infrawise 0.3.0 → 0.4.0

package/README.md

@@ -220,6 +220,9 @@ lambda:
 rds:
   enabled: false
 
+kafka:
+  enabled: false
+
 cloudwatchLogs:
   enabled: false
   logGroupPrefixes: []
@@ -284,6 +287,7 @@ Works from AWS APIs, database schema introspection, and IaC files — no depende
 | PostgreSQL / MySQL schema | Tables, indexes, column types |
 | MongoDB schema | Collections, indexes |
 | SQS | Missing DLQs, unencrypted queues, large backlogs |
+| Kafka (kafkajs) | Producer/consumer topic mapping from code |
 | Secrets Manager | Missing secret rotation |
 | Lambda | Default memory (128 MB), high timeouts |
 | RDS | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ |
@@ -309,7 +313,7 @@ Uses [ts-morph](https://ts-morph.com/) AST analysis to detect which functions ca
 
 Non-TypeScript/JavaScript projects still get full value from infrastructure-level analyzers — code correlation (function-to-table mapping, N+1 patterns) is skipped.
 
-The scanner supports: AWS SDK v3/v2 for DynamoDB, `pg`/Prisma/Knex for PostgreSQL, `mysql2`/Knex for MySQL, driver/Mongoose for MongoDB, and AWS SDK v3 for SQS/SNS/SSM/Secrets/Lambda.
+The scanner supports: AWS SDK v3/v2 for DynamoDB, `pg`/Prisma/Knex for PostgreSQL, `mysql2`/Knex for MySQL, driver/Mongoose for MongoDB, AWS SDK v3 for SQS/SNS/SSM/Secrets/Lambda, and `kafkajs` for Kafka topics (producer/consumer).
 
 ---
 
@@ -399,6 +403,7 @@ src/
 - Kubernetes workload graphing
 - VS Code extension
 - Infrastructure drift detection
+- MSK (Amazon Managed Streaming for Apache Kafka) — cluster metadata + topic listing via MSK API and Kafka admin client
 
 ### Under consideration
 - OpenTelemetry integration

package/dist/adapters/aws.js

@@ -244,7 +244,7 @@ async function extractRDSMetadata(cfg = {}) {
                     instanceClass: db.DBInstanceClass ?? '',
                     publiclyAccessible: db.PubliclyAccessible ?? false,
                     storageEncrypted: db.StorageEncrypted ?? false,
-                    backupRetentionPeriod: db.BackupRetentionPeriod ?? 0,
+                    backupRetentionDays: db.BackupRetentionPeriod ?? 0,
                     deletionProtection: db.DeletionProtection ?? false,
                     multiAZ: db.MultiAZ ?? false,
                     dbInstanceStatus: db.DBInstanceStatus ?? '',

package/dist/adapters/logs.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.extractLogsSummary = extractLogsSummary;
+exports.extractLogsMetadata = extractLogsMetadata;
 exports.validateLogsAccess = validateLogsAccess;
 const client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
 const credential_providers_1 = require("@aws-sdk/credential-providers");
@@ -44,7 +44,7 @@ function topPatterns(messages, limit = 5) {
         .slice(0, limit)
         .map(([pattern, count]) => ({ pattern, count }));
 }
-async function extractLogsSummary(cfg = {}) {
+async function extractLogsMetadata(cfg = {}) {
     const client = new client_cloudwatch_logs_1.CloudWatchLogsClient(clientConfig(cfg));
     const windowMs = (cfg.windowHours ?? 24) * 60 * 60 * 1000;
     const startTime = Date.now() - windowMs;

package/dist/cli/commands/analyze.js

@@ -194,7 +194,7 @@ async function runAnalyze(options = {}) {
     if (config.cloudwatchLogs?.enabled) {
         const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Sampling CloudWatch Logs (errors only, max 50 groups)...'), color: 'cyan' }).start();
         try {
-            const result = await (0, logs_1.extractLogsSummary)({
+            const result = await (0, logs_1.extractLogsMetadata)({
                 ...awsCfg,
                 logGroupPrefixes: config.cloudwatchLogs.logGroupPrefixes,
                 windowHours: config.cloudwatchLogs.windowHours,

package/dist/context/index.js

@@ -82,6 +82,11 @@ const MONGO_COLLECTION_METHODS = new Set(['collection']);
 // ── AWS service patterns ──────────────────────────────────────────────────────
 const SQS_COMMANDS = new Set(['SendMessageCommand', 'SendMessageBatchCommand', 'ReceiveMessageCommand', 'DeleteMessageCommand', 'sendMessage', 'sendMessageBatch', 'receiveMessage']);
 const SNS_COMMANDS = new Set(['PublishCommand', 'PublishBatchCommand', 'publish', 'publishBatch']);
+// kafkajs patterns — detection relies on variable naming (producer/consumer/kafka)
+const KAFKA_PRODUCER_METHODS = new Set(['send', 'sendBatch']);
+const KAFKA_CONSUMER_METHODS = new Set(['subscribe']);
+const KAFKA_CLIENT_PATTERNS = ['kafka', 'producer', 'consumer'];
+const KAFKA_TOPIC_KEYS = ['topic'];
 const SSM_COMMANDS = new Set(['GetParameterCommand', 'GetParametersCommand', 'GetParametersByPathCommand', 'getParameter', 'getParameters', 'getParametersByPath']);
 const SECRETS_COMMANDS = new Set(['GetSecretValueCommand', 'getSecretValue']);
 const LAMBDA_COMMANDS = new Set(['InvokeCommand', 'InvokeAsyncCommand', 'invoke', 'invokeAsync']);
@@ -158,7 +163,7 @@ function detectDynamoOperations(callExpr, filePath) {
                     return {
                         functionName: getEnclosingFunctionName(callExpr),
                         operationType: className,
-                        databaseType: 'dynamodb',
+                        serviceType: 'dynamodb',
                         target: tableName,
                         filePath,
                     };
@@ -173,7 +178,7 @@ function detectDynamoOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: methodName,
-                    databaseType: 'dynamodb',
+                    serviceType: 'dynamodb',
                     target: tableName,
                     filePath,
                 };
@@ -229,7 +234,7 @@ function detectPostgresOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: 'query',
-                databaseType: 'postgres',
+                serviceType: 'postgres',
                 target: tableName,
                 filePath,
             };
@@ -245,7 +250,7 @@ function detectPostgresOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: methodName,
-                    databaseType: 'postgres',
+                    serviceType: 'postgres',
                     target: modelName,
                     filePath,
                 };
@@ -262,7 +267,7 @@ function detectPostgresOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'postgres',
+                serviceType: 'postgres',
                 target: 'unknown',
                 filePath,
             };
@@ -278,7 +283,7 @@ function detectPostgresOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: methodName,
-                    databaseType: 'postgres',
+                    serviceType: 'postgres',
                     target: tableName,
                     filePath,
                 };
@@ -315,7 +320,7 @@ function detectMySQLOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: 'query',
-                databaseType: 'mysql',
+                serviceType: 'mysql',
                 target: tableName,
                 filePath,
             };
@@ -334,7 +339,7 @@ function detectMySQLOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'mysql',
+                serviceType: 'mysql',
                 target: tableName,
                 filePath,
             };
@@ -382,7 +387,7 @@ function detectMongoOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: opType,
-                databaseType: 'mongodb',
+                serviceType: 'mongodb',
                 target: collectionName,
                 filePath,
             };
@@ -399,7 +404,7 @@ function detectMongoOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: 'query',
-                databaseType: 'mongodb',
+                serviceType: 'mongodb',
                 target: collectionName,
                 filePath,
             };
@@ -422,6 +427,35 @@ function extractArgValue(arg, ...keys) {
     }
     return 'unknown';
 }
+function detectKafkaOperations(callExpr, filePath) {
+    const expr = callExpr.getExpression();
+    const args = callExpr.getArguments();
+    if (!ts_morph_1.Node.isPropertyAccessExpression(expr))
+        return null;
+    const methodName = expr.getName();
+    const objText = expr.getExpression().getText().toLowerCase();
+    if (!KAFKA_CLIENT_PATTERNS.some((p) => objText.includes(p)))
+        return null;
+    if (KAFKA_PRODUCER_METHODS.has(methodName)) {
+        return {
+            functionName: getEnclosingFunctionName(callExpr),
+            operationType: methodName,
+            serviceType: 'kafka',
+            target: args.length > 0 ? extractArgValue(args[0], ...KAFKA_TOPIC_KEYS) : 'unknown',
+            filePath,
+        };
+    }
+    if (KAFKA_CONSUMER_METHODS.has(methodName)) {
+        return {
+            functionName: getEnclosingFunctionName(callExpr),
+            operationType: methodName,
+            serviceType: 'kafka',
+            target: args.length > 0 ? extractArgValue(args[0], ...KAFKA_TOPIC_KEYS) : 'unknown',
+            filePath,
+        };
+    }
+    return null;
+}
 function detectAWSServiceOperations(callExpr, filePath) {
     const expr = callExpr.getExpression();
     const args = callExpr.getArguments();
@@ -435,7 +469,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'sqs',
+                    serviceType: 'sqs',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SQS_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -444,7 +478,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'sns',
+                    serviceType: 'sns',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SNS_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -453,7 +487,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'ssm',
+                    serviceType: 'ssm',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SSM_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -462,7 +496,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'secretsmanager',
+                    serviceType: 'secretsmanager',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SECRETS_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -471,7 +505,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'lambda',
+                    serviceType: 'lambda',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...LAMBDA_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -486,7 +520,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'sqs',
+                serviceType: 'sqs',
                 target: args.length > 0 ? extractArgValue(args[0], ...SQS_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -495,7 +529,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'sns',
+                serviceType: 'sns',
                 target: args.length > 0 ? extractArgValue(args[0], ...SNS_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -504,7 +538,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'ssm',
+                serviceType: 'ssm',
                 target: args.length > 0 ? extractArgValue(args[0], ...SSM_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -513,7 +547,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'secretsmanager',
+                serviceType: 'secretsmanager',
                 target: args.length > 0 ? extractArgValue(args[0], ...SECRETS_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -522,7 +556,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'lambda',
+                serviceType: 'lambda',
                 target: args.length > 0 ? extractArgValue(args[0], ...LAMBDA_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -586,6 +620,11 @@ async function scanRepository(repoPath) {
                 operations.push(mongoOp);
                 continue;
             }
+            const kafkaOp = detectKafkaOperations(callExpr, filePath);
+            if (kafkaOp) {
+                operations.push(kafkaOp);
+                continue;
+            }
             const awsOp = detectAWSServiceOperations(callExpr, filePath);
             if (awsOp) {
                 operations.push(awsOp);

package/dist/graph/index.js

@@ -140,7 +140,7 @@ function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [], mongoM
             instanceClass: db.instanceClass,
             publiclyAccessible: db.publiclyAccessible,
             storageEncrypted: db.storageEncrypted,
-            backupRetentionDays: db.backupRetentionPeriod,
+            backupRetentionDays: db.backupRetentionDays,
             deletionProtection: db.deletionProtection,
             multiAZ: db.multiAZ,
         });
@@ -153,31 +153,38 @@ function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [], mongoM
             nodeIds.add(funcNodeId);
         }
         // AWS service operations create edges to service nodes
-        if (op.databaseType === 'sqs') {
+        if (op.serviceType === 'sqs') {
             const queueId = `queue:aws:${op.target}`;
             addNode({ id: queueId, type: 'queue', name: op.target, provider: 'aws', hasDLQ: false, encrypted: false });
             edges.push({ from: funcNodeId, to: queueId, type: 'publishes_to' });
             continue;
         }
-        if (op.databaseType === 'sns') {
+        if (op.serviceType === 'sns') {
             const topicId = `topic:aws:${op.target}`;
             addNode({ id: topicId, type: 'topic', name: op.target, provider: 'aws', encrypted: false });
             edges.push({ from: funcNodeId, to: topicId, type: 'publishes_to' });
             continue;
         }
-        if (op.databaseType === 'ssm') {
+        if (op.serviceType === 'kafka') {
+            const topicId = `topic:kafka:${op.target}`;
+            addNode({ id: topicId, type: 'topic', name: op.target, provider: 'kafka', encrypted: false });
+            const edgeType = op.operationType === 'subscribe' ? 'subscribes_to' : 'publishes_to';
+            edges.push({ from: funcNodeId, to: topicId, type: edgeType });
+            continue;
+        }
+        if (op.serviceType === 'ssm') {
             const paramId = `parameter:aws:${op.target}`;
             addNode({ id: paramId, type: 'parameter', name: op.target, provider: 'aws', paramType: 'String', tier: 'Standard' });
             edges.push({ from: funcNodeId, to: paramId, type: 'reads_parameter' });
             continue;
         }
-        if (op.databaseType === 'secretsmanager') {
+        if (op.serviceType === 'secretsmanager') {
             const secretId = `secret:aws:${op.target}`;
             addNode({ id: secretId, type: 'secret', name: op.target, provider: 'aws', rotationEnabled: false });
             edges.push({ from: funcNodeId, to: secretId, type: 'reads_secret' });
             continue;
         }
-        if (op.databaseType === 'lambda') {
+        if (op.serviceType === 'lambda') {
             const lambdaId = `lambda:aws:${op.target}`;
             addNode({ id: lambdaId, type: 'lambda', name: op.target });
             edges.push({ from: funcNodeId, to: lambdaId, type: 'triggers' });
@@ -185,16 +192,16 @@ function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [], mongoM
         }
         // Database operations
         let tableNodeId;
-        if (op.databaseType === 'dynamodb') {
+        if (op.serviceType === 'dynamodb') {
             tableNodeId = `table:dynamo:${op.target}`;
             addNode({ id: tableNodeId, type: 'table', name: op.target, databaseType: 'dynamodb' });
         }
-        else if (op.databaseType === 'mysql') {
+        else if (op.serviceType === 'mysql') {
             const q = op.target.includes('.') ? op.target : `default.${op.target}`;
             tableNodeId = `table:mysql:${q}`;
             addNode({ id: tableNodeId, type: 'table', name: q, databaseType: 'mysql' });
         }
-        else if (op.databaseType === 'mongodb') {
+        else if (op.serviceType === 'mongodb') {
             const q = op.target.includes('.') ? op.target : `default.${op.target}`;
             tableNodeId = `table:mongodb:${q}`;
             addNode({ id: tableNodeId, type: 'table', name: q, databaseType: 'mongodb' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
     "infrastructure",