infrawise 0.7.1 → 0.8.0

package/README.md

@@ -4,6 +4,7 @@
 [![Publish to npm](https://github.com/Sidd27/infrawise/actions/workflows/npm-publish.yml/badge.svg)](https://github.com/Sidd27/infrawise/actions/workflows/npm-publish.yml)
 [![CI](https://github.com/Sidd27/infrawise/actions/workflows/ci.yml/badge.svg)](https://github.com/Sidd27/infrawise/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![infrawise MCP server](https://glama.ai/mcp/servers/Sidd27/infrawise/badges/score.svg)](https://glama.ai/mcp/servers/Sidd27/infrawise)
 
 **Understand your infrastructure, not just your code.**
 
@@ -22,12 +23,14 @@ AI coding assistants can read your source files but have no deterministic knowle
 Infrawise replaces guessing with infrastructure-aware context.
 
 **Without Infrawise**, an AI assistant might:
+
 - Suggest a `.scan()` on your Orders table that has 50M rows
 - Recommend adding a GSI on `status` that you already have
 - Write a `SELECT *` when you need to keep query cost low
 - Not notice that 5 functions are already hammering the same partition key
 
 **With Infrawise**, it knows:
+
 - Your exact table schemas, partition keys, sort keys, and GSIs
 - Which functions query which tables and how
 - Which patterns are already flagged as high severity
@@ -157,34 +160,57 @@ To let Claude Code manage the server lifecycle automatically:
 
 ### MCP tools
 
-| Tool | What it provides |
-|---|---|
-| `get_infra_overview` | Complete snapshot — all services, counts, and high-severity findings |
-| `get_graph_summary` | Full infrastructure graph — all nodes, edges, and findings |
-| `analyze_function` | Issues in a specific function — scans, missing indexes, N+1, trigger event shapes |
-| `suggest_gsi` | Exact GSI config for a DynamoDB table + attribute |
-| `postgres_index_suggestions` | Exact `CREATE INDEX` SQL for your actual table |
-| `suggest_mongo_index` | Exact `createIndex` command for a MongoDB collection + field |
-| `mysql_index_suggestions` | Exact `ALTER TABLE ADD INDEX` SQL for your MySQL table |
-| `get_queue_details` | SQS queues — DLQ status, encryption, message counts |
-| `get_topic_details` | SNS topics — subscription counts and protocols |
-| `get_secrets_overview` | Secrets Manager — names and rotation status (values never included) |
-| `get_parameter_overview` | SSM Parameter Store — names, types, tiers (values never included) |
-| `get_lambda_overview` | Lambda functions — runtime, memory, timeout, triggers (SQS/DynamoDB/Kinesis/EventBridge), env var key names |
-| `get_eventbridge_details` | EventBridge rules — name, state, schedule/event pattern, target functions |
-| `get_log_errors` | CloudWatch error patterns and counts (no raw log messages) |
+| Tool                         | What it provides                                                                                            |
+| ---------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| `get_infra_overview`         | Complete snapshot — all services, counts, and high-severity findings                                        |
+| `get_graph_summary`          | Full infrastructure graph — all nodes, edges, and findings                                                  |
+| `analyze_function`           | Issues in a specific function — scans, missing indexes, N+1, trigger event shapes                           |
+| `suggest_gsi`                | Exact GSI config for a DynamoDB table + attribute                                                           |
+| `postgres_index_suggestions` | Exact `CREATE INDEX` SQL for your actual table                                                              |
+| `suggest_mongo_index`        | Exact `createIndex` command for a MongoDB collection + field                                                |
+| `mysql_index_suggestions`    | Exact `ALTER TABLE ADD INDEX` SQL for your MySQL table                                                      |
+| `get_queue_details`          | SQS queues — DLQ status, encryption, message counts                                                         |
+| `get_topic_details`          | SNS topics — subscription counts and protocols                                                              |
+| `get_secrets_overview`       | Secrets Manager — names and rotation status (values never included)                                         |
+| `get_parameter_overview`     | SSM Parameter Store — names, types, tiers (values never included)                                           |
+| `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, triggers (SQS/DynamoDB/Kinesis/EventBridge/S3), env var key names |
+| `get_eventbridge_details`    | EventBridge rules — name, state, schedule/event pattern, target functions                                   |
+| `get_s3_overview`            | S3 buckets — versioning, encryption, public access, event notifications                                     |
+| `get_log_errors`             | CloudWatch error patterns and counts (no raw log messages)                                                  |
 
 ---
 
 ## CLI reference
 
-| Command | What it does |
-|---|---|
-| `infrawise init` | Detect AWS + repo, generate `infrawise.yaml` |
-| `infrawise auth` | Select or switch AWS profile |
-| `infrawise analyze` | Scan repo + AWS, build graph, print findings |
-| `infrawise dev` | Start MCP server — auto-analyzes if no cache, watches files for live refresh |
-| `infrawise doctor` | Validate AWS access, DB connectivity, and config |
+| Command             | What it does                                                                 |
+| ------------------- | ---------------------------------------------------------------------------- |
+| `infrawise init`    | Detect AWS + repo, generate `infrawise.yaml`                                 |
+| `infrawise auth`    | Select or switch AWS profile                                                 |
+| `infrawise analyze` | Scan repo + AWS, build graph, print findings                                 |
+| `infrawise dev`     | Start MCP server — auto-analyzes if no cache, watches files for live refresh |
+| `infrawise stdio`   | Start MCP server on stdio transport (for Claude Desktop)                     |
+| `infrawise doctor`  | Validate AWS access, DB connectivity, and config                             |
+
+### `infrawise analyze` options
+
+| Flag                  | Description                                                            |
+| --------------------- | ---------------------------------------------------------------------- |
+| `-c, --config <path>` | Path to `infrawise.yaml` (default: `infrawise.yaml`)                   |
+| `-r, --repo <path>`   | Repository to scan (default: current directory)                        |
+| `--no-cache`          | Skip reading/writing the cache                                         |
+| `-o, --output <path>` | Save findings as a markdown report, e.g. `report.md`                   |
+| `--severity <level>`  | Only show findings at or above this level: `high` \| `medium` \| `low` \| `verify` |
+
+```bash
+# Export a shareable findings report
+infrawise analyze --output report.md
+
+# Only show high-severity issues
+infrawise analyze --severity high
+
+# High-severity issues only, saved to a file
+infrawise analyze --severity high --output report.md
+```
 
 ---
 
@@ -206,12 +232,12 @@ Full example:
 project: payments-service
 
 aws:
-  profile: default          # AWS profile from ~/.aws/credentials
+  profile: default # AWS profile from ~/.aws/credentials
   region: ap-south-1
 
 dynamodb:
   enabled: true
-  includeTables:            # omit to include all tables
+  includeTables: # omit to include all tables
     - Orders
     - Users
 
@@ -221,11 +247,11 @@ postgres:
 
 mysql:
   enabled: false
-  connectionString: ""
+  connectionString: ''
 
 mongodb:
   enabled: false
-  connectionString: ""
+  connectionString: ''
 
 sqs:
   enabled: true
@@ -235,14 +261,14 @@ sns:
 
 ssm:
   enabled: true
-  paths: []                 # filter by prefix e.g. ["/myapp/prod"]
+  paths: [] # filter by prefix e.g. ["/myapp/prod"]
 
 secretsManager:
   enabled: true
 
 lambda:
   enabled: true
-  includeFunctions:           # omit to include all functions
+  includeFunctions: # omit to include all functions
     - myFunction
     - anotherFunction
 
@@ -252,6 +278,9 @@ eventbridge:
 rds:
   enabled: false
 
+s3:
+  enabled: false
+
 kafka:
   enabled: false
 
@@ -274,10 +303,7 @@ Infrawise is **read-only**. Minimum IAM policy required:
   "Statement": [
     {
       "Effect": "Allow",
-      "Action": [
-        "dynamodb:ListTables",
-        "dynamodb:DescribeTable"
-      ],
+      "Action": ["dynamodb:ListTables", "dynamodb:DescribeTable"],
       "Resource": "*"
     }
   ]
@@ -313,36 +339,37 @@ Infrawise has two analysis layers:
 
 Works from AWS APIs, database schema introspection, and IaC files — no dependency on application code:
 
-| Service | What it checks |
-|---|---|
-| DynamoDB schema | Tables, GSIs, partition keys |
-| PostgreSQL / MySQL schema | Tables, indexes, column types |
-| MongoDB schema | Collections, indexes |
-| SQS | Missing DLQs, unencrypted queues, large backlogs |
-| Kafka (kafkajs) | Producer/consumer topic mapping from code |
-| Secrets Manager | Missing secret rotation |
-| Lambda | Default memory (128 MB), high timeouts, triggers (SQS/DynamoDB/Kinesis/EventBridge), missing DLQ on trigger source |
-| EventBridge | Rules, schedules, event patterns, target Lambda functions |
-| RDS | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ |
-| CloudWatch Logs | Log groups with no retention policy |
-| Terraform / CloudFormation / CDK | IaC drift vs deployed state |
+| Service                          | What it checks                                                                                                     |
+| -------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
+| DynamoDB schema                  | Tables, GSIs, partition keys                                                                                       |
+| PostgreSQL / MySQL schema        | Tables, indexes, column types                                                                                      |
+| MongoDB schema                   | Collections, indexes                                                                                               |
+| SQS                              | Missing DLQs, unencrypted queues, large backlogs                                                                   |
+| Kafka (kafkajs)                  | Producer/consumer topic mapping from code                                                                          |
+| Secrets Manager                  | Missing secret rotation                                                                                            |
+| Lambda                           | Default memory (128 MB), high timeouts, triggers (SQS/DynamoDB/Kinesis/EventBridge/S3), missing DLQ on trigger source |
+| S3                               | Public access blocking (verify), missing versioning, missing encryption                                            |
+| EventBridge                      | Rules, schedules, event patterns, target Lambda functions                                                          |
+| RDS                              | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ                                    |
+| CloudWatch Logs                  | Log groups with no retention policy                                                                                |
+| Terraform / CloudFormation / CDK | IaC drift vs deployed state                                                                                        |
 
 ### Code correlation analysis (TypeScript / JavaScript)
 
 Uses [ts-morph](https://ts-morph.com/) AST analysis to detect which functions call which tables and how:
 
-| Analyzer | Severity | What it detects |
-|---|---|---|
-| Full Table Scan (DynamoDB) | High | `.scan()` calls without filters |
-| Missing GSI | Medium | Queries on attributes without a matching GSI |
-| Hot Partition | Medium | 5+ distinct code paths hitting the same table |
-| Missing Index (PostgreSQL) | Medium | Tables queried without indexes |
-| N+1 Query | Medium | Repeated query patterns from ORM loops |
-| Large SELECT | Low | `SELECT *` usage |
-| Missing MySQL Index | Medium | MySQL tables queried without indexes |
-| MySQL Full Table Scan | High | Full table scan patterns in MySQL queries |
-| Missing Mongo Index | Medium | Collections queried without secondary indexes |
-| Collection Scan | High | `find()` calls without filter predicates |
+| Analyzer                   | Severity | What it detects                               |
+| -------------------------- | -------- | --------------------------------------------- |
+| Full Table Scan (DynamoDB) | High     | `.scan()` calls without filters               |
+| Missing GSI                | Medium   | Queries on attributes without a matching GSI  |
+| Hot Partition              | Medium   | 5+ distinct code paths hitting the same table |
+| Missing Index (PostgreSQL) | Medium   | Tables queried without indexes                |
+| N+1 Query                  | Medium   | Repeated query patterns from ORM loops        |
+| Large SELECT               | Low      | `SELECT *` usage                              |
+| Missing MySQL Index        | Medium   | MySQL tables queried without indexes          |
+| MySQL Full Table Scan      | High     | Full table scan patterns in MySQL queries     |
+| Missing Mongo Index        | Medium   | Collections queried without secondary indexes |
+| Collection Scan            | High     | `find()` calls without filter predicates      |
 
 Non-TypeScript/JavaScript projects still get full value from infrastructure-level analyzers — code correlation (function-to-table mapping, N+1 patterns) is skipped.
 
@@ -377,29 +404,52 @@ Infrawise does not use an LLM to analyze your infrastructure. All extraction and
 
 ## Architecture overview
 
-```
-Your repo (any language)          Your repo (TS/JS only)
-        │                                  │
-        │                    Repository Scanner (ts-morph AST)
-        │                     which functions → which tables
-        │                                  │
-┌───────┴──────────────────────────────────┴────────────┐
-│  infrawise analyze                                    │
-│                                                       │
-│  AWS APIs / DB schema / IaC files  +  Code ops (opt)  │
-│         (works for any project)      (TS/JS only)     │
-│                          │                            │
-│                     Graph Engine                      │
-│                   (nodes + edges)                     │
-│                          │                            │
-│                   Analyzer Engine                     │
-│               (rule-based, deterministic)             │
-└─────────────────────────┬─────────────────────────────┘
-                          │
-               ┌──────────────────┐
-               │   MCP Server     │ ◄── Claude Code
-               │  localhost:3000  │ ◄── Cursor
-               └──────────────────┘ ◄── Windsurf
+```mermaid
+flowchart LR
+    subgraph IN["Your Infrastructure & Code"]
+        direction TB
+        D["DynamoDB"]
+        L["Lambda · SQS · SNS\nEventBridge · RDS"]
+        S["Secrets Manager · SSM\nCloudWatch"]
+        P["PostgreSQL · MySQL"]
+        M["MongoDB"]
+        T["Terraform · CDK\nCloudFormation"]
+        C["TypeScript / JS"]
+    end
+
+    A["Adapters"]
+    G["Graph Engine"]
+    AN["23 Analyzers"]
+    CA["Cache"]
+
+    subgraph SV["infrawise dev"]
+        MCP["MCP Server\nlocalhost:3000/mcp"]
+    end
+
+    subgraph AI["AI Coding Assistants"]
+        direction TB
+        CC["Claude Code"]
+        CU["Cursor"]
+        WS["Windsurf"]
+    end
+
+    D & L & S & P & M & T & C --> A
+    A --> G --> AN --> CA --> MCP
+    MCP --> CC & CU & WS
+
+    classDef aws fill:#FF9900,stroke:#232F3E,color:#000
+    classDef db fill:#336791,stroke:#1a3a5c,color:#fff
+    classDef iac fill:#7B42BC,stroke:#4a2080,color:#fff
+    classDef code fill:#3178C6,stroke:#1a4a80,color:#fff
+    classDef iw fill:#1a1a2e,stroke:#e94560,color:#fff
+    classDef ai fill:#10a37f,stroke:#0a6b54,color:#fff
+
+    class D,L,S aws
+    class P,M db
+    class T iac
+    class C code
+    class A,G,AN,CA,MCP iw
+    class CC,CU,WS ai
 ```
 
 ### Source layout
@@ -409,8 +459,10 @@ src/
   types.ts      Shared type definitions
   core/         Config (Zod + YAML), logger (Pino), local cache
   graph/        Graph engine — nodes, edges, builder
-  adapters/     Flat extractors: dynamodb.ts, postgres.ts, mysql.ts,
-                mongodb.ts, aws.ts, logs.ts, terraform.ts
+  adapters/
+    aws/        DynamoDB, Lambda, SQS/SNS/SSM/Secrets/EventBridge/RDS, CloudWatch
+    db/         PostgreSQL, MySQL, MongoDB
+    iac/        Terraform, CDK, CloudFormation (local file parsing)
   analyzers/    23 rule-based analyzers
   context/      Repository scanner (ts-morph AST)
   server/       Fastify MCP server (@modelcontextprotocol/sdk, Streamable HTTP)
@@ -430,20 +482,7 @@ src/
 
 ## Roadmap
 
-Feature roadmap is tracked in the [GitHub Project](https://github.com/users/Sidd27/projects/1). Priorities, complexity, and virality scores are visible there. Feature requests and upvotes welcome.
-
-### Planned
-- Runtime tracing integration
-- Incremental analysis for large monorepos
-- Kubernetes workload graphing
-- VS Code extension
-- Infrastructure drift detection
-- MSK (Amazon Managed Streaming for Apache Kafka) — cluster metadata + topic listing via MSK API and Kafka admin client
-
-### Under consideration
-- OpenTelemetry integration
-- CI/CD reporting mode
-- Multi-repository graph correlation
+Feature roadmap is tracked in the [GitHub Project](https://github.com/users/Sidd27/projects/1). Feature requests and upvotes welcome.
 
 ---
 
@@ -455,47 +494,7 @@ The `demo/localstack/` directory runs infrawise against real AWS APIs emulated l
 
 ## Contributing
 
-### Prerequisites
-
-Node.js 24+, pnpm 9+, AWS CLI (for integration testing).
-
-### Setup
-
-```bash
-git clone https://github.com/Sidd27/infrawise
-cd infrawise
-pnpm install
-pnpm build
-```
-
-### Development workflow
-
-```bash
-pnpm build        # compile
-pnpm test         # run all tests
-pnpm typecheck    # TypeScript strict check
-pnpm lint         # ESLint
-```
-
-### Adding a new analyzer
-
-1. Create your analyzer in `src/analyzers/`
-2. Implement the `Analyzer` interface:
-```ts
-export class MyAnalyzer implements Analyzer {
-  name = 'MyAnalyzer';
-  async analyze(graph: SystemGraph): Promise<Finding[]> { ... }
-}
-```
-3. Export it from `src/analyzers/index.ts`
-4. Add tests in `src/analyzers/__tests__/`
-
-### Adding a new database adapter
-
-1. Create your extractor as `src/adapters/yourdb.ts`
-2. Export a function returning `Promise<YourTableMetadata[]>`
-3. Add the metadata type to `src/types.ts` if needed
-4. Wire it into `src/cli/commands/analyze.ts`
+See [CONTRIBUTING.md](CONTRIBUTING.md) for a full walkthrough — including how to add a new service adapter, a new analyzer, and the PR checklist.
 
 ### Releasing
 
@@ -508,14 +507,6 @@ pnpm release 1.5.0    # explicit version
 
 Bumps `package.json`, commits, tags, pushes, and creates a draft GitHub release with notes from commit messages. Then publish the draft on GitHub to trigger npm publish.
 
-### PR checklist
-
-- `pnpm lint` passes
-- `pnpm typecheck` passes
-- `pnpm test` passes
-- New analyzers have unit tests with mock graph data
-- No hardcoded AWS regions or credentials
-
 ---
 
 ## License

package/dist/adapters/{dynamodb.js → aws/dynamodb.js}

@@ -1,6 +1,6 @@
 import { DynamoDBClient, ListTablesCommand, DescribeTableCommand, } from '@aws-sdk/client-dynamodb';
 import { fromIni } from '@aws-sdk/credential-providers';
-import { DynamoDBError, logger } from '../core/index.js';
+import { DynamoDBError, logger } from '../../core/index.js';
 function createDynamoClient(config) {
     const region = config.aws?.region ?? 'us-east-1';
     const profile = config.aws?.profile;

package/dist/adapters/aws/index.js

@@ -0,0 +1,4 @@
+export * from './services.js';
+export * from './dynamodb.js';
+export * from './logs.js';
+export * from './s3.js';

package/dist/adapters/{logs.js → aws/logs.js}

@@ -1,6 +1,6 @@
 import { CloudWatchLogsClient, DescribeLogGroupsCommand, FilterLogEventsCommand, } from '@aws-sdk/client-cloudwatch-logs';
 import { fromIni } from '@aws-sdk/credential-providers';
-import { logger } from '../core/index.js';
+import { logger } from '../../core/index.js';
 // Hard caps to prevent context bloat
 const MAX_LOG_GROUPS = 50;
 const MAX_EVENTS_PER_GROUP = 50;

package/dist/adapters/aws/s3.js

@@ -0,0 +1,72 @@
+import { S3Client, ListBucketsCommand, GetBucketNotificationConfigurationCommand, GetBucketVersioningCommand, GetBucketEncryptionCommand, GetPublicAccessBlockCommand, } from '@aws-sdk/client-s3';
+import { fromIni } from '@aws-sdk/credential-providers';
+import { logger } from '../../core/index.js';
+function clientConfig(cfg) {
+    const region = cfg.region ?? 'us-east-1';
+    const base = { region };
+    if (cfg.endpoint)
+        base.endpoint = cfg.endpoint;
+    if (cfg.profile)
+        base.credentials = fromIni({ profile: cfg.profile });
+    return base;
+}
+export async function extractS3Metadata(cfg = {}) {
+    const client = new S3Client(clientConfig(cfg));
+    const buckets = [];
+    try {
+        const listRes = await client.send(new ListBucketsCommand({}));
+        const rawBuckets = (listRes.Buckets ?? []).slice(0, 200);
+        for (const bucket of rawBuckets) {
+            const name = bucket.Name ?? '';
+            if (!name)
+                continue;
+            const arn = `arn:aws:s3:::${name}`;
+            const createdAt = bucket.CreationDate?.toISOString();
+            const [notifResult, versionResult, encryptResult, pabResult] = await Promise.allSettled([
+                client.send(new GetBucketNotificationConfigurationCommand({ Bucket: name })),
+                client.send(new GetBucketVersioningCommand({ Bucket: name })),
+                client.send(new GetBucketEncryptionCommand({ Bucket: name })),
+                client.send(new GetPublicAccessBlockCommand({ Bucket: name })),
+            ]);
+            const notifications = [];
+            if (notifResult.status === 'fulfilled') {
+                for (const config of notifResult.value.LambdaFunctionConfigurations ?? []) {
+                    const lambdaArn = config.LambdaFunctionArn ?? '';
+                    const lambdaName = lambdaArn.split(':').pop() ?? lambdaArn;
+                    const rules = config.Filter?.Key?.FilterRules ?? [];
+                    const prefix = rules.find((r) => r.Name?.toLowerCase() === 'prefix')?.Value;
+                    const suffix = rules.find((r) => r.Name?.toLowerCase() === 'suffix')?.Value;
+                    const notification = {
+                        events: config.Events ?? [],
+                        lambdaArn,
+                        lambdaName,
+                    };
+                    if (prefix !== undefined)
+                        notification.prefix = prefix;
+                    if (suffix !== undefined)
+                        notification.suffix = suffix;
+                    notifications.push(notification);
+                }
+            }
+            const versioned = versionResult.status === 'fulfilled'
+                ? versionResult.value.Status === 'Enabled'
+                : false;
+            const encrypted = encryptResult.status === 'fulfilled'
+                ? (encryptResult.value.ServerSideEncryptionConfiguration?.Rules?.length ?? 0) > 0
+                : false;
+            let publicAccessBlocked = false;
+            if (pabResult.status === 'fulfilled') {
+                const pab = pabResult.value.PublicAccessBlockConfiguration ?? {};
+                publicAccessBlocked = !!(pab.BlockPublicAcls && pab.IgnorePublicAcls && pab.BlockPublicPolicy && pab.RestrictPublicBuckets);
+            }
+            buckets.push({ name, arn, createdAt, versioned, encrypted, publicAccessBlocked, notifications });
+        }
+    }
+    catch (err) {
+        logger.warn(`S3 list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return buckets;
+}
+export async function validateS3Access(cfg = {}) {
+    await new S3Client(clientConfig(cfg)).send(new ListBucketsCommand({}));
+}

package/dist/adapters/{aws.js → aws/services.js}

@@ -6,7 +6,7 @@ import { LambdaClient, ListFunctionsCommand, ListEventSourceMappingsCommand, } f
 import { EventBridgeClient, ListRulesCommand, ListTargetsByRuleCommand, } from '@aws-sdk/client-eventbridge';
 import { RDSClient, DescribeDBInstancesCommand, } from '@aws-sdk/client-rds';
 import { fromIni } from '@aws-sdk/credential-providers';
-import { logger } from '../core/index.js';
+import { logger } from '../../core/index.js';
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };

package/dist/adapters/db/index.js

@@ -0,0 +1,3 @@
+export * from './postgres.js';
+export * from './mysql.js';
+export * from './mongodb.js';

package/dist/adapters/{mongodb.js → db/mongodb.js}

@@ -1,5 +1,5 @@
 import { MongoClient } from 'mongodb';
-import { InfrawiseError, logger } from '../core/index.js';
+import { InfrawiseError, logger } from '../../core/index.js';
 const SYSTEM_DATABASES = new Set(['admin', 'local', 'config']);
 export class MongoConnectionError extends InfrawiseError {
     constructor(details) {

package/dist/adapters/{mysql.js → db/mysql.js}

@@ -1,5 +1,5 @@
 import mysql from 'mysql2/promise';
-import { InfrawiseError, logger } from '../core/index.js';
+import { InfrawiseError, logger } from '../../core/index.js';
 const SYSTEM_SCHEMAS = new Set(['information_schema', 'performance_schema', 'mysql', 'sys']);
 export class MySQLConnectionError extends InfrawiseError {
     constructor(details) {

package/dist/adapters/{postgres.js → db/postgres.js}

@@ -1,5 +1,5 @@
 import { Pool } from 'pg';
-import { PostgresConnectionError, logger } from '../core/index.js';
+import { PostgresConnectionError, logger } from '../../core/index.js';
 export async function extractPostgresMetadata(connectionString) {
     const pool = new Pool({
         connectionString,

package/dist/adapters/iac/index.js

@@ -0,0 +1 @@
+export * from './terraform.js';

package/dist/adapters/{terraform.js → iac/terraform.js}

@@ -1,7 +1,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import yaml from 'js-yaml';
-import { logger } from '../core/index.js';
+import { logger } from '../../core/index.js';
 function emptySchema() {
     return {
         dynamoTables: [],

package/dist/analyzers/aws-services.js

@@ -183,3 +183,64 @@ export class LambdaHighTimeoutAnalyzer {
         return findings;
     }
 }
+// ─── S3 ──────────────────────────────────────────────────────────────────────
+export class S3PublicAccessAnalyzer {
+    name = 'S3PublicAccessAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'bucket')
+                continue;
+            if (node.publicAccessBlocked === false) {
+                findings.push({
+                    severity: 'verify',
+                    issue: `S3 bucket "${node.name}" has public access blocking disabled`,
+                    description: `Public access blocking is disabled on "${node.name}". This is expected for static website hosting and public asset buckets. Confirm this is intentional before treating it as a security issue.`,
+                    recommendation: `If "${node.name}" is not intentionally public, enable all four S3 Block Public Access settings: BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets.`,
+                    metadata: { bucketName: node.name, provider: node.provider },
+                });
+            }
+        }
+        return findings;
+    }
+}
+export class S3MissingVersioningAnalyzer {
+    name = 'S3MissingVersioningAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'bucket')
+                continue;
+            if (node.versioned === false) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `S3 bucket "${node.name}" does not have versioning enabled`,
+                    description: `"${node.name}" has versioning disabled. Without versioning, accidental deletes or overwrites are unrecoverable. Versioning is required for cross-region replication and Object Lock.`,
+                    recommendation: `Enable versioning on "${node.name}" via the S3 console or IaC. Consider adding a lifecycle rule to expire old versions and manage storage costs.`,
+                    metadata: { bucketName: node.name, provider: node.provider },
+                });
+            }
+        }
+        return findings;
+    }
+}
+export class S3UnencryptedAnalyzer {
+    name = 'S3UnencryptedAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'bucket')
+                continue;
+            if (node.encrypted === false) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `S3 bucket "${node.name}" does not have server-side encryption configured`,
+                    description: `"${node.name}" has no SSE (Server-Side Encryption) configuration. Data at rest is unencrypted. AWS S3 has enabled SSE-S3 by default since January 2023 for new buckets, but older buckets or those without explicit config should be verified.`,
+                    recommendation: `Enable SSE on "${node.name}" using SSE-S3 (AES-256) or SSE-KMS. Specify the encryption configuration in your IaC to make it explicit.`,
+                    metadata: { bucketName: node.name, provider: node.provider },
+                });
+            }
+        }
+        return findings;
+    }
+}

package/dist/analyzers/index.js

@@ -4,7 +4,7 @@ export { MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer } from './p
 export { MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer } from './mysql.js';
 export { MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer } from './mongodb.js';
 export { IaCDriftAnalyzer } from './terraform.js';
-export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, } from './aws-services.js';
+export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from './aws-services.js';
 export { RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from './rds.js';
 export async function runAllAnalyzers(graph, analyzers) {
     const allFindings = [];
@@ -19,12 +19,12 @@ export async function runAllAnalyzers(graph, analyzers) {
             logger.warn(`Analyzer "${analyzer.name}" failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
-    const severityOrder = { high: 0, medium: 1, low: 2 };
+    const severityOrder = { high: 0, medium: 1, low: 2, verify: 3 };
     allFindings.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
     return allFindings;
 }
 export function summarizeFindings(findings) {
-    const counts = { total: findings.length, high: 0, medium: 0, low: 0 };
+    const counts = { total: findings.length, high: 0, medium: 0, low: 0, verify: 0 };
     for (const f of findings)
         counts[f.severity]++;
     return counts;