infrawise 0.1.2 → 0.2.1

package/dist/adapters/terraform.js

@@ -0,0 +1,510 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractTerraformSchema = extractTerraformSchema;
+exports.extractCloudFormationSchema = extractCloudFormationSchema;
+exports.extractCDKSchema = extractCDKSchema;
+exports.extractIaCSchema = extractIaCSchema;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const js_yaml_1 = __importDefault(require("js-yaml"));
+const core_1 = require("../core");
+function emptySchema() {
+    return {
+        dynamoTables: [],
+        rdsInstances: [],
+        mongoClusters: [],
+        queues: [],
+        topics: [],
+        lambdas: [],
+        buckets: [],
+        parameters: [],
+        secrets: [],
+        apiGateways: [],
+    };
+}
+// ─── File discovery ───────────────────────────────────────────────────────────
+function findFilesRecursively(dir, extensions, skipDirs = new Set(['node_modules', '.git', 'dist', '.infrawise'])) {
+    const results = [];
+    if (!fs.existsSync(dir))
+        return results;
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        if (skipDirs.has(entry.name))
+            continue;
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            results.push(...findFilesRecursively(fullPath, extensions, skipDirs));
+        }
+        else if (extensions.some((ext) => entry.name.endsWith(ext))) {
+            results.push(fullPath);
+        }
+    }
+    return results;
+}
+// ─── Terraform HCL parser ─────────────────────────────────────────────────────
+function extractTerraformResourceBlocks(content) {
+    const results = [];
+    const resourcePattern = /resource\s+"([^"]+)"\s+"([^"]+)"\s*\{/g;
+    let match;
+    while ((match = resourcePattern.exec(content)) !== null) {
+        const resourceType = match[1] ?? '';
+        const resourceName = match[2] ?? '';
+        const startBrace = match.index + match[0].length - 1;
+        let depth = 1;
+        let i = startBrace + 1;
+        while (i < content.length && depth > 0) {
+            if (content[i] === '{')
+                depth++;
+            else if (content[i] === '}')
+                depth--;
+            i++;
+        }
+        results.push({ resourceType, resourceName, body: content.slice(startBrace + 1, i - 1) });
+    }
+    return results;
+}
+function tfStr(body, attr) {
+    const m = body.match(new RegExp(`${attr}\\s*=\\s*"([^"]*)"`, 'i'));
+    return m?.[1];
+}
+function tfBool(body, attr) {
+    const m = body.match(new RegExp(`${attr}\\s*=\\s*(true|false)`, 'i'));
+    return m?.[1] === 'true';
+}
+function tfGSINames(body) {
+    const names = [];
+    const pat = /global_secondary_index\s*\{([^}]*)\}/g;
+    let m;
+    while ((m = pat.exec(body)) !== null) {
+        const nameMatch = m[1].match(/name\s*=\s*"([^"]*)"/);
+        if (nameMatch?.[1])
+            names.push(nameMatch[1]);
+    }
+    return names;
+}
+async function extractTerraformSchema(repoPath) {
+    const schema = emptySchema();
+    const tfFiles = findFilesRecursively(repoPath, ['.tf']);
+    core_1.logger.debug(`Found ${tfFiles.length} Terraform file(s)`);
+    for (const filePath of tfFiles) {
+        let content;
+        try {
+            content = fs.readFileSync(filePath, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        for (const { resourceType, resourceName, body } of extractTerraformResourceBlocks(content)) {
+            switch (resourceType) {
+                case 'aws_dynamodb_table':
+                    schema.dynamoTables.push({
+                        name: tfStr(body, 'name') ?? resourceName,
+                        partitionKey: tfStr(body, 'hash_key'),
+                        sortKey: tfStr(body, 'range_key'),
+                        gsiNames: tfGSINames(body),
+                        source: 'terraform', filePath,
+                    });
+                    break;
+                case 'aws_db_instance':
+                case 'aws_rds_cluster':
+                    schema.rdsInstances.push({
+                        identifier: tfStr(body, 'identifier') ?? tfStr(body, 'cluster_identifier') ?? resourceName,
+                        engine: tfStr(body, 'engine') ?? 'unknown',
+                        source: 'terraform', filePath,
+                    });
+                    break;
+                case 'aws_docdb_cluster':
+                    schema.mongoClusters.push({
+                        identifier: tfStr(body, 'cluster_identifier') ?? resourceName,
+                        source: 'terraform', filePath,
+                    });
+                    break;
+                case 'aws_sqs_queue': {
+                    const name = tfStr(body, 'name') ?? resourceName;
+                    const hasDLQ = body.includes('redrive_policy');
+                    const encrypted = body.includes('kms_master_key_id') || tfBool(body, 'sqs_managed_sse_enabled');
+                    schema.queues.push({ name, hasDLQ, encrypted, source: 'terraform', filePath });
+                    break;
+                }
+                case 'aws_sns_topic':
+                    schema.topics.push({
+                        name: tfStr(body, 'name') ?? resourceName,
+                        encrypted: body.includes('kms_master_key_id'),
+                        source: 'terraform', filePath,
+                    });
+                    break;
+                case 'aws_lambda_function':
+                    schema.lambdas.push({
+                        name: tfStr(body, 'function_name') ?? resourceName,
+                        runtime: tfStr(body, 'runtime'),
+                        source: 'terraform', filePath,
+                    });
+                    break;
+                case 'aws_s3_bucket':
+                    schema.buckets.push({
+                        name: tfStr(body, 'bucket') ?? tfStr(body, 'bucket_prefix') ?? resourceName,
+                        versioned: body.includes('versioning') && body.includes('enabled = true'),
+                        source: 'terraform', filePath,
+                    });
+                    break;
+                case 'aws_ssm_parameter':
+                    schema.parameters.push({
+                        name: tfStr(body, 'name') ?? resourceName,
+                        type: tfStr(body, 'type') ?? 'String',
+                        source: 'terraform', filePath,
+                    });
+                    break;
+                case 'aws_secretsmanager_secret':
+                    schema.secrets.push({
+                        name: tfStr(body, 'name') ?? resourceName,
+                        source: 'terraform', filePath,
+                    });
+                    break;
+                case 'aws_api_gateway_rest_api':
+                case 'aws_apigatewayv2_api':
+                    schema.apiGateways.push({
+                        name: tfStr(body, 'name') ?? resourceName,
+                        source: 'terraform', filePath,
+                    });
+                    break;
+            }
+        }
+    }
+    return schema;
+}
+// ─── CloudFormation / CDK parser ──────────────────────────────────────────────
+function isCloudFormationTemplate(parsed) {
+    if (typeof parsed !== 'object' || parsed === null)
+        return false;
+    const obj = parsed;
+    return 'AWSTemplateFormatVersion' in obj || ('Resources' in obj && typeof obj['Resources'] === 'object');
+}
+function parseCFNFile(filePath) {
+    let content;
+    try {
+        content = fs.readFileSync(filePath, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    if (!content.includes('AWSTemplateFormatVersion') && !content.includes('Resources'))
+        return null;
+    let parsed;
+    try {
+        parsed = filePath.endsWith('.json') ? JSON.parse(content) : js_yaml_1.default.load(content);
+    }
+    catch {
+        return null;
+    }
+    if (!isCloudFormationTemplate(parsed))
+        return null;
+    return parsed;
+}
+function cfnStr(props, ...keys) {
+    for (const key of keys) {
+        if (typeof props[key] === 'string')
+            return props[key];
+    }
+    return undefined;
+}
+function cfnBool(props, key) {
+    return props[key] === true || props[key] === 'true' || props[key] === 'Enabled';
+}
+function processCFNResources(resources, schema, filePath, source) {
+    for (const [logicalId, rawResource] of Object.entries(resources)) {
+        if (typeof rawResource !== 'object' || rawResource === null)
+            continue;
+        const resource = rawResource;
+        const resourceType = resource['Type'];
+        const props = (resource['Properties'] ?? {});
+        switch (resourceType) {
+            case 'AWS::DynamoDB::Table': {
+                let pk, sk;
+                const keySchema = props['KeySchema'];
+                if (Array.isArray(keySchema)) {
+                    for (const kd of keySchema) {
+                        if (typeof kd !== 'object' || kd === null)
+                            continue;
+                        const k = kd;
+                        if (k['KeyType'] === 'HASH')
+                            pk = k['AttributeName'];
+                        if (k['KeyType'] === 'RANGE')
+                            sk = k['AttributeName'];
+                    }
+                }
+                const gsiNames = [];
+                const gsis = props['GlobalSecondaryIndexes'];
+                if (Array.isArray(gsis)) {
+                    for (const g of gsis) {
+                        if (typeof g === 'object' && g !== null) {
+                            const gi = g;
+                            if (typeof gi['IndexName'] === 'string')
+                                gsiNames.push(gi['IndexName']);
+                        }
+                    }
+                }
+                schema.dynamoTables.push({
+                    name: cfnStr(props, 'TableName') ?? logicalId,
+                    partitionKey: pk,
+                    sortKey: sk,
+                    gsiNames,
+                    source, filePath,
+                });
+                break;
+            }
+            case 'AWS::RDS::DBInstance':
+                schema.rdsInstances.push({
+                    identifier: cfnStr(props, 'DBInstanceIdentifier') ?? logicalId,
+                    engine: cfnStr(props, 'Engine') ?? 'unknown',
+                    source, filePath,
+                });
+                break;
+            case 'AWS::RDS::DBCluster':
+                schema.rdsInstances.push({
+                    identifier: cfnStr(props, 'DBClusterIdentifier') ?? logicalId,
+                    engine: cfnStr(props, 'Engine') ?? 'aurora',
+                    source, filePath,
+                });
+                break;
+            case 'AWS::DocDB::DBCluster':
+                schema.mongoClusters.push({
+                    identifier: cfnStr(props, 'DBClusterIdentifier') ?? logicalId,
+                    source, filePath,
+                });
+                break;
+            case 'AWS::SQS::Queue': {
+                const name = cfnStr(props, 'QueueName') ?? logicalId;
+                const hasDLQ = !!props['RedrivePolicy'];
+                const encrypted = !!(props['KmsMasterKeyId'] || cfnBool(props, 'SqsManagedSseEnabled'));
+                schema.queues.push({ name, hasDLQ, encrypted, source, filePath });
+                break;
+            }
+            case 'AWS::SNS::Topic':
+                schema.topics.push({
+                    name: cfnStr(props, 'TopicName') ?? logicalId,
+                    encrypted: !!props['KmsMasterKeyId'],
+                    source, filePath,
+                });
+                break;
+            case 'AWS::Lambda::Function':
+                schema.lambdas.push({
+                    name: cfnStr(props, 'FunctionName') ?? logicalId,
+                    runtime: cfnStr(props, 'Runtime'),
+                    source, filePath,
+                });
+                break;
+            case 'AWS::S3::Bucket': {
+                const versioningConfig = props['VersioningConfiguration'];
+                schema.buckets.push({
+                    name: cfnStr(props, 'BucketName') ?? logicalId,
+                    versioned: versioningConfig?.['Status'] === 'Enabled',
+                    source, filePath,
+                });
+                break;
+            }
+            case 'AWS::SSM::Parameter':
+                schema.parameters.push({
+                    name: cfnStr(props, 'Name') ?? logicalId,
+                    type: cfnStr(props, 'Type') ?? 'String',
+                    source, filePath,
+                });
+                break;
+            case 'AWS::SecretsManager::Secret':
+                schema.secrets.push({
+                    name: cfnStr(props, 'Name') ?? logicalId,
+                    source, filePath,
+                });
+                break;
+            case 'AWS::ApiGateway::RestApi':
+            case 'AWS::ApiGatewayV2::Api':
+                schema.apiGateways.push({
+                    name: cfnStr(props, 'Name') ?? logicalId,
+                    source, filePath,
+                });
+                break;
+        }
+    }
+}
+async function extractCloudFormationSchema(repoPath) {
+    const schema = emptySchema();
+    const cfnFiles = findFilesRecursively(repoPath, ['.yaml', '.yml', '.json']);
+    core_1.logger.debug(`Scanning ${cfnFiles.length} potential CloudFormation file(s)`);
+    for (const filePath of cfnFiles) {
+        const parsed = parseCFNFile(filePath);
+        if (!parsed)
+            continue;
+        const resources = parsed['Resources'];
+        if (!resources)
+            continue;
+        processCFNResources(resources, schema, filePath, 'cloudformation');
+    }
+    return schema;
+}
+// ─── CDK parser ───────────────────────────────────────────────────────────────
+async function extractCDKSchema(repoPath) {
+    const schema = emptySchema();
+    // Strategy 1: Parse cdk.out/*.template.json (synthesized CloudFormation)
+    const cdkOutDir = path.join(repoPath, 'cdk.out');
+    if (fs.existsSync(cdkOutDir)) {
+        const templateFiles = fs.readdirSync(cdkOutDir)
+            .filter((f) => f.endsWith('.template.json'))
+            .map((f) => path.join(cdkOutDir, f));
+        core_1.logger.debug(`Found ${templateFiles.length} CDK synthesized template(s) in cdk.out/`);
+        for (const filePath of templateFiles) {
+            const parsed = parseCFNFile(filePath);
+            if (!parsed)
+                continue;
+            const resources = parsed['Resources'];
+            if (!resources)
+                continue;
+            processCFNResources(resources, schema, filePath, 'cdk');
+        }
+    }
+    // Strategy 2: Detect CDK TypeScript construct patterns if no cdk.out exists
+    if (schema.queues.length === 0 && schema.topics.length === 0 && schema.lambdas.length === 0) {
+        const cdkJsonPath = path.join(repoPath, 'cdk.json');
+        if (fs.existsSync(cdkJsonPath)) {
+            core_1.logger.debug('CDK project detected (cdk.json found) — run `cdk synth` for full IaC analysis');
+        }
+    }
+    return schema;
+}
+// ─── Combined ─────────────────────────────────────────────────────────────────
+function mergeSchemas(...schemas) {
+    const merged = emptySchema();
+    const seen = {
+        dynamo: new Set(),
+        rds: new Set(),
+        mongo: new Set(),
+        queue: new Set(),
+        topic: new Set(),
+        lambda: new Set(),
+        bucket: new Set(),
+        param: new Set(),
+        secret: new Set(),
+        api: new Set(),
+    };
+    for (const schema of schemas) {
+        for (const t of schema.dynamoTables) {
+            const k = `${t.source}::${t.name}`;
+            if (!seen.dynamo.has(k)) {
+                seen.dynamo.add(k);
+                merged.dynamoTables.push(t);
+            }
+        }
+        for (const r of schema.rdsInstances) {
+            const k = `${r.source}::${r.identifier}`;
+            if (!seen.rds.has(k)) {
+                seen.rds.add(k);
+                merged.rdsInstances.push(r);
+            }
+        }
+        for (const m of schema.mongoClusters) {
+            const k = `${m.source}::${m.identifier}`;
+            if (!seen.mongo.has(k)) {
+                seen.mongo.add(k);
+                merged.mongoClusters.push(m);
+            }
+        }
+        for (const q of schema.queues) {
+            const k = `${q.source}::${q.name}`;
+            if (!seen.queue.has(k)) {
+                seen.queue.add(k);
+                merged.queues.push(q);
+            }
+        }
+        for (const t of schema.topics) {
+            const k = `${t.source}::${t.name}`;
+            if (!seen.topic.has(k)) {
+                seen.topic.add(k);
+                merged.topics.push(t);
+            }
+        }
+        for (const l of schema.lambdas) {
+            const k = `${l.source}::${l.name}`;
+            if (!seen.lambda.has(k)) {
+                seen.lambda.add(k);
+                merged.lambdas.push(l);
+            }
+        }
+        for (const b of schema.buckets) {
+            const k = `${b.source}::${b.name}`;
+            if (!seen.bucket.has(k)) {
+                seen.bucket.add(k);
+                merged.buckets.push(b);
+            }
+        }
+        for (const p of schema.parameters) {
+            const k = `${p.source}::${p.name}`;
+            if (!seen.param.has(k)) {
+                seen.param.add(k);
+                merged.parameters.push(p);
+            }
+        }
+        for (const s of schema.secrets) {
+            const k = `${s.source}::${s.name}`;
+            if (!seen.secret.has(k)) {
+                seen.secret.add(k);
+                merged.secrets.push(s);
+            }
+        }
+        for (const a of schema.apiGateways) {
+            const k = `${a.source}::${a.name}`;
+            if (!seen.api.has(k)) {
+                seen.api.add(k);
+                merged.apiGateways.push(a);
+            }
+        }
+    }
+    return merged;
+}
+async function extractIaCSchema(repoPath) {
+    const [tfSchema, cfnSchema, cdkSchema] = await Promise.all([
+        extractTerraformSchema(repoPath),
+        extractCloudFormationSchema(repoPath),
+        extractCDKSchema(repoPath),
+    ]);
+    const merged = mergeSchemas(tfSchema, cfnSchema, cdkSchema);
+    const total = merged.dynamoTables.length + merged.rdsInstances.length +
+        merged.mongoClusters.length + merged.queues.length + merged.topics.length +
+        merged.lambdas.length + merged.buckets.length + merged.parameters.length +
+        merged.secrets.length + merged.apiGateways.length;
+    core_1.logger.debug(`IaC schema total: ${total} resource(s) across TF/CFN/CDK`);
+    return merged;
+}

package/dist/analyzers/aws-services.js

@@ -0,0 +1,168 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LambdaHighTimeoutAnalyzer = exports.LambdaDefaultMemoryAnalyzer = exports.MissingLogRetentionAnalyzer = exports.MissingSecretRotationAnalyzer = exports.LargeQueueBacklogAnalyzer = exports.UnencryptedQueueAnalyzer = exports.MissingDLQAnalyzer = void 0;
+// ─── SQS ─────────────────────────────────────────────────────────────────────
+class MissingDLQAnalyzer {
+    name = 'MissingDLQAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'queue')
+                continue;
+            if (!node.hasDLQ) {
+                findings.push({
+                    severity: 'high',
+                    issue: `Queue "${node.name}" has no Dead Letter Queue`,
+                    description: `SQS queue "${node.name}" has no DLQ configured. Failed messages will be discarded after maxReceiveCount retries, causing silent data loss.`,
+                    recommendation: `Add a Dead Letter Queue to "${node.name}". Set maxReceiveCount to 3–5 retries before routing to DLQ. Alert on DLQ depth.`,
+                    metadata: { queueName: node.name, provider: node.provider },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.MissingDLQAnalyzer = MissingDLQAnalyzer;
+class UnencryptedQueueAnalyzer {
+    name = 'UnencryptedQueueAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'queue')
+                continue;
+            if (!node.encrypted) {
+                findings.push({
+                    severity: 'low',
+                    issue: `Queue "${node.name}" is not encrypted`,
+                    description: `SQS queue "${node.name}" does not have server-side encryption enabled. Messages at rest are unencrypted.`,
+                    recommendation: `Enable SQS-managed SSE (SqsManagedSseEnabled=true) or bring your own KMS key for "${node.name}".`,
+                    metadata: { queueName: node.name },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.UnencryptedQueueAnalyzer = UnencryptedQueueAnalyzer;
+class LargeQueueBacklogAnalyzer {
+    name = 'LargeQueueBacklogAnalyzer';
+    threshold;
+    constructor(threshold = 1000) {
+        this.threshold = threshold;
+    }
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'queue')
+                continue;
+            const count = node.approximateMessages ?? 0;
+            if (count > this.threshold) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `Queue "${node.name}" has a large backlog (${count.toLocaleString()} messages)`,
+                    description: `The approximate message count for "${node.name}" is ${count.toLocaleString()}, indicating consumers may be falling behind or stuck.`,
+                    recommendation: `Check consumer health and scaling for "${node.name}". Consider auto-scaling consumers on queue depth. If messages are stale, investigate consumer errors in CloudWatch.`,
+                    metadata: { queueName: node.name, messageCount: count },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.LargeQueueBacklogAnalyzer = LargeQueueBacklogAnalyzer;
+// ─── Secrets Manager ─────────────────────────────────────────────────────────
+class MissingSecretRotationAnalyzer {
+    name = 'MissingSecretRotationAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'secret')
+                continue;
+            if (!node.rotationEnabled) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `Secret "${node.name}" has no automatic rotation`,
+                    description: `Secrets Manager secret "${node.name}" does not have automatic rotation enabled. Long-lived credentials increase the blast radius of a compromise.`,
+                    recommendation: `Enable automatic rotation for "${node.name}" using a Lambda rotation function. AWS provides pre-built rotators for RDS, Redshift, and custom secrets.`,
+                    metadata: { secretName: node.name, provider: node.provider },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.MissingSecretRotationAnalyzer = MissingSecretRotationAnalyzer;
+// ─── CloudWatch Logs ─────────────────────────────────────────────────────────
+class MissingLogRetentionAnalyzer {
+    name = 'MissingLogRetentionAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'log_group')
+                continue;
+            if (node.retentionDays === undefined) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `Log group "${node.name}" has no retention policy`,
+                    description: `CloudWatch Log group "${node.name}" retains logs indefinitely. This increases storage costs and can expose sensitive data longer than necessary.`,
+                    recommendation: `Set a retention policy on "${node.name}". 90 days is a common baseline; adjust based on compliance requirements (e.g., 365 days for SOC2/PCI).`,
+                    metadata: { logGroupName: node.name },
+                });
+            }
+            else if (node.retentionDays > 365) {
+                findings.push({
+                    severity: 'low',
+                    issue: `Log group "${node.name}" retains logs for ${node.retentionDays} days`,
+                    description: `Log group "${node.name}" has a ${node.retentionDays}-day retention period. Unless required by compliance, this may be longer than needed.`,
+                    recommendation: `Review whether ${node.retentionDays} days of retention is required for "${node.name}". Consider archiving older logs to S3 Glacier for cost savings.`,
+                    metadata: { logGroupName: node.name, retentionDays: node.retentionDays },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.MissingLogRetentionAnalyzer = MissingLogRetentionAnalyzer;
+// ─── Lambda ───────────────────────────────────────────────────────────────────
+class LambdaDefaultMemoryAnalyzer {
+    name = 'LambdaDefaultMemoryAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'lambda')
+                continue;
+            if (node.memoryMB === 128) {
+                findings.push({
+                    severity: 'low',
+                    issue: `Lambda "${node.name}" uses the default 128 MB memory`,
+                    description: `"${node.name}" uses the default 128 MB. Undersized memory causes throttled CPU and higher durations. AWS Lambda pricing is duration × memory, so more memory often lowers cost by reducing duration.`,
+                    recommendation: `Run Lambda Power Tuning on "${node.name}" to find the optimal memory/cost balance. Most workloads perform better at 512 MB–1 GB.`,
+                    metadata: { functionName: node.name, memoryMB: node.memoryMB },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.LambdaDefaultMemoryAnalyzer = LambdaDefaultMemoryAnalyzer;
+class LambdaHighTimeoutAnalyzer {
+    name = 'LambdaHighTimeoutAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'lambda')
+                continue;
+            if ((node.timeoutSec ?? 0) >= 300) {
+                findings.push({
+                    severity: 'low',
+                    issue: `Lambda "${node.name}" has a very high timeout (${node.timeoutSec}s)`,
+                    description: `"${node.name}" has a ${node.timeoutSec}-second timeout. High timeouts mask latency issues and increase worst-case cost when functions hang.`,
+                    recommendation: `Review whether "${node.name}" truly needs ${node.timeoutSec}s. Add internal circuit-breakers or streaming patterns to avoid reaching the timeout. Set alarms on p99 duration.`,
+                    metadata: { functionName: node.name, timeoutSec: node.timeoutSec },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.LambdaHighTimeoutAnalyzer = LambdaHighTimeoutAnalyzer;