infrawise 0.4.2 → 0.6.0

package/dist/cli/commands/analyze.js

@@ -1,124 +1,31 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runAnalyze = runAnalyze;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const chalk_1 = __importDefault(require("chalk"));
-const ora_1 = __importDefault(require("ora"));
-const core_1 = require("../../core");
-const dynamodb_1 = require("../../adapters/dynamodb");
-const postgres_1 = require("../../adapters/postgres");
-const mysql_1 = require("../../adapters/mysql");
-const mongodb_1 = require("../../adapters/mongodb");
-const terraform_1 = require("../../adapters/terraform");
-const aws_1 = require("../../adapters/aws");
-const logs_1 = require("../../adapters/logs");
-const context_1 = require("../../context");
-const graph_1 = require("../../graph");
-const analyzers_1 = require("../../analyzers");
-const utils_1 = require("../utils");
-const SEVERITY_RANK = { high: 3, medium: 2, low: 1, never: 0 };
-function mkSpinner(text, ci) {
-    if (ci) {
-        return {
-            succeed: (msg) => console.log(`  ✓ ${msg}`),
-            warn: (msg) => console.log(`  ⚠ ${msg}`),
-        };
-    }
-    return (0, ora_1.default)({ text: chalk_1.default.dim(text), color: 'cyan' }).start();
-}
-function emitCIOutput(findings, failOn) {
-    for (const f of findings) {
-        const level = f.severity === 'high' ? 'error' : f.severity === 'medium' ? 'warning' : 'notice';
-        console.log(`::${level} title=Infrawise [${f.severity.toUpperCase()}]::${f.issue} — ${f.description}`);
-    }
-    const summaryPath = process.env['GITHUB_STEP_SUMMARY'];
-    if (summaryPath) {
-        const high = findings.filter((f) => f.severity === 'high').length;
-        const medium = findings.filter((f) => f.severity === 'medium').length;
-        const low = findings.filter((f) => f.severity === 'low').length;
-        const rows = findings.map((f) => {
-            const icon = f.severity === 'high' ? '🔴' : f.severity === 'medium' ? '🟡' : '🔵';
-            return `| ${icon} ${f.severity.toUpperCase()} | ${f.issue} | ${f.recommendation} |`;
-        }).join('\n');
-        const summary = findings.length === 0
-            ? '## ✅ Infrawise — no issues found\n'
-            : [
-                '## Infrawise Analysis',
-                '',
-                `**${high} high · ${medium} medium · ${low} low**`,
-                '',
-                '| Severity | Issue | Recommendation |',
-                '|---|---|---|',
-                rows,
-            ].join('\n');
-        fs.appendFileSync(summaryPath, summary + '\n');
-    }
-    const threshold = SEVERITY_RANK[failOn] ?? 3;
-    const maxFound = Math.max(0, ...findings.map((f) => SEVERITY_RANK[f.severity] ?? 0));
-    if (maxFound >= threshold && threshold > 0) {
-        process.exit(1);
-    }
+import * as path from 'path';
+import chalk from 'chalk';
+import ora from 'ora';
+import { loadConfig, formatError, writeCache, readCache } from '../../core/index.js';
+import { extractDynamoMetadata } from '../../adapters/dynamodb.js';
+import { extractPostgresMetadata } from '../../adapters/postgres.js';
+import { extractMySQLMetadata } from '../../adapters/mysql.js';
+import { extractMongoMetadata } from '../../adapters/mongodb.js';
+import { extractIaCSchema } from '../../adapters/terraform.js';
+import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractRDSMetadata, } from '../../adapters/aws.js';
+import { extractLogsMetadata } from '../../adapters/logs.js';
+import { scanRepository } from '../../context/index.js';
+import { buildGraph } from '../../graph/index.js';
+import { runAllAnalyzers, IaCDriftAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from '../../analyzers/index.js';
+import { printFinding, printSummaryBox, log, printHeader } from '../utils.js';
+function mkSpinner(text) {
+    return ora({ text: chalk.dim(text), color: 'cyan' }).start();
 }
-async function runAnalyze(options = {}) {
-    const ci = options.ci ?? false;
-    const failOn = options.failOn ?? 'high';
-    if (!ci)
-        (0, utils_1.printHeader)('Running Analysis');
+export async function runAnalyze(options = {}) {
+    printHeader('Running Analysis');
     let config;
-    let isFallback = false;
     try {
-        config = (0, core_1.loadConfig)(options.config);
-        if (!ci)
-            utils_1.log.success('Config loaded', options.config ?? 'infrawise.yaml');
+        config = loadConfig(options.config);
+        log.success('Config loaded', options.config ?? 'infrawise.yaml');
     }
     catch (err) {
-        const isNotFound = err instanceof Error && err.message.includes('not found at');
-        if (ci && isNotFound) {
-            config = { project: path.basename(process.cwd()) };
-            isFallback = true;
-            console.log('  ✓ No infrawise.yaml — running code-only analysis (repo scan + IaC)');
-        }
-        else {
-            console.error((0, core_1.formatError)(err));
-            process.exit(1);
-        }
+        console.error(formatError(err));
+        process.exit(1);
     }
     const repoPath = options.repo ?? process.cwd();
     const awsCfg = { region: config.aws?.region, profile: config.aws?.profile, endpoint: config.aws?.endpoint };
@@ -129,252 +36,308 @@ async function runAnalyze(options = {}) {
     const servicesMeta = {};
     // ── DynamoDB ────────────────────────────────────────────────────────────────
     if (config.dynamodb?.enabled === true) {
-        const s = mkSpinner('Extracting DynamoDB tables...', ci);
+        const s = mkSpinner('Extracting DynamoDB tables...');
         try {
-            const result = await (0, dynamodb_1.extractDynamoMetadata)(config);
+            const result = await extractDynamoMetadata(config);
             dynamoMeta.push(...result);
-            s.succeed(chalk_1.default.green('DynamoDB') + chalk_1.default.dim(`  ${result.length} table(s)`));
+            s.succeed(chalk.green('DynamoDB') + chalk.dim(`  ${result.length} table(s)`));
         }
         catch (err) {
-            s.warn(chalk_1.default.yellow('DynamoDB skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk.yellow('DynamoDB skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── PostgreSQL ──────────────────────────────────────────────────────────────
     if (config.postgres?.enabled && config.postgres.connectionString) {
-        const s = mkSpinner('Extracting PostgreSQL schema...', ci);
+        const s = mkSpinner('Extracting PostgreSQL schema...');
         try {
-            const result = await (0, postgres_1.extractPostgresMetadata)(config.postgres.connectionString);
+            const result = await extractPostgresMetadata(config.postgres.connectionString);
             postgresMeta.push(...result);
-            s.succeed(chalk_1.default.green('PostgreSQL') + chalk_1.default.dim(`  ${result.length} table(s)`));
+            s.succeed(chalk.green('PostgreSQL') + chalk.dim(`  ${result.length} table(s)`));
         }
         catch (err) {
-            s.warn(chalk_1.default.yellow('PostgreSQL skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk.yellow('PostgreSQL skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── MySQL ───────────────────────────────────────────────────────────────────
     if (config.mysql?.enabled && config.mysql.connectionString) {
-        const s = mkSpinner('Extracting MySQL schema...', ci);
+        const s = mkSpinner('Extracting MySQL schema...');
         try {
-            const result = await (0, mysql_1.extractMySQLMetadata)(config.mysql.connectionString);
+            const result = await extractMySQLMetadata(config.mysql.connectionString);
             mysqlMeta.push(...result);
-            s.succeed(chalk_1.default.green('MySQL') + chalk_1.default.dim(`  ${result.length} table(s)`));
+            s.succeed(chalk.green('MySQL') + chalk.dim(`  ${result.length} table(s)`));
         }
         catch (err) {
-            s.warn(chalk_1.default.yellow('MySQL skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk.yellow('MySQL skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── MongoDB ─────────────────────────────────────────────────────────────────
     if (config.mongodb?.enabled && config.mongodb.connectionString) {
-        const s = mkSpinner('Extracting MongoDB schema...', ci);
+        const s = mkSpinner('Extracting MongoDB schema...');
         try {
-            const result = await (0, mongodb_1.extractMongoMetadata)(config.mongodb.connectionString, config.mongodb.databases);
+            const result = await extractMongoMetadata(config.mongodb.connectionString, config.mongodb.databases);
             mongoMeta.push(...result);
-            s.succeed(chalk_1.default.green('MongoDB') + chalk_1.default.dim(`  ${result.length} collection(s)`));
+            s.succeed(chalk.green('MongoDB') + chalk.dim(`  ${result.length} collection(s)`));
         }
         catch (err) {
-            s.warn(chalk_1.default.yellow('MongoDB skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk.yellow('MongoDB skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── SQS ─────────────────────────────────────────────────────────────────────
     if (config.sqs?.enabled === true) {
-        const s = mkSpinner('Extracting SQS queues...', ci);
+        const s = mkSpinner('Extracting SQS queues...');
         try {
-            const result = await (0, aws_1.extractSQSMetadata)(awsCfg);
+            const result = await extractSQSMetadata(awsCfg);
             servicesMeta.sqs = result;
-            s.succeed(chalk_1.default.green('SQS') + chalk_1.default.dim(`  ${result.length} queue(s)`));
+            s.succeed(chalk.green('SQS') + chalk.dim(`  ${result.length} queue(s)`));
         }
         catch (err) {
-            s.warn(chalk_1.default.yellow('SQS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk.yellow('SQS skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── SNS ─────────────────────────────────────────────────────────────────────
     if (config.sns?.enabled === true) {
-        const s = mkSpinner('Extracting SNS topics...', ci);
+        const s = mkSpinner('Extracting SNS topics...');
         try {
-            const result = await (0, aws_1.extractSNSMetadata)(awsCfg);
+            const result = await extractSNSMetadata(awsCfg);
             servicesMeta.sns = result;
-            s.succeed(chalk_1.default.green('SNS') + chalk_1.default.dim(`  ${result.length} topic(s)`));
+            s.succeed(chalk.green('SNS') + chalk.dim(`  ${result.length} topic(s)`));
         }
         catch (err) {
-            s.warn(chalk_1.default.yellow('SNS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk.yellow('SNS skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── SSM Parameter Store ──────────────────────────────────────────────────────
     if (config.ssm?.enabled === true) {
-        const s = mkSpinner('Extracting SSM parameters...', ci);
+        const s = mkSpinner('Extracting SSM parameters...');
         try {
-            const result = await (0, aws_1.extractSSMMetadata)({ ...awsCfg, paths: config.ssm?.paths });
+            const result = await extractSSMMetadata({ ...awsCfg, paths: config.ssm?.paths });
             servicesMeta.ssm = result;
-            s.succeed(chalk_1.default.green('SSM') + chalk_1.default.dim(`  ${result.length} parameter(s)  `) + chalk_1.default.dim('(metadata only, no values)'));
+            s.succeed(chalk.green('SSM') + chalk.dim(`  ${result.length} parameter(s)  `) + chalk.dim('(metadata only, no values)'));
         }
         catch (err) {
-            s.warn(chalk_1.default.yellow('SSM skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk.yellow('SSM skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── Secrets Manager ──────────────────────────────────────────────────────────
     if (config.secretsManager?.enabled === true) {
-        const s = mkSpinner('Extracting Secrets Manager metadata...', ci);
+        const s = mkSpinner('Extracting Secrets Manager metadata...');
         try {
-            const result = await (0, aws_1.extractSecretsMetadata)(awsCfg);
+            const result = await extractSecretsMetadata(awsCfg);
             servicesMeta.secrets = result;
-            s.succeed(chalk_1.default.green('Secrets Manager') + chalk_1.default.dim(`  ${result.length} secret(s)  `) + chalk_1.default.dim('(names/rotation only, no values)'));
+            s.succeed(chalk.green('Secrets Manager') + chalk.dim(`  ${result.length} secret(s)  `) + chalk.dim('(names/rotation only, no values)'));
         }
         catch (err) {
-            s.warn(chalk_1.default.yellow('Secrets Manager skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk.yellow('Secrets Manager skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── Lambda ───────────────────────────────────────────────────────────────────
     if (config.lambda?.enabled === true) {
-        const s = mkSpinner('Extracting Lambda functions...', ci);
+        const s = mkSpinner('Extracting Lambda functions...');
         try {
-            const result = await (0, aws_1.extractLambdaMetadata)(awsCfg);
+            const result = await extractLambdaMetadata(awsCfg);
             servicesMeta.lambda = result;
-            s.succeed(chalk_1.default.green('Lambda') + chalk_1.default.dim(`  ${result.length} function(s)`));
+            s.succeed(chalk.green('Lambda') + chalk.dim(`  ${result.length} function(s)`));
         }
         catch (err) {
-            s.warn(chalk_1.default.yellow('Lambda skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk.yellow('Lambda skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── RDS ──────────────────────────────────────────────────────────────────────
     if (config.rds?.enabled === true) {
-        const s = mkSpinner('Extracting RDS instances...', ci);
+        const s = mkSpinner('Extracting RDS instances...');
         try {
-            const result = await (0, aws_1.extractRDSMetadata)(awsCfg);
+            const result = await extractRDSMetadata(awsCfg);
             servicesMeta.rds = result;
-            s.succeed(chalk_1.default.green('RDS') + chalk_1.default.dim(`  ${result.length} instance(s)`));
+            s.succeed(chalk.green('RDS') + chalk.dim(`  ${result.length} instance(s)`));
         }
         catch (err) {
-            s.warn(chalk_1.default.yellow('RDS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk.yellow('RDS skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── CloudWatch Logs ──────────────────────────────────────────────────────────
     if (config.cloudwatchLogs?.enabled) {
-        const s = mkSpinner('Sampling CloudWatch Logs (errors only, max 50 groups)...', ci);
+        const s = mkSpinner('Sampling CloudWatch Logs (errors only, max 50 groups)...');
         try {
-            const result = await (0, logs_1.extractLogsMetadata)({
+            const result = await extractLogsMetadata({
                 ...awsCfg,
                 logGroupPrefixes: config.cloudwatchLogs.logGroupPrefixes,
                 windowHours: config.cloudwatchLogs.windowHours,
             });
             servicesMeta.logs = result;
             const errorGroups = result.filter((lg) => lg.errorCount > 0).length;
-            s.succeed(chalk_1.default.green('CloudWatch Logs') + chalk_1.default.dim(`  ${result.length} group(s), ${errorGroups} with errors`));
+            s.succeed(chalk.green('CloudWatch Logs') + chalk.dim(`  ${result.length} group(s), ${errorGroups} with errors`));
         }
         catch (err) {
-            s.warn(chalk_1.default.yellow('CloudWatch Logs skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk.yellow('CloudWatch Logs skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── IaC schema (Terraform / CloudFormation / CDK) ────────────────────────────
     let iacDriftAnalyzer;
     {
-        const s = mkSpinner('Extracting IaC schema (Terraform / CloudFormation / CDK)...', ci);
+        const s = mkSpinner('Extracting IaC schema (Terraform / CloudFormation / CDK)...');
         try {
-            const iacSchema = await (0, terraform_1.extractIaCSchema)(repoPath);
+            const iacSchema = await extractIaCSchema(repoPath);
             const total = iacSchema.dynamoTables.length + iacSchema.rdsInstances.length +
                 iacSchema.mongoClusters.length + iacSchema.queues.length + iacSchema.topics.length +
                 iacSchema.lambdas.length + iacSchema.buckets.length + iacSchema.parameters.length +
                 iacSchema.secrets.length + iacSchema.apiGateways.length;
-            iacDriftAnalyzer = new analyzers_1.IaCDriftAnalyzer();
+            iacDriftAnalyzer = new IaCDriftAnalyzer();
             iacDriftAnalyzer.setIaCSchema(iacSchema);
-            s.succeed(chalk_1.default.green('IaC schema') + chalk_1.default.dim(`  ${total} resource(s) across TF/CFN/CDK`));
+            s.succeed(chalk.green('IaC schema') + chalk.dim(`  ${total} resource(s) across TF/CFN/CDK`));
         }
         catch (err) {
-            s.warn(chalk_1.default.yellow('IaC scan skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk.yellow('IaC scan skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── Repository scan ──────────────────────────────────────────────────────────
     let operations;
     {
-        const s = mkSpinner(`Scanning ${path.basename(repoPath)} for service usage...`, ci);
+        const s = mkSpinner(`Scanning ${path.basename(repoPath)} for service usage...`);
         try {
-            operations = await (0, context_1.scanRepository)(repoPath);
-            s.succeed(chalk_1.default.green('Repository scanned') + chalk_1.default.dim(`  ${operations.length} service operation(s) found`));
+            operations = await scanRepository(repoPath);
+            s.succeed(chalk.green('Repository scanned') + chalk.dim(`  ${operations.length} service operation(s) found`));
         }
         catch (err) {
-            s.warn(chalk_1.default.yellow('Repository scan failed') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk.yellow('Repository scan failed') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
             operations = [];
         }
     }
     // ── Build graph ──────────────────────────────────────────────────────────────
     let graph;
     {
-        const s = mkSpinner('Building infrastructure graph...', ci);
-        graph = (0, graph_1.buildGraph)(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
-        s.succeed(chalk_1.default.green('Graph built') + chalk_1.default.dim(`  ${graph.nodes.length} nodes, ${graph.edges.length} edges`));
+        const s = mkSpinner('Building infrastructure graph...');
+        graph = buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
+        s.succeed(chalk.green('Graph built') + chalk.dim(`  ${graph.nodes.length} nodes, ${graph.edges.length} edges`));
     }
     // ── Run analyzers ────────────────────────────────────────────────────────────
     let findings;
     {
-        const s = mkSpinner('Running analyzers...', ci);
+        const s = mkSpinner('Running analyzers...');
         const analyzers = [
-            ...(config.dynamodb?.enabled === true || isFallback ? [
-                new analyzers_1.FullTableScanAnalyzer(),
-                new analyzers_1.MissingGSIAnalyzer(),
-                new analyzers_1.HotPartitionAnalyzer(),
+            ...(config.dynamodb?.enabled === true ? [
+                new FullTableScanAnalyzer(),
+                new MissingGSIAnalyzer(),
+                new HotPartitionAnalyzer(),
             ] : []),
-            ...(config.postgres?.enabled || isFallback ? [
-                new analyzers_1.MissingIndexAnalyzer(),
-                new analyzers_1.NplusOneAnalyzer(),
-                new analyzers_1.LargeSelectAnalyzer(),
+            ...(config.postgres?.enabled ? [
+                new MissingIndexAnalyzer(),
+                new NplusOneAnalyzer(),
+                new LargeSelectAnalyzer(),
             ] : []),
-            ...(config.mysql?.enabled || isFallback ? [
-                new analyzers_1.MissingMySQLIndexAnalyzer(),
-                new analyzers_1.MySQLFullTableScanAnalyzer(),
+            ...(config.mysql?.enabled ? [
+                new MissingMySQLIndexAnalyzer(),
+                new MySQLFullTableScanAnalyzer(),
             ] : []),
-            ...(config.mongodb?.enabled || isFallback ? [
-                new analyzers_1.MissingMongoIndexAnalyzer(),
-                new analyzers_1.MongoCollectionScanAnalyzer(),
+            ...(config.mongodb?.enabled ? [
+                new MissingMongoIndexAnalyzer(),
+                new MongoCollectionScanAnalyzer(),
             ] : []),
             ...(config.sqs?.enabled === true ? [
-                new analyzers_1.MissingDLQAnalyzer(),
-                new analyzers_1.UnencryptedQueueAnalyzer(),
-                new analyzers_1.LargeQueueBacklogAnalyzer(),
+                new MissingDLQAnalyzer(),
+                new UnencryptedQueueAnalyzer(),
+                new LargeQueueBacklogAnalyzer(),
             ] : []),
             ...(config.secretsManager?.enabled === true ? [
-                new analyzers_1.MissingSecretRotationAnalyzer(),
+                new MissingSecretRotationAnalyzer(),
             ] : []),
             ...(config.cloudwatchLogs?.enabled ? [
-                new analyzers_1.MissingLogRetentionAnalyzer(),
+                new MissingLogRetentionAnalyzer(),
             ] : []),
             ...(config.lambda?.enabled === true ? [
-                new analyzers_1.LambdaDefaultMemoryAnalyzer(),
-                new analyzers_1.LambdaHighTimeoutAnalyzer(),
+                new LambdaDefaultMemoryAnalyzer(),
+                new LambdaHighTimeoutAnalyzer(),
             ] : []),
             ...(config.rds?.enabled === true ? [
-                new analyzers_1.RDSPubliclyAccessibleAnalyzer(),
-                new analyzers_1.RDSNoBackupAnalyzer(),
-                new analyzers_1.RDSUnencryptedAnalyzer(),
-                new analyzers_1.RDSNoDeletionProtectionAnalyzer(),
-                new analyzers_1.RDSNoMultiAZAnalyzer(),
+                new RDSPubliclyAccessibleAnalyzer(),
+                new RDSNoBackupAnalyzer(),
+                new RDSUnencryptedAnalyzer(),
+                new RDSNoDeletionProtectionAnalyzer(),
+                new RDSNoMultiAZAnalyzer(),
             ] : []),
             ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
         ];
-        findings = await (0, analyzers_1.runAllAnalyzers)(graph, analyzers);
-        s.succeed(chalk_1.default.green('Analysis complete') + chalk_1.default.dim(`  ${findings.length} finding(s)`));
+        findings = await runAllAnalyzers(graph, analyzers);
+        s.succeed(chalk.green('Analysis complete') + chalk.dim(`  ${findings.length} finding(s)`));
     }
     // ── Cache ─────────────────────────────────────────────────────────────────────
-    (0, core_1.writeCache)('graph', graph);
-    (0, core_1.writeCache)('findings', findings);
-    (0, core_1.writeCache)('operations', operations);
+    writeCache('graph', graph);
+    writeCache('findings', findings);
+    writeCache('operations', operations);
+    writeCache('meta', { dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta });
     // ── Output ────────────────────────────────────────────────────────────────────
-    if (ci) {
-        emitCIOutput(findings, failOn);
-        return;
-    }
     console.log('');
     if (findings.length === 0) {
-        console.log(`  ${chalk_1.default.green.bold('✓ No issues found!')}  ${chalk_1.default.dim('Your infrastructure looks clean.')}`);
+        console.log(`  ${chalk.green.bold('✓ No issues found!')}  ${chalk.dim('Your infrastructure looks clean.')}`);
     }
     else {
-        console.log(chalk_1.default.bold(`  Findings`) + chalk_1.default.dim(`  ${findings.length} total`));
-        findings.forEach((f, i) => (0, utils_1.printFinding)(f, i));
-        (0, utils_1.printSummaryBox)(findings);
+        console.log(chalk.bold(`  Findings`) + chalk.dim(`  ${findings.length} total`));
+        findings.forEach((f, i) => printFinding(f, i));
+        printSummaryBox(findings);
         if (findings.some((f) => f.severity === 'high')) {
-            console.log(`\n  ${chalk_1.default.red.bold('Action required:')} ${chalk_1.default.red('High severity issues detected.')}`);
+            console.log(`\n  ${chalk.red.bold('Action required:')} ${chalk.red('High severity issues detected.')}`);
         }
     }
     console.log('');
-    utils_1.log.dim(`Results cached in .infrawise/cache/`);
-    utils_1.log.info(`Run ${chalk_1.default.cyan('infrawise dev')} to explore via the MCP server`);
+    log.dim(`Results cached in .infrawise/cache/`);
+    log.info(`Run ${chalk.cyan('infrawise dev')} to explore via the MCP server`);
     console.log('');
 }
+export async function runCodeRefresh(repoPath, config) {
+    const cached = readCache('meta', Infinity);
+    const dynamoMeta = cached?.dynamoMeta ?? [];
+    const postgresMeta = cached?.postgresMeta ?? [];
+    const mysqlMeta = cached?.mysqlMeta ?? [];
+    const mongoMeta = cached?.mongoMeta ?? [];
+    const servicesMeta = cached?.servicesMeta ?? {};
+    // Re-run IaC schema (pure file scan, no AWS calls)
+    let iacDriftAnalyzer;
+    try {
+        const iacSchema = await extractIaCSchema(repoPath);
+        iacDriftAnalyzer = new IaCDriftAnalyzer();
+        iacDriftAnalyzer.setIaCSchema(iacSchema);
+    }
+    catch {
+        // IaC scan is best-effort
+    }
+    // Re-run repo scan
+    let operations;
+    try {
+        operations = await scanRepository(repoPath);
+    }
+    catch {
+        operations = [];
+    }
+    const graph = buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
+    const analyzers = [
+        ...(config.dynamodb?.enabled === true ? [
+            new FullTableScanAnalyzer(), new MissingGSIAnalyzer(), new HotPartitionAnalyzer(),
+        ] : []),
+        ...(config.postgres?.enabled ? [
+            new MissingIndexAnalyzer(), new NplusOneAnalyzer(), new LargeSelectAnalyzer(),
+        ] : []),
+        ...(config.mysql?.enabled ? [
+            new MissingMySQLIndexAnalyzer(), new MySQLFullTableScanAnalyzer(),
+        ] : []),
+        ...(config.mongodb?.enabled ? [
+            new MissingMongoIndexAnalyzer(), new MongoCollectionScanAnalyzer(),
+        ] : []),
+        ...(config.sqs?.enabled === true ? [
+            new MissingDLQAnalyzer(), new UnencryptedQueueAnalyzer(), new LargeQueueBacklogAnalyzer(),
+        ] : []),
+        ...(config.secretsManager?.enabled === true ? [new MissingSecretRotationAnalyzer()] : []),
+        ...(config.cloudwatchLogs?.enabled ? [new MissingLogRetentionAnalyzer()] : []),
+        ...(config.lambda?.enabled === true ? [
+            new LambdaDefaultMemoryAnalyzer(), new LambdaHighTimeoutAnalyzer(),
+        ] : []),
+        ...(config.rds?.enabled === true ? [
+            new RDSPubliclyAccessibleAnalyzer(), new RDSNoBackupAnalyzer(), new RDSUnencryptedAnalyzer(),
+            new RDSNoDeletionProtectionAnalyzer(), new RDSNoMultiAZAnalyzer(),
+        ] : []),
+        ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
+    ];
+    const findings = await runAllAnalyzers(graph, analyzers);
+    writeCache('graph', graph);
+    writeCache('findings', findings);
+    writeCache('operations', operations);
+    return { graph, findings };
+}