infrawise 0.13.2 → 0.15.0

package/dist/adapters/iac/terraform.js

@@ -14,6 +14,7 @@ function emptySchema() {
         parameters: [],
         secrets: [],
         apiGateways: [],
+        outputs: [],
     };
 }
 // ─── File discovery ───────────────────────────────────────────────────────────
@@ -76,6 +77,25 @@ function tfGSINames(body) {
     }
     return names;
 }
+function extractTerraformOutputBlocks(content) {
+    const results = [];
+    const pat = /output\s+"([^"]+)"\s*\{/g;
+    let match;
+    while ((match = pat.exec(content)) !== null) {
+        const startBrace = match.index + match[0].length - 1;
+        let depth = 1;
+        let i = startBrace + 1;
+        while (i < content.length && depth > 0) {
+            if (content[i] === '{')
+                depth++;
+            else if (content[i] === '}')
+                depth--;
+            i++;
+        }
+        results.push({ name: match[1] ?? '', body: content.slice(startBrace + 1, i - 1) });
+    }
+    return results;
+}
 export async function extractTerraformSchema(repoPath) {
     const schema = emptySchema();
     const tfFiles = findFilesRecursively(repoPath, ['.tf']);
@@ -173,6 +193,16 @@ export async function extractTerraformSchema(repoPath) {
                     break;
             }
         }
+        for (const { name, body } of extractTerraformOutputBlocks(content)) {
+            const valueMatch = body.match(/value\s*=\s*(.+)/);
+            schema.outputs.push({
+                name,
+                description: tfStr(body, 'description'),
+                value: valueMatch?.[1]?.trim(),
+                source: 'terraform',
+                filePath,
+            });
+        }
     }
     return schema;
 }
@@ -341,6 +371,30 @@ function processCFNResources(resources, schema, filePath, source) {
         }
     }
 }
+function processCFNOutputs(template, schema, filePath, source) {
+    const outputs = template['Outputs'];
+    if (typeof outputs !== 'object' || outputs === null)
+        return;
+    for (const [name, raw] of Object.entries(outputs)) {
+        if (typeof raw !== 'object' || raw === null)
+            continue;
+        const out = raw;
+        const exp = out['Export'];
+        const expName = exp?.['Name'];
+        schema.outputs.push({
+            name,
+            description: typeof out['Description'] === 'string' ? out['Description'] : undefined,
+            exportName: expName === undefined
+                ? undefined
+                : typeof expName === 'string'
+                    ? expName
+                    : JSON.stringify(expName),
+            value: typeof out['Value'] === 'string' ? out['Value'] : JSON.stringify(out['Value']),
+            source,
+            filePath,
+        });
+    }
+}
 export async function extractCloudFormationSchema(repoPath) {
     const schema = emptySchema();
     const cfnFiles = findFilesRecursively(repoPath, ['.yaml', '.yml', '.json']);
@@ -353,6 +407,7 @@ export async function extractCloudFormationSchema(repoPath) {
         if (!resources)
             continue;
         processCFNResources(resources, schema, filePath, 'cloudformation');
+        processCFNOutputs(parsed, schema, filePath, 'cloudformation');
     }
     return schema;
 }
@@ -375,6 +430,7 @@ export async function extractCDKSchema(repoPath) {
             if (!resources)
                 continue;
             processCFNResources(resources, schema, filePath, 'cdk');
+            processCFNOutputs(parsed, schema, filePath, 'cdk');
         }
     }
     // Strategy 2: Detect CDK TypeScript construct patterns if no cdk.out exists
@@ -400,6 +456,7 @@ function mergeSchemas(...schemas) {
         param: new Set(),
         secret: new Set(),
         api: new Set(),
+        output: new Set(),
     };
     for (const schema of schemas) {
         for (const t of schema.dynamoTables) {
@@ -472,6 +529,13 @@ function mergeSchemas(...schemas) {
                 merged.apiGateways.push(a);
             }
         }
+        for (const o of schema.outputs) {
+            const k = `${o.source}::${o.filePath}::${o.name}`;
+            if (!seen.output.has(k)) {
+                seen.output.add(k);
+                merged.outputs.push(o);
+            }
+        }
     }
     return merged;
 }
@@ -491,7 +555,8 @@ export async function extractIaCSchema(repoPath) {
         merged.buckets.length +
         merged.parameters.length +
         merged.secrets.length +
-        merged.apiGateways.length;
+        merged.apiGateways.length +
+        merged.outputs.length;
     logger.debug(`IaC schema total: ${total} resource(s) across TF/CFN/CDK`);
     return merged;
 }

package/dist/analyzers/aws-services.js

@@ -284,6 +284,93 @@ export class S3UnencryptedAnalyzer {
         return findings;
     }
 }
+// ─── ElastiCache ─────────────────────────────────────────────────────────────
+export class CacheTransitEncryptionAnalyzer {
+    name = 'CacheTransitEncryptionAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'cache_cluster')
+                continue;
+            if (node.transitEncryption === false) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `Cache cluster "${node.name}" has no in-transit encryption`,
+                    description: `ElastiCache cluster "${node.name}" (${node.engine}) does not have TLS in-transit encryption enabled. Credentials and cached data cross the network in plaintext.`,
+                    recommendation: `Enable transit encryption on "${node.name}". Note this requires clients to connect with TLS (rediss:// for Redis).`,
+                    metadata: { cacheClusterId: node.name, provider: node.provider },
+                });
+            }
+        }
+        return findings;
+    }
+}
+export class CacheSingleNodeAnalyzer {
+    name = 'CacheSingleNodeAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'cache_cluster')
+                continue;
+            if (node.numNodes === 1 && !node.replicationGroupId) {
+                findings.push({
+                    severity: 'low',
+                    issue: `Cache cluster "${node.name}" is a single node with no replication`,
+                    description: `"${node.name}" runs one cache node outside a replication group. A node failure loses all cached data and takes the cache offline until replaced.`,
+                    recommendation: `Move "${node.name}" into a replication group with at least one replica and automatic failover if cache availability matters for this workload.`,
+                    metadata: { cacheClusterId: node.name },
+                });
+            }
+        }
+        return findings;
+    }
+}
+// ─── Runtime signals ─────────────────────────────────────────────────────────
+export class LambdaThrottlingAnalyzer {
+    name = 'LambdaThrottlingAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'lambda')
+                continue;
+            if ((node.recentThrottles ?? 0) > 0) {
+                findings.push({
+                    severity: 'high',
+                    issue: `Lambda "${node.name}" was throttled ${node.recentThrottles} time(s) recently`,
+                    description: `"${node.name}" hit concurrency throttling in the analysis window. Throttled invocations are rejected or delayed; for sync callers this surfaces as errors, for event sources as retries and growing backlogs.`,
+                    recommendation: `Check reserved/account concurrency for "${node.name}". Raise reserved concurrency, request an account limit increase, or smooth the invoke rate (SQS between producer and Lambda).`,
+                    metadata: { functionName: node.name, recentThrottles: node.recentThrottles },
+                });
+            }
+        }
+        return findings;
+    }
+}
+export class StaleQueueMessagesAnalyzer {
+    name = 'StaleQueueMessagesAnalyzer';
+    thresholdSec;
+    constructor(thresholdSec = 3600) {
+        this.thresholdSec = thresholdSec;
+    }
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'queue')
+                continue;
+            const age = node.oldestMessageAgeSec ?? 0;
+            if (age > this.thresholdSec) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `Queue "${node.name}" has messages older than ${Math.round(age / 3600)} hour(s)`,
+                    description: `The oldest message in "${node.name}" is ${Math.round(age / 60)} minutes old. Consumers are not keeping up, are failing, or are not running.`,
+                    recommendation: `Check consumer health for "${node.name}". If a Lambda consumes it, look at its error and throttle counts; if messages are near the retention limit they will be silently dropped.`,
+                    metadata: { queueName: node.name, oldestMessageAgeSec: age },
+                });
+            }
+        }
+        return findings;
+    }
+}
 // ─── IAM ─────────────────────────────────────────────────────────────────────
 const MINIMAL_ACTIONS = {
     dynamodb: 'dynamodb:GetItem, dynamodb:PutItem, dynamodb:Query, dynamodb:UpdateItem, dynamodb:DeleteItem',

package/dist/analyzers/index.js

@@ -5,7 +5,7 @@ export { MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer } from './mysql.j
 export { MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer } from './mongodb.js';
 export { IaCDriftAnalyzer } from './terraform.js';
 export { PipelineAnalyzer } from './pipeline.js';
-export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from './aws-services.js';
+export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, CacheTransitEncryptionAnalyzer, CacheSingleNodeAnalyzer, LambdaThrottlingAnalyzer, StaleQueueMessagesAnalyzer, } from './aws-services.js';
 export { RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from './rds.js';
 export async function runAllAnalyzers(graph, analyzers) {
     const allFindings = [];

package/dist/cli/commands/analyze.js

@@ -8,12 +8,13 @@ import { extractPostgresMetadata } from '../../adapters/db/postgres.js';
 import { extractMySQLMetadata } from '../../adapters/db/mysql.js';
 import { extractMongoMetadata } from '../../adapters/db/mongodb.js';
 import { extractIaCSchema } from '../../adapters/iac/terraform.js';
-import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractEventBridgeMetadata, extractRDSMetadata, extractAPIGatewayMetadata, } from '../../adapters/aws/services.js';
+import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractEventBridgeMetadata, extractRDSMetadata, extractAPIGatewayMetadata, extractCognitoMetadata, extractKinesisMetadata, extractMSKMetadata, extractElastiCacheMetadata, } from '../../adapters/aws/services.js';
 import { extractLogsMetadata } from '../../adapters/aws/logs.js';
+import { extractRuntimeSignals } from '../../adapters/aws/metrics.js';
 import { extractS3Metadata } from '../../adapters/aws/s3.js';
 import { scanRepository } from '../../context/index.js';
-import { buildGraph } from '../../graph/index.js';
-import { runAllAnalyzers, IaCDriftAnalyzer, PipelineAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from '../../analyzers/index.js';
+import { buildGraph, addStackOutputNodes } from '../../graph/index.js';
+import { runAllAnalyzers, IaCDriftAnalyzer, PipelineAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, CacheTransitEncryptionAnalyzer, CacheSingleNodeAnalyzer, LambdaThrottlingAnalyzer, StaleQueueMessagesAnalyzer, } from '../../analyzers/index.js';
 import { printFinding, printSummaryBox, log, printHeader } from '../utils.js';
 const SEVERITY_ORDER = { high: 3, medium: 2, low: 1, verify: 0 };
 function buildMarkdownReport(findings, projectName) {
@@ -119,6 +120,12 @@ function buildAnalyzers(config, iacDriftAnalyzer, iacLambdas) {
                 new S3UnencryptedAnalyzer(),
             ]
             : []),
+        ...(config.elasticache?.enabled === true
+            ? [new CacheTransitEncryptionAnalyzer(), new CacheSingleNodeAnalyzer()]
+            : []),
+        ...(config.runtimeSignals?.enabled === true
+            ? [new LambdaThrottlingAnalyzer(), new StaleQueueMessagesAnalyzer()]
+            : []),
         ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
         pipelineAnalyzer,
     ];
@@ -158,15 +165,44 @@ export async function runAnalyze(options = {}) {
     servicesMeta.rds = await extract(config.rds?.enabled === true, 'Extracting RDS instances...', 'RDS', () => extractRDSMetadata(awsCfg), (r) => `${r.length} instance(s)`);
     servicesMeta.s3 = await extract(config.s3?.enabled === true, 'Extracting S3 buckets...', 'S3', () => extractS3Metadata(awsCfg), (r) => `${r.length} bucket(s)`);
     servicesMeta.apiGateway = await extract(config.apiGateway?.enabled === true, 'Extracting API Gateway routes...', 'API Gateway', () => extractAPIGatewayMetadata(awsCfg), (r) => `${r.length} API(s), ${r.reduce((sum, api) => sum + api.routes.length, 0)} route(s)`);
+    servicesMeta.cognito = await extract(config.cognito?.enabled === true, 'Extracting Cognito user pools...', 'Cognito', () => extractCognitoMetadata(awsCfg), (r) => `${r.length} user pool(s)`);
+    servicesMeta.kinesis = await extract(config.kinesis?.enabled === true, 'Extracting Kinesis streams...', 'Kinesis', () => extractKinesisMetadata(awsCfg), (r) => `${r.length} stream(s)`);
+    servicesMeta.msk = await extract(config.msk?.enabled === true, 'Extracting MSK clusters...', 'MSK', () => extractMSKMetadata(awsCfg), (r) => `${r.length} cluster(s)`);
+    servicesMeta.elasticache = await extract(config.elasticache?.enabled === true, 'Extracting ElastiCache clusters...', 'ElastiCache', () => extractElastiCacheMetadata(awsCfg), (r) => `${r.length} cluster(s)`);
     const cwLogs = config.cloudwatchLogs;
     servicesMeta.logs = await extract(cwLogs?.enabled, 'Sampling CloudWatch Logs (errors only, max 50 groups)...', 'CloudWatch Logs', () => extractLogsMetadata({
         ...awsCfg,
         logGroupPrefixes: cwLogs?.logGroupPrefixes,
         windowHours: cwLogs?.windowHours,
     }), (r) => `${r.length} group(s), ${r.filter((lg) => lg.errorCount > 0).length} with errors`);
+    if (config.runtimeSignals?.enabled && (servicesMeta.lambda?.length || servicesMeta.sqs?.length)) {
+        const s = mkSpinner('Fetching runtime signals (CloudWatch metrics)...');
+        try {
+            const signals = await extractRuntimeSignals(awsCfg, (servicesMeta.lambda ?? []).map((f) => f.name), (servicesMeta.sqs ?? []).map((q) => q.name), config.runtimeSignals.windowHours);
+            for (const fn of servicesMeta.lambda ?? []) {
+                const sig = signals.lambdas.get(fn.name);
+                if (sig) {
+                    fn.recentThrottles = sig.throttles;
+                    fn.recentErrors = sig.errors;
+                }
+            }
+            for (const q of servicesMeta.sqs ?? []) {
+                const sig = signals.queues.get(q.name);
+                if (sig)
+                    q.oldestMessageAgeSec = sig.oldestMessageAgeSec;
+            }
+            s.succeed(chalk.green('Runtime signals') +
+                chalk.dim(`  ${signals.lambdas.size} function(s), ${signals.queues.size} queue(s)`));
+        }
+        catch (err) {
+            s.warn(chalk.yellow('Runtime signals skipped') +
+                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
     // ── IaC schema (Terraform / CloudFormation / CDK) ────────────────────────────
     let iacDriftAnalyzer;
     let iacLambdas = [];
+    let iacOutputs = [];
     {
         const s = mkSpinner('Extracting IaC schema (Terraform / CloudFormation / CDK)...');
         try {
@@ -180,10 +216,12 @@ export async function runAnalyze(options = {}) {
                 iacSchema.buckets.length +
                 iacSchema.parameters.length +
                 iacSchema.secrets.length +
-                iacSchema.apiGateways.length;
+                iacSchema.apiGateways.length +
+                iacSchema.outputs.length;
             iacDriftAnalyzer = new IaCDriftAnalyzer();
             iacDriftAnalyzer.setIaCSchema(iacSchema);
             iacLambdas = iacSchema.lambdas;
+            iacOutputs = iacSchema.outputs;
             s.succeed(chalk.green('IaC schema') + chalk.dim(`  ${total} resource(s) across TF/CFN/CDK`));
         }
         catch (err) {
@@ -211,6 +249,7 @@ export async function runAnalyze(options = {}) {
     {
         const s = mkSpinner('Building infrastructure graph...');
         graph = buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
+        addStackOutputNodes(graph, iacOutputs);
         s.succeed(chalk.green('Graph built') +
             chalk.dim(`  ${graph.nodes.length} nodes, ${graph.edges.length} edges`));
     }
@@ -278,11 +317,13 @@ export async function runCodeRefresh(repoPath, config) {
     // Re-run IaC schema (pure file scan, no AWS calls)
     let iacDriftAnalyzer;
     let iacLambdas = [];
+    let iacOutputs = [];
     try {
         const iacSchema = await extractIaCSchema(repoPath);
         iacDriftAnalyzer = new IaCDriftAnalyzer();
         iacDriftAnalyzer.setIaCSchema(iacSchema);
         iacLambdas = iacSchema.lambdas;
+        iacOutputs = iacSchema.outputs;
     }
     catch {
         // IaC scan is best-effort
@@ -296,6 +337,7 @@ export async function runCodeRefresh(repoPath, config) {
         operations = [];
     }
     const graph = buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
+    addStackOutputNodes(graph, iacOutputs);
     const analyzers = buildAnalyzers(config, iacDriftAnalyzer, iacLambdas);
     const findings = await runAllAnalyzers(graph, analyzers);
     writeCache('graph', graph);

package/dist/cli/commands/discover.js

@@ -186,6 +186,11 @@ function writeYaml(cwd, opts) {
         rds: { enabled: false },
         s3: { enabled: true },
         apiGateway: { enabled: true },
+        cognito: { enabled: false },
+        kinesis: { enabled: false },
+        msk: { enabled: false },
+        elasticache: { enabled: false },
+        runtimeSignals: { enabled: false, windowHours: 24 },
         cloudwatchLogs: { enabled: false, logGroupPrefixes: [], windowHours: 24 },
         analysis: { sampleSize: 100 },
     };

package/dist/cli/commands/serve.js

@@ -11,6 +11,7 @@ const BOX_W = 52;
 const TOOL_MAP = [
     { name: 'get_infra_overview' },
     { name: 'get_graph_summary' },
+    { name: 'get_table_schema' },
     { name: 'analyze_function' },
     { name: 'suggest_gsi', service: 'dynamodb' },
     { name: 'postgres_index_suggestions', service: 'postgres' },
@@ -25,6 +26,10 @@ const TOOL_MAP = [
     { name: 'get_s3_overview', service: 's3' },
     { name: 'get_api_routes', service: 'apiGateway' },
     { name: 'get_log_errors', service: 'cloudwatchLogs' },
+    { name: 'get_stack_outputs', service: 'terraform' },
+    { name: 'get_cognito_overview', service: 'cognito' },
+    { name: 'get_stream_details', service: 'kinesis' },
+    { name: 'get_cache_overview', service: 'elasticache' },
 ];
 // With no config every registered tool is shown as active (the server exposes
 // all of them); a config narrows the list to its enabled services.

package/dist/core/config.js

@@ -57,6 +57,16 @@ export const InfrawiseConfigSchema = z.object({
     rds: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     s3: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     apiGateway: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
+    cognito: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
+    kinesis: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
+    msk: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
+    elasticache: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
+    runtimeSignals: z
+        .object({
+        enabled: z.boolean().optional().default(false),
+        windowHours: z.number().int().positive().optional().default(24),
+    })
+        .optional(),
     cloudwatchLogs: z
         .object({
         enabled: z.boolean().optional().default(false),
@@ -185,6 +195,14 @@ export function generateDefaultConfig(projectName, options) {
         rds: { enabled: options?.rds?.enabled ?? false },
         s3: { enabled: options?.s3?.enabled ?? false },
         apiGateway: { enabled: options?.apiGateway?.enabled ?? false },
+        cognito: { enabled: options?.cognito?.enabled ?? false },
+        kinesis: { enabled: options?.kinesis?.enabled ?? false },
+        msk: { enabled: options?.msk?.enabled ?? false },
+        elasticache: { enabled: options?.elasticache?.enabled ?? false },
+        runtimeSignals: {
+            enabled: options?.runtimeSignals?.enabled ?? false,
+            windowHours: options?.runtimeSignals?.windowHours ?? 24,
+        },
         cloudwatchLogs: {
             enabled: options?.cloudwatchLogs?.enabled ?? false,
             logGroupPrefixes: options?.cloudwatchLogs?.logGroupPrefixes ?? [],

package/dist/graph/index.js

@@ -13,7 +13,14 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
     // ── Database tables ──────────────────────────────────────────────────────
     for (const table of dynamoMeta) {
         const nodeId = `table:dynamo:${table.tableName}`;
-        addNode({ id: nodeId, type: 'table', name: table.tableName, databaseType: 'dynamodb' });
+        addNode({
+            id: nodeId,
+            type: 'table',
+            name: table.tableName,
+            databaseType: 'dynamodb',
+            partitionKey: table.partitionKey,
+            sortKey: table.sortKey,
+        });
         for (const indexName of table.indexes) {
             const indexNodeId = `index:${table.tableName}:${indexName}`;
             addNode({ id: indexNodeId, type: 'index', name: indexName });
@@ -27,6 +34,9 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             type: 'table',
             name: `${table.schema}.${table.table}`,
             databaseType: 'postgres',
+            columns: table.columnDetails,
+            primaryKeys: table.primaryKeys,
+            foreignKeys: table.foreignKeys,
         });
         for (const indexName of table.indexes) {
             const indexNodeId = `index:${table.schema}.${table.table}:${indexName}`;
@@ -41,6 +51,9 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             type: 'table',
             name: `${table.schema}.${table.table}`,
             databaseType: 'mysql',
+            columns: table.columnDetails,
+            primaryKeys: table.primaryKeys,
+            foreignKeys: table.foreignKeys,
         });
         for (const indexName of table.indexes) {
             const indexNodeId = `index:${table.schema}.${table.table}:${indexName}`;
@@ -55,6 +68,7 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             type: 'table',
             name: `${coll.database}.${coll.collection}`,
             databaseType: 'mongodb',
+            estimatedCount: coll.estimatedCount,
         });
         for (const idx of coll.indexes) {
             if (idx.name === '_id_')
@@ -77,6 +91,32 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             visibilityTimeoutSec: q.visibilityTimeoutSec,
             approximateMessages: q.approximateMessages,
             retentionDays: q.retentionDays,
+            oldestMessageAgeSec: q.oldestMessageAgeSec,
+        });
+    }
+    for (const s of servicesMeta.kinesis ?? []) {
+        addNode({
+            id: `stream:aws:${s.name}`,
+            type: 'stream',
+            name: s.name,
+            provider: 'aws',
+            status: s.status,
+            shardCount: s.shardCount,
+            retentionHours: s.retentionHours,
+            encrypted: s.encrypted,
+            mode: s.mode,
+        });
+    }
+    for (const c of servicesMeta.msk ?? []) {
+        addNode({
+            id: `kafka_cluster:aws:${c.name}`,
+            type: 'kafka_cluster',
+            name: c.name,
+            provider: 'aws',
+            state: c.state,
+            clusterType: c.clusterType,
+            kafkaVersion: c.kafkaVersion,
+            brokerNodes: c.brokerNodes,
         });
     }
     for (const api of servicesMeta.apiGateway ?? []) {
@@ -150,6 +190,8 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             triggers: fn.triggers,
             roleArn: fn.roleArn,
             allowedServices: fn.allowedServices,
+            recentThrottles: fn.recentThrottles,
+            recentErrors: fn.recentErrors,
         });
         // Add trigger edges from source → lambda (only for enabled/active mappings)
         for (const trigger of fn.triggers ?? []) {
@@ -177,15 +219,8 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
                 });
             }
             else if (trigger.type === 'kinesis') {
-                sourceId = `queue:aws:${trigger.sourceName}`;
-                addNode({
-                    id: sourceId,
-                    type: 'queue',
-                    name: trigger.sourceName,
-                    provider: 'aws',
-                    hasDLQ: false,
-                    encrypted: false,
-                });
+                sourceId = `stream:aws:${trigger.sourceName}`;
+                addNode({ id: sourceId, type: 'stream', name: trigger.sourceName, provider: 'aws' });
             }
             else {
                 continue;
@@ -271,6 +306,33 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             }
         }
     }
+    for (const c of servicesMeta.elasticache ?? []) {
+        addNode({
+            id: `cache_cluster:aws:${c.id}`,
+            type: 'cache_cluster',
+            name: c.id,
+            provider: 'aws',
+            engine: c.engine,
+            engineVersion: c.engineVersion,
+            nodeType: c.nodeType,
+            numNodes: c.numNodes,
+            transitEncryption: c.transitEncryption,
+            atRestEncryption: c.atRestEncryption,
+            replicationGroupId: c.replicationGroupId,
+            automaticFailover: c.automaticFailover,
+        });
+    }
+    for (const pool of servicesMeta.cognito ?? []) {
+        addNode({
+            id: `user_pool:aws:${pool.id}`,
+            type: 'user_pool',
+            name: pool.name,
+            provider: 'aws',
+            poolId: pool.id,
+            mfaConfiguration: pool.mfaConfiguration,
+            clients: pool.clients,
+        });
+    }
     // ── Code operations (functions + edges) ───────────────────────────────────
     for (const op of operations) {
         const funcNodeId = `function:${op.filePath}:${op.functionName}`;
@@ -360,6 +422,25 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
     }
     return { nodes, edges };
 }
+export function addStackOutputNodes(graph, outputs) {
+    const ids = new Set(graph.nodes.map((n) => n.id));
+    for (const o of outputs) {
+        const id = `stack_output:${o.source}:${o.filePath}:${o.name}`;
+        if (ids.has(id))
+            continue;
+        ids.add(id);
+        graph.nodes.push({
+            id,
+            type: 'stack_output',
+            name: o.name,
+            description: o.description,
+            exportName: o.exportName,
+            value: o.value,
+            iacSource: o.source,
+            file: o.filePath,
+        });
+    }
+}
 function resolveEdgeType(operationType) {
     const op = operationType.toLowerCase();
     if (op === 'scan' || op === 'scancommand')
@@ -385,6 +466,11 @@ export const getLambdaNodes = (g) => getNodes(g, 'lambda');
 export const getEventBridgeRuleNodes = (g) => getNodes(g, 'eventbridge_rule');
 export const getBucketNodes = (g) => getNodes(g, 'bucket');
 export const getAPINodes = (g) => getNodes(g, 'api');
+export const getStackOutputNodes = (g) => getNodes(g, 'stack_output');
+export const getUserPoolNodes = (g) => getNodes(g, 'user_pool');
+export const getStreamNodes = (g) => getNodes(g, 'stream');
+export const getKafkaClusterNodes = (g) => getNodes(g, 'kafka_cluster');
+export const getCacheClusterNodes = (g) => getNodes(g, 'cache_cluster');
 export function getEdgesForNode(graph, nodeId) {
     return graph.edges.filter((e) => e.from === nodeId || e.to === nodeId);
 }