infrawise 0.1.2 → 0.2.1

package/dist/analyzers/dynamodb.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HotPartitionAnalyzer = exports.MissingGSIAnalyzer = exports.FullTableScanAnalyzer = void 0;
+const graph_1 = require("../graph");
+/**
+ * Detects full table scans on DynamoDB tables.
+ * A full scan without any filters is always a high-severity issue.
+ */
+class FullTableScanAnalyzer {
+    name = 'FullTableScanAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        const scanEdges = (0, graph_1.getScanEdges)(graph);
+        // Find which tables are being scanned
+        const scannedTableIds = new Set();
+        for (const edge of scanEdges) {
+            // edge.to should be a table node
+            const targetNode = graph.nodes.find((n) => n.id === edge.to);
+            if (targetNode?.type === 'table' && targetNode.databaseType === 'dynamodb') {
+                scannedTableIds.add(targetNode.id);
+            }
+        }
+        for (const tableId of scannedTableIds) {
+            const tableNode = graph.nodes.find((n) => n.id === tableId);
+            if (!tableNode)
+                continue;
+            const tableScanEdges = scanEdges.filter((e) => e.to === tableId);
+            const callerFunctions = tableScanEdges
+                .map((e) => {
+                const node = graph.nodes.find((n) => n.id === e.from);
+                return node?.type === 'function' ? node.name : e.from;
+            })
+                .join(', ');
+            findings.push({
+                severity: 'high',
+                issue: `Full table scan detected on DynamoDB table "${tableNode.name}"`,
+                description: `The table "${tableNode.name}" is being scanned without any filter, which reads every item. This is expensive and slow for large tables. Called from: ${callerFunctions || 'unknown'}`,
+                recommendation: 'Replace Scan with a Query operation using a partition key or GSI. If filtering is required on non-key attributes, add a Global Secondary Index (GSI).',
+                metadata: {
+                    tableName: tableNode.name,
+                    scanCount: tableScanEdges.length,
+                    callerFunctions,
+                },
+            });
+        }
+        return findings;
+    }
+}
+exports.FullTableScanAnalyzer = FullTableScanAnalyzer;
+/**
+ * Detects when a DynamoDB table is accessed without a GSI covering
+ * the access pattern, which forces an expensive scan or inefficient query.
+ */
+class MissingGSIAnalyzer {
+    name = 'MissingGSIAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        // Find all DynamoDB tables
+        const dynamoTables = graph.nodes.filter((n) => n.type === 'table' && n.databaseType === 'dynamodb');
+        for (const table of dynamoTables) {
+            // Find edges coming INTO this table from function nodes
+            const incomingEdges = graph.edges.filter((e) => e.to === table.id);
+            const queryEdges = incomingEdges.filter((e) => e.type === 'query');
+            // Check if this table has any GSIs
+            const hasGSI = graph.edges.some((e) => e.from === table.id && e.type === 'uses_index');
+            // If there are query operations but no GSI, flag as medium severity
+            if (queryEdges.length > 0 && !hasGSI) {
+                const callerFunctions = queryEdges
+                    .map((e) => {
+                    const node = graph.nodes.find((n) => n.id === e.from);
+                    return node?.type === 'function' ? node.name : e.from;
+                })
+                    .join(', ');
+                findings.push({
+                    severity: 'medium',
+                    issue: `DynamoDB table "${table.name}" has no GSIs but is queried by multiple functions`,
+                    description: `Table "${table.name}" is accessed by ${queryEdges.length} function(s) (${callerFunctions}) but has no Global Secondary Indexes defined. If queries filter on non-partition-key attributes, this will degrade to full scans.`,
+                    recommendation: 'Analyze query access patterns and add GSIs for frequently filtered attributes. Consider using single-table design patterns with composite sort keys.',
+                    metadata: {
+                        tableName: table.name,
+                        queryCount: queryEdges.length,
+                        callerFunctions,
+                    },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.MissingGSIAnalyzer = MissingGSIAnalyzer;
+/**
+ * Detects hot partition patterns — when the same table/partition
+ * is accessed with very high frequency from many code paths.
+ */
+class HotPartitionAnalyzer {
+    name = 'HotPartitionAnalyzer';
+    hotThreshold;
+    constructor(hotThreshold = 5) {
+        this.hotThreshold = hotThreshold;
+    }
+    async analyze(graph) {
+        const findings = [];
+        const edgeFrequency = (0, graph_1.getEdgeFrequency)(graph);
+        // Count how many distinct functions access each DynamoDB table
+        const tableAccessCount = new Map();
+        for (const edge of graph.edges) {
+            const targetNode = graph.nodes.find((n) => n.id === edge.to);
+            if (targetNode?.type !== 'table' || targetNode.databaseType !== 'dynamodb')
+                continue;
+            let accessors = tableAccessCount.get(edge.to);
+            if (!accessors) {
+                accessors = new Set();
+                tableAccessCount.set(edge.to, accessors);
+            }
+            accessors.add(edge.from);
+        }
+        for (const [tableId, accessors] of tableAccessCount) {
+            if (accessors.size >= this.hotThreshold) {
+                const tableNode = graph.nodes.find((n) => n.id === tableId);
+                if (!tableNode)
+                    continue;
+                // Also check edge frequency for repeated access patterns
+                let maxFreq = 0;
+                for (const [key, freq] of edgeFrequency) {
+                    if (key.includes(tableId))
+                        maxFreq = Math.max(maxFreq, freq);
+                }
+                findings.push({
+                    severity: 'medium',
+                    issue: `Potential hot partition detected on DynamoDB table "${tableNode.name}"`,
+                    description: `Table "${tableNode.name}" is accessed by ${accessors.size} distinct code paths, which may create hot partition issues at scale. High access concentration on the same partition key can throttle requests.`,
+                    recommendation: 'Consider adding a random suffix or timestamp to partition keys (write sharding). Use DynamoDB DAX for read-heavy workloads. Distribute access patterns across multiple partition key values.',
+                    metadata: {
+                        tableName: tableNode.name,
+                        accessorCount: accessors.size,
+                        maxEdgeFrequency: maxFreq,
+                    },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.HotPartitionAnalyzer = HotPartitionAnalyzer;

package/dist/analyzers/index.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RDSNoMultiAZAnalyzer = exports.RDSNoDeletionProtectionAnalyzer = exports.RDSUnencryptedAnalyzer = exports.RDSNoBackupAnalyzer = exports.RDSPubliclyAccessibleAnalyzer = exports.LambdaHighTimeoutAnalyzer = exports.LambdaDefaultMemoryAnalyzer = exports.MissingLogRetentionAnalyzer = exports.MissingSecretRotationAnalyzer = exports.LargeQueueBacklogAnalyzer = exports.UnencryptedQueueAnalyzer = exports.MissingDLQAnalyzer = exports.IaCDriftAnalyzer = exports.MongoCollectionScanAnalyzer = exports.MissingMongoIndexAnalyzer = exports.MySQLFullTableScanAnalyzer = exports.MissingMySQLIndexAnalyzer = exports.LargeSelectAnalyzer = exports.NplusOneAnalyzer = exports.MissingIndexAnalyzer = exports.HotPartitionAnalyzer = exports.MissingGSIAnalyzer = exports.FullTableScanAnalyzer = void 0;
+exports.runAllAnalyzers = runAllAnalyzers;
+exports.summarizeFindings = summarizeFindings;
+const core_1 = require("../core");
+var dynamodb_1 = require("./dynamodb");
+Object.defineProperty(exports, "FullTableScanAnalyzer", { enumerable: true, get: function () { return dynamodb_1.FullTableScanAnalyzer; } });
+Object.defineProperty(exports, "MissingGSIAnalyzer", { enumerable: true, get: function () { return dynamodb_1.MissingGSIAnalyzer; } });
+Object.defineProperty(exports, "HotPartitionAnalyzer", { enumerable: true, get: function () { return dynamodb_1.HotPartitionAnalyzer; } });
+var postgres_1 = require("./postgres");
+Object.defineProperty(exports, "MissingIndexAnalyzer", { enumerable: true, get: function () { return postgres_1.MissingIndexAnalyzer; } });
+Object.defineProperty(exports, "NplusOneAnalyzer", { enumerable: true, get: function () { return postgres_1.NplusOneAnalyzer; } });
+Object.defineProperty(exports, "LargeSelectAnalyzer", { enumerable: true, get: function () { return postgres_1.LargeSelectAnalyzer; } });
+var mysql_1 = require("./mysql");
+Object.defineProperty(exports, "MissingMySQLIndexAnalyzer", { enumerable: true, get: function () { return mysql_1.MissingMySQLIndexAnalyzer; } });
+Object.defineProperty(exports, "MySQLFullTableScanAnalyzer", { enumerable: true, get: function () { return mysql_1.MySQLFullTableScanAnalyzer; } });
+var mongodb_1 = require("./mongodb");
+Object.defineProperty(exports, "MissingMongoIndexAnalyzer", { enumerable: true, get: function () { return mongodb_1.MissingMongoIndexAnalyzer; } });
+Object.defineProperty(exports, "MongoCollectionScanAnalyzer", { enumerable: true, get: function () { return mongodb_1.MongoCollectionScanAnalyzer; } });
+var terraform_1 = require("./terraform");
+Object.defineProperty(exports, "IaCDriftAnalyzer", { enumerable: true, get: function () { return terraform_1.IaCDriftAnalyzer; } });
+var aws_services_1 = require("./aws-services");
+Object.defineProperty(exports, "MissingDLQAnalyzer", { enumerable: true, get: function () { return aws_services_1.MissingDLQAnalyzer; } });
+Object.defineProperty(exports, "UnencryptedQueueAnalyzer", { enumerable: true, get: function () { return aws_services_1.UnencryptedQueueAnalyzer; } });
+Object.defineProperty(exports, "LargeQueueBacklogAnalyzer", { enumerable: true, get: function () { return aws_services_1.LargeQueueBacklogAnalyzer; } });
+Object.defineProperty(exports, "MissingSecretRotationAnalyzer", { enumerable: true, get: function () { return aws_services_1.MissingSecretRotationAnalyzer; } });
+Object.defineProperty(exports, "MissingLogRetentionAnalyzer", { enumerable: true, get: function () { return aws_services_1.MissingLogRetentionAnalyzer; } });
+Object.defineProperty(exports, "LambdaDefaultMemoryAnalyzer", { enumerable: true, get: function () { return aws_services_1.LambdaDefaultMemoryAnalyzer; } });
+Object.defineProperty(exports, "LambdaHighTimeoutAnalyzer", { enumerable: true, get: function () { return aws_services_1.LambdaHighTimeoutAnalyzer; } });
+var rds_1 = require("./rds");
+Object.defineProperty(exports, "RDSPubliclyAccessibleAnalyzer", { enumerable: true, get: function () { return rds_1.RDSPubliclyAccessibleAnalyzer; } });
+Object.defineProperty(exports, "RDSNoBackupAnalyzer", { enumerable: true, get: function () { return rds_1.RDSNoBackupAnalyzer; } });
+Object.defineProperty(exports, "RDSUnencryptedAnalyzer", { enumerable: true, get: function () { return rds_1.RDSUnencryptedAnalyzer; } });
+Object.defineProperty(exports, "RDSNoDeletionProtectionAnalyzer", { enumerable: true, get: function () { return rds_1.RDSNoDeletionProtectionAnalyzer; } });
+Object.defineProperty(exports, "RDSNoMultiAZAnalyzer", { enumerable: true, get: function () { return rds_1.RDSNoMultiAZAnalyzer; } });
+async function runAllAnalyzers(graph, analyzers) {
+    const allFindings = [];
+    for (const analyzer of analyzers) {
+        try {
+            core_1.logger.debug(`Running analyzer: ${analyzer.name}`);
+            const findings = await analyzer.analyze(graph);
+            core_1.logger.debug(`[${analyzer.name}] found ${findings.length} issue(s)`);
+            allFindings.push(...findings);
+        }
+        catch (err) {
+            core_1.logger.warn(`Analyzer "${analyzer.name}" failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    const severityOrder = { high: 0, medium: 1, low: 2 };
+    allFindings.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
+    return allFindings;
+}
+function summarizeFindings(findings) {
+    const counts = { total: findings.length, high: 0, medium: 0, low: 0 };
+    for (const f of findings)
+        counts[f.severity]++;
+    return counts;
+}

package/dist/analyzers/mongodb.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MongoCollectionScanAnalyzer = exports.MissingMongoIndexAnalyzer = void 0;
+const graph_1 = require("../graph");
+/**
+ * Detects MongoDB collections that are queried without any secondary indexes.
+ */
+class MissingMongoIndexAnalyzer {
+    name = 'MissingMongoIndexAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        const mongoCollections = graph.nodes.filter((n) => n.type === 'table' && n.databaseType === 'mongodb');
+        for (const coll of mongoCollections) {
+            const indexEdges = graph.edges.filter((e) => e.from === coll.id && e.type === 'uses_index');
+            const hasIndexes = indexEdges.length > 0;
+            const queryEdges = graph.edges.filter((e) => e.to === coll.id && (e.type === 'query' || e.type === 'scan'));
+            if (queryEdges.length > 0 && !hasIndexes) {
+                const callerFunctions = queryEdges
+                    .map((e) => {
+                    const node = graph.nodes.find((n) => n.id === e.from);
+                    return node?.type === 'function' ? node.name : e.from;
+                })
+                    .join(', ');
+                findings.push({
+                    severity: 'medium',
+                    issue: `MongoDB collection "${coll.name}" has no indexes but is queried by ${queryEdges.length} function(s)`,
+                    description: `Collection "${coll.name}" is accessed by functions (${callerFunctions}) but has no secondary indexes defined. Queries on non-_id fields will result in full collection scans.`,
+                    recommendation: 'Add indexes using db.collection.createIndex({ field: 1 }) for frequently queried fields. Use explain("executionStats") to verify query plan.',
+                    metadata: {
+                        collectionName: coll.name,
+                        queryCount: queryEdges.length,
+                        callerFunctions,
+                    },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.MissingMongoIndexAnalyzer = MissingMongoIndexAnalyzer;
+/**
+ * Detects collection scan operations on MongoDB collections.
+ */
+class MongoCollectionScanAnalyzer {
+    name = 'MongoCollectionScanAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        const scanEdges = (0, graph_1.getScanEdges)(graph);
+        const scannedCollIds = new Set();
+        for (const edge of scanEdges) {
+            const targetNode = graph.nodes.find((n) => n.id === edge.to);
+            if (targetNode?.type === 'table' && targetNode.databaseType === 'mongodb') {
+                scannedCollIds.add(targetNode.id);
+            }
+        }
+        for (const collId of scannedCollIds) {
+            const collNode = graph.nodes.find((n) => n.id === collId);
+            if (!collNode)
+                continue;
+            const collScanEdges = scanEdges.filter((e) => e.to === collId);
+            const callerFunctions = collScanEdges
+                .map((e) => {
+                const node = graph.nodes.find((n) => n.id === e.from);
+                return node?.type === 'function' ? node.name : e.from;
+            })
+                .join(', ');
+            findings.push({
+                severity: 'high',
+                issue: `Collection scan detected on MongoDB collection "${collNode.name}"`,
+                description: `Collection "${collNode.name}" is being scanned without an index, reading every document. This is very expensive for large collections. Called from: ${callerFunctions || 'unknown'}`,
+                recommendation: 'Add an index on the field(s) used as query predicates. Use db.collection.createIndex({ field: 1 }) and verify with explain("executionStats").',
+                metadata: {
+                    collectionName: collNode.name,
+                    scanCount: collScanEdges.length,
+                    callerFunctions,
+                },
+            });
+        }
+        return findings;
+    }
+}
+exports.MongoCollectionScanAnalyzer = MongoCollectionScanAnalyzer;

package/dist/analyzers/mysql.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MySQLFullTableScanAnalyzer = exports.MissingMySQLIndexAnalyzer = void 0;
+const graph_1 = require("../graph");
+/**
+ * Detects MySQL tables that are queried without any indexes defined.
+ */
+class MissingMySQLIndexAnalyzer {
+    name = 'MissingMySQLIndexAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        const mysqlTables = graph.nodes.filter((n) => n.type === 'table' && n.databaseType === 'mysql');
+        for (const table of mysqlTables) {
+            const indexEdges = graph.edges.filter((e) => e.from === table.id && e.type === 'uses_index');
+            const hasIndexes = indexEdges.length > 0;
+            const queryEdges = graph.edges.filter((e) => e.to === table.id && (e.type === 'query' || e.type === 'scan'));
+            if (queryEdges.length > 0 && !hasIndexes) {
+                const callerFunctions = queryEdges
+                    .map((e) => {
+                    const node = graph.nodes.find((n) => n.id === e.from);
+                    return node?.type === 'function' ? node.name : e.from;
+                })
+                    .join(', ');
+                findings.push({
+                    severity: 'medium',
+                    issue: `MySQL table "${table.name}" has no indexes but is queried by ${queryEdges.length} function(s)`,
+                    description: `Table "${table.name}" is accessed by functions (${callerFunctions}) but has no secondary indexes defined. Queries on non-primary-key columns will result in full table scans.`,
+                    recommendation: 'Add indexes on columns used in WHERE clauses. Run EXPLAIN on slow queries. Consider composite indexes for multi-column filters.',
+                    metadata: {
+                        tableName: table.name,
+                        queryCount: queryEdges.length,
+                        callerFunctions,
+                    },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.MissingMySQLIndexAnalyzer = MissingMySQLIndexAnalyzer;
+/**
+ * Detects full table scans on MySQL tables.
+ */
+class MySQLFullTableScanAnalyzer {
+    name = 'MySQLFullTableScanAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        const scanEdges = (0, graph_1.getScanEdges)(graph);
+        const scannedTableIds = new Set();
+        for (const edge of scanEdges) {
+            const targetNode = graph.nodes.find((n) => n.id === edge.to);
+            if (targetNode?.type === 'table' && targetNode.databaseType === 'mysql') {
+                scannedTableIds.add(targetNode.id);
+            }
+        }
+        for (const tableId of scannedTableIds) {
+            const tableNode = graph.nodes.find((n) => n.id === tableId);
+            if (!tableNode)
+                continue;
+            const tableScanEdges = scanEdges.filter((e) => e.to === tableId);
+            const callerFunctions = tableScanEdges
+                .map((e) => {
+                const node = graph.nodes.find((n) => n.id === e.from);
+                return node?.type === 'function' ? node.name : e.from;
+            })
+                .join(', ');
+            findings.push({
+                severity: 'high',
+                issue: `Full table scan detected on MySQL table "${tableNode.name}"`,
+                description: `The table "${tableNode.name}" is being scanned without a usable index, reading every row. This is expensive for large tables. Called from: ${callerFunctions || 'unknown'}`,
+                recommendation: 'Add an index on the column(s) used in the WHERE clause. Use EXPLAIN to verify the query plan uses the index after adding it.',
+                metadata: {
+                    tableName: tableNode.name,
+                    scanCount: tableScanEdges.length,
+                    callerFunctions,
+                },
+            });
+        }
+        return findings;
+    }
+}
+exports.MySQLFullTableScanAnalyzer = MySQLFullTableScanAnalyzer;

package/dist/analyzers/postgres.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LargeSelectAnalyzer = exports.NplusOneAnalyzer = exports.MissingIndexAnalyzer = void 0;
+/**
+ * Detects PostgreSQL table columns that are used in WHERE patterns
+ * but don't have a corresponding index.
+ */
+class MissingIndexAnalyzer {
+    name = 'MissingIndexAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        const postgresTables = graph.nodes.filter((n) => n.type === 'table' && n.databaseType === 'postgres');
+        for (const table of postgresTables) {
+            // Find indexes for this table via uses_index edges
+            const indexEdges = graph.edges.filter((e) => e.from === table.id && e.type === 'uses_index');
+            const hasIndexes = indexEdges.length > 0;
+            // Find all query operations targeting this table
+            const queryEdges = graph.edges.filter((e) => e.to === table.id && (e.type === 'query' || e.type === 'scan'));
+            if (queryEdges.length > 0 && !hasIndexes) {
+                const callerFunctions = queryEdges
+                    .map((e) => {
+                    const node = graph.nodes.find((n) => n.id === e.from);
+                    return node?.type === 'function' ? node.name : e.from;
+                })
+                    .join(', ');
+                findings.push({
+                    severity: 'medium',
+                    issue: `PostgreSQL table "${table.name}" has no indexes but is queried by ${queryEdges.length} function(s)`,
+                    description: `Table "${table.name}" is accessed by functions (${callerFunctions}) but has no secondary indexes defined. Queries on non-primary-key columns will result in sequential scans.`,
+                    recommendation: 'Add indexes on columns used in WHERE clauses. Use EXPLAIN ANALYZE to identify slow queries. Consider composite indexes for multi-column filters.',
+                    metadata: {
+                        tableName: table.name,
+                        queryCount: queryEdges.length,
+                        callerFunctions,
+                    },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.MissingIndexAnalyzer = MissingIndexAnalyzer;
+/**
+ * Detects N+1 query patterns — same function making multiple queries
+ * to the same table inside what is likely a loop.
+ */
+class NplusOneAnalyzer {
+    name = 'NplusOneAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        // Group edges by function node -> table node
+        const functionTableAccess = new Map();
+        for (const edge of graph.edges) {
+            if (edge.type !== 'query')
+                continue;
+            const fromNode = graph.nodes.find((n) => n.id === edge.from);
+            const toNode = graph.nodes.find((n) => n.id === edge.to);
+            if (fromNode?.type !== 'function' || toNode?.type !== 'table')
+                continue;
+            if (toNode.databaseType !== 'postgres')
+                continue;
+            let tableAccess = functionTableAccess.get(edge.from);
+            if (!tableAccess) {
+                tableAccess = new Map();
+                functionTableAccess.set(edge.from, tableAccess);
+            }
+            tableAccess.set(edge.to, (tableAccess.get(edge.to) ?? 0) + 1);
+        }
+        // Flag functions that access the same table more than once
+        for (const [funcId, tableAccess] of functionTableAccess) {
+            for (const [tableId, count] of tableAccess) {
+                if (count >= 2) {
+                    const funcNode = graph.nodes.find((n) => n.id === funcId);
+                    const tableNode = graph.nodes.find((n) => n.id === tableId);
+                    if (!funcNode || !tableNode)
+                        continue;
+                    findings.push({
+                        severity: 'high',
+                        issue: `Potential N+1 query pattern in function "${funcNode.name}"`,
+                        description: `Function "${funcNode.name}" in ${funcNode.file} appears to query table "${tableNode.name}" ${count} time(s), suggesting a potential N+1 query pattern. This can lead to exponential database load when called in a loop.`,
+                        recommendation: 'Batch multiple queries into a single query using IN clauses, JOIN operations, or DataLoader patterns. Consider using a bulk-fetch approach and filtering in application code.',
+                        metadata: {
+                            functionName: funcNode.name,
+                            filePath: funcNode.file,
+                            tableName: tableNode.name,
+                            queryCount: count,
+                        },
+                    });
+                }
+            }
+        }
+        return findings;
+    }
+}
+exports.NplusOneAnalyzer = NplusOneAnalyzer;
+/**
+ * Detects SELECT * usage patterns which read all columns even when
+ * only a subset is needed, wasting I/O and memory.
+ */
+class LargeSelectAnalyzer {
+    name = 'LargeSelectAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        // Find query nodes that represent SELECT * patterns
+        const queryNodes = graph.nodes.filter((n) => n.type === 'query');
+        for (const queryNode of queryNodes) {
+            if (queryNode.operation.toLowerCase().includes('select *') ||
+                queryNode.operation.toLowerCase().includes('select_all')) {
+                findings.push({
+                    severity: 'low',
+                    issue: `SELECT * usage detected in query "${queryNode.operation}"`,
+                    description: 'Using SELECT * reads all columns from the table, which can be expensive for wide tables. It also prevents index-only scans and increases network transfer.',
+                    recommendation: 'Specify only the columns you need. For frequently accessed subsets of columns, consider creating a covering index that includes those columns.',
+                    metadata: {
+                        operation: queryNode.operation,
+                    },
+                });
+            }
+        }
+        // Also look for edges from functions to postgres tables with a high number of scan operations
+        const postgresTables = graph.nodes.filter((n) => n.type === 'table' && n.databaseType === 'postgres');
+        for (const table of postgresTables) {
+            const scanEdges = graph.edges.filter((e) => e.to === table.id && e.type === 'scan');
+            if (scanEdges.length > 0) {
+                const callerFunctions = scanEdges
+                    .map((e) => {
+                    const node = graph.nodes.find((n) => n.id === e.from);
+                    return node?.type === 'function' ? node.name : e.from;
+                })
+                    .filter((v, i, arr) => arr.indexOf(v) === i)
+                    .join(', ');
+                findings.push({
+                    severity: 'medium',
+                    issue: `Sequential scan detected on PostgreSQL table "${table.name}"`,
+                    description: `Table "${table.name}" is accessed via sequential scan by ${scanEdges.length} operation(s) from: ${callerFunctions}. Sequential scans read the entire table and are very slow on large tables.`,
+                    recommendation: 'Add appropriate indexes to support the WHERE conditions in these queries. Run EXPLAIN ANALYZE to understand the query plan. Consider partial indexes for filtered queries.',
+                    metadata: {
+                        tableName: table.name,
+                        scanCount: scanEdges.length,
+                        callerFunctions,
+                    },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.LargeSelectAnalyzer = LargeSelectAnalyzer;

package/dist/analyzers/rds.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RDSNoMultiAZAnalyzer = exports.RDSNoDeletionProtectionAnalyzer = exports.RDSUnencryptedAnalyzer = exports.RDSNoBackupAnalyzer = exports.RDSPubliclyAccessibleAnalyzer = void 0;
+// ─── RDS ─────────────────────────────────────────────────────────────────────
+class RDSPubliclyAccessibleAnalyzer {
+    name = 'RDSPubliclyAccessibleAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'database_instance')
+                continue;
+            if (node.publiclyAccessible) {
+                findings.push({
+                    severity: 'high',
+                    issue: `RDS instance "${node.name}" is publicly accessible`,
+                    description: `"${node.name}" (${node.engine}) has PubliclyAccessible=true, meaning it is reachable from the internet. This exposes the database to brute-force and credential-stuffing attacks.`,
+                    recommendation: `Set PubliclyAccessible=false on "${node.name}" and use a bastion host, VPN, or VPC peering for private access. If public access is required, enforce strong passwords, IP allowlisting, and TLS.`,
+                    metadata: { dbInstanceIdentifier: node.name, engine: node.engine, instanceClass: node.instanceClass },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.RDSPubliclyAccessibleAnalyzer = RDSPubliclyAccessibleAnalyzer;
+class RDSNoBackupAnalyzer {
+    name = 'RDSNoBackupAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'database_instance')
+                continue;
+            if (node.backupRetentionDays === 0) {
+                findings.push({
+                    severity: 'high',
+                    issue: `RDS instance "${node.name}" has automated backups disabled`,
+                    description: `"${node.name}" has a backup retention period of 0, meaning automated backups are off. Any accidental deletion or corruption is unrecoverable without a manual snapshot.`,
+                    recommendation: `Enable automated backups on "${node.name}" with at least 7 days retention (35 days for production workloads). Enable point-in-time recovery.`,
+                    metadata: { dbInstanceIdentifier: node.name, engine: node.engine, backupRetentionDays: node.backupRetentionDays },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.RDSNoBackupAnalyzer = RDSNoBackupAnalyzer;
+class RDSUnencryptedAnalyzer {
+    name = 'RDSUnencryptedAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'database_instance')
+                continue;
+            if (!node.storageEncrypted) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `RDS instance "${node.name}" has unencrypted storage`,
+                    description: `"${node.name}" does not have storage encryption enabled. Data at rest (including automated backups and read replicas) is stored unencrypted.`,
+                    recommendation: `Enable storage encryption on "${node.name}" using an AWS KMS key. Note: encryption must be enabled at creation time — you'll need to create a new encrypted instance and migrate.`,
+                    metadata: { dbInstanceIdentifier: node.name, engine: node.engine },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.RDSUnencryptedAnalyzer = RDSUnencryptedAnalyzer;
+class RDSNoDeletionProtectionAnalyzer {
+    name = 'RDSNoDeletionProtectionAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'database_instance')
+                continue;
+            if (!node.deletionProtection) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `RDS instance "${node.name}" has deletion protection disabled`,
+                    description: `"${node.name}" can be deleted without any additional safeguard. A mistaken Terraform destroy, IaC misconfiguration, or human error could permanently drop the database.`,
+                    recommendation: `Enable DeletionProtection on "${node.name}". This must be explicitly disabled before the instance can be deleted, preventing accidental data loss.`,
+                    metadata: { dbInstanceIdentifier: node.name, engine: node.engine },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.RDSNoDeletionProtectionAnalyzer = RDSNoDeletionProtectionAnalyzer;
+class RDSNoMultiAZAnalyzer {
+    name = 'RDSNoMultiAZAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'database_instance')
+                continue;
+            if (!node.multiAZ) {
+                findings.push({
+                    severity: 'low',
+                    issue: `RDS instance "${node.name}" is single-AZ`,
+                    description: `"${node.name}" does not have Multi-AZ enabled. An AZ outage will cause downtime until the instance is recovered in the same AZ.`,
+                    recommendation: `Enable Multi-AZ on "${node.name}" to get automatic failover to a standby in a separate Availability Zone. Typical failover is 60–120 seconds.`,
+                    metadata: { dbInstanceIdentifier: node.name, engine: node.engine },
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.RDSNoMultiAZAnalyzer = RDSNoMultiAZAnalyzer;