
-              return node?.type === "function" ? node.name : e.from;
-            }).join(", ");
-            findings.push({
-              severity: "medium",
-              issue: `MySQL table "${table.name}" has no indexes but is queried by ${queryEdges.length} function(s)`,
-              description: `Table "${table.name}" is accessed by functions (${callerFunctions}) but has no secondary indexes defined. Queries on non-primary-key columns will result in full table scans.`,
-              recommendation: "Add indexes on columns used in WHERE clauses. Run EXPLAIN on slow queries. Consider composite indexes for multi-column filters.",
-              metadata: {
-                tableName: table.name,
-                queryCount: queryEdges.length,
-                callerFunctions
-              }
-            });
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.MissingMySQLIndexAnalyzer = MissingMySQLIndexAnalyzer;
-    var MySQLFullTableScanAnalyzer = class {
-      name = "MySQLFullTableScanAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        const scanEdges = (0, graph_1.getScanEdges)(graph);
-        const scannedTableIds = /* @__PURE__ */ new Set();
-        for (const edge of scanEdges) {
-          const targetNode = graph.nodes.find((n) => n.id === edge.to);
-          if (targetNode?.type === "table" && targetNode.databaseType === "mysql") {
-            scannedTableIds.add(targetNode.id);
-          }
-        }
-        for (const tableId of scannedTableIds) {
-          const tableNode = graph.nodes.find((n) => n.id === tableId);
-          if (!tableNode)
-            continue;
-          const tableScanEdges = scanEdges.filter((e) => e.to === tableId);
-          const callerFunctions = tableScanEdges.map((e) => {
-            const node = graph.nodes.find((n) => n.id === e.from);
-            return node?.type === "function" ? node.name : e.from;
-          }).join(", ");
-          findings.push({
-            severity: "high",
-            issue: `Full table scan detected on MySQL table "${tableNode.name}"`,
-            description: `The table "${tableNode.name}" is being scanned without a usable index, reading every row. This is expensive for large tables. Called from: ${callerFunctions || "unknown"}`,
-            recommendation: "Add an index on the column(s) used in the WHERE clause. Use EXPLAIN to verify the query plan uses the index after adding it.",
-            metadata: {
-              tableName: tableNode.name,
-              scanCount: tableScanEdges.length,
-              callerFunctions
-            }
-          });
-        }
-        return findings;
-      }
-    };
-    exports2.MySQLFullTableScanAnalyzer = MySQLFullTableScanAnalyzer;
-  }
-});
-
-// ../analyzers/dist/mongodb.js
-var require_mongodb = __commonJS({
-  "../analyzers/dist/mongodb.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.MongoCollectionScanAnalyzer = exports2.MissingMongoIndexAnalyzer = void 0;
-    var graph_1 = require_dist10();
-    var MissingMongoIndexAnalyzer = class {
-      name = "MissingMongoIndexAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        const mongoCollections = graph.nodes.filter((n) => n.type === "table" && n.databaseType === "mongodb");
-        for (const coll of mongoCollections) {
-          const indexEdges = graph.edges.filter((e) => e.from === coll.id && e.type === "uses_index");
-          const hasIndexes = indexEdges.length > 0;
-          const queryEdges = graph.edges.filter((e) => e.to === coll.id && (e.type === "query" || e.type === "scan"));
-          if (queryEdges.length > 0 && !hasIndexes) {
-            const callerFunctions = queryEdges.map((e) => {
-              const node = graph.nodes.find((n) => n.id === e.from);
-              return node?.type === "function" ? node.name : e.from;
-            }).join(", ");
-            findings.push({
-              severity: "medium",
-              issue: `MongoDB collection "${coll.name}" has no indexes but is queried by ${queryEdges.length} function(s)`,
-              description: `Collection "${coll.name}" is accessed by functions (${callerFunctions}) but has no secondary indexes defined. Queries on non-_id fields will result in full collection scans.`,
-              recommendation: 'Add indexes using db.collection.createIndex({ field: 1 }) for frequently queried fields. Use explain("executionStats") to verify query plan.',
-              metadata: {
-                collectionName: coll.name,
-                queryCount: queryEdges.length,
-                callerFunctions
-              }
-            });
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.MissingMongoIndexAnalyzer = MissingMongoIndexAnalyzer;
-    var MongoCollectionScanAnalyzer = class {
-      name = "MongoCollectionScanAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        const scanEdges = (0, graph_1.getScanEdges)(graph);
-        const scannedCollIds = /* @__PURE__ */ new Set();
-        for (const edge of scanEdges) {
-          const targetNode = graph.nodes.find((n) => n.id === edge.to);
-          if (targetNode?.type === "table" && targetNode.databaseType === "mongodb") {
-            scannedCollIds.add(targetNode.id);
-          }
-        }
-        for (const collId of scannedCollIds) {
-          const collNode = graph.nodes.find((n) => n.id === collId);
-          if (!collNode)
-            continue;
-          const collScanEdges = scanEdges.filter((e) => e.to === collId);
-          const callerFunctions = collScanEdges.map((e) => {
-            const node = graph.nodes.find((n) => n.id === e.from);
-            return node?.type === "function" ? node.name : e.from;
-          }).join(", ");
-          findings.push({
-            severity: "high",
-            issue: `Collection scan detected on MongoDB collection "${collNode.name}"`,
-            description: `Collection "${collNode.name}" is being scanned without an index, reading every document. This is very expensive for large collections. Called from: ${callerFunctions || "unknown"}`,
-            recommendation: 'Add an index on the field(s) used as query predicates. Use db.collection.createIndex({ field: 1 }) and verify with explain("executionStats").',
-            metadata: {
-              collectionName: collNode.name,
-              scanCount: collScanEdges.length,
-              callerFunctions
-            }
-          });
-        }
-        return findings;
-      }
-    };
-    exports2.MongoCollectionScanAnalyzer = MongoCollectionScanAnalyzer;
-  }
-});
-
-// ../analyzers/dist/terraform.js
-var require_terraform = __commonJS({
-  "../analyzers/dist/terraform.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.IaCDriftAnalyzer = void 0;
-    var IaCDriftAnalyzer2 = class {
-      name = "IaCDriftAnalyzer";
-      iacSchema = null;
-      setIaCSchema(schema) {
-        this.iacSchema = schema;
-      }
-      async analyze(graph) {
-        const findings = [];
-        if (!this.iacSchema)
-          return findings;
-        const iac = this.iacSchema;
-        const deployedDynamo = new Set(graph.nodes.filter((n) => n.type === "table" && n.databaseType === "dynamodb").map((n) => n.name));
-        const iacDynamo = new Map(iac.dynamoTables.map((t) => [t.name, t.filePath]));
-        for (const [name, fp] of iacDynamo) {
-          if (!deployedDynamo.has(name)) {
-            findings.push({
-              severity: "medium",
-              issue: `IaC drift: DynamoDB table "${name}" defined in IaC but not deployed`,
-              description: `"${name}" is in ${fp} but not found in AWS. It may be undeployed or deleted manually.`,
-              recommendation: "Run `terraform apply` / deploy your stack, or remove the definition from IaC.",
-              metadata: { resourceType: "dynamodb_table", name, filePath: fp, driftType: "defined_not_deployed" }
-            });
-          }
-        }
-        for (const name of deployedDynamo) {
-          if (!iacDynamo.has(name)) {
-            findings.push({
-              severity: "medium",
-              issue: `IaC drift: DynamoDB table "${name}" deployed but not in IaC`,
-              description: `"${name}" exists in AWS DynamoDB but has no IaC definition. It may have been created manually.`,
-              recommendation: "Import the table with `terraform import` or add a CloudFormation resource, then track all future changes through IaC.",
-              metadata: { resourceType: "dynamodb_table", name, driftType: "deployed_not_defined" }
-            });
-          }
-        }
-        const deployedQueues = new Set(graph.nodes.filter((n) => n.type === "queue").map((n) => n.name));
-        const iacQueues = new Map(iac.queues.map((q) => [q.name, q.filePath]));
-        for (const [name, fp] of iacQueues) {
-          if (!deployedQueues.has(name)) {
-            findings.push({
-              severity: "medium",
-              issue: `IaC drift: SQS queue "${name}" defined in IaC but not deployed`,
-              description: `SQS queue "${name}" is defined in ${fp} but not found in the live account.`,
-              recommendation: "Deploy the queue via `terraform apply` or your CFN/CDK stack.",
-              metadata: { resourceType: "sqs_queue", name, filePath: fp, driftType: "defined_not_deployed" }
-            });
-          }
-        }
-        for (const name of deployedQueues) {
-          if (!iacQueues.has(name)) {
-            findings.push({
-              severity: "low",
-              issue: `IaC drift: SQS queue "${name}" deployed but not in IaC`,
-              description: `SQS queue "${name}" exists in AWS but is not tracked in IaC. Manual resources can't be audited or reproduced reliably.`,
-              recommendation: "Import or define the queue in IaC to bring it under version control.",
-              metadata: { resourceType: "sqs_queue", name, driftType: "deployed_not_defined" }
-            });
-          }
-        }
-        const deployedLambdas = new Set(graph.nodes.filter((n) => n.type === "lambda").map((n) => n.name));
-        const iacLambdas = new Map(iac.lambdas.map((l) => [l.name, l.filePath]));
-        for (const [name, fp] of iacLambdas) {
-          if (!deployedLambdas.has(name)) {
-            findings.push({
-              severity: "medium",
-              issue: `IaC drift: Lambda "${name}" defined in IaC but not deployed`,
-              description: `Lambda function "${name}" is defined in ${fp} but not found in the live account.`,
-              recommendation: "Deploy the function via `terraform apply` or your CFN/CDK stack.",
-              metadata: { resourceType: "lambda_function", name, filePath: fp, driftType: "defined_not_deployed" }
-            });
-          }
-        }
-        for (const name of deployedLambdas) {
-          if (!iacLambdas.has(name)) {
-            findings.push({
-              severity: "low",
-              issue: `IaC drift: Lambda "${name}" deployed but not in IaC`,
-              description: `Lambda "${name}" exists in AWS but is not tracked in IaC.`,
-              recommendation: "Import the function into IaC or add it as a resource.",
-              metadata: { resourceType: "lambda_function", name, driftType: "deployed_not_defined" }
-            });
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.IaCDriftAnalyzer = IaCDriftAnalyzer2;
-  }
-});
-
-// ../analyzers/dist/aws-services.js
-var require_aws_services = __commonJS({
-  "../analyzers/dist/aws-services.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.LambdaHighTimeoutAnalyzer = exports2.LambdaDefaultMemoryAnalyzer = exports2.MissingLogRetentionAnalyzer = exports2.MissingSecretRotationAnalyzer = exports2.LargeQueueBacklogAnalyzer = exports2.UnencryptedQueueAnalyzer = exports2.MissingDLQAnalyzer = void 0;
-    var MissingDLQAnalyzer = class {
-      name = "MissingDLQAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        for (const node of graph.nodes) {
-          if (node.type !== "queue")
-            continue;
-          if (!node.hasDLQ) {
-            findings.push({
-              severity: "high",
-              issue: `Queue "${node.name}" has no Dead Letter Queue`,
-              description: `SQS queue "${node.name}" has no DLQ configured. Failed messages will be discarded after maxReceiveCount retries, causing silent data loss.`,
-              recommendation: `Add a Dead Letter Queue to "${node.name}". Set maxReceiveCount to 3\u20135 retries before routing to DLQ. Alert on DLQ depth.`,
-              metadata: { queueName: node.name, provider: node.provider }
-            });
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.MissingDLQAnalyzer = MissingDLQAnalyzer;
-    var UnencryptedQueueAnalyzer = class {
-      name = "UnencryptedQueueAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        for (const node of graph.nodes) {
-          if (node.type !== "queue")
-            continue;
-          if (!node.encrypted) {
-            findings.push({
-              severity: "low",
-              issue: `Queue "${node.name}" is not encrypted`,
-              description: `SQS queue "${node.name}" does not have server-side encryption enabled. Messages at rest are unencrypted.`,
-              recommendation: `Enable SQS-managed SSE (SqsManagedSseEnabled=true) or bring your own KMS key for "${node.name}".`,
-              metadata: { queueName: node.name }
-            });
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.UnencryptedQueueAnalyzer = UnencryptedQueueAnalyzer;
-    var LargeQueueBacklogAnalyzer = class {
-      name = "LargeQueueBacklogAnalyzer";
-      threshold;
-      constructor(threshold = 1e3) {
-        this.threshold = threshold;
-      }
-      async analyze(graph) {
-        const findings = [];
-        for (const node of graph.nodes) {
-          if (node.type !== "queue")
-            continue;
-          const count = node.approximateMessages ?? 0;
-          if (count > this.threshold) {
-            findings.push({
-              severity: "medium",
-              issue: `Queue "${node.name}" has a large backlog (${count.toLocaleString()} messages)`,
-              description: `The approximate message count for "${node.name}" is ${count.toLocaleString()}, indicating consumers may be falling behind or stuck.`,
-              recommendation: `Check consumer health and scaling for "${node.name}". Consider auto-scaling consumers on queue depth. If messages are stale, investigate consumer errors in CloudWatch.`,
-              metadata: { queueName: node.name, messageCount: count }
-            });
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.LargeQueueBacklogAnalyzer = LargeQueueBacklogAnalyzer;
-    var MissingSecretRotationAnalyzer = class {
-      name = "MissingSecretRotationAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        for (const node of graph.nodes) {
-          if (node.type !== "secret")
-            continue;
-          if (!node.rotationEnabled) {
-            findings.push({
-              severity: "medium",
-              issue: `Secret "${node.name}" has no automatic rotation`,
-              description: `Secrets Manager secret "${node.name}" does not have automatic rotation enabled. Long-lived credentials increase the blast radius of a compromise.`,
-              recommendation: `Enable automatic rotation for "${node.name}" using a Lambda rotation function. AWS provides pre-built rotators for RDS, Redshift, and custom secrets.`,
-              metadata: { secretName: node.name, provider: node.provider }
-            });
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.MissingSecretRotationAnalyzer = MissingSecretRotationAnalyzer;
-    var MissingLogRetentionAnalyzer = class {
-      name = "MissingLogRetentionAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        for (const node of graph.nodes) {
-          if (node.type !== "log_group")
-            continue;
-          if (node.retentionDays === void 0) {
-            findings.push({
-              severity: "medium",
-              issue: `Log group "${node.name}" has no retention policy`,
-              description: `CloudWatch Log group "${node.name}" retains logs indefinitely. This increases storage costs and can expose sensitive data longer than necessary.`,
-              recommendation: `Set a retention policy on "${node.name}". 90 days is a common baseline; adjust based on compliance requirements (e.g., 365 days for SOC2/PCI).`,
-              metadata: { logGroupName: node.name }
-            });
-          } else if (node.retentionDays > 365) {
-            findings.push({
-              severity: "low",
-              issue: `Log group "${node.name}" retains logs for ${node.retentionDays} days`,
-              description: `Log group "${node.name}" has a ${node.retentionDays}-day retention period. Unless required by compliance, this may be longer than needed.`,
-              recommendation: `Review whether ${node.retentionDays} days of retention is required for "${node.name}". Consider archiving older logs to S3 Glacier for cost savings.`,
-              metadata: { logGroupName: node.name, retentionDays: node.retentionDays }
-            });
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.MissingLogRetentionAnalyzer = MissingLogRetentionAnalyzer;
-    var LambdaDefaultMemoryAnalyzer = class {
-      name = "LambdaDefaultMemoryAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        for (const node of graph.nodes) {
-          if (node.type !== "lambda")
-            continue;
-          if (node.memoryMB === 128) {
-            findings.push({
-              severity: "low",
-              issue: `Lambda "${node.name}" uses the default 128 MB memory`,
-              description: `"${node.name}" uses the default 128 MB. Undersized memory causes throttled CPU and higher durations. AWS Lambda pricing is duration \xD7 memory, so more memory often lowers cost by reducing duration.`,
-              recommendation: `Run Lambda Power Tuning on "${node.name}" to find the optimal memory/cost balance. Most workloads perform better at 512 MB\u20131 GB.`,
-              metadata: { functionName: node.name, memoryMB: node.memoryMB }
-            });
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.LambdaDefaultMemoryAnalyzer = LambdaDefaultMemoryAnalyzer;
-    var LambdaHighTimeoutAnalyzer = class {
-      name = "LambdaHighTimeoutAnalyzer";
-      async analyze(graph) {
-        const findings = [];
-        for (const node of graph.nodes) {
-          if (node.type !== "lambda")
-            continue;
-          if ((node.timeoutSec ?? 0) >= 300) {
-            findings.push({
-              severity: "low",
-              issue: `Lambda "${node.name}" has a very high timeout (${node.timeoutSec}s)`,
-              description: `"${node.name}" has a ${node.timeoutSec}-second timeout. High timeouts mask latency issues and increase worst-case cost when functions hang.`,
-              recommendation: `Review whether "${node.name}" truly needs ${node.timeoutSec}s. Add internal circuit-breakers or streaming patterns to avoid reaching the timeout. Set alarms on p99 duration.`,
-              metadata: { functionName: node.name, timeoutSec: node.timeoutSec }
-            });
-          }
-        }
-        return findings;
-      }
-    };
-    exports2.LambdaHighTimeoutAnalyzer = LambdaHighTimeoutAnalyzer;
-  }
-});
-
-// ../analyzers/dist/index.js
-var require_dist11 = __commonJS({
-  "../analyzers/dist/index.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.LambdaHighTimeoutAnalyzer = exports2.LambdaDefaultMemoryAnalyzer = exports2.MissingLogRetentionAnalyzer = exports2.MissingSecretRotationAnalyzer = exports2.LargeQueueBacklogAnalyzer = exports2.UnencryptedQueueAnalyzer = exports2.MissingDLQAnalyzer = exports2.IaCDriftAnalyzer = exports2.MongoCollectionScanAnalyzer = exports2.MissingMongoIndexAnalyzer = exports2.MySQLFullTableScanAnalyzer = exports2.MissingMySQLIndexAnalyzer = exports2.LargeSelectAnalyzer = exports2.NplusOneAnalyzer = exports2.MissingIndexAnalyzer = exports2.HotPartitionAnalyzer = exports2.MissingGSIAnalyzer = exports2.FullTableScanAnalyzer = void 0;
-    exports2.runAllAnalyzers = runAllAnalyzers2;
-    exports2.summarizeFindings = summarizeFindings;
-    var core_1 = require_dist();
-    var dynamodb_1 = require_dynamodb();
-    var postgres_1 = require_postgres();
-    var mysql_1 = require_mysql();
-    var mongodb_1 = require_mongodb();
-    var terraform_1 = require_terraform();
-    var aws_services_1 = require_aws_services();
-    var dynamodb_2 = require_dynamodb();
-    Object.defineProperty(exports2, "FullTableScanAnalyzer", { enumerable: true, get: function() {
-      return dynamodb_2.FullTableScanAnalyzer;
-    } });
-    Object.defineProperty(exports2, "MissingGSIAnalyzer", { enumerable: true, get: function() {
-      return dynamodb_2.MissingGSIAnalyzer;
-    } });
-    Object.defineProperty(exports2, "HotPartitionAnalyzer", { enumerable: true, get: function() {
-      return dynamodb_2.HotPartitionAnalyzer;
-    } });
-    var postgres_2 = require_postgres();
-    Object.defineProperty(exports2, "MissingIndexAnalyzer", { enumerable: true, get: function() {
-      return postgres_2.MissingIndexAnalyzer;
-    } });
-    Object.defineProperty(exports2, "NplusOneAnalyzer", { enumerable: true, get: function() {
-      return postgres_2.NplusOneAnalyzer;
-    } });
-    Object.defineProperty(exports2, "LargeSelectAnalyzer", { enumerable: true, get: function() {
-      return postgres_2.LargeSelectAnalyzer;
-    } });
-    var mysql_2 = require_mysql();
-    Object.defineProperty(exports2, "MissingMySQLIndexAnalyzer", { enumerable: true, get: function() {
-      return mysql_2.MissingMySQLIndexAnalyzer;
-    } });
-    Object.defineProperty(exports2, "MySQLFullTableScanAnalyzer", { enumerable: true, get: function() {
-      return mysql_2.MySQLFullTableScanAnalyzer;
-    } });
-    var mongodb_2 = require_mongodb();
-    Object.defineProperty(exports2, "MissingMongoIndexAnalyzer", { enumerable: true, get: function() {
-      return mongodb_2.MissingMongoIndexAnalyzer;
-    } });
-    Object.defineProperty(exports2, "MongoCollectionScanAnalyzer", { enumerable: true, get: function() {
-      return mongodb_2.MongoCollectionScanAnalyzer;
-    } });
-    var terraform_2 = require_terraform();
-    Object.defineProperty(exports2, "IaCDriftAnalyzer", { enumerable: true, get: function() {
-      return terraform_2.IaCDriftAnalyzer;
-    } });
-    var aws_services_2 = require_aws_services();
-    Object.defineProperty(exports2, "MissingDLQAnalyzer", { enumerable: true, get: function() {
-      return aws_services_2.MissingDLQAnalyzer;
-    } });
-    Object.defineProperty(exports2, "UnencryptedQueueAnalyzer", { enumerable: true, get: function() {
-      return aws_services_2.UnencryptedQueueAnalyzer;
-    } });
-    Object.defineProperty(exports2, "LargeQueueBacklogAnalyzer", { enumerable: true, get: function() {
-      return aws_services_2.LargeQueueBacklogAnalyzer;
-    } });
-    Object.defineProperty(exports2, "MissingSecretRotationAnalyzer", { enumerable: true, get: function() {
-      return aws_services_2.MissingSecretRotationAnalyzer;
-    } });
-    Object.defineProperty(exports2, "MissingLogRetentionAnalyzer", { enumerable: true, get: function() {
-      return aws_services_2.MissingLogRetentionAnalyzer;
-    } });
-    Object.defineProperty(exports2, "LambdaDefaultMemoryAnalyzer", { enumerable: true, get: function() {
-      return aws_services_2.LambdaDefaultMemoryAnalyzer;
-    } });
-    Object.defineProperty(exports2, "LambdaHighTimeoutAnalyzer", { enumerable: true, get: function() {
-      return aws_services_2.LambdaHighTimeoutAnalyzer;
-    } });
-    var DEFAULT_ANALYZERS = [
-      // DynamoDB
-      new dynamodb_1.FullTableScanAnalyzer(),
-      new dynamodb_1.MissingGSIAnalyzer(),
-      new dynamodb_1.HotPartitionAnalyzer(),
-      // PostgreSQL
-      new postgres_1.MissingIndexAnalyzer(),
-      new postgres_1.NplusOneAnalyzer(),
-      new postgres_1.LargeSelectAnalyzer(),
-      // MySQL
-      new mysql_1.MissingMySQLIndexAnalyzer(),
-      new mysql_1.MySQLFullTableScanAnalyzer(),
-      // MongoDB
-      new mongodb_1.MissingMongoIndexAnalyzer(),
-      new mongodb_1.MongoCollectionScanAnalyzer(),
-      // IaC drift
-      new terraform_1.IaCDriftAnalyzer(),
-      // SQS / messaging
-      new aws_services_1.MissingDLQAnalyzer(),
-      new aws_services_1.UnencryptedQueueAnalyzer(),
-      new aws_services_1.LargeQueueBacklogAnalyzer(),
-      // Secrets Manager
-      new aws_services_1.MissingSecretRotationAnalyzer(),
-      // CloudWatch Logs
-      new aws_services_1.MissingLogRetentionAnalyzer(),
-      // Lambda
-      new aws_services_1.LambdaDefaultMemoryAnalyzer(),
-      new aws_services_1.LambdaHighTimeoutAnalyzer()
-    ];
-    async function runAllAnalyzers2(graph, analyzers = DEFAULT_ANALYZERS) {
-      const allFindings = [];
-      for (const analyzer of analyzers) {
-        try {
-          core_1.logger.debug(`Running analyzer: ${analyzer.name}`);
-          const findings = await analyzer.analyze(graph);
-          core_1.logger.info(`[${analyzer.name}] found ${findings.length} issue(s)`);
-          allFindings.push(...findings);
-        } catch (err) {
-          core_1.logger.warn(`Analyzer "${analyzer.name}" failed: ${err instanceof Error ? err.message : String(err)}`);
-        }
-      }
-      const severityOrder = { high: 0, medium: 1, low: 2 };
-      allFindings.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
-      return allFindings;
-    }
-    function summarizeFindings(findings) {
-      return {
-        total: findings.length,
-        high: findings.filter((f) => f.severity === "high").length,
-        medium: findings.filter((f) => f.severity === "medium").length,
-        low: findings.filter((f) => f.severity === "low").length
-      };
-    }
-  }
-});
-
-// ../server/dist/index.js
-var require_dist12 = __commonJS({
-  "../server/dist/index.js"(exports2) {
-    "use strict";
-    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { "default": mod };
-    };
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.currentFindings = exports2.currentGraph = void 0;
-    exports2.setGraphState = setGraphState2;
-    exports2.createServer = createServer2;
-    var fastify_1 = __importDefault(require("fastify"));
-    var cors_1 = __importDefault(require("@fastify/cors"));
-    var core_1 = require_dist();
-    var graph_1 = require_dist10();
-    var currentGraph = { nodes: [], edges: [] };
-    exports2.currentGraph = currentGraph;
-    var currentFindings = [];
-    exports2.currentFindings = currentFindings;
-    function setGraphState2(graph, findings) {
-      exports2.currentGraph = currentGraph = graph;
-      exports2.currentFindings = currentFindings = findings;
-    }
-    function createServer2(port = 3e3) {
-      const fastify = (0, fastify_1.default)({ logger: false });
-      fastify.register(cors_1.default, { origin: true });
-      fastify.get("/health", async () => ({
-        status: "ok",
-        version: "0.1.0",
-        graphNodes: currentGraph.nodes.length,
-        graphEdges: currentGraph.edges.length,
-        findings: currentFindings.length
-      }));
-      fastify.post("/mcp", async (request, reply) => {
-        const { tool, input } = request.body;
-        if (!tool) {
-          reply.status(400);
-          return { success: false, error: 'Missing "tool" field' };
-        }
-        core_1.logger.info(`MCP tool call: ${tool}`);
-        try {
-          const result = await handleToolCall(tool, input ?? {});
-          return { success: true, data: result };
-        } catch (err) {
-          core_1.logger.error(`MCP tool "${tool}" failed: ${err instanceof Error ? err.message : String(err)}`);
-          reply.status(500);
-          return { success: false, error: err instanceof Error ? err.message : "Unknown error" };
-        }
-      });
-      fastify.get("/mcp/tools", async () => ({
-        tools: [
-          // ── Overview ──────────────────────────────────────────────────────────
-          {
-            name: "get_infra_overview",
-            description: "Returns a complete snapshot of all infrastructure: databases, queues, topics, secrets, parameters, log groups, lambdas, and all findings. Start here for a full picture.",
-            input: {}
-          },
-          {
-            name: "get_graph_summary",
-            description: "Returns the full infrastructure graph (all nodes and edges) plus findings summary.",
-            input: {}
-          },
-          // ── Code analysis ────────────────────────────────────────────────────
-          {
-            name: "analyze_function",
-            description: "Analyze a specific function for all infrastructure issues: DB queries, queue publishing, secret access, etc.",
-            input: { function: "string \u2014 function name" }
-          },
-          // ── Database helpers ─────────────────────────────────────────────────
-          {
-            name: "suggest_gsi",
-            description: "Get GSI suggestions for a DynamoDB table and attribute",
-            input: { table: "string", attribute: "string" }
-          },
-          {
-            name: "postgres_index_suggestions",
-            description: "Get PostgreSQL index suggestions for a table column",
-            input: { table: "string", column: "string" }
-          },
-          {
-            name: "suggest_mongo_index",
-            description: "Get index suggestions for a MongoDB collection field",
-            input: { collection: "string", field: "string" }
-          },
-          {
-            name: "mysql_index_suggestions",
-            description: "Get MySQL index suggestions for a table column",
-            input: { table: "string", column: "string" }
-          },
-          // ── Messaging ────────────────────────────────────────────────────────
-          {
-            name: "get_queue_details",
-            description: "Returns all SQS queues with DLQ status, encryption, message counts, and retention. Use to audit messaging infrastructure.",
-            input: {}
-          },
-          {
-            name: "get_topic_details",
-            description: "Returns all SNS topics with subscription counts and protocols.",
-            input: {}
-          },
-          // ── Secrets & config ─────────────────────────────────────────────────
-          {
-            name: "get_secrets_overview",
-            description: "Returns all Secrets Manager secrets: names, rotation status, last accessed. Secret VALUES are never included.",
-            input: {}
-          },
-          {
-            name: "get_parameter_overview",
-            description: "Returns all SSM Parameter Store parameters: names, types, tiers. Parameter VALUES are never included.",
-            input: {}
-          },
-          // ── Compute ──────────────────────────────────────────────────────────
-          {
-            name: "get_lambda_overview",
-            description: "Returns all Lambda functions: runtime, memory, timeout, env var key names (values never included).",
-            input: {}
-          },
-          // ── Observability ────────────────────────────────────────────────────
-          {
-            name: "get_log_errors",
-            description: "Returns recent error patterns from CloudWatch log groups. Returns pattern counts and frequencies \u2014 never raw log messages. Safe for context.",
-            input: {
-              logGroup: "string (optional) \u2014 filter to a specific log group name"
-            }
-          }
-        ]
-      }));
-      return { fastify, start: () => startServer(fastify, port) };
-    }
-    async function handleToolCall(tool, input) {
-      switch (tool) {
-        // ── Overview ─────────────────────────────────────────────────────────────
-        case "get_infra_overview": {
-          const tables = (0, graph_1.getTableNodes)(currentGraph);
-          const queues = (0, graph_1.getQueueNodes)(currentGraph);
-          const topics = (0, graph_1.getTopicNodes)(currentGraph);
-          const secrets = (0, graph_1.getSecretNodes)(currentGraph);
-          const parameters = (0, graph_1.getParameterNodes)(currentGraph);
-          const logGroups = (0, graph_1.getLogGroupNodes)(currentGraph);
-          const lambdas = (0, graph_1.getLambdaNodes)(currentGraph);
-          const functions = (0, graph_1.getFunctionNodes)(currentGraph);
-          return {
-            summary: {
-              tables: tables.length,
-              functions: functions.length,
-              queues: queues.length,
-              topics: topics.length,
-              secrets: secrets.length,
-              parameters: parameters.length,
-              logGroups: logGroups.length,
-              lambdas: lambdas.length,
-              totalNodes: currentGraph.nodes.length,
-              totalEdges: currentGraph.edges.length,
-              findings: {
-                total: currentFindings.length,
-                high: currentFindings.filter((f) => f.severity === "high").length,
-                medium: currentFindings.filter((f) => f.severity === "medium").length,
-                low: currentFindings.filter((f) => f.severity === "low").length
-              }
-            },
-            databases: tables.map((t) => ({ name: t.name, type: t.databaseType })),
-            queues: queues.map((q) => ({
-              name: q.name,
-              hasDLQ: q.hasDLQ,
-              encrypted: q.encrypted,
-              approximateMessages: q.approximateMessages
-            })),
-            topics: topics.map((t) => ({ name: t.name, subscriptions: t.subscriptionCount })),
-            secrets: secrets.map((s) => ({ name: s.name, rotationEnabled: s.rotationEnabled })),
-            parameters: parameters.map((p) => ({ name: p.name, type: p.paramType, tier: p.tier })),
-            lambdas: lambdas.map((l) => ({ name: l.name, runtime: l.runtime, memoryMB: l.memoryMB })),
-            logGroups: logGroups.map((lg) => ({
-              name: lg.name,
-              retentionDays: lg.retentionDays ?? "never",
-              errorCount: lg.errorCount
-            })),
-            highFindings: currentFindings.filter((f) => f.severity === "high").map((f) => ({
-              issue: f.issue,
-              recommendation: f.recommendation
-            }))
-          };
-        }
-        case "get_graph_summary": {
-          return {
-            nodes: currentGraph.nodes,
-            edges: currentGraph.edges,
-            findings: currentFindings,
-            summary: {
-              totalNodes: currentGraph.nodes.length,
-              totalEdges: currentGraph.edges.length,
-              tables: (0, graph_1.getTableNodes)(currentGraph).length,
-              functions: (0, graph_1.getFunctionNodes)(currentGraph).length,
-              queues: (0, graph_1.getQueueNodes)(currentGraph).length,
-              scans: (0, graph_1.getScanEdges)(currentGraph).length,
-              totalFindings: currentFindings.length,
-              highSeverity: currentFindings.filter((f) => f.severity === "high").length,
-              mediumSeverity: currentFindings.filter((f) => f.severity === "medium").length,
-              lowSeverity: currentFindings.filter((f) => f.severity === "low").length
-            }
-          };
-        }
-        // ── Code analysis ──────────────────────────────────────────────────────────
-        case "analyze_function": {
-          const functionName = String(input.function ?? "");
-          if (!functionName)
-            throw new Error("Missing input.function");
-          const funcNode = currentGraph.nodes.find((n) => n.type === "function" && n.name === functionName);
-          if (!funcNode) {
-            return {
-              function: functionName,
-              found: false,
-              issues: [],
-              recommendations: [`Function "${functionName}" not found in the analyzed codebase.`]
-            };
-          }
-          const outEdges = (0, graph_1.getOutgoingEdges)(currentGraph, funcNode.id);
-          const relatedFindings = currentFindings.filter((f) => {
-            const meta = f.metadata;
-            return meta?.functionName === functionName || String(meta?.callerFunctions ?? "").includes(functionName);
-          });
-          return {
-            function: functionName,
-            found: true,
-            file: funcNode.type === "function" ? funcNode.file : void 0,
-            accesses: outEdges.map((e) => {
-              const target = currentGraph.nodes.find((n) => n.id === e.to);
-              return {
-                targetId: e.to,
-                edgeType: e.type,
-                targetName: target && "name" in target ? target.name : e.to,
-                targetType: target?.type
-              };
-            }),
-            issues: relatedFindings.map((f) => ({
-              severity: f.severity,
-              issue: f.issue,
-              description: f.description
-            })),
-            recommendations: [...new Set(relatedFindings.map((f) => f.recommendation))]
-          };
-        }
-        // ── Database helpers ───────────────────────────────────────────────────────
-        case "suggest_gsi": {
-          const tableName = String(input.table ?? "");
-          const attribute = String(input.attribute ?? "");
-          if (!tableName || !attribute)
-            throw new Error("Missing input.table or input.attribute");
-          const tableNode = currentGraph.nodes.find((n) => n.type === "table" && n.databaseType === "dynamodb" && "name" in n && n.name === tableName);
-          const sanitizedAttr = attribute.replace(/[^a-zA-Z0-9_]/g, "_");
-          const indexName = `${tableName}-${sanitizedAttr}-index`;
-          return {
-            table: tableName,
-            attribute,
-            found: !!tableNode,
-            index: { name: indexName, partitionKey: attribute, projectionType: "ALL", billingMode: "PAY_PER_REQUEST" },
-            rationale: `A GSI on "${attribute}" allows Query instead of Scan when filtering by this attribute.`,
-            recommendation: `Add GSI "${indexName}" with partition key "${attribute}" to your IaC definition.`
-          };
-        }
-        case "postgres_index_suggestions": {
-          const tableName = String(input.table ?? "");
-          const column = String(input.column ?? "");
-          if (!tableName || !column)
-            throw new Error("Missing input.table or input.column");
-          const sanitizedCol = column.replace(/[^a-zA-Z0-9_]/g, "_");
-          const sanitizedTable = tableName.replace(/[^a-zA-Z0-9_]/g, "_");
-          const indexName = `idx_${sanitizedTable}_${sanitizedCol}`;
-          return {
-            table: tableName,
-            column,
-            recommendation: `CREATE INDEX CONCURRENTLY ${indexName} ON ${tableName} (${column});`,
-            rationale: `An index on "${column}" eliminates sequential scans when filtering on this column.`,
-            notes: [
-              "Use CONCURRENTLY to avoid locking the table",
-              "Run ANALYZE after creation",
-              `Partial index: CREATE INDEX CONCURRENTLY ${indexName}_partial ON ${tableName} (${column}) WHERE ${column} IS NOT NULL;`
-            ]
-          };
-        }
-        case "suggest_mongo_index": {
-          const collection = String(input.collection ?? "");
-          const field = String(input.field ?? "");
-          if (!collection || !field)
-            throw new Error("Missing input.collection or input.field");
-          return {
-            collection,
-            field,
-            recommendation: `db.${collection}.createIndex({ ${field}: 1 })`,
-            rationale: `An index on "${field}" eliminates full collection scans when filtering on this field.`,
-            notes: [
-              `Compound: db.${collection}.createIndex({ ${field}: 1, otherField: 1 })`,
-              `Text: db.${collection}.createIndex({ ${field}: "text" })`,
-              `Verify: db.${collection}.explain("executionStats").find({ ${field}: value })`
-            ]
-          };
-        }
-        case "mysql_index_suggestions": {
-          const tableName = String(input.table ?? "");
-          const column = String(input.column ?? "");
-          if (!tableName || !column)
-            throw new Error("Missing input.table or input.column");
-          const sanitizedCol = column.replace(/[^a-zA-Z0-9_]/g, "_");
-          const sanitizedTable = tableName.replace(/[^a-zA-Z0-9_]/g, "_");
-          const indexName = `idx_${sanitizedTable}_${sanitizedCol}`;
-          return {
-            table: tableName,
-            column,
-            recommendation: `ALTER TABLE ${tableName} ADD INDEX ${indexName} (${column});`,
-            rationale: `An index on "${column}" eliminates full table scans when filtering on this column.`,
-            notes: [
-              "MySQL InnoDB adds indexes online (no full lock for 5.6+)",
-              `EXPLAIN SELECT ... to verify after adding`,
-              `Composite: ALTER TABLE ${tableName} ADD INDEX idx_composite (${column}, other_column);`
-            ]
-          };
-        }
-        // ── Messaging ─────────────────────────────────────────────────────────────
-        case "get_queue_details": {
-          const queues = (0, graph_1.getQueueNodes)(currentGraph);
-          const queueFindings = currentFindings.filter((f) => f.metadata?.queueName);
-          return {
-            total: queues.length,
-            queues: queues.map((q) => ({
-              name: q.name,
-              provider: q.provider,
-              hasDLQ: q.hasDLQ,
-              encrypted: q.encrypted,
-              approximateMessages: q.approximateMessages,
-              retentionDays: q.retentionDays,
-              findings: queueFindings.filter((f) => f.metadata.queueName === q.name).map((f) => ({ severity: f.severity, issue: f.issue }))
-            }))
-          };
-        }
-        case "get_topic_details": {
-          const topics = (0, graph_1.getTopicNodes)(currentGraph);
-          return {
-            total: topics.length,
-            topics: topics.map((t) => ({
-              name: t.name,
-              provider: t.provider,
-              subscriptionCount: t.subscriptionCount,
-              encrypted: t.encrypted
-            }))
-          };
-        }
-        // ── Secrets & config ──────────────────────────────────────────────────────
-        case "get_secrets_overview": {
-          const secrets = (0, graph_1.getSecretNodes)(currentGraph);
-          const secretFindings = currentFindings.filter((f) => f.metadata?.secretName);
-          return {
-            total: secrets.length,
-            note: "Secret values are never included in this response.",
-            secrets: secrets.map((s) => ({
-              name: s.name,
-              provider: s.provider,
-              rotationEnabled: s.rotationEnabled,
-              rotationDays: s.rotationDays,
-              findings: secretFindings.filter((f) => f.metadata.secretName === s.name).map((f) => ({ severity: f.severity, issue: f.issue }))
-            }))
-          };
-        }
-        case "get_parameter_overview": {
-          const parameters = (0, graph_1.getParameterNodes)(currentGraph);
-          return {
-            total: parameters.length,
-            note: "Parameter values are never included in this response.",
-            parameters: parameters.map((p) => ({
-              name: p.name,
-              provider: p.provider,
-              type: p.paramType,
-              tier: p.tier
-            }))
-          };
-        }
-        // ── Compute ───────────────────────────────────────────────────────────────
-        case "get_lambda_overview": {
-          const lambdas = (0, graph_1.getLambdaNodes)(currentGraph);
-          const lambdaFindings = currentFindings.filter((f) => f.metadata?.functionName);
-          return {
-            total: lambdas.length,
-            note: "Environment variable values are never included.",
-            lambdas: lambdas.map((l) => ({
-              name: l.name,
-              runtime: l.runtime,
-              memoryMB: l.memoryMB,
-              timeoutSec: l.timeoutSec,
-              envVarCount: l.envVarKeys?.length ?? 0,
-              envVarKeys: l.envVarKeys,
-              findings: lambdaFindings.filter((f) => f.metadata.functionName === l.name).map((f) => ({ severity: f.severity, issue: f.issue }))
-            }))
-          };
-        }
-        // ── Observability ─────────────────────────────────────────────────────────
-        case "get_log_errors": {
-          const filterName = input.logGroup ? String(input.logGroup) : void 0;
-          const logGroups = (0, graph_1.getLogGroupNodes)(currentGraph).filter((lg) => !filterName || lg.name.includes(filterName));
-          return {
-            note: "Only error patterns and counts are returned \u2014 no raw log messages.",
-            windowHours: 24,
-            logGroups: logGroups.map((lg) => ({
-              name: lg.name,
-              retentionDays: lg.retentionDays ?? "never-expires",
-              errorCount: lg.errorCount,
-              topErrorPatterns: lg.topErrorPatterns
-            }))
-          };
-        }
-        default:
-          throw new Error(`Unknown tool: "${tool}". Call GET /mcp/tools for the list of available tools.`);
-      }
-    }
-    async function startServer(fastify, port) {
-      try {
-        await fastify.listen({ port, host: "0.0.0.0" });
-        core_1.logger.info(`Infrawise MCP server running at http://localhost:${port}`);
-      } catch (err) {
-        core_1.logger.error(`Failed to start server: ${err instanceof Error ? err.message : String(err)}`);
-        process.exit(1);
-      }
-    }
-  }
-});
-
-// src/index.ts
-var import_commander = require("commander");
-
-// src/utils.ts
-var fs = __toESM(require("fs"));
-var path = __toESM(require("path"));
-var os = __toESM(require("os"));
-var import_chalk = __toESM(require("chalk"));
-function readAWSProfiles() {
-  const credentialsPath = path.join(os.homedir(), ".aws", "credentials");
-  const configPath = path.join(os.homedir(), ".aws", "config");
-  const profiles = /* @__PURE__ */ new Set();
-  function parseFile(filePath) {
-    if (!fs.existsSync(filePath)) return;
-    for (const line of fs.readFileSync(filePath, "utf-8").split("\n")) {
-      const match = line.match(/^\[(.+)\]$/);
-      if (match?.[1]) {
-        let name = match[1];
-        if (name.startsWith("profile ")) name = name.slice(8);
-        profiles.add(name);
-      }
-    }
-  }
-  parseFile(credentialsPath);
-  parseFile(configPath);
-  return profiles.size > 0 ? [...profiles] : ["default"];
-}
-function detectAWSRegion() {
-  if (process.env.AWS_DEFAULT_REGION) return process.env.AWS_DEFAULT_REGION;
-  if (process.env.AWS_REGION) return process.env.AWS_REGION;
-  const configPath = path.join(os.homedir(), ".aws", "config");
-  if (fs.existsSync(configPath)) {
-    const match = fs.readFileSync(configPath, "utf-8").match(/region\s*=\s*(.+)/);
-    if (match?.[1]) return match[1].trim();
-  }
-  return "us-east-1";
-}
-function detectRepoType(repoPath) {
-  if (fs.existsSync(path.join(repoPath, "tsconfig.json"))) return "typescript";
-  if (fs.existsSync(path.join(repoPath, "package.json"))) return "javascript";
-  return "unknown";
-}
-function printBanner() {
-  const line1 = import_chalk.default.bold.hex("#6366f1")("  infrawise");
-  const version = import_chalk.default.dim(" v0.1.0");
-  const tagline = import_chalk.default.dim("  Infrastructure Intelligence Platform\n");
-  console.log(`
-${line1}${version}`);
-  console.log(tagline);
-}
-function printHeader(title) {
-  console.log(import_chalk.default.bold(`
-${title}`));
-  console.log(import_chalk.default.dim("\u2500".repeat(title.length + 2)));
-}
-var log = {
-  success: (msg, detail) => {
-    console.log(`  ${import_chalk.default.green("\u2713")} ${msg}${detail ? import_chalk.default.dim(`  ${detail}`) : ""}`);
-  },
-  fail: (msg, detail) => {
-    console.log(`  ${import_chalk.default.red("\u2717")} ${import_chalk.default.red(msg)}${detail ? import_chalk.default.dim(`
-    ${detail}`) : ""}`);
-  },
-  warn: (msg, detail) => {
-    console.log(`  ${import_chalk.default.yellow("\u26A0")} ${import_chalk.default.yellow(msg)}${detail ? import_chalk.default.dim(`
-    ${detail}`) : ""}`);
-  },
-  skip: (msg, detail) => {
-    console.log(`  ${import_chalk.default.dim("\u2212")} ${import_chalk.default.dim(msg)}${detail ? import_chalk.default.dim(`  ${detail}`) : ""}`);
-  },
-  info: (msg) => {
-    console.log(`  ${import_chalk.default.cyan("\u203A")} ${msg}`);
-  },
-  dim: (msg) => {
-    console.log(import_chalk.default.dim(`  ${msg}`));
-  }
-};
-function severityBadge(severity) {
-  switch (severity) {
-    case "high":
-      return import_chalk.default.bgRed.white.bold(` HIGH `);
-    case "medium":
-      return import_chalk.default.bgYellow.black.bold(` MED  `);
-    case "low":
-      return import_chalk.default.bgCyan.black.bold(` LOW  `);
-  }
-}
-function printFinding(finding, index) {
-  const badge = severityBadge(finding.severity);
-  const num = import_chalk.default.dim(`${index + 1}.`);
-  console.log(`
-  ${num} ${badge}  ${import_chalk.default.bold(finding.issue)}`);
-  console.log(import_chalk.default.dim(`       ${finding.description}`));
-  console.log(`       ${import_chalk.default.green("\u2192")} ${finding.recommendation}`);
-}
-function printSummaryBox(findings) {
-  const high = findings.filter((f) => f.severity === "high").length;
-  const medium = findings.filter((f) => f.severity === "medium").length;
-  const low = findings.filter((f) => f.severity === "low").length;
-  console.log("");
-  console.log(import_chalk.default.dim("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-  console.log(import_chalk.default.dim("  \u2502") + import_chalk.default.bold("  Analysis Summary             ") + import_chalk.default.dim("\u2502"));
-  console.log(import_chalk.default.dim("  \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
-  console.log(import_chalk.default.dim("  \u2502") + `  ${import_chalk.default.red("\u25CF")} High     ${import_chalk.default.red.bold(String(high).padStart(3))}                 ` + import_chalk.default.dim("\u2502"));
-  console.log(import_chalk.default.dim("  \u2502") + `  ${import_chalk.default.yellow("\u25CF")} Medium   ${import_chalk.default.yellow.bold(String(medium).padStart(3))}                 ` + import_chalk.default.dim("\u2502"));
-  console.log(import_chalk.default.dim("  \u2502") + `  ${import_chalk.default.cyan("\u25CF")} Low      ${import_chalk.default.cyan.bold(String(low).padStart(3))}                 ` + import_chalk.default.dim("\u2502"));
-  console.log(import_chalk.default.dim("  \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
-  console.log(import_chalk.default.dim("  \u2502") + `  Total    ${import_chalk.default.bold(String(findings.length).padStart(3))}                 ` + import_chalk.default.dim("\u2502"));
-  console.log(import_chalk.default.dim("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
-}
-
-// src/commands/init.ts
-var fs2 = __toESM(require("fs"));
-var path2 = __toESM(require("path"));
-var import_chalk2 = __toESM(require("chalk"));
-var import_inquirer = __toESM(require("inquirer"));
-var import_core = __toESM(require_dist());
-async function runInit(options = {}) {
-  const cwd = process.cwd();
-  const configPath = path2.join(cwd, "infrawise.yaml");
-  if (fs2.existsSync(configPath) && !options.force) {
-    console.log(`
-  ${import_chalk2.default.yellow("\u26A0")} ${import_chalk2.default.yellow("infrawise.yaml already exists.")}  ${import_chalk2.default.dim("Use --force to overwrite.")}
-`);
-    return;
-  }
-  printHeader("Initialize Infrawise");
-  const repoType = detectRepoType(cwd);
-  const repoName = path2.basename(cwd);
-  const profiles = readAWSProfiles();
-  const detectedRegion = detectAWSRegion();
-  log.success(`Repository detected`, repoName);
-  log.success(`Type`, repoType);
-  log.success(`AWS profiles found`, String(profiles.length));
-  console.log("");
-  const core = await import_inquirer.default.prompt([
-    {
-      type: "input",
-      name: "project",
-      message: "Project name:",
-      default: repoName
-    },
-    {
-      type: "list",
-      name: "awsProfile",
-      message: "AWS profile:",
-      choices: profiles,
-      default: profiles[0]
-    },
-    {
-      type: "input",
-      name: "region",
-      message: "AWS region:",
-      default: detectedRegion
-    }
-  ]);
-  console.log("\n  " + import_chalk2.default.bold("Databases"));
-  const databases = await import_inquirer.default.prompt([
-    {
-      type: "input",
-      name: "dynamoTables",
-      message: "DynamoDB tables to include:",
-      default: "",
-      suffix: import_chalk2.default.dim(" (comma-separated, blank = all)")
-    },
-    {
-      type: "confirm",
-      name: "pgEnabled",
-      message: "Enable PostgreSQL analysis?",
-      default: false
-    },
-    {
-      type: "input",
-      name: "pgConnectionString",
-      message: "PostgreSQL connection string:",
-      default: "postgresql://localhost:5432/mydb",
-      when: (a) => a.pgEnabled
-    },
-    {
-      type: "confirm",
-      name: "mysqlEnabled",
-      message: "Enable MySQL analysis?",
-      default: false
-    },
-    {
-      type: "input",
-      name: "mysqlConnectionString",
-      message: "MySQL connection string:",
-      default: "mysql://localhost:3306/mydb",
-      when: (a) => a.mysqlEnabled
-    },
-    {
-      type: "confirm",
-      name: "mongoEnabled",
-      message: "Enable MongoDB analysis?",
-      default: false
-    },
-    {
-      type: "input",
-      name: "mongoConnectionString",
-      message: "MongoDB connection string:",
-      default: "mongodb://localhost:27017",
-      when: (a) => a.mongoEnabled
-    }
-  ]);
-  console.log("\n  " + import_chalk2.default.bold("AWS Services"));
-  console.log(import_chalk2.default.dim("  Infrawise will introspect these services \u2014 credentials from the AWS profile above."));
-  const services = await import_inquirer.default.prompt([
-    {
-      type: "confirm",
-      name: "sqsEnabled",
-      message: "Introspect SQS queues?",
-      default: true
-    },
-    {
-      type: "confirm",
-      name: "snsEnabled",
-      message: "Introspect SNS topics?",
-      default: true
-    },
-    {
-      type: "confirm",
-      name: "ssmEnabled",
-      message: "Introspect SSM Parameter Store? (metadata only, no values)",
-      default: true
-    },
-    {
-      type: "input",
-      name: "ssmPaths",
-      message: "SSM path prefixes to filter:",
-      default: "",
-      suffix: import_chalk2.default.dim(" (comma-separated, blank = all  e.g. /myapp/prod)"),
-      when: (a) => a.ssmEnabled
-    },
-    {
-      type: "confirm",
-      name: "secretsEnabled",
-      message: "Introspect Secrets Manager? (names & rotation only, no values)",
-      default: true
-    },
-    {
-      type: "confirm",
-      name: "lambdaEnabled",
-      message: "Introspect Lambda functions?",
-      default: true
-    },
-    {
-      type: "confirm",
-      name: "logsEnabled",
-      message: "Sample CloudWatch Logs? (error patterns only, no raw logs)",
-      default: false
-    },
-    {
-      type: "input",
-      name: "logGroupPrefixes",
-      message: "CloudWatch log group prefixes:",
-      default: "",
-      suffix: import_chalk2.default.dim(" (comma-separated, blank = all)"),
-      when: (a) => a.logsEnabled
-    }
-  ]);
-  const includeTables = databases.dynamoTables ? databases.dynamoTables.split(",").map((t) => t.trim()).filter(Boolean) : [];
-  const ssmPaths = services.ssmPaths ? services.ssmPaths.split(",").map((p) => p.trim()).filter(Boolean) : [];
-  const logGroupPrefixes = services.logGroupPrefixes ? services.logGroupPrefixes.split(",").map((p) => p.trim()).filter(Boolean) : [];
-  const configContent = (0, import_core.generateDefaultConfig)(core.project, {
-    aws: { profile: core.awsProfile, region: core.region },
-    dynamodb: { includeTables },
-    postgres: { enabled: databases.pgEnabled, connectionString: databases.pgConnectionString ?? "" },
-    mysql: { enabled: databases.mysqlEnabled, connectionString: databases.mysqlConnectionString ?? "" },
-    mongodb: { enabled: databases.mongoEnabled, connectionString: databases.mongoConnectionString ?? "" },
-    sqs: { enabled: services.sqsEnabled },
-    sns: { enabled: services.snsEnabled },
-    ssm: { enabled: services.ssmEnabled, paths: ssmPaths },
-    secretsManager: { enabled: services.secretsEnabled },
-    lambda: { enabled: services.lambdaEnabled },
-    cloudwatchLogs: {
-      enabled: services.logsEnabled,
-      logGroupPrefixes,
-      windowHours: 24
-    }
-  });
-  fs2.writeFileSync(configPath, configContent, "utf-8");
-  console.log("");
-  log.success(`Created ${import_chalk2.default.bold("infrawise.yaml")}`);
-  console.log("");
-  console.log(import_chalk2.default.bold("  Next steps:"));
-  log.info(`Run ${import_chalk2.default.cyan("infrawise doctor")} to validate your setup`);
-  log.info(`Run ${import_chalk2.default.cyan("infrawise analyze")} to scan your infrastructure`);
-  log.info(`Run ${import_chalk2.default.cyan("infrawise dev")} to start the MCP server`);
-  console.log("");
-}
-
-// src/commands/auth.ts
-var import_chalk3 = __toESM(require("chalk"));
-var import_inquirer2 = __toESM(require("inquirer"));
-var import_ora = __toESM(require("ora"));
-var import_adapters_dynamodb = __toESM(require_dist2());
-async function runAuth() {
-  printHeader("AWS Authentication");
-  const profiles = readAWSProfiles();
-  if (profiles.length === 0) {
-    log.fail("No AWS profiles found");
-    console.log("");
-    log.info("Run " + import_chalk3.default.cyan("aws configure") + " to set up credentials");
-    log.info("Or manually edit " + import_chalk3.default.dim("~/.aws/credentials"));
-    console.log("");
-    return;
-  }
-  log.success(`Found ${profiles.length} profile(s)`);
-  console.log("");
-  const { selectedProfile } = await import_inquirer2.default.prompt([
-    {
-      type: "list",
-      name: "selectedProfile",
-      message: "Select a profile to validate:",
-      choices: profiles
-    }
-  ]);
-  console.log("");
-  const spin = (0, import_ora.default)({ text: import_chalk3.default.dim(`Validating "${selectedProfile}"...`), color: "cyan" }).start();
-  const testConfig = {
-    project: "auth-test",
-    aws: { profile: selectedProfile, region: "us-east-1" }
-  };
-  const isValid = await (0, import_adapters_dynamodb.validateDynamoAccess)(testConfig);
-  if (isValid) {
-    spin.succeed(import_chalk3.default.green(`Profile "${import_chalk3.default.bold(selectedProfile)}" is valid`));
-    console.log("");
-    console.log(import_chalk3.default.dim("  Update your infrawise.yaml:"));
-    console.log(import_chalk3.default.cyan(`  aws:
-    profile: ${selectedProfile}`));
-  } else {
-    spin.fail(import_chalk3.default.red(`Profile "${import_chalk3.default.bold(selectedProfile)}" cannot access DynamoDB`));
-    console.log("");
-    log.warn("Possible causes:");
-    log.dim("Missing IAM permissions \u2014 need dynamodb:ListTables, dynamodb:DescribeTable");
-    log.dim("Expired SSO \u2014 run: aws sso login");
-    log.dim("Wrong region \u2014 check your AWS config");
-    console.log("");
-    log.info(`Run ${import_chalk3.default.cyan("infrawise doctor")} for a full diagnostic`);
-  }
-  console.log("");
-}
-
-// src/commands/analyze.ts
-var path3 = __toESM(require("path"));
-var import_chalk4 = __toESM(require("chalk"));
-var import_ora2 = __toESM(require("ora"));
-var import_core2 = __toESM(require_dist());
-var import_adapters_dynamodb2 = __toESM(require_dist2());
-var import_adapters_postgres = __toESM(require_dist3());
-var import_adapters_mysql = __toESM(require_dist4());
-var import_adapters_mongodb = __toESM(require_dist5());
-var import_adapters_terraform = __toESM(require_dist6());
-var import_adapters_aws_services = __toESM(require_dist7());
-var import_adapters_logs = __toESM(require_dist8());
-var import_context = __toESM(require_dist9());
-var import_graph = __toESM(require_dist10());
-var import_analyzers = __toESM(require_dist11());
-async function runAnalyze(options = {}) {
-  printHeader("Running Analysis");
-  let config;
-  try {
-    config = (0, import_core2.loadConfig)(options.config);
-    log.success("Config loaded", options.config ?? "infrawise.yaml");
-  } catch (err) {
-    console.error((0, import_core2.formatError)(err));
-    process.exit(1);
-  }
-  const repoPath = options.repo ?? process.cwd();
-  const awsCfg = { region: config.aws?.region, profile: config.aws?.profile };
-  const dynamoMeta = [];
-  const postgresMeta = [];
-  const mysqlMeta = [];
-  const mongoMeta = [];
-  const servicesMeta = {};
-  {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting DynamoDB tables..."), color: "cyan" }).start();
-    try {
-      const result = await (0, import_adapters_dynamodb2.extractDynamoMetadata)(config);
-      dynamoMeta.push(...result);
-      spin.succeed(import_chalk4.default.green("DynamoDB") + import_chalk4.default.dim(`  ${result.length} table(s)`));
-    } catch (err) {
-      spin.warn(import_chalk4.default.yellow("DynamoDB skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-    }
-  }
-  if (config.postgres?.enabled && config.postgres.connectionString) {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting PostgreSQL schema..."), color: "cyan" }).start();
-    try {
-      const result = await (0, import_adapters_postgres.extractPostgresMetadata)(config.postgres.connectionString);
-      postgresMeta.push(...result);
-      spin.succeed(import_chalk4.default.green("PostgreSQL") + import_chalk4.default.dim(`  ${result.length} table(s)`));
-    } catch (err) {
-      spin.warn(import_chalk4.default.yellow("PostgreSQL skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-    }
-  }
-  if (config.mysql?.enabled && config.mysql.connectionString) {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting MySQL schema..."), color: "cyan" }).start();
-    try {
-      const result = await (0, import_adapters_mysql.extractMySQLMetadata)(config.mysql.connectionString);
-      mysqlMeta.push(...result);
-      spin.succeed(import_chalk4.default.green("MySQL") + import_chalk4.default.dim(`  ${result.length} table(s)`));
-    } catch (err) {
-      spin.warn(import_chalk4.default.yellow("MySQL skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-    }
-  }
-  if (config.mongodb?.enabled && config.mongodb.connectionString) {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting MongoDB schema..."), color: "cyan" }).start();
-    try {
-      const result = await (0, import_adapters_mongodb.extractMongoMetadata)(config.mongodb.connectionString, config.mongodb.databases);
-      mongoMeta.push(...result);
-      spin.succeed(import_chalk4.default.green("MongoDB") + import_chalk4.default.dim(`  ${result.length} collection(s)`));
-    } catch (err) {
-      spin.warn(import_chalk4.default.yellow("MongoDB skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-    }
-  }
-  if (config.sqs?.enabled !== false) {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting SQS queues..."), color: "cyan" }).start();
-    try {
-      const result = await (0, import_adapters_aws_services.extractSQSMetadata)(awsCfg);
-      servicesMeta.sqs = result;
-      spin.succeed(import_chalk4.default.green("SQS") + import_chalk4.default.dim(`  ${result.length} queue(s)`));
-    } catch (err) {
-      spin.warn(import_chalk4.default.yellow("SQS skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-    }
-  }
-  if (config.sns?.enabled !== false) {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting SNS topics..."), color: "cyan" }).start();
-    try {
-      const result = await (0, import_adapters_aws_services.extractSNSMetadata)(awsCfg);
-      servicesMeta.sns = result;
-      spin.succeed(import_chalk4.default.green("SNS") + import_chalk4.default.dim(`  ${result.length} topic(s)`));
-    } catch (err) {
-      spin.warn(import_chalk4.default.yellow("SNS skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-    }
-  }
-  if (config.ssm?.enabled !== false) {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting SSM parameters..."), color: "cyan" }).start();
-    try {
-      const result = await (0, import_adapters_aws_services.extractSSMMetadata)({ ...awsCfg, paths: config.ssm?.paths });
-      servicesMeta.ssm = result;
-      spin.succeed(import_chalk4.default.green("SSM") + import_chalk4.default.dim(`  ${result.length} parameter(s)  `) + import_chalk4.default.dim("(metadata only, no values)"));
-    } catch (err) {
-      spin.warn(import_chalk4.default.yellow("SSM skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-    }
-  }
-  if (config.secretsManager?.enabled !== false) {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting Secrets Manager metadata..."), color: "cyan" }).start();
-    try {
-      const result = await (0, import_adapters_aws_services.extractSecretsMetadata)(awsCfg);
-      servicesMeta.secrets = result;
-      spin.succeed(import_chalk4.default.green("Secrets Manager") + import_chalk4.default.dim(`  ${result.length} secret(s)  `) + import_chalk4.default.dim("(names/rotation only, no values)"));
-    } catch (err) {
-      spin.warn(import_chalk4.default.yellow("Secrets Manager skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-    }
-  }
-  if (config.lambda?.enabled !== false) {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting Lambda functions..."), color: "cyan" }).start();
-    try {
-      const result = await (0, import_adapters_aws_services.extractLambdaMetadata)(awsCfg);
-      servicesMeta.lambda = result;
-      spin.succeed(import_chalk4.default.green("Lambda") + import_chalk4.default.dim(`  ${result.length} function(s)`));
-    } catch (err) {
-      spin.warn(import_chalk4.default.yellow("Lambda skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-    }
-  }
-  if (config.cloudwatchLogs?.enabled) {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Sampling CloudWatch Logs (errors only, max 50 groups)..."), color: "cyan" }).start();
-    try {
-      const result = await (0, import_adapters_logs.extractLogsSummary)({
-        ...awsCfg,
-        logGroupPrefixes: config.cloudwatchLogs.logGroupPrefixes,
-        windowHours: config.cloudwatchLogs.windowHours
-      });
-      servicesMeta.logs = result;
-      const errorGroups = result.filter((lg) => lg.errorCount > 0).length;
-      spin.succeed(import_chalk4.default.green("CloudWatch Logs") + import_chalk4.default.dim(`  ${result.length} group(s), ${errorGroups} with errors`));
-    } catch (err) {
-      spin.warn(import_chalk4.default.yellow("CloudWatch Logs skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-    }
-  }
-  let iacDriftAnalyzer;
-  {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Extracting IaC schema (Terraform / CloudFormation / CDK)..."), color: "cyan" }).start();
-    try {
-      const iacSchema = await (0, import_adapters_terraform.extractIaCSchema)(repoPath);
-      const total = iacSchema.dynamoTables.length + iacSchema.rdsInstances.length + iacSchema.mongoClusters.length + iacSchema.queues.length + iacSchema.topics.length + iacSchema.lambdas.length + iacSchema.buckets.length + iacSchema.parameters.length + iacSchema.secrets.length + iacSchema.apiGateways.length;
-      iacDriftAnalyzer = new import_analyzers.IaCDriftAnalyzer();
-      iacDriftAnalyzer.setIaCSchema(iacSchema);
-      spin.succeed(import_chalk4.default.green("IaC schema") + import_chalk4.default.dim(`  ${total} resource(s) across TF/CFN/CDK`));
-    } catch (err) {
-      spin.warn(import_chalk4.default.yellow("IaC scan skipped") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-    }
-  }
-  let operations;
-  {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim(`Scanning ${path3.basename(repoPath)} for service usage...`), color: "cyan" }).start();
-    try {
-      operations = await (0, import_context.scanRepository)(repoPath);
-      spin.succeed(import_chalk4.default.green("Repository scanned") + import_chalk4.default.dim(`  ${operations.length} service operation(s) found`));
-    } catch (err) {
-      spin.warn(import_chalk4.default.yellow("Repository scan failed") + import_chalk4.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-      operations = [];
-    }
-  }
-  let graph;
-  {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Building infrastructure graph..."), color: "cyan" }).start();
-    graph = (0, import_graph.buildGraph)(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
-    spin.succeed(import_chalk4.default.green("Graph built") + import_chalk4.default.dim(`  ${graph.nodes.length} nodes, ${graph.edges.length} edges`));
-  }
-  const findings = await (async () => {
-    const spin = (0, import_ora2.default)({ text: import_chalk4.default.dim("Running analyzers..."), color: "cyan" }).start();
-    const {
-      FullTableScanAnalyzer,
-      MissingGSIAnalyzer,
-      HotPartitionAnalyzer,
-      MissingIndexAnalyzer,
-      NplusOneAnalyzer,
-      LargeSelectAnalyzer,
-      MissingMySQLIndexAnalyzer,
-      MySQLFullTableScanAnalyzer,
-      MissingMongoIndexAnalyzer,
-      MongoCollectionScanAnalyzer,
-      MissingDLQAnalyzer,
-      UnencryptedQueueAnalyzer,
-      LargeQueueBacklogAnalyzer,
-      MissingSecretRotationAnalyzer,
-      MissingLogRetentionAnalyzer,
-      LambdaDefaultMemoryAnalyzer,
-      LambdaHighTimeoutAnalyzer
-    } = await Promise.resolve().then(() => __toESM(require_dist11()));
-    const analyzers = [
-      new FullTableScanAnalyzer(),
-      new MissingGSIAnalyzer(),
-      new HotPartitionAnalyzer(),
-      new MissingIndexAnalyzer(),
-      new NplusOneAnalyzer(),
-      new LargeSelectAnalyzer(),
-      new MissingMySQLIndexAnalyzer(),
-      new MySQLFullTableScanAnalyzer(),
-      new MissingMongoIndexAnalyzer(),
-      new MongoCollectionScanAnalyzer(),
-      new MissingDLQAnalyzer(),
-      new UnencryptedQueueAnalyzer(),
-      new LargeQueueBacklogAnalyzer(),
-      new MissingSecretRotationAnalyzer(),
-      new MissingLogRetentionAnalyzer(),
-      new LambdaDefaultMemoryAnalyzer(),
-      new LambdaHighTimeoutAnalyzer(),
-      ...iacDriftAnalyzer ? [iacDriftAnalyzer] : []
-    ];
-    const result = await (0, import_analyzers.runAllAnalyzers)(graph, analyzers);
-    spin.succeed(import_chalk4.default.green("Analysis complete") + import_chalk4.default.dim(`  ${result.length} finding(s)`));
-    return result;
-  })();
-  (0, import_core2.writeCache)("graph", graph);
-  (0, import_core2.writeCache)("findings", findings);
-  (0, import_core2.writeCache)("operations", operations);
-  console.log("");
-  if (findings.length === 0) {
-    console.log(`  ${import_chalk4.default.green.bold("\u2713 No issues found!")}  ${import_chalk4.default.dim("Your infrastructure looks clean.")}`);
-  } else {
-    console.log(import_chalk4.default.bold(`  Findings`) + import_chalk4.default.dim(`  ${findings.length} total`));
-    findings.forEach((f, i) => printFinding(f, i));
-    printSummaryBox(findings);
-    if (findings.some((f) => f.severity === "high")) {
-      console.log(`
-  ${import_chalk4.default.red.bold("Action required:")} ${import_chalk4.default.red("High severity issues detected.")}`);
-    }
-  }
-  console.log("");
-  log.dim(`Results cached in .infrawise/cache/`);
-  log.info(`Run ${import_chalk4.default.cyan("infrawise dev")} to explore via the MCP server`);
-  console.log("");
-}
-
-// src/commands/dev.ts
-var import_chalk5 = __toESM(require("chalk"));
-var import_ora3 = __toESM(require("ora"));
-var import_core3 = __toESM(require_dist());
-var import_server = __toESM(require_dist12());
-async function runDev(options = {}) {
-  const port = options.port ?? 3e3;
-  printHeader("MCP Server");
-  try {
-    (0, import_core3.loadConfig)(options.config);
-    log.success("Config loaded", options.config ?? "infrawise.yaml");
-  } catch (err) {
-    console.error((0, import_core3.formatError)(err));
-    process.exit(1);
-  }
-  const cachedGraph = (0, import_core3.readCache)("graph");
-  const cachedFindings = (0, import_core3.readCache)("findings");
-  if (cachedGraph && cachedFindings) {
-    log.success(
-      "Cached analysis loaded",
-      `${cachedGraph.nodes.length} nodes \xB7 ${cachedGraph.edges.length} edges \xB7 ${cachedFindings.length} finding(s)`
-    );
-    (0, import_server.setGraphState)(cachedGraph, cachedFindings);
-  } else {
-    log.warn("No cached analysis found");
-    log.dim(`Run ${import_chalk5.default.cyan("infrawise analyze")} first for full results`);
-    (0, import_server.setGraphState)({ nodes: [], edges: [] }, []);
-  }
-  console.log("");
-  const spin = (0, import_ora3.default)({ text: import_chalk5.default.dim("Starting server..."), color: "cyan" }).start();
-  const { start } = (0, import_server.createServer)(port);
-  await start();
-  spin.succeed(import_chalk5.default.green("Server running"));
-  console.log("");
-  console.log(import_chalk5.default.dim("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-  console.log(import_chalk5.default.dim("  \u2502") + import_chalk5.default.bold("  MCP Server                                        ") + import_chalk5.default.dim("\u2502"));
-  console.log(import_chalk5.default.dim("  \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
-  console.log(import_chalk5.default.dim("  \u2502") + `  ${import_chalk5.default.dim("POST")} ${import_chalk5.default.cyan(`http://localhost:${port}/mcp`)}           ` + import_chalk5.default.dim("\u2502"));
-  console.log(import_chalk5.default.dim("  \u2502") + `  ${import_chalk5.default.dim("GET")}  ${import_chalk5.default.cyan(`http://localhost:${port}/mcp/tools`)}      ` + import_chalk5.default.dim("\u2502"));
-  console.log(import_chalk5.default.dim("  \u2502") + `  ${import_chalk5.default.dim("GET")}  ${import_chalk5.default.cyan(`http://localhost:${port}/health`)}          ` + import_chalk5.default.dim("\u2502"));
-  console.log(import_chalk5.default.dim("  \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
-  console.log(import_chalk5.default.dim("  \u2502") + import_chalk5.default.dim("  Tools: get_graph_summary \xB7 analyze_function        ") + import_chalk5.default.dim("\u2502"));
-  console.log(import_chalk5.default.dim("  \u2502") + import_chalk5.default.dim("         suggest_gsi \xB7 postgres_index_suggestions    ") + import_chalk5.default.dim("\u2502"));
-  console.log(import_chalk5.default.dim("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
-  console.log("");
-  console.log(import_chalk5.default.dim("  Add to .claude/settings.json:"));
-  console.log(import_chalk5.default.dim("  {"));
-  console.log(import_chalk5.default.dim('    "mcpServers": {'));
-  console.log(import_chalk5.default.dim('      "infrawise": {'));
-  console.log(import_chalk5.default.dim(`        "url": "http://localhost:${port}/mcp"`));
-  console.log(import_chalk5.default.dim("      }"));
-  console.log(import_chalk5.default.dim("    }"));
-  console.log(import_chalk5.default.dim("  }"));
-  console.log("");
-  console.log(import_chalk5.default.dim("  Press Ctrl+C to stop\n"));
-  process.on("SIGINT", () => {
-    console.log(import_chalk5.default.dim("\n  Shutting down...\n"));
-    process.exit(0);
-  });
-  await new Promise(() => {
-  });
-}
-
-// src/commands/doctor.ts
-var fs3 = __toESM(require("fs"));
-var path4 = __toESM(require("path"));
-var os2 = __toESM(require("os"));
-var import_chalk6 = __toESM(require("chalk"));
-var import_ora4 = __toESM(require("ora"));
-var import_core4 = __toESM(require_dist());
-var import_adapters_dynamodb3 = __toESM(require_dist2());
-var import_adapters_postgres2 = __toESM(require_dist3());
-var import_adapters_mysql2 = __toESM(require_dist4());
-var import_adapters_mongodb2 = __toESM(require_dist5());
-var import_adapters_aws_services2 = __toESM(require_dist7());
-var import_adapters_logs2 = __toESM(require_dist8());
-async function runCheck(label, fn) {
-  const spin = (0, import_ora4.default)({ text: import_chalk6.default.dim(label), color: "cyan" }).start();
-  const result = await fn();
-  switch (result.status) {
-    case "pass":
-      spin.succeed(import_chalk6.default.green(result.name) + import_chalk6.default.dim(`  ${result.message}`));
-      break;
-    case "fail":
-      spin.fail(import_chalk6.default.red(result.name) + import_chalk6.default.dim(`  ${result.message}`));
-      break;
-    case "warn":
-      spin.warn(import_chalk6.default.yellow(result.name) + import_chalk6.default.dim(`  ${result.message}`));
-      break;
-    case "skip":
-      spin.info(import_chalk6.default.dim(`${result.name}  ${result.message}`));
-      break;
-  }
-  if (result.detail) console.log(import_chalk6.default.dim(`       ${result.detail}`));
-  return result;
-}
-async function runDoctor(options = {}) {
-  printHeader("Infrawise Doctor");
-  const configPath = path4.resolve(options.config ?? "infrawise.yaml");
-  const results = [];
-  results.push(await runCheck("Checking config file...", async () => {
-    const exists = fs3.existsSync(configPath);
-    return {
-      name: "Config file",
-      status: exists ? "pass" : "fail",
-      message: exists ? configPath : `Not found at ${configPath}`,
-      detail: exists ? void 0 : "Run: infrawise init"
-    };
-  }));
-  let config;
-  results.push(await runCheck("Validating config...", async () => {
-    if (!fs3.existsSync(configPath)) return { name: "Config validation", status: "skip", message: "No config file" };
-    try {
-      config = (0, import_core4.loadConfig)(options.config);
-      return { name: "Config validation", status: "pass", message: `project: ${config.project}` };
-    } catch (err) {
-      return {
-        name: "Config validation",
-        status: "fail",
-        message: "Invalid config",
-        detail: err instanceof Error ? err.message : String(err)
-      };
-    }
-  }));
-  results.push(await runCheck("Checking AWS credentials...", async () => {
-    const home = process.env.HOME ?? os2.homedir();
-    const hasCreds = fs3.existsSync(path4.join(home, ".aws", "credentials")) || fs3.existsSync(path4.join(home, ".aws", "config"));
-    return {
-      name: "AWS credentials",
-      status: hasCreds ? "pass" : "warn",
-      message: hasCreds ? "Found" : "Not found \u2014 may use env vars or IAM role",
-      detail: hasCreds ? void 0 : "Run: aws configure"
-    };
-  }));
-  const awsCfg = { region: config?.aws?.region, profile: config?.aws?.profile };
-  results.push(await runCheck("Testing DynamoDB access...", async () => {
-    if (!config) return { name: "DynamoDB", status: "skip", message: "No valid config" };
-    try {
-      const ok = await (0, import_adapters_dynamodb3.validateDynamoAccess)(config);
-      return {
-        name: "DynamoDB",
-        status: ok ? "pass" : "fail",
-        message: ok ? `Connected (profile: ${config.aws?.profile ?? "default"})` : "Cannot connect",
-        detail: ok ? void 0 : "Check IAM: dynamodb:ListTables, dynamodb:DescribeTable"
-      };
-    } catch (err) {
-      return { name: "DynamoDB", status: "fail", message: err instanceof Error ? err.message : String(err) };
-    }
-  }));
-  results.push(await runCheck("Testing SQS access...", async () => {
-    if (config?.sqs?.enabled === false) return { name: "SQS", status: "skip", message: "Disabled in config" };
-    try {
-      await (0, import_adapters_aws_services2.validateSQSAccess)(awsCfg);
-      return { name: "SQS", status: "pass", message: "Connected" };
-    } catch (err) {
-      return {
-        name: "SQS",
-        status: "warn",
-        message: err instanceof Error ? err.message : String(err),
-        detail: "Check IAM: sqs:ListQueues, sqs:GetQueueAttributes"
-      };
-    }
-  }));
-  results.push(await runCheck("Testing SNS access...", async () => {
-    if (config?.sns?.enabled === false) return { name: "SNS", status: "skip", message: "Disabled in config" };
-    try {
-      await (0, import_adapters_aws_services2.validateSNSAccess)(awsCfg);
-      return { name: "SNS", status: "pass", message: "Connected" };
-    } catch (err) {
-      return {
-        name: "SNS",
-        status: "warn",
-        message: err instanceof Error ? err.message : String(err),
-        detail: "Check IAM: sns:ListTopics, sns:GetTopicAttributes, sns:ListSubscriptionsByTopic"
-      };
-    }
-  }));
-  results.push(await runCheck("Testing SSM Parameter Store access...", async () => {
-    if (config?.ssm?.enabled === false) return { name: "SSM", status: "skip", message: "Disabled in config" };
-    try {
-      await (0, import_adapters_aws_services2.validateSSMAccess)(awsCfg);
-      return { name: "SSM", status: "pass", message: "Connected (metadata only)" };
-    } catch (err) {
-      return {
-        name: "SSM",
-        status: "warn",
-        message: err instanceof Error ? err.message : String(err),
-        detail: "Check IAM: ssm:DescribeParameters"
-      };
-    }
-  }));
-  results.push(await runCheck("Testing Secrets Manager access...", async () => {
-    if (config?.secretsManager?.enabled === false) return { name: "Secrets Manager", status: "skip", message: "Disabled in config" };
-    try {
-      await (0, import_adapters_aws_services2.validateSecretsAccess)(awsCfg);
-      return { name: "Secrets Manager", status: "pass", message: "Connected (names/rotation only)" };
-    } catch (err) {
-      return {
-        name: "Secrets Manager",
-        status: "warn",
-        message: err instanceof Error ? err.message : String(err),
-        detail: "Check IAM: secretsmanager:ListSecrets"
-      };
-    }
-  }));
-  results.push(await runCheck("Testing Lambda access...", async () => {
-    if (config?.lambda?.enabled === false) return { name: "Lambda", status: "skip", message: "Disabled in config" };
-    try {
-      await (0, import_adapters_aws_services2.validateLambdaAccess)(awsCfg);
-      return { name: "Lambda", status: "pass", message: "Connected" };
-    } catch (err) {
-      return {
-        name: "Lambda",
-        status: "warn",
-        message: err instanceof Error ? err.message : String(err),
-        detail: "Check IAM: lambda:ListFunctions"
-      };
-    }
-  }));
-  results.push(await runCheck("Testing CloudWatch Logs access...", async () => {
-    if (!config?.cloudwatchLogs?.enabled) return { name: "CloudWatch Logs", status: "skip", message: "Not enabled in config" };
-    try {
-      await (0, import_adapters_logs2.validateLogsAccess)(awsCfg);
-      return { name: "CloudWatch Logs", status: "pass", message: "Connected" };
-    } catch (err) {
-      return {
-        name: "CloudWatch Logs",
-        status: "warn",
-        message: err instanceof Error ? err.message : String(err),
-        detail: "Check IAM: logs:DescribeLogGroups, logs:FilterLogEvents"
-      };
-    }
-  }));
-  results.push(await runCheck("Testing PostgreSQL...", async () => {
-    if (!config?.postgres?.enabled || !config.postgres.connectionString) {
-      return { name: "PostgreSQL", status: "skip", message: "Not configured" };
-    }
-    try {
-      const ok = await (0, import_adapters_postgres2.validatePostgresAccess)(config.postgres.connectionString);
-      return {
-        name: "PostgreSQL",
-        status: ok ? "pass" : "fail",
-        message: ok ? "Connected" : "Cannot connect",
-        detail: ok ? void 0 : "Check connection string and security group"
-      };
-    } catch (err) {
-      return { name: "PostgreSQL", status: "fail", message: err instanceof Error ? err.message : String(err) };
-    }
-  }));
-  results.push(await runCheck("Testing MySQL...", async () => {
-    if (!config?.mysql?.enabled || !config.mysql.connectionString) {
-      return { name: "MySQL", status: "skip", message: "Not configured" };
-    }
-    try {
-      const ok = await (0, import_adapters_mysql2.validateMySQLAccess)(config.mysql.connectionString);
-      return {
-        name: "MySQL",
-        status: ok ? "pass" : "fail",
-        message: ok ? "Connected" : "Cannot connect",
-        detail: ok ? void 0 : "Check connection string, host, port 3306"
-      };
-    } catch (err) {
-      return { name: "MySQL", status: "fail", message: err instanceof Error ? err.message : String(err) };
-    }
-  }));
-  results.push(await runCheck("Testing MongoDB...", async () => {
-    if (!config?.mongodb?.enabled || !config.mongodb.connectionString) {
-      return { name: "MongoDB", status: "skip", message: "Not configured" };
-    }
-    try {
-      const ok = await (0, import_adapters_mongodb2.validateMongoAccess)(config.mongodb.connectionString);
-      return {
-        name: "MongoDB",
-        status: ok ? "pass" : "fail",
-        message: ok ? "Connected" : "Cannot connect",
-        detail: ok ? void 0 : "Check connection string and port 27017"
-      };
-    } catch (err) {
-      return { name: "MongoDB", status: "fail", message: err instanceof Error ? err.message : String(err) };
-    }
-  }));
-  results.push(await runCheck("Detecting project type...", async () => {
-    const hasTsConfig = fs3.existsSync(path4.join(process.cwd(), "tsconfig.json"));
-    const hasPkg = fs3.existsSync(path4.join(process.cwd(), "package.json"));
-    return {
-      name: "Project type",
-      status: hasTsConfig ? "pass" : "warn",
-      message: hasTsConfig ? "TypeScript" : hasPkg ? "JavaScript (no tsconfig.json)" : "Unknown",
-      detail: hasTsConfig ? void 0 : "Scanner works best with TypeScript projects"
-    };
-  }));
-  results.push(await runCheck("Detecting IaC files...", async () => {
-    const cwd = process.cwd();
-    const hasTF = fs3.existsSync(path4.join(cwd, "main.tf")) || fs3.readdirSync(cwd).some((f) => f.endsWith(".tf"));
-    const hasCFN = fs3.existsSync(path4.join(cwd, "template.yaml")) || fs3.existsSync(path4.join(cwd, "template.json"));
-    const hasCDK = fs3.existsSync(path4.join(cwd, "cdk.json"));
-    const hasCDKOut = fs3.existsSync(path4.join(cwd, "cdk.out"));
-    const found = [];
-    if (hasTF) found.push("Terraform");
-    if (hasCFN) found.push("CloudFormation");
-    if (hasCDK) found.push(`CDK${hasCDKOut ? " (synthesized)" : " (run cdk synth)"}`);
-    return {
-      name: "IaC files",
-      status: found.length > 0 ? "pass" : "warn",
-      message: found.length > 0 ? found.join(", ") : "No Terraform/CFN/CDK files detected",
-      detail: found.length === 0 ? "IaC analysis will be skipped without TF/CFN/CDK files" : void 0
-    };
-  }));
-  results.push(await runCheck("Checking analysis cache...", async () => {
-    const cached = fs3.existsSync(path4.join(process.cwd(), ".infrawise", "cache", "graph.json"));
-    return {
-      name: "Analysis cache",
-      status: cached ? "pass" : "warn",
-      message: cached ? "Cached results found" : "No cache \u2014 run infrawise analyze first"
-    };
-  }));
-  const passed = results.filter((r) => r.status === "pass").length;
-  const failed = results.filter((r) => r.status === "fail").length;
-  const warned = results.filter((r) => r.status === "warn").length;
-  console.log("");
-  console.log(import_chalk6.default.dim("  " + "\u2500".repeat(40)));
-  if (failed === 0) {
-    console.log(`  ${import_chalk6.default.green.bold("All checks passed")}  ${import_chalk6.default.dim(`${passed} passed, ${warned} warning(s)`)}`);
-  } else {
-    console.log(`  ${import_chalk6.default.red.bold(`${failed} check(s) failed`)}  ${import_chalk6.default.dim(`${passed} passed, ${warned} warning(s)`)}`);
-  }
-  console.log("");
-  if (failed > 0) process.exit(1);
-}
-
-// src/index.ts
-var program = new import_commander.Command();
-program.name("infrawise").description("CLI-first infrastructure intelligence platform for DynamoDB and PostgreSQL").version("0.1.0");
-program.command("init").description("Detect AWS profile/region, discover DynamoDB tables, and generate infrawise.yaml").option("--force", "Overwrite existing infrawise.yaml").action(async (options) => {
-  printBanner();
-  await runInit({ force: options.force });
-});
-program.command("auth").description("Validate and select AWS profile from ~/.aws/credentials").action(async () => {
-  printBanner();
-  await runAuth();
-});
-program.command("analyze").description("Load config, run extractors, build graph, and run all analyzers").option("-c, --config <path>", "Path to infrawise.yaml", "infrawise.yaml").option("-r, --repo <path>", "Path to repository to scan", process.cwd()).option("--no-cache", "Skip reading/writing the cache").action(async (options) => {
-  printBanner();
-  await runAnalyze({
-    config: options.config !== "infrawise.yaml" ? options.config : void 0,
-    repo: options.repo,
-    noCache: !options.cache
-  });
-});
-program.command("dev").description("Start Fastify MCP server on localhost:3000").option("-c, --config <path>", "Path to infrawise.yaml", "infrawise.yaml").option("-p, --port <number>", "Port to listen on", "3000").action(async (options) => {
-  printBanner();
-  await runDev({
-    config: options.config !== "infrawise.yaml" ? options.config : void 0,
-    port: parseInt(options.port, 10)
-  });
-});
-program.command("doctor").description("Validate AWS access, postgres connectivity, config, and repo scan").option("-c, --config <path>", "Path to infrawise.yaml", "infrawise.yaml").action(async (options) => {
-  printBanner();
-  await runDoctor({
-    config: options.config !== "infrawise.yaml" ? options.config : void 0
-  });
-});
-program.exitOverride((err) => {
-  if (err.code === "commander.helpDisplayed" || err.code === "commander.version") {
-    process.exit(0);
-  }
-  console.error(`
-Error: ${err.message}`);
-  process.exit(1);
-});
-process.on("unhandledRejection", (reason) => {
-  console.error("\nUnhandled error:", reason instanceof Error ? reason.message : String(reason));
-  process.exit(1);
-});
-program.parse(process.argv);