infrawise 0.2.2 → 0.4.0

package/README.md

@@ -220,6 +220,9 @@ lambda:
 rds:
   enabled: false
 
+kafka:
+  enabled: false
+
 cloudwatchLogs:
   enabled: false
   logGroupPrefixes: []
@@ -284,6 +287,7 @@ Works from AWS APIs, database schema introspection, and IaC files — no depende
 | PostgreSQL / MySQL schema | Tables, indexes, column types |
 | MongoDB schema | Collections, indexes |
 | SQS | Missing DLQs, unencrypted queues, large backlogs |
+| Kafka (kafkajs) | Producer/consumer topic mapping from code |
 | Secrets Manager | Missing secret rotation |
 | Lambda | Default memory (128 MB), high timeouts |
 | RDS | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ |
@@ -309,7 +313,7 @@ Uses [ts-morph](https://ts-morph.com/) AST analysis to detect which functions ca
 
 Non-TypeScript/JavaScript projects still get full value from infrastructure-level analyzers — code correlation (function-to-table mapping, N+1 patterns) is skipped.
 
-The scanner supports: AWS SDK v3/v2 for DynamoDB, `pg`/Prisma/Knex for PostgreSQL, `mysql2`/Knex for MySQL, driver/Mongoose for MongoDB, and AWS SDK v3 for SQS/SNS/SSM/Secrets/Lambda.
+The scanner supports: AWS SDK v3/v2 for DynamoDB, `pg`/Prisma/Knex for PostgreSQL, `mysql2`/Knex for MySQL, driver/Mongoose for MongoDB, AWS SDK v3 for SQS/SNS/SSM/Secrets/Lambda, and `kafkajs` for Kafka topics (producer/consumer).
 
 ---
 
@@ -399,6 +403,7 @@ src/
 - Kubernetes workload graphing
 - VS Code extension
 - Infrastructure drift detection
+- MSK (Amazon Managed Streaming for Apache Kafka) — cluster metadata + topic listing via MSK API and Kafka admin client
 
 ### Under consideration
 - OpenTelemetry integration

package/dist/adapters/aws.js

@@ -22,9 +22,17 @@ const credential_providers_1 = require("@aws-sdk/credential-providers");
 const core_1 = require("../core");
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
-    return cfg.profile
-        ? { region, credentials: (0, credential_providers_1.fromIni)({ profile: cfg.profile }) }
-        : { region };
+    const base = { region };
+    if (cfg.endpoint)
+        base.endpoint = cfg.endpoint;
+    if (cfg.profile)
+        base.credentials = (0, credential_providers_1.fromIni)({ profile: cfg.profile });
+    else if (cfg.endpoint)
+        base.credentials = {
+            accessKeyId: process.env.AWS_ACCESS_KEY_ID ?? 'test',
+            secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY ?? 'test',
+        };
+    return base;
 }
 // ─── SQS ─────────────────────────────────────────────────────────────────────
 async function extractSQSMetadata(cfg = {}) {
@@ -236,7 +244,7 @@ async function extractRDSMetadata(cfg = {}) {
                     instanceClass: db.DBInstanceClass ?? '',
                     publiclyAccessible: db.PubliclyAccessible ?? false,
                     storageEncrypted: db.StorageEncrypted ?? false,
-                    backupRetentionPeriod: db.BackupRetentionPeriod ?? 0,
+                    backupRetentionDays: db.BackupRetentionPeriod ?? 0,
                     deletionProtection: db.DeletionProtection ?? false,
                     multiAZ: db.MultiAZ ?? false,
                     dbInstanceStatus: db.DBInstanceStatus ?? '',

package/dist/adapters/dynamodb.js

@@ -2,16 +2,24 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractDynamoMetadata = extractDynamoMetadata;
 exports.validateDynamoAccess = validateDynamoAccess;
+exports.probeDynamoAccess = probeDynamoAccess;
 const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
 const credential_providers_1 = require("@aws-sdk/credential-providers");
 const core_1 = require("../core");
 function createDynamoClient(config) {
     const region = config.aws?.region ?? 'us-east-1';
     const profile = config.aws?.profile;
+    const endpoint = config.aws?.endpoint;
     const clientConfig = { region };
-    if (profile) {
+    if (endpoint)
+        clientConfig.endpoint = endpoint;
+    if (profile)
         clientConfig.credentials = (0, credential_providers_1.fromIni)({ profile });
-    }
+    else if (endpoint)
+        clientConfig.credentials = {
+            accessKeyId: process.env.AWS_ACCESS_KEY_ID ?? 'test',
+            secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY ?? 'test',
+        };
     return new client_dynamodb_1.DynamoDBClient(clientConfig);
 }
 function parseTableDescription(desc) {
@@ -95,3 +103,7 @@ async function validateDynamoAccess(config) {
         return false;
     }
 }
+async function probeDynamoAccess(config) {
+    const client = createDynamoClient(config);
+    await client.send(new client_dynamodb_1.ListTablesCommand({ Limit: 1 }));
+}

package/dist/adapters/logs.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.extractLogsSummary = extractLogsSummary;
+exports.extractLogsMetadata = extractLogsMetadata;
 exports.validateLogsAccess = validateLogsAccess;
 const client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
 const credential_providers_1 = require("@aws-sdk/credential-providers");
@@ -10,9 +10,17 @@ const MAX_LOG_GROUPS = 50;
 const MAX_EVENTS_PER_GROUP = 50;
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
-    return cfg.profile
-        ? { region, credentials: (0, credential_providers_1.fromIni)({ profile: cfg.profile }) }
-        : { region };
+    const base = { region };
+    if (cfg.endpoint)
+        base.endpoint = cfg.endpoint;
+    if (cfg.profile)
+        base.credentials = (0, credential_providers_1.fromIni)({ profile: cfg.profile });
+    else if (cfg.endpoint)
+        base.credentials = {
+            accessKeyId: process.env.AWS_ACCESS_KEY_ID ?? 'test',
+            secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY ?? 'test',
+        };
+    return base;
 }
 // Strip UUIDs, timestamps, numbers → group similar messages by pattern
 function toPattern(message) {
@@ -36,7 +44,7 @@ function topPatterns(messages, limit = 5) {
         .slice(0, limit)
         .map(([pattern, count]) => ({ pattern, count }));
 }
-async function extractLogsSummary(cfg = {}) {
+async function extractLogsMetadata(cfg = {}) {
     const client = new client_cloudwatch_logs_1.CloudWatchLogsClient(clientConfig(cfg));
     const windowMs = (cfg.windowHours ?? 24) * 60 * 60 * 1000;
     const startTime = Date.now() - windowMs;

package/dist/cli/commands/analyze.js

@@ -64,7 +64,7 @@ async function runAnalyze(options = {}) {
         process.exit(1);
     }
     const repoPath = options.repo ?? process.cwd();
-    const awsCfg = { region: config.aws?.region, profile: config.aws?.profile };
+    const awsCfg = { region: config.aws?.region, profile: config.aws?.profile, endpoint: config.aws?.endpoint };
     const dynamoMeta = [];
     const postgresMeta = [];
     const mysqlMeta = [];
@@ -194,7 +194,7 @@ async function runAnalyze(options = {}) {
     if (config.cloudwatchLogs?.enabled) {
         const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Sampling CloudWatch Logs (errors only, max 50 groups)...'), color: 'cyan' }).start();
         try {
-            const result = await (0, logs_1.extractLogsSummary)({
+            const result = await (0, logs_1.extractLogsMetadata)({
                 ...awsCfg,
                 logGroupPrefixes: config.cloudwatchLogs.logGroupPrefixes,
                 windowHours: config.cloudwatchLogs.windowHours,

package/dist/cli/commands/doctor.js

@@ -113,7 +113,7 @@ async function runDoctor(options = {}) {
             detail: hasCreds ? undefined : 'Run: aws configure',
         };
     }));
-    const awsCfg = { region: config?.aws?.region, profile: config?.aws?.profile };
+    const awsCfg = { region: config?.aws?.region, profile: config?.aws?.profile, endpoint: config?.aws?.endpoint };
     // DynamoDB
     results.push(await runCheck('Testing DynamoDB access...', async () => {
         if (!config)
@@ -121,15 +121,15 @@ async function runDoctor(options = {}) {
         if (config.dynamodb?.enabled !== true)
             return { name: 'DynamoDB', status: 'skip', message: 'Disabled in config' };
         try {
-            const ok = await (0, dynamodb_1.validateDynamoAccess)(config);
-            return {
-                name: 'DynamoDB', status: ok ? 'pass' : 'warn',
-                message: ok ? `Connected (profile: ${config.aws?.profile ?? 'default'})` : 'Cannot connect',
-                detail: ok ? undefined : 'Check IAM: dynamodb:ListTables, dynamodb:DescribeTable',
-            };
+            await (0, dynamodb_1.probeDynamoAccess)(config);
+            return { name: 'DynamoDB', status: 'pass', message: `Connected (profile: ${config.aws?.profile ?? 'default'})` };
         }
         catch (err) {
-            return { name: 'DynamoDB', status: 'warn', message: err instanceof Error ? err.message : String(err) };
+            return {
+                name: 'DynamoDB', status: 'warn',
+                message: err instanceof Error ? err.message : String(err),
+                detail: 'Check IAM: dynamodb:ListTables, dynamodb:DescribeTable',
+            };
         }
     }));
     // SQS
@@ -293,7 +293,11 @@ async function runDoctor(options = {}) {
     // IaC detection
     results.push(await runCheck('Detecting IaC files...', async () => {
         const cwd = process.cwd();
-        const hasTF = fs.existsSync(path.join(cwd, 'main.tf')) || fs.readdirSync(cwd).some((f) => f.endsWith('.tf'));
+        const hasTfFile = (dir) => fs.existsSync(dir) && fs.readdirSync(dir).some((f) => f.endsWith('.tf'));
+        const hasTF = hasTfFile(cwd) || fs.readdirSync(cwd).some((entry) => {
+            const full = path.join(cwd, entry);
+            return fs.statSync(full).isDirectory() && hasTfFile(full);
+        });
         const hasCFN = fs.existsSync(path.join(cwd, 'template.yaml')) || fs.existsSync(path.join(cwd, 'template.json'));
         const hasCDK = fs.existsSync(path.join(cwd, 'cdk.json'));
         const hasCDKOut = fs.existsSync(path.join(cwd, 'cdk.out'));

package/dist/cli/commands/init.js

@@ -71,7 +71,13 @@ async function runInit(options = {}) {
             type: 'list',
             name: 'awsProfile',
             message: 'AWS profile:',
-            choices: profiles,
+            choices: [
+                new inquirer_1.default.Separator('── no profile ──'),
+                { name: 'Environment variables  (CI/CD, real AWS)', value: '__env__' },
+                { name: 'LocalStack  (local development)', value: '__localstack__' },
+                new inquirer_1.default.Separator('── named profiles ──'),
+                ...profiles,
+            ],
             default: profiles[0],
         },
         {
@@ -80,24 +86,18 @@ async function runInit(options = {}) {
             message: 'AWS region:',
             default: detectedRegion,
         },
+        {
+            type: 'input',
+            name: 'endpoint',
+            message: 'LocalStack endpoint:',
+            default: 'http://localhost:4566',
+            when: (a) => a.awsProfile === '__localstack__',
+        },
     ]);
     // ── Databases ──────────────────────────────────────────────────────────────
     console.log('\n  ' + chalk_1.default.bold('Databases'));
+    console.log(chalk_1.default.dim('  Self-hosted databases (PostgreSQL, MySQL, MongoDB).'));
     const databases = await inquirer_1.default.prompt([
-        {
-            type: 'confirm',
-            name: 'dynamoEnabled',
-            message: 'Enable DynamoDB analysis?',
-            default: true,
-        },
-        {
-            type: 'input',
-            name: 'dynamoTables',
-            message: 'DynamoDB tables to include:',
-            default: '',
-            suffix: chalk_1.default.dim(' (comma-separated, blank = all)'),
-            when: (a) => a.dynamoEnabled,
-        },
         {
             type: 'confirm',
             name: 'pgEnabled',
@@ -140,8 +140,22 @@ async function runInit(options = {}) {
     ]);
     // ── AWS services ───────────────────────────────────────────────────────────
     console.log('\n  ' + chalk_1.default.bold('AWS Services'));
-    console.log(chalk_1.default.dim('  Infrawise will introspect these services — credentials from the AWS profile above.'));
+    console.log(chalk_1.default.dim('  Infrawise will introspect these services using the credentials configured above.'));
     const services = await inquirer_1.default.prompt([
+        {
+            type: 'confirm',
+            name: 'dynamoEnabled',
+            message: 'Introspect DynamoDB?',
+            default: true,
+        },
+        {
+            type: 'input',
+            name: 'dynamoTables',
+            message: 'DynamoDB tables to include:',
+            default: '',
+            suffix: chalk_1.default.dim(' (comma-separated, blank = all)'),
+            when: (a) => a.dynamoEnabled,
+        },
         {
             type: 'confirm',
             name: 'sqsEnabled',
@@ -196,8 +210,8 @@ async function runInit(options = {}) {
         },
     ]);
     // ── Build config ───────────────────────────────────────────────────────────
-    const includeTables = databases.dynamoTables
-        ? databases.dynamoTables.split(',').map((t) => t.trim()).filter(Boolean)
+    const includeTables = services.dynamoTables
+        ? services.dynamoTables.split(',').map((t) => t.trim()).filter(Boolean)
         : [];
     const ssmPaths = services.ssmPaths
         ? services.ssmPaths.split(',').map((p) => p.trim()).filter(Boolean)
@@ -205,9 +219,13 @@ async function runInit(options = {}) {
     const logGroupPrefixes = services.logGroupPrefixes
         ? services.logGroupPrefixes.split(',').map((p) => p.trim()).filter(Boolean)
         : [];
+    const isLocalStack = core.awsProfile === '__localstack__';
+    const isEnvVars = core.awsProfile === '__env__';
+    const resolvedProfile = isLocalStack || isEnvVars ? '' : core.awsProfile;
+    const resolvedEndpoint = isLocalStack ? (core.endpoint || 'http://localhost:4566') : undefined;
     const configContent = (0, core_1.generateDefaultConfig)(core.project, {
-        aws: { profile: core.awsProfile, region: core.region },
-        dynamodb: { enabled: databases.dynamoEnabled, includeTables },
+        aws: { profile: resolvedProfile, region: core.region, endpoint: resolvedEndpoint },
+        dynamodb: { enabled: services.dynamoEnabled, includeTables },
         postgres: { enabled: databases.pgEnabled, connectionString: databases.pgConnectionString ?? '' },
         mysql: { enabled: databases.mysqlEnabled, connectionString: databases.mysqlConnectionString ?? '' },
         mongodb: { enabled: databases.mongoEnabled, connectionString: databases.mongoConnectionString ?? '' },

package/dist/context/index.js

@@ -82,6 +82,11 @@ const MONGO_COLLECTION_METHODS = new Set(['collection']);
 // ── AWS service patterns ──────────────────────────────────────────────────────
 const SQS_COMMANDS = new Set(['SendMessageCommand', 'SendMessageBatchCommand', 'ReceiveMessageCommand', 'DeleteMessageCommand', 'sendMessage', 'sendMessageBatch', 'receiveMessage']);
 const SNS_COMMANDS = new Set(['PublishCommand', 'PublishBatchCommand', 'publish', 'publishBatch']);
+// kafkajs patterns — detection relies on variable naming (producer/consumer/kafka)
+const KAFKA_PRODUCER_METHODS = new Set(['send', 'sendBatch']);
+const KAFKA_CONSUMER_METHODS = new Set(['subscribe']);
+const KAFKA_CLIENT_PATTERNS = ['kafka', 'producer', 'consumer'];
+const KAFKA_TOPIC_KEYS = ['topic'];
 const SSM_COMMANDS = new Set(['GetParameterCommand', 'GetParametersCommand', 'GetParametersByPathCommand', 'getParameter', 'getParameters', 'getParametersByPath']);
 const SECRETS_COMMANDS = new Set(['GetSecretValueCommand', 'getSecretValue']);
 const LAMBDA_COMMANDS = new Set(['InvokeCommand', 'InvokeAsyncCommand', 'invoke', 'invokeAsync']);
@@ -158,7 +163,7 @@ function detectDynamoOperations(callExpr, filePath) {
                     return {
                         functionName: getEnclosingFunctionName(callExpr),
                         operationType: className,
-                        databaseType: 'dynamodb',
+                        serviceType: 'dynamodb',
                         target: tableName,
                         filePath,
                     };
@@ -173,7 +178,7 @@ function detectDynamoOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: methodName,
-                    databaseType: 'dynamodb',
+                    serviceType: 'dynamodb',
                     target: tableName,
                     filePath,
                 };
@@ -229,7 +234,7 @@ function detectPostgresOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: 'query',
-                databaseType: 'postgres',
+                serviceType: 'postgres',
                 target: tableName,
                 filePath,
             };
@@ -245,7 +250,7 @@ function detectPostgresOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: methodName,
-                    databaseType: 'postgres',
+                    serviceType: 'postgres',
                     target: modelName,
                     filePath,
                 };
@@ -262,7 +267,7 @@ function detectPostgresOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'postgres',
+                serviceType: 'postgres',
                 target: 'unknown',
                 filePath,
             };
@@ -278,7 +283,7 @@ function detectPostgresOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: methodName,
-                    databaseType: 'postgres',
+                    serviceType: 'postgres',
                     target: tableName,
                     filePath,
                 };
@@ -315,7 +320,7 @@ function detectMySQLOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: 'query',
-                databaseType: 'mysql',
+                serviceType: 'mysql',
                 target: tableName,
                 filePath,
             };
@@ -334,7 +339,7 @@ function detectMySQLOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'mysql',
+                serviceType: 'mysql',
                 target: tableName,
                 filePath,
             };
@@ -382,7 +387,7 @@ function detectMongoOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: opType,
-                databaseType: 'mongodb',
+                serviceType: 'mongodb',
                 target: collectionName,
                 filePath,
             };
@@ -399,7 +404,7 @@ function detectMongoOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: 'query',
-                databaseType: 'mongodb',
+                serviceType: 'mongodb',
                 target: collectionName,
                 filePath,
             };
@@ -422,6 +427,35 @@ function extractArgValue(arg, ...keys) {
     }
     return 'unknown';
 }
+function detectKafkaOperations(callExpr, filePath) {
+    const expr = callExpr.getExpression();
+    const args = callExpr.getArguments();
+    if (!ts_morph_1.Node.isPropertyAccessExpression(expr))
+        return null;
+    const methodName = expr.getName();
+    const objText = expr.getExpression().getText().toLowerCase();
+    if (!KAFKA_CLIENT_PATTERNS.some((p) => objText.includes(p)))
+        return null;
+    if (KAFKA_PRODUCER_METHODS.has(methodName)) {
+        return {
+            functionName: getEnclosingFunctionName(callExpr),
+            operationType: methodName,
+            serviceType: 'kafka',
+            target: args.length > 0 ? extractArgValue(args[0], ...KAFKA_TOPIC_KEYS) : 'unknown',
+            filePath,
+        };
+    }
+    if (KAFKA_CONSUMER_METHODS.has(methodName)) {
+        return {
+            functionName: getEnclosingFunctionName(callExpr),
+            operationType: methodName,
+            serviceType: 'kafka',
+            target: args.length > 0 ? extractArgValue(args[0], ...KAFKA_TOPIC_KEYS) : 'unknown',
+            filePath,
+        };
+    }
+    return null;
+}
 function detectAWSServiceOperations(callExpr, filePath) {
     const expr = callExpr.getExpression();
     const args = callExpr.getArguments();
@@ -435,7 +469,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'sqs',
+                    serviceType: 'sqs',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SQS_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -444,7 +478,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'sns',
+                    serviceType: 'sns',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SNS_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -453,7 +487,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'ssm',
+                    serviceType: 'ssm',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SSM_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -462,7 +496,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'secretsmanager',
+                    serviceType: 'secretsmanager',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SECRETS_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -471,7 +505,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'lambda',
+                    serviceType: 'lambda',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...LAMBDA_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -486,7 +520,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'sqs',
+                serviceType: 'sqs',
                 target: args.length > 0 ? extractArgValue(args[0], ...SQS_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -495,7 +529,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'sns',
+                serviceType: 'sns',
                 target: args.length > 0 ? extractArgValue(args[0], ...SNS_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -504,7 +538,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'ssm',
+                serviceType: 'ssm',
                 target: args.length > 0 ? extractArgValue(args[0], ...SSM_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -513,7 +547,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'secretsmanager',
+                serviceType: 'secretsmanager',
                 target: args.length > 0 ? extractArgValue(args[0], ...SECRETS_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -522,7 +556,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'lambda',
+                serviceType: 'lambda',
                 target: args.length > 0 ? extractArgValue(args[0], ...LAMBDA_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -586,6 +620,11 @@ async function scanRepository(repoPath) {
                 operations.push(mongoOp);
                 continue;
             }
+            const kafkaOp = detectKafkaOperations(callExpr, filePath);
+            if (kafkaOp) {
+                operations.push(kafkaOp);
+                continue;
+            }
             const awsOp = detectAWSServiceOperations(callExpr, filePath);
             if (awsOp) {
                 operations.push(awsOp);

package/dist/core/config.js

@@ -46,6 +46,7 @@ exports.InfrawiseConfigSchema = zod_1.z.object({
         .object({
         profile: zod_1.z.string().optional().default('default'),
         region: zod_1.z.string().optional().default('us-east-1'),
+        endpoint: zod_1.z.string().optional(),
     })
         .optional()
         .default({}),
@@ -128,6 +129,7 @@ function generateDefaultConfig(projectName, options) {
         aws: {
             profile: options?.aws?.profile ?? 'default',
             region: options?.aws?.region ?? 'us-east-1',
+            ...(options?.aws?.endpoint ? { endpoint: options.aws.endpoint } : {}),
         },
         dynamodb: { enabled: options?.dynamodb?.enabled ?? true, includeTables: options?.dynamodb?.includeTables ?? [] },
         postgres: {

package/dist/graph/index.js

@@ -140,7 +140,7 @@ function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [], mongoM
             instanceClass: db.instanceClass,
             publiclyAccessible: db.publiclyAccessible,
             storageEncrypted: db.storageEncrypted,
-            backupRetentionDays: db.backupRetentionPeriod,
+            backupRetentionDays: db.backupRetentionDays,
             deletionProtection: db.deletionProtection,
             multiAZ: db.multiAZ,
         });
@@ -153,31 +153,38 @@ function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [], mongoM
             nodeIds.add(funcNodeId);
         }
         // AWS service operations create edges to service nodes
-        if (op.databaseType === 'sqs') {
+        if (op.serviceType === 'sqs') {
             const queueId = `queue:aws:${op.target}`;
             addNode({ id: queueId, type: 'queue', name: op.target, provider: 'aws', hasDLQ: false, encrypted: false });
             edges.push({ from: funcNodeId, to: queueId, type: 'publishes_to' });
             continue;
         }
-        if (op.databaseType === 'sns') {
+        if (op.serviceType === 'sns') {
             const topicId = `topic:aws:${op.target}`;
             addNode({ id: topicId, type: 'topic', name: op.target, provider: 'aws', encrypted: false });
             edges.push({ from: funcNodeId, to: topicId, type: 'publishes_to' });
             continue;
         }
-        if (op.databaseType === 'ssm') {
+        if (op.serviceType === 'kafka') {
+            const topicId = `topic:kafka:${op.target}`;
+            addNode({ id: topicId, type: 'topic', name: op.target, provider: 'kafka', encrypted: false });
+            const edgeType = op.operationType === 'subscribe' ? 'subscribes_to' : 'publishes_to';
+            edges.push({ from: funcNodeId, to: topicId, type: edgeType });
+            continue;
+        }
+        if (op.serviceType === 'ssm') {
             const paramId = `parameter:aws:${op.target}`;
             addNode({ id: paramId, type: 'parameter', name: op.target, provider: 'aws', paramType: 'String', tier: 'Standard' });
             edges.push({ from: funcNodeId, to: paramId, type: 'reads_parameter' });
             continue;
         }
-        if (op.databaseType === 'secretsmanager') {
+        if (op.serviceType === 'secretsmanager') {
             const secretId = `secret:aws:${op.target}`;
             addNode({ id: secretId, type: 'secret', name: op.target, provider: 'aws', rotationEnabled: false });
             edges.push({ from: funcNodeId, to: secretId, type: 'reads_secret' });
             continue;
         }
-        if (op.databaseType === 'lambda') {
+        if (op.serviceType === 'lambda') {
             const lambdaId = `lambda:aws:${op.target}`;
             addNode({ id: lambdaId, type: 'lambda', name: op.target });
             edges.push({ from: funcNodeId, to: lambdaId, type: 'triggers' });
@@ -185,16 +192,16 @@ function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [], mongoM
         }
         // Database operations
         let tableNodeId;
-        if (op.databaseType === 'dynamodb') {
+        if (op.serviceType === 'dynamodb') {
             tableNodeId = `table:dynamo:${op.target}`;
             addNode({ id: tableNodeId, type: 'table', name: op.target, databaseType: 'dynamodb' });
         }
-        else if (op.databaseType === 'mysql') {
+        else if (op.serviceType === 'mysql') {
             const q = op.target.includes('.') ? op.target : `default.${op.target}`;
             tableNodeId = `table:mysql:${q}`;
             addNode({ id: tableNodeId, type: 'table', name: q, databaseType: 'mysql' });
         }
-        else if (op.databaseType === 'mongodb') {
+        else if (op.serviceType === 'mongodb') {
             const q = op.target.includes('.') ? op.target : `default.${op.target}`;
             tableNodeId = `table:mongodb:${q}`;
             addNode({ id: tableNodeId, type: 'table', name: q, databaseType: 'mongodb' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.2.2",
+  "version": "0.4.0",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
     "infrastructure",