infrawise 0.10.3 → 0.12.0

package/README.md

@@ -69,10 +69,10 @@ infrawise start --claude
 
 That's it. Infrawise will:
 
-1. Ask a few questions and generate `infrawise.yaml` (first time only)
+1. Probe your environment and generate `infrawise.yaml` (first time only — asks which AWS profile to use only if you have several)
 2. Scan your AWS services, databases, and codebase
 3. Write `.mcp.json` so your editor auto-connects on every future launch
-4. Open Claude Code with all 15 MCP tools ready
+4. Open Claude Code with all 16 MCP tools ready
 
 **Every time after:**
 
@@ -80,7 +80,7 @@ That's it. Infrawise will:
 claude    # no infrawise command needed — editor manages the connection
 ```
 
-Analysis is cached for 24 hours. When the cache is stale, `infrawise stdio` (spawned automatically by your editor) refreshes it at session start. File changes are detected within the session and the code graph is updated automatically.
+Analysis is cached for 24 hours. When the cache is stale, `infrawise serve --stdio` (spawned automatically by your editor) refreshes it at session start. File changes are detected within the session and the code graph is updated automatically.
 
 ```
 Findings (3 total)
@@ -107,7 +107,7 @@ Findings (3 total)
 infrawise start --claude
 ```
 
-Writes `.mcp.json` to your project root and opens Claude Code. Claude Code reads `.mcp.json` automatically on every launch and manages the `infrawise stdio` process — no server to start, no ports to configure.
+Writes `.mcp.json` to your project root and opens Claude Code. Claude Code reads `.mcp.json` automatically on every launch and manages the `infrawise serve --stdio` process — no server to start, no ports to configure.
 
 ### Cursor
 
@@ -115,7 +115,7 @@ Writes `.mcp.json` to your project root and opens Claude Code. Claude Code reads
 infrawise start --cursor
 ```
 
-Writes `.cursor/mcp.json` and opens Cursor. All 15 infrawise tools are available in Cursor's MCP panel.
+Writes `.cursor/mcp.json` and opens Cursor. All 16 infrawise tools are available in Cursor's MCP panel.
 
 ### Any editor (no flag)
 
@@ -123,14 +123,14 @@ Writes `.cursor/mcp.json` and opens Cursor. All 15 infrawise tools are available
 infrawise start
 ```
 
-Writes `.mcp.json` and exits. Open whichever editor you prefer — point it at `infrawise stdio --config /path/to/infrawise.yaml` as an MCP server command.
+Writes `.mcp.json` and exits. Open whichever editor you prefer — point it at `infrawise serve --stdio --config /path/to/infrawise.yaml` as an MCP server command.
 
 ### HTTP transport (alternative)
 
 If your editor or workflow requires an HTTP MCP endpoint instead of stdio:
 
 ```bash
-infrawise dev    # starts server at http://localhost:3000/mcp
+infrawise serve    # starts server at http://localhost:3000/mcp
 ```
 
 Add to your editor's MCP config:
@@ -156,7 +156,8 @@ Add to your editor's MCP config:
 | `postgres_index_suggestions` | Exact `CREATE INDEX` SQL for your actual table                                                              |
 | `suggest_mongo_index`        | Exact `createIndex` command for a MongoDB collection + field                                                |
 | `mysql_index_suggestions`    | Exact `ALTER TABLE ADD INDEX` SQL for your MySQL table                                                      |
-| `get_queue_details`          | SQS queues — DLQ status, encryption, message counts                                                         |
+| `get_queue_details`          | SQS queues — DLQ status, encryption, FIFO type, visibility timeout, message counts                          |
+| `get_api_routes`             | API Gateway APIs (REST, HTTP, WebSocket) — routes, HTTP methods, paths, and Lambda integrations             |
 | `get_topic_details`          | SNS topics — subscription counts, protocols, and filter policies (required message attributes per subscription) |
 | `get_secrets_overview`       | Secrets Manager — names and rotation status (values never included)                                         |
 | `get_parameter_overview`     | SSM Parameter Store — names, types, tiers (values never included)                                           |
@@ -169,17 +170,17 @@ Add to your editor's MCP config:
 
 ## CLI reference
 
-| Command                      | What it does                                                                      |
-| ---------------------------- | --------------------------------------------------------------------------------- |
-| `infrawise start`            | **Primary command** — init + analyze + write editor MCP config, then exit         |
-| `infrawise start --claude`   | Same as above, then opens Claude Code                                             |
-| `infrawise start --cursor`   | Same as above, then opens Cursor                                                  |
-| `infrawise init`             | Generate `infrawise.yaml` only (no analysis, no editor config)                   |
-| `infrawise auth`             | Select or switch AWS profile                                                      |
-| `infrawise analyze`          | Force a full re-scan — useful after major infrastructure changes                  |
-| `infrawise dev`              | HTTP transport alternative — starts server at `localhost:3000/mcp`               |
-| `infrawise stdio`            | Stdio transport — auto-managed by editors via `.mcp.json` (rarely run directly)  |
-| `infrawise doctor`           | Validate AWS access, DB connectivity, and config                                  |
+| Command                       | What it does                                                                       |
+| ----------------------------- | --------------------------------------------------------------------------------- |
+| `infrawise start`             | **Primary command** — probe env, generate config, analyze, write editor MCP config |
+| `infrawise start --claude`    | Same as above, then opens Claude Code                                             |
+| `infrawise start --cursor`    | Same as above, then opens Cursor                                                  |
+| `infrawise start --interactive` | Run the guided setup wizard instead of auto-discovery                           |
+| `infrawise start --rediscover` | Delete `infrawise.yaml` + `.infrawise/`, then re-probe and re-analyze            |
+| `infrawise analyze`           | Force a full re-scan — useful after major infrastructure changes                  |
+| `infrawise check`             | CI gate — analyze and exit non-zero when findings reach the threshold severity    |
+| `infrawise serve`             | Start the MCP server — HTTP by default, or `--stdio` for editor integration       |
+| `infrawise doctor`            | Diagnostic escape hatch — validate AWS/DB access, config, and repo scan            |
 
 ### `infrawise analyze` options
 
@@ -189,7 +190,7 @@ Add to your editor's MCP config:
 | `-r, --repo <path>`   | Repository to scan (default: current directory)                        |
 | `--no-cache`          | Skip reading/writing the cache                                         |
 | `-o, --output <path>` | Save findings as a markdown report, e.g. `report.md`                   |
-| `--severity <level>`  | Only show findings at or above this level: `high` \| `medium` \| `low` \| `verify` |
+| `--severity <level>`  | Only show findings at or above this level: `high` \| `medium` \| `low` |
 
 ```bash
 # Export a shareable findings report
@@ -202,11 +203,37 @@ infrawise analyze --severity high
 infrawise analyze --severity high --output report.md
 ```
 
+### `infrawise check` options (CI/CD)
+
+`check` runs a fresh analysis and sets a non-zero exit code when blocking findings exist, so it can gate a pipeline without an AI editor.
+
+| Flag                  | Description                                                            |
+| --------------------- | ---------------------------------------------------------------------- |
+| `-c, --config <path>` | Path to `infrawise.yaml` (default: `infrawise.yaml`)                   |
+| `-r, --repo <path>`   | Repository to scan (default: current directory)                        |
+| `--fail-on <level>`   | Severity that fails the build: `high` (default) \| `medium` \| `low`   |
+
+```bash
+# Block a deploy if any high-severity finding exists (exit 1)
+infrawise check
+
+# Stricter gate — fail on medium and above
+infrawise check --fail-on medium
+```
+
+### `infrawise serve` options
+
+| Flag                  | Description                                                            |
+| --------------------- | ---------------------------------------------------------------------- |
+| `-c, --config <path>` | Path to `infrawise.yaml` (default: `infrawise.yaml`)                   |
+| `--stdio`             | Use stdio transport (for editors via `.mcp.json`) instead of HTTP      |
+| `-p, --port <number>` | Port to listen on, HTTP only (default: `3000`)                         |
+
 ---
 
 ## Configuration
 
-`infrawise.yaml` is generated by `infrawise start` (or `infrawise init` to create the file only) and lives in your repo root. Every service must be explicitly `enabled: true` — infrawise never connects to anything not listed in config.
+`infrawise.yaml` is generated by `infrawise start` (or `infrawise start --interactive` for the guided wizard) and lives in your repo root. Every service must be explicitly `enabled: true` — infrawise never connects to anything not listed in config.
 
 Connection strings support `${ENV_VAR}` substitution so passwords never need to be committed:
 
@@ -271,7 +298,7 @@ rds:
 s3:
   enabled: false
 
-kafka:
+apiGateway:
   enabled: false
 
 cloudwatchLogs:
@@ -281,6 +308,9 @@ cloudwatchLogs:
 
 analysis:
   sampleSize: 100
+  hotPartitionThreshold: 5
+  hotPartitionThresholds:
+    high-traffic-table: 12
 ```
 
 ### AWS setup
@@ -334,13 +364,14 @@ Works from AWS APIs, database schema introspection, and IaC files — no depende
 | DynamoDB schema                  | Tables, GSIs, partition keys                                                                                       |
 | PostgreSQL / MySQL schema        | Tables, indexes, column types                                                                                      |
 | MongoDB schema                   | Collections, indexes                                                                                               |
-| SQS                              | Missing DLQs, unencrypted queues, large backlogs                                                                   |
+| SQS                              | Missing DLQs, unencrypted queues, large backlogs, FIFO detection, visibility timeout vs Lambda timeout mismatch    |
 | SNS                              | Subscription filter policies — required message attributes per subscription                                        |
-| Kafka (kafkajs)                  | Producer/consumer topic mapping from code                                                                          |
+| Apache Kafka (kafkajs)           | Producer/consumer topic mapping from code — any broker (self-hosted, Confluent, Redpanda, MSK); distinct from the MSK Lambda trigger |
 | Secrets Manager                  | Missing secret rotation                                                                                            |
-| Lambda                           | Default memory (128 MB), high timeouts, triggers (SQS/DynamoDB/Kinesis/EventBridge/S3), missing DLQ on trigger source |
+| Lambda                           | Default memory (128 MB), high timeouts, triggers (SQS/SNS/DynamoDB/Kinesis/MSK/EventBridge/S3), missing DLQ on trigger source |
 | S3                               | Public access blocking (verify), missing versioning, missing encryption                                            |
 | EventBridge                      | Rules, schedules, event patterns, target Lambda functions                                                          |
+| API Gateway                      | REST, HTTP, and WebSocket APIs — routes, methods, Lambda integrations                                             |
 | RDS                              | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ                                    |
 | CloudWatch Logs                  | Log groups with no retention policy                                                                                |
 | Terraform / CloudFormation / CDK | IaC drift vs deployed state                                                                                        |
@@ -355,12 +386,15 @@ Uses [ts-morph](https://ts-morph.com/) AST analysis to detect which functions ca
 | Missing GSI                | Medium   | Queries on attributes without a matching GSI  |
 | Hot Partition              | Medium   | 5+ distinct code paths hitting the same table |
 | Missing Index (PostgreSQL) | Medium   | Tables queried without indexes                |
-| N+1 Query                  | Medium   | Repeated query patterns from ORM loops        |
+| N+1 Query                  | High     | Repeated query patterns from ORM loops        |
 | Large SELECT               | Low      | `SELECT *` usage                              |
 | Missing MySQL Index        | Medium   | MySQL tables queried without indexes          |
 | MySQL Full Table Scan      | High     | Full table scan patterns in MySQL queries     |
 | Missing Mongo Index        | Medium   | Collections queried without secondary indexes |
 | Collection Scan            | High     | `find()` calls without filter predicates      |
+| Pipeline: scan in consumer | High / Verify | Full scan inside an event-triggered Lambda handler (High when the lambda-to-code link is IaC-proven, Verify when name-matched) |
+| Pipeline: repeated table access | Medium / Verify | Same table read by 2+ functions in one service pipeline |
+| Pipeline: missing DLQ hop  | Medium   | Mid-pipeline queue (has producer and consumer) with no Dead Letter Queue |
 
 Non-TypeScript/JavaScript projects still get full value from infrastructure-level analyzers — code correlation (function-to-table mapping, N+1 patterns) is skipped.
 
@@ -409,10 +443,10 @@ src/
   core/         Config (Zod + YAML), logger (Pino), local cache
   graph/        Graph engine — nodes, edges, builder
   adapters/
-    aws/        DynamoDB, S3, Lambda, SQS/SNS/SSM/Secrets/EventBridge/RDS, CloudWatch
+    aws/        DynamoDB, S3, Lambda, SQS/SNS/SSM/Secrets/EventBridge/RDS/APIGateway, CloudWatch
     db/         PostgreSQL, MySQL, MongoDB
     iac/        Terraform, CDK, CloudFormation (local file parsing)
-  analyzers/    27 rule-based analyzers
+  analyzers/    29 rule-based analyzers
   context/      Repository scanner (ts-morph AST)
   server/       Fastify MCP server (@modelcontextprotocol/sdk, Streamable HTTP)
   cli/          CLI commands (Commander.js)

package/dist/adapters/aws/dynamodb.js

@@ -4,10 +4,7 @@ import { DynamoDBError, logger } from '../../core/index.js';
 function createDynamoClient(config) {
     const region = config.aws?.region ?? 'us-east-1';
     const profile = config.aws?.profile;
-    const endpoint = config.aws?.endpoint;
     const clientConfig = { region };
-    if (endpoint)
-        clientConfig.endpoint = endpoint;
     if (profile)
         clientConfig.credentials = fromIni({ profile });
     return new DynamoDBClient(clientConfig);

package/dist/adapters/aws/logs.js

@@ -7,8 +7,6 @@ const MAX_EVENTS_PER_GROUP = 50;
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };
-    if (cfg.endpoint)
-        base.endpoint = cfg.endpoint;
     if (cfg.profile)
         base.credentials = fromIni({ profile: cfg.profile });
     return base;

package/dist/adapters/aws/s3.js

@@ -1,25 +1,9 @@
 import { S3Client, ListBucketsCommand, GetBucketNotificationConfigurationCommand, GetBucketVersioningCommand, GetBucketEncryptionCommand, GetPublicAccessBlockCommand, } from '@aws-sdk/client-s3';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../../core/index.js';
-function validateEndpoint(endpoint) {
-    let url;
-    try {
-        url = new URL(endpoint);
-    }
-    catch {
-        throw new Error(`Invalid aws.endpoint URL: "${endpoint}"`);
-    }
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-        throw new Error(`aws.endpoint must use http:// or https://, got "${url.protocol}//"`);
-    }
-}
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };
-    if (cfg.endpoint) {
-        validateEndpoint(cfg.endpoint);
-        base.endpoint = cfg.endpoint;
-    }
     if (cfg.profile)
         base.credentials = fromIni({ profile: cfg.profile });
     return base;

package/dist/adapters/aws/services.js

@@ -1,4 +1,6 @@
 import { SQSClient, ListQueuesCommand, GetQueueAttributesCommand } from '@aws-sdk/client-sqs';
+import { APIGatewayClient, GetRestApisCommand, GetResourcesCommand, } from '@aws-sdk/client-api-gateway';
+import { ApiGatewayV2Client, GetApisCommand, GetRoutesCommand, GetIntegrationsCommand, } from '@aws-sdk/client-apigatewayv2';
 import { SNSClient, ListTopicsCommand, GetTopicAttributesCommand, ListSubscriptionsByTopicCommand, GetSubscriptionAttributesCommand, } from '@aws-sdk/client-sns';
 import { SSMClient, DescribeParametersCommand } from '@aws-sdk/client-ssm';
 import { SecretsManagerClient, ListSecretsCommand } from '@aws-sdk/client-secrets-manager';
@@ -7,25 +9,9 @@ import { EventBridgeClient, ListRulesCommand, ListTargetsByRuleCommand, } from '
 import { RDSClient, DescribeDBInstancesCommand } from '@aws-sdk/client-rds';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../../core/index.js';
-function validateEndpoint(endpoint) {
-    let url;
-    try {
-        url = new URL(endpoint);
-    }
-    catch {
-        throw new Error(`Invalid aws.endpoint URL: "${endpoint}"`);
-    }
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-        throw new Error(`aws.endpoint must use http:// or https://, got "${url.protocol}//"`);
-    }
-}
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };
-    if (cfg.endpoint) {
-        validateEndpoint(cfg.endpoint);
-        base.endpoint = cfg.endpoint;
-    }
     if (cfg.profile)
         base.credentials = fromIni({ profile: cfg.profile });
     return base;
@@ -66,6 +52,7 @@ export async function extractSQSMetadata(cfg = {}) {
                     : undefined;
                 const encrypted = !!(a['KmsMasterKeyId'] || a['SqsManagedSseEnabled'] === 'true');
                 const retentionSeconds = parseInt(a['MessageRetentionPeriod'] ?? '345600', 10);
+                const isFifo = name.endsWith('.fifo') || a['FifoQueue'] === 'true';
                 queues.push({
                     name,
                     url,
@@ -73,6 +60,7 @@ export async function extractSQSMetadata(cfg = {}) {
                     hasDLQ: !!dlqArn,
                     dlqArn,
                     encrypted,
+                    isFifo,
                     visibilityTimeoutSec: parseInt(a['VisibilityTimeout'] ?? '30', 10),
                     retentionDays: Math.round(retentionSeconds / 86400),
                     approximateMessages: parseInt(a['ApproximateNumberOfMessages'] ?? '0', 10),
@@ -382,3 +370,105 @@ export async function extractRDSMetadata(cfg = {}) {
 export async function validateRDSAccess(cfg = {}) {
     await new RDSClient(clientConfig(cfg)).send(new DescribeDBInstancesCommand({ MaxRecords: 20 }));
 }
+// ─── API Gateway ──────────────────────────────────────────────────────────────
+function lambdaNameFromArn(arn) {
+    if (!arn)
+        return undefined;
+    const parts = arn.split(':');
+    return parts[parts.length - 1] || undefined;
+}
+export async function extractAPIGatewayMetadata(cfg = {}) {
+    const results = [];
+    const ccfg = clientConfig(cfg);
+    // REST APIs (v1)
+    try {
+        const restClient = new APIGatewayClient(ccfg);
+        let position;
+        const restApis = [];
+        do {
+            const res = await restClient.send(new GetRestApisCommand({ position, limit: 500 }));
+            for (const api of res.items ?? []) {
+                if (api.id && api.name)
+                    restApis.push({ id: api.id, name: api.name });
+            }
+            position = res.position;
+        } while (position);
+        for (const api of restApis) {
+            const routes = [];
+            try {
+                const resourcesRes = await restClient.send(new GetResourcesCommand({ restApiId: api.id, embed: ['methods'], limit: 500 }));
+                for (const resource of resourcesRes.items ?? []) {
+                    const resourcePath = resource.path ?? '/';
+                    for (const [method, methodItem] of Object.entries(resource.resourceMethods ?? {})) {
+                        if (method === 'OPTIONS')
+                            continue;
+                        const integration = methodItem
+                            ?.methodIntegration;
+                        const lambdaArn = typeof integration?.uri === 'string' ? integration.uri : undefined;
+                        const lambdaName = lambdaArn
+                            ? lambdaNameFromArn(lambdaArn.split('/functions/')[1]?.split('/')[0])
+                            : undefined;
+                        routes.push({ method, path: resourcePath, lambdaArn, lambdaName });
+                    }
+                }
+            }
+            catch (err) {
+                logger.warn(`API Gateway REST resources failed for ${api.name}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            results.push({ name: api.name, id: api.id, type: 'REST', routes });
+        }
+    }
+    catch (err) {
+        logger.warn(`API Gateway REST list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    // HTTP + WebSocket APIs (v2)
+    try {
+        const v2Client = new ApiGatewayV2Client(ccfg);
+        let nextToken;
+        const v2Apis = [];
+        do {
+            const res = await v2Client.send(new GetApisCommand({ NextToken: nextToken, MaxResults: '500' }));
+            for (const api of res.Items ?? []) {
+                if (api.ApiId && api.Name) {
+                    v2Apis.push({ id: api.ApiId, name: api.Name, protocolType: api.ProtocolType ?? 'HTTP' });
+                }
+            }
+            nextToken = res.NextToken;
+        } while (nextToken);
+        for (const api of v2Apis) {
+            const apiType = api.protocolType === 'WEBSOCKET' ? 'WEBSOCKET' : 'HTTP';
+            const routes = [];
+            try {
+                const [routesRes, integrationsRes] = await Promise.all([
+                    v2Client.send(new GetRoutesCommand({ ApiId: api.id, MaxResults: '500' })),
+                    v2Client.send(new GetIntegrationsCommand({ ApiId: api.id, MaxResults: '500' })),
+                ]);
+                const integrationMap = new Map();
+                for (const integ of integrationsRes.Items ?? []) {
+                    if (integ.IntegrationId && integ.IntegrationUri) {
+                        integrationMap.set(integ.IntegrationId, integ.IntegrationUri);
+                    }
+                }
+                for (const route of routesRes.Items ?? []) {
+                    const routeKey = route.RouteKey ?? '';
+                    const [method, ...pathParts] = routeKey.split(' ');
+                    const routePath = pathParts.join(' ') || '/';
+                    const integrationId = route.Target?.replace('integrations/', '');
+                    const lambdaArn = integrationId ? integrationMap.get(integrationId) : undefined;
+                    const lambdaName = lambdaArn
+                        ? lambdaNameFromArn(lambdaArn.split('/functions/')[1]?.split('/')[0])
+                        : undefined;
+                    routes.push({ method: method ?? routeKey, path: routePath, lambdaArn, lambdaName });
+                }
+            }
+            catch (err) {
+                logger.warn(`API Gateway v2 routes failed for ${api.name}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            results.push({ name: api.name, id: api.id, type: apiType, routes });
+        }
+    }
+    catch (err) {
+        logger.debug(`API Gateway v2 list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return results;
+}

package/dist/adapters/iac/terraform.js

@@ -135,6 +135,7 @@ export async function extractTerraformSchema(repoPath) {
                     schema.lambdas.push({
                         name: tfStr(body, 'function_name') ?? resourceName,
                         runtime: tfStr(body, 'runtime'),
+                        handler: tfStr(body, 'handler'),
                         source: 'terraform',
                         filePath,
                     });
@@ -299,6 +300,7 @@ function processCFNResources(resources, schema, filePath, source) {
                 schema.lambdas.push({
                     name: cfnStr(props, 'FunctionName') ?? logicalId,
                     runtime: cfnStr(props, 'Runtime'),
+                    handler: cfnStr(props, 'Handler'),
                     source,
                     filePath,
                 });

package/dist/analyzers/aws-services.js

@@ -64,6 +64,42 @@ export class LargeQueueBacklogAnalyzer {
         return findings;
     }
 }
+export class VisibilityTimeoutMismatchAnalyzer {
+    name = 'VisibilityTimeoutMismatchAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        const lambdaTimeouts = new Map();
+        for (const node of graph.nodes) {
+            if (node.type === 'lambda' && node.timeoutSec) {
+                lambdaTimeouts.set(node.name, node.timeoutSec);
+            }
+        }
+        for (const node of graph.nodes) {
+            if (node.type !== 'queue' || node.visibilityTimeoutSec === undefined)
+                continue;
+            const triggeringEdge = graph.edges.find((e) => e.type === 'triggers' && e.from === `queue:aws:${node.name}`);
+            if (!triggeringEdge)
+                continue;
+            const lambdaName = triggeringEdge.to.replace('lambda:aws:', '');
+            const lambdaTimeout = lambdaTimeouts.get(lambdaName);
+            if (lambdaTimeout && node.visibilityTimeoutSec < lambdaTimeout) {
+                findings.push({
+                    severity: 'high',
+                    issue: `Queue "${node.name}" visibility timeout (${node.visibilityTimeoutSec}s) is less than Lambda "${lambdaName}" timeout (${lambdaTimeout}s)`,
+                    description: `If the Lambda takes longer than the visibility timeout, SQS will re-deliver the message to another consumer while the original invocation is still running, causing duplicate processing.`,
+                    recommendation: `Set the visibility timeout for "${node.name}" to at least ${lambdaTimeout * 6}s (6× the Lambda timeout of ${lambdaTimeout}s), per AWS best practice.`,
+                    metadata: {
+                        queueName: node.name,
+                        visibilityTimeoutSec: node.visibilityTimeoutSec,
+                        lambdaName,
+                        lambdaTimeoutSec: lambdaTimeout,
+                    },
+                });
+            }
+        }
+        return findings;
+    }
+}
 // ─── Secrets Manager ─────────────────────────────────────────────────────────
 export class MissingSecretRotationAnalyzer {
     name = 'MissingSecretRotationAnalyzer';

package/dist/analyzers/dynamodb.js

@@ -90,8 +90,10 @@ export class MissingGSIAnalyzer {
 export class HotPartitionAnalyzer {
     name = 'HotPartitionAnalyzer';
     hotThreshold;
-    constructor(hotThreshold = 5) {
+    tableThresholds;
+    constructor(hotThreshold = 5, tableThresholds = {}) {
         this.hotThreshold = hotThreshold;
+        this.tableThresholds = tableThresholds;
     }
     async analyze(graph) {
         const findings = [];
@@ -110,10 +112,11 @@ export class HotPartitionAnalyzer {
             accessors.add(edge.from);
         }
         for (const [tableId, accessors] of tableAccessCount) {
-            if (accessors.size >= this.hotThreshold) {
-                const tableNode = graph.nodes.find((n) => n.id === tableId);
-                if (!tableNode)
-                    continue;
+            const tableNode = graph.nodes.find((n) => n.id === tableId);
+            if (!tableNode)
+                continue;
+            const threshold = this.tableThresholds[tableNode.name] ?? this.hotThreshold;
+            if (accessors.size >= threshold) {
                 // Also check edge frequency for repeated access patterns
                 let maxFreq = 0;
                 for (const [key, freq] of edgeFrequency) {
@@ -128,6 +131,7 @@ export class HotPartitionAnalyzer {
                     metadata: {
                         tableName: tableNode.name,
                         accessorCount: accessors.size,
+                        threshold,
                         maxEdgeFrequency: maxFreq,
                     },
                 });

package/dist/analyzers/index.js

@@ -4,7 +4,8 @@ export { MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer } from './p
 export { MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer } from './mysql.js';
 export { MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer } from './mongodb.js';
 export { IaCDriftAnalyzer } from './terraform.js';
-export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from './aws-services.js';
+export { PipelineAnalyzer } from './pipeline.js';
+export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from './aws-services.js';
 export { RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from './rds.js';
 export async function runAllAnalyzers(graph, analyzers) {
     const allFindings = [];

package/dist/analyzers/linkers.js

@@ -0,0 +1,106 @@
+const STAGE_TOKENS = new Set([
+    'prod',
+    'production',
+    'dev',
+    'development',
+    'staging',
+    'stage',
+    'test',
+    'qa',
+]);
+const NOISE_TOKENS = new Set(['handler', 'fn', 'func', 'function', 'lambda']);
+export function normalizeName(raw) {
+    let s = raw.toLowerCase().trim();
+    s = s.split('/').pop() ?? s;
+    s = s.replace(/\.(ts|js|mjs|cjs)$/, '');
+    let segs = s.split(/[-_.\s]+/).filter(Boolean);
+    if (segs.length > 1 && STAGE_TOKENS.has(segs[segs.length - 1] ?? ''))
+        segs.pop();
+    segs = segs.filter((seg) => !NOISE_TOKENS.has(seg));
+    return segs.join('');
+}
+function lambdaNodes(graph) {
+    return graph.nodes.filter((n) => n.type === 'lambda');
+}
+function functionNodes(graph) {
+    return graph.nodes.filter((n) => n.type === 'function');
+}
+export class HeuristicLinker {
+    link(graph) {
+        const fns = functionNodes(graph);
+        const links = [];
+        for (const lam of lambdaNodes(graph)) {
+            const target = normalizeName(lam.name);
+            if (!target)
+                continue;
+            const matches = fns.filter((f) => {
+                const byName = normalizeName(f.name);
+                const byFile = normalizeName(f.file);
+                return (byName !== '' && byName === target) || (byFile !== '' && byFile === target);
+            });
+            if (matches.length !== 1)
+                continue;
+            const [only] = matches;
+            if (!only)
+                continue;
+            links.push({ lambdaId: lam.id, functionId: only.id, confidence: 'inferred' });
+        }
+        return links;
+    }
+}
+function parseHandler(handler) {
+    const lastDot = handler.lastIndexOf('.');
+    if (lastDot < 0)
+        return { fileBase: '', exportName: '' };
+    const exportName = handler.slice(lastDot + 1);
+    const filePart = handler.slice(0, lastDot);
+    const fileBase = filePart.split('/').pop() ?? filePart;
+    return { fileBase, exportName };
+}
+function fileBaseNoExt(file) {
+    const base = file.split('/').pop() ?? file;
+    return base.replace(/\.(ts|js|mjs|cjs)$/, '');
+}
+export class IaCHandlerLinker {
+    iacLambdas;
+    constructor(iacLambdas) {
+        this.iacLambdas = iacLambdas;
+    }
+    link(graph) {
+        const lambdaIds = new Set(lambdaNodes(graph).map((n) => n.id));
+        const fns = functionNodes(graph);
+        const links = [];
+        for (const il of this.iacLambdas) {
+            if (!il.handler)
+                continue;
+            const lambdaId = `lambda:aws:${il.name}`;
+            if (!lambdaIds.has(lambdaId))
+                continue;
+            const { fileBase, exportName } = parseHandler(il.handler);
+            if (!exportName || !fileBase)
+                continue;
+            const matches = fns.filter((f) => f.name === exportName && fileBaseNoExt(f.file) === fileBase);
+            if (matches.length !== 1)
+                continue;
+            const [only] = matches;
+            if (!only)
+                continue;
+            links.push({ lambdaId, functionId: only.id, confidence: 'proven' });
+        }
+        return links;
+    }
+}
+export class CompositeLinker {
+    proven;
+    heuristic;
+    constructor(proven, heuristic) {
+        this.proven = proven;
+        this.heuristic = heuristic;
+    }
+    link(graph) {
+        const provenLinks = this.proven.link(graph);
+        const covered = new Set(provenLinks.map((l) => l.lambdaId));
+        const heur = this.heuristic.link(graph).filter((l) => !covered.has(l.lambdaId));
+        return [...provenLinks, ...heur];
+    }
+}