mcp-aws-manager 0.3.1 → 0.3.2

package/bin/mcp-aws-manager.js

@@ -11,7 +11,8 @@ const DEFAULT_SNAPSHOT_CONCURRENCY = 3;
 const MAX_SSM_FILTER_IDS = 50;
 const DEFAULT_SERVER_NAME = "mcp-aws-manager";
 const DEFAULT_MCP_COMMAND = "mcp-aws-manager-mcp";
-const SUPPORTED_CLIENTS = new Set(["codex", "claude"]);
+const SUPPORTED_CLIENTS = new Set(["codex", "claude", "cursor", "windsurf", "antigravity"]);
+const INTERNAL_BACKEND_ID = "internal";
 
 function eprint(msg) {
   process.stderr.write(String(msg) + "\n");
@@ -65,6 +66,7 @@ function expandHome(input) {
 }
 
 function usageText() {
+  const clientList = Array.from(SUPPORTED_CLIENTS).join(",");
   return [
     "Usage:",
     "  mcp-aws-manager",
@@ -74,18 +76,18 @@ function usageText() {
     "  mcp-aws-manager discover [discover-options]",
     "  mcp-aws-manager [discover-options]",
     "",
-    "SSM-only AWS EC2 inventory/runtime collector plus MCP client setup helper.",
+    "SSM-first AWS inventory/runtime collector (EC2/Lambda/ALB/ASG/RDS/ElastiCache/Route53) plus MCP client setup helper.",
     "",
     "Commands:",
     "  bootstrap               Ensure mcp-aws-manager MCP server is registered (default command)",
-    "  setup                   Register/re-register MCP server for Codex/Claude",
+    "  setup                   Register/re-register MCP server for supported clients",
     "  doctor                  Check install and registration health",
-    "  discover                Run EC2+SSM inventory workflow",
+    "  discover                Run multi-service inventory workflow (EC2/Lambda/ALB/ASG/RDS/ElastiCache/Route53)",
     "",
     "Setup/Bootstrap/Doctor options:",
     "  --name <server-name>            (default: mcp-aws-manager)",
     "  --mcp-command <command>         (default: mcp-aws-manager-mcp)",
-    "  --clients <codex,claude>        (default: codex,claude)",
+    `  --clients <${clientList}>        (default: codex,claude)`,
     "  --force                         (setup/bootstrap only; always remove then add)",
     "  -h, --help",
     "",
@@ -93,6 +95,20 @@ function usageText() {
     "  --profiles <a,b,c>",
     "  --regions <a,b,c>",
     "  --instance-ids <id1,id2>",
+    "  --include-lambda",
+    "  --no-include-lambda",
+    "  --include-ec2",
+    "  --no-ec2",
+    "  --include-alb",
+    "  --no-include-alb",
+    "  --include-asg",
+    "  --no-include-asg",
+    "  --include-rds",
+    "  --no-include-rds",
+    "  --include-elasticache",
+    "  --no-include-elasticache",
+    "  --include-route53",
+    "  --no-include-route53",
     "  --public-only",
     "  --managed-only",
     "  --auto-remediate-ssm",
@@ -112,6 +128,8 @@ function usageText() {
     "",
     "Env:",
     "  MCP_AWS_PROFILES, MCP_AWS_REGIONS, MCP_AWS_INSTANCE_IDS",
+    "  MCP_AWS_INCLUDE_LAMBDA, MCP_AWS_INCLUDE_EC2, MCP_AWS_INCLUDE_ALB, MCP_AWS_INCLUDE_ASG",
+    "  MCP_AWS_INCLUDE_RDS, MCP_AWS_INCLUDE_ELASTICACHE, MCP_AWS_INCLUDE_ROUTE53",
     "  MCP_AWS_PUBLIC_ONLY, MCP_AWS_MANAGED_ONLY, MCP_AWS_AUTO_REMEDIATE_SSM",
     "  MCP_AWS_SSM_INSTANCE_PROFILE_NAME, MCP_AWS_SSM_INSTANCE_PROFILE_ARN",
     "  MCP_AWS_ALLOW_REPLACE_PROFILE, MCP_AWS_REMEDIATION_WAIT",
@@ -125,14 +143,14 @@ function usageText() {
 function parseClients(raw) {
   const values = parseCsv(raw) || [];
   if (!values.length) {
-    throw new Error("--clients must include at least one of: codex, claude");
+    throw new Error(`--clients must include at least one of: ${Array.from(SUPPORTED_CLIENTS).join(", ")}`);
   }
   const out = [];
   const seen = new Set();
   for (const value of values) {
     const name = String(value).trim().toLowerCase();
     if (!SUPPORTED_CLIENTS.has(name)) {
-      throw new Error(`Unsupported client '${value}'. Supported: codex, claude`);
+      throw new Error(`Unsupported client '${value}'. Supported: ${Array.from(SUPPORTED_CLIENTS).join(", ")}`);
     }
     if (!seen.has(name)) {
       seen.add(name);
@@ -251,6 +269,13 @@ function parseDiscoverArgs(argv) {
     profiles: null,
     regions: null,
     instanceIds: null,
+    includeLambda: null,
+    includeEc2: null,
+    includeAlb: null,
+    includeAsg: null,
+    includeRds: null,
+    includeElastiCache: null,
+    includeRoute53: null,
     publicOnly: false,
     managedOnly: false,
     autoRemediateSsm: false,
@@ -290,6 +315,20 @@ function parseDiscoverArgs(argv) {
   for (let i = 0; i < args.length; i += 1) {
     const arg = args[i];
     if (arg === "-h" || arg === "--help") { options.help = true; continue; }
+    if (arg === "--include-lambda") { options.includeLambda = true; continue; }
+    if (arg === "--no-include-lambda") { options.includeLambda = false; continue; }
+    if (arg === "--include-ec2") { options.includeEc2 = true; continue; }
+    if (arg === "--no-ec2") { options.includeEc2 = false; continue; }
+    if (arg === "--include-alb") { options.includeAlb = true; continue; }
+    if (arg === "--no-include-alb") { options.includeAlb = false; continue; }
+    if (arg === "--include-asg") { options.includeAsg = true; continue; }
+    if (arg === "--no-include-asg") { options.includeAsg = false; continue; }
+    if (arg === "--include-rds") { options.includeRds = true; continue; }
+    if (arg === "--no-include-rds") { options.includeRds = false; continue; }
+    if (arg === "--include-elasticache") { options.includeElastiCache = true; continue; }
+    if (arg === "--no-include-elasticache") { options.includeElastiCache = false; continue; }
+    if (arg === "--include-route53") { options.includeRoute53 = true; continue; }
+    if (arg === "--no-include-route53") { options.includeRoute53 = false; continue; }
     if (arg === "--public-only") { options.publicOnly = true; continue; }
     if (arg === "--managed-only") { options.managedOnly = true; continue; }
     if (arg === "--auto-remediate-ssm") { options.autoRemediateSsm = true; continue; }
@@ -330,6 +369,13 @@ function parseDiscoverArgs(argv) {
     profiles: parseCsv(options.profiles) || parseCsv(envText("MCP_AWS_PROFILES")),
     regions: parseCsv(options.regions) || parseCsv(envText("MCP_AWS_REGIONS")),
     instanceIds: parseCsv(options.instanceIds) || parseCsv(envText("MCP_AWS_INSTANCE_IDS")),
+    includeLambda: options.includeLambda != null ? options.includeLambda : envBool("MCP_AWS_INCLUDE_LAMBDA"),
+    includeEc2: options.includeEc2 != null ? options.includeEc2 : (envText("MCP_AWS_INCLUDE_EC2") != null ? envBool("MCP_AWS_INCLUDE_EC2") : true),
+    includeAlb: options.includeAlb != null ? options.includeAlb : envBool("MCP_AWS_INCLUDE_ALB"),
+    includeAsg: options.includeAsg != null ? options.includeAsg : envBool("MCP_AWS_INCLUDE_ASG"),
+    includeRds: options.includeRds != null ? options.includeRds : envBool("MCP_AWS_INCLUDE_RDS"),
+    includeElastiCache: options.includeElastiCache != null ? options.includeElastiCache : envBool("MCP_AWS_INCLUDE_ELASTICACHE"),
+    includeRoute53: options.includeRoute53 != null ? options.includeRoute53 : envBool("MCP_AWS_INCLUDE_ROUTE53"),
     publicOnly: Boolean(options.publicOnly || envBool("MCP_AWS_PUBLIC_ONLY")),
     managedOnly: Boolean(options.managedOnly || envBool("MCP_AWS_MANAGED_ONLY")),
     autoRemediateSsm: Boolean(options.autoRemediateSsm || envBool("MCP_AWS_AUTO_REMEDIATE_SSM")),
@@ -352,6 +398,22 @@ function validateConfig(config, warnings, requiredActions) {
   if (config.outPath) {
     fs.mkdirSync(path.dirname(config.outPath), { recursive: true });
   }
+  const includeAny = config.includeEc2
+    || config.includeLambda
+    || config.includeAlb
+    || config.includeAsg
+    || config.includeRds
+    || config.includeElastiCache
+    || config.includeRoute53;
+  if (!includeAny) {
+    throw new Error("At least one resource type must be enabled. Use --include-ec2 and/or other --include-* options.");
+  }
+  if (config.managedOnly && !config.includeEc2) {
+    warnings.push("--managed-only applies only to EC2 SSM records.");
+  }
+  if (config.publicOnly && !config.includeEc2) {
+    warnings.push("--public-only applies only to EC2 public IPv4 records.");
+  }
   if (config.autoRemediateSsm && !config.ssmInstanceProfileArn && !config.ssmInstanceProfileName) {
     warnings.push("--auto-remediate-ssm is enabled but no instance profile target was provided; remediation is disabled.");
     requiredActions.push({
@@ -406,7 +468,9 @@ function runCLICommand(cliBin, args, options = {}) {
     env: process.env,
     stdio: options.stdio || "pipe",
     encoding: "utf8",
-    shell: false
+    shell: false,
+    timeout: options.timeoutMs != null ? Math.max(1000, Math.round(options.timeoutMs)) : 4000,
+    windowsHide: true
   };
 
   const direct = spawnSync(cliBin, args, execOptions);
@@ -438,28 +502,73 @@ function commandExists(bin, checkArgs) {
   return run && run.status === 0;
 }
 
-function removeRegistration(cliBin, serverName) {
+function clientHelpAttempts(cliBin) {
+  if (cliBin === "cursor" || cliBin === "windsurf" || cliBin === "antigravity") {
+    return [
+      ["mcp", "--help"],
+      ["--help"]
+    ];
+  }
+  return [["mcp", "--help"]];
+}
+
+function clientGetAttempts(cliBin, serverName) {
   if (cliBin === "claude") {
-    runCLICommand(cliBin, ["mcp", "remove", serverName, "-s", "user"], { stdio: "ignore" });
-    runCLICommand(cliBin, ["mcp", "remove", serverName, "-s", "local"], { stdio: "ignore" });
-    return;
+    return [
+      ["mcp", "get", serverName],
+      ["mcp", "get", serverName, "-s", "user"],
+      ["mcp", "get", serverName, "-s", "local"]
+    ];
   }
-  runCLICommand(cliBin, ["mcp", "remove", serverName], { stdio: "ignore" });
+  if (cliBin === "cursor" || cliBin === "windsurf" || cliBin === "antigravity") {
+    return [
+      ["mcp", "get", serverName, "--json"],
+      ["mcp", "get", serverName],
+      ["mcp", "show", serverName]
+    ];
+  }
+  return [
+    ["mcp", "get", serverName, "--json"],
+    ["mcp", "get", serverName]
+  ];
 }
 
-function isRegistered(cliBin, serverName) {
-  const args = cliBin === "claude"
-    ? ["mcp", "get", serverName]
-    : ["mcp", "get", serverName, "--json"];
-  const run = runCLICommand(cliBin, args, { stdio: "ignore" });
-  return run && run.status === 0;
+function clientRemoveAttempts(cliBin, serverName) {
+  if (cliBin === "claude") {
+    return [
+      ["mcp", "remove", serverName, "-s", "user"],
+      ["mcp", "remove", serverName, "-s", "local"],
+      ["mcp", "remove", serverName]
+    ];
+  }
+  if (cliBin === "cursor" || cliBin === "windsurf" || cliBin === "antigravity") {
+    return [
+      ["mcp", "remove", serverName],
+      ["mcp", "rm", serverName],
+      ["mcp", "remove", serverName, "-s", "user"],
+      ["mcp", "remove", serverName, "-s", "local"]
+    ];
+  }
+  return [["mcp", "remove", serverName]];
 }
 
-function registrationAttempts(cliBin, serverName, mcpCommand) {
+function clientAddAttempts(cliBin, serverName, mcpCommand) {
   if (cliBin === "claude") {
     return [
       ["mcp", "add", "--scope", "user", serverName, "--", mcpCommand],
-      ["mcp", "add", "--scope", "user", serverName, mcpCommand]
+      ["mcp", "add", "--scope", "user", serverName, mcpCommand],
+      ["mcp", "add", serverName, "--", mcpCommand],
+      ["mcp", "add", serverName, mcpCommand]
+    ];
+  }
+  if (cliBin === "cursor" || cliBin === "windsurf" || cliBin === "antigravity") {
+    return [
+      ["mcp", "add", serverName, "--", mcpCommand],
+      ["mcp", "add", serverName, mcpCommand],
+      ["mcp", "add", "--scope", "user", serverName, "--", mcpCommand],
+      ["mcp", "add", "--scope", "user", serverName, mcpCommand],
+      ["mcp", "add", "--scope", "local", serverName, "--", mcpCommand],
+      ["mcp", "add", "--scope", "local", serverName, mcpCommand]
     ];
   }
   return [
@@ -468,6 +577,26 @@ function registrationAttempts(cliBin, serverName, mcpCommand) {
   ];
 }
 
+function removeRegistration(cliBin, serverName) {
+  const attempts = clientRemoveAttempts(cliBin, serverName);
+  for (const args of attempts) {
+    runCLICommand(cliBin, args, { stdio: "ignore" });
+  }
+}
+
+function isRegistered(cliBin, serverName) {
+  const attempts = clientGetAttempts(cliBin, serverName);
+  for (const args of attempts) {
+    const run = runCLICommand(cliBin, args, { stdio: "ignore" });
+    if (run && run.status === 0) return true;
+  }
+  return false;
+}
+
+function registrationAttempts(cliBin, serverName, mcpCommand) {
+  return clientAddAttempts(cliBin, serverName, mcpCommand);
+}
+
 function tryRegister(cliBin, serverName, mcpCommand) {
   const attempts = registrationAttempts(cliBin, serverName, mcpCommand);
   let lastRun = null;
@@ -485,7 +614,9 @@ function tryRegister(cliBin, serverName, mcpCommand) {
 
 function runSetupInternal(config, options = {}) {
   const ensureOnly = options.ensureOnly === true;
-  const clients = config.clients.filter((cli) => commandExists(cli, ["mcp", "--help"]));
+  const clients = config.clients.filter((cli) =>
+    clientHelpAttempts(cli).some((args) => commandExists(cli, args))
+  );
   const results = [];
 
   process.stdout.write(ensureOnly ? "Bootstrap start.\n" : "Setup start.\n");
@@ -494,7 +625,8 @@ function runSetupInternal(config, options = {}) {
   process.stdout.write(`Clients: ${config.clients.join(",")}\n`);
 
   if (!clients.length) {
-    process.stdout.write("No codex/claude CLI found. Registration skipped.\n");
+    process.stdout.write(`No supported client CLI found. Supported: ${Array.from(SUPPORTED_CLIENTS).join(", ")}\n`);
+    process.stdout.write("Registration skipped.\n");
     return 2;
   }
 
@@ -547,7 +679,7 @@ function runDoctor(config) {
   }
 
   for (const cliBin of config.clients) {
-    const exists = commandExists(cliBin, ["mcp", "--help"]);
+    const exists = clientHelpAttempts(cliBin).some((args) => commandExists(cliBin, args));
     if (!exists) {
       hasIssue = true;
       process.stdout.write(`${cliBin}: not installed or not available in PATH\n`);
@@ -566,7 +698,7 @@ function runDoctor(config) {
   }
 
   if (!foundClient) {
-    process.stdout.write("No requested clients detected. Install Codex or Claude Code first.\n");
+    process.stdout.write("No requested clients detected. Install at least one supported client first.\n");
   }
 
   process.stdout.write(hasIssue ? "Doctor result: issues found.\n" : "Doctor result: healthy.\n");
@@ -578,10 +710,16 @@ function loadAwsModules() {
   if (awsModulesCache) return awsModulesCache;
   try {
     const ec2 = require("@aws-sdk/client-ec2");
+    const lambda = require("@aws-sdk/client-lambda");
+    const elbv2 = require("@aws-sdk/client-elastic-load-balancing-v2");
+    const autoScaling = require("@aws-sdk/client-auto-scaling");
+    const rds = require("@aws-sdk/client-rds");
+    const elasticache = require("@aws-sdk/client-elasticache");
+    const route53 = require("@aws-sdk/client-route-53");
     const sts = require("@aws-sdk/client-sts");
     const ssm = require("@aws-sdk/client-ssm");
     const credentialProviders = require("@aws-sdk/credential-providers");
-    awsModulesCache = { ec2, sts, ssm, credentialProviders };
+    awsModulesCache = { ec2, lambda, elbv2, autoScaling, rds, elasticache, route53, sts, ssm, credentialProviders };
     return awsModulesCache;
   } catch {
     throw new Error("Missing AWS SDK dependencies. Run: npm install");
@@ -733,6 +871,16 @@ async function discoverRegionsForProfile(profileName, profileLabel, warnings) {
 }
 
 async function buildDiscoveryPlan(config, warnings, requiredActions) {
+  const needsRegionalPlan = Boolean(
+    config.includeEc2
+    || config.includeLambda
+    || config.includeAlb
+    || config.includeAsg
+    || config.includeRds
+    || config.includeElastiCache
+    || config.runtimeSnapshot
+    || config.autoRemediateSsm
+  );
   const plans = [];
   for (const profileName of requestedProfiles(config)) {
     const profileLabel = profileName || "default";
@@ -741,7 +889,7 @@ async function buildDiscoveryPlan(config, warnings, requiredActions) {
 
     const regions = config.regions && config.regions.length
       ? config.regions.slice()
-      : await discoverRegionsForProfile(profileName, profileLabel, warnings);
+      : (needsRegionalPlan ? await discoverRegionsForProfile(profileName, profileLabel, warnings) : [baseRegion()]);
 
     if (!regions.length) {
       warnings.push(`[${profileLabel}] No regions resolved, profile skipped.`);
@@ -751,7 +899,44 @@ async function buildDiscoveryPlan(config, warnings, requiredActions) {
     plans.push({ profileName, profileLabel, accountId: auth.accountId, regions });
   }
   return plans;
-}
+}
+
+function buildOperationPlan(config) {
+  const inventoryOps = [];
+  if (config.includeEc2) {
+    inventoryOps.push("inventory.ec2");
+    inventoryOps.push("inventory.ssmStatus");
+  }
+  if (config.includeLambda) {
+    inventoryOps.push("inventory.lambda");
+  }
+  if (config.includeAlb) {
+    inventoryOps.push("inventory.alb");
+    inventoryOps.push("inventory.targetGroup");
+  }
+  if (config.includeAsg) {
+    inventoryOps.push("inventory.asg");
+  }
+  if (config.includeRds) {
+    inventoryOps.push("inventory.rds");
+  }
+  if (config.includeElastiCache) {
+    inventoryOps.push("inventory.elasticache");
+  }
+  if (config.includeRoute53) {
+    inventoryOps.push("inventory.route53");
+  }
+
+  const runtimeOps = [];
+  if (config.autoRemediateSsm) {
+    runtimeOps.push("remediation.attachSsmRole");
+  }
+  if (config.runtimeSnapshot) {
+    runtimeOps.push("runtime.snapshot");
+  }
+
+  return { inventoryOps, runtimeOps };
+}
 
 function getTagValue(tags, key) {
   if (!Array.isArray(tags)) return null;
@@ -905,13 +1090,236 @@ async function sleep(ms) {
   await new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+function boolFromArray(values) {
+  return Array.isArray(values) && values.length > 0;
+}
+
+function lambdaVpcConfigured(fnConfig) {
+  if (!fnConfig || typeof fnConfig !== "object") return false;
+  return boolFromArray(fnConfig.SubnetIds) || boolFromArray(fnConfig.SecurityGroupIds);
+}
+
+function baseInventoryRecord(plan, region, resourceType, service, resourceId, name, state, platform) {
+  return {
+    resourceType,
+    service,
+    resourceId: resourceId || null,
+    profile: plan.profileLabel,
+    accountId: plan.accountId,
+    region: region || null,
+    instanceId: null,
+    name: name || null,
+    state: state || null,
+    privateIp: null,
+    publicIp: null,
+    publicDns: null,
+    platform: platform || null,
+    iamInstanceProfileArn: null,
+    ssmManaged: null,
+    ssmOnline: null,
+    ssmPingStatus: null,
+    ssmLastPingDateTime: null,
+    ssmAgentVersion: null,
+    ssmPlatformName: null,
+    ssmPlatformVersion: null,
+    remediationStatus: null,
+    runtimeSnapshot: null,
+    lambdaFunctionName: null,
+    lambdaFunctionArn: null,
+    lambdaRuntime: null,
+    lambdaHandler: null,
+    lambdaRole: null,
+    lambdaLastModified: null,
+    lambdaState: null,
+    lambdaPackageType: null,
+    lambdaTimeoutSec: null,
+    lambdaMemoryMb: null,
+    lambdaVpcConfigured: null,
+    albArn: null,
+    albType: null,
+    albScheme: null,
+    albDnsName: null,
+    albVpcId: null,
+    albListenerPorts: null,
+    targetGroupArn: null,
+    targetGroupType: null,
+    targetGroupPort: null,
+    targetGroupProtocol: null,
+    targetGroupVpcId: null,
+    targetGroupLoadBalancers: null,
+    asgName: null,
+    asgDesiredCapacity: null,
+    asgMinSize: null,
+    asgMaxSize: null,
+    asgInstanceCount: null,
+    asgLaunchTemplate: null,
+    rdsIdentifier: null,
+    rdsEngine: null,
+    rdsEngineVersion: null,
+    rdsStatus: null,
+    rdsMultiAz: null,
+    rdsEndpoint: null,
+    rdsStorageGb: null,
+    elasticacheClusterId: null,
+    elasticacheEngine: null,
+    elasticacheEngineVersion: null,
+    elasticacheNodeType: null,
+    elasticacheStatus: null,
+    elasticacheNumNodes: null,
+    route53ZoneId: null,
+    route53ZoneName: null,
+    route53PrivateZone: null,
+    route53RecordSetCount: null,
+    route53CallerReference: null
+  };
+}
+
+function addEc2Record(regionRecords, plan, region, instance) {
+  const record = baseInventoryRecord(
+    plan,
+    region,
+    "ec2",
+    "ec2",
+    instance.InstanceId || null,
+    getTagValue(instance.Tags, "Name"),
+    instance.State && instance.State.Name ? instance.State.Name : null,
+    instancePlatform(instance)
+  );
+  record.instanceId = instance.InstanceId || null;
+  record.privateIp = instance.PrivateIpAddress || null;
+  record.publicIp = instance.PublicIpAddress || null;
+  record.publicDns = instance.PublicDnsName || null;
+  record.iamInstanceProfileArn = instance.IamInstanceProfile && instance.IamInstanceProfile.Arn ? instance.IamInstanceProfile.Arn : null;
+  record.ssmManaged = false;
+  record.ssmOnline = false;
+  regionRecords.push(record);
+}
+
+function addLambdaRecord(regionRecords, plan, region, fn) {
+  const vpc = fn && fn.VpcConfig ? fn.VpcConfig : null;
+  const record = baseInventoryRecord(
+    plan,
+    region,
+    "lambda",
+    "lambda",
+    fn && fn.FunctionArn ? fn.FunctionArn : (fn && fn.FunctionName ? fn.FunctionName : null),
+    fn && fn.FunctionName ? fn.FunctionName : null,
+    fn && fn.State ? fn.State : null,
+    "Lambda"
+  );
+  record.lambdaFunctionName = fn && fn.FunctionName ? fn.FunctionName : null;
+  record.lambdaFunctionArn = fn && fn.FunctionArn ? fn.FunctionArn : null;
+  record.lambdaRuntime = fn && fn.Runtime ? fn.Runtime : null;
+  record.lambdaHandler = fn && fn.Handler ? fn.Handler : null;
+  record.lambdaRole = fn && fn.Role ? fn.Role : null;
+  record.lambdaLastModified = fn && fn.LastModified ? fn.LastModified : null;
+  record.lambdaState = fn && fn.State ? fn.State : null;
+  record.lambdaPackageType = fn && fn.PackageType ? fn.PackageType : null;
+  record.lambdaTimeoutSec = fn && typeof fn.Timeout === "number" ? fn.Timeout : null;
+  record.lambdaMemoryMb = fn && typeof fn.MemorySize === "number" ? fn.MemorySize : null;
+  record.lambdaVpcConfigured = lambdaVpcConfigured(vpc);
+  regionRecords.push(record);
+}
+
+function addAlbRecord(regionRecords, plan, region, lb) {
+  const name = lb && lb.LoadBalancerName ? lb.LoadBalancerName : null;
+  const arn = lb && lb.LoadBalancerArn ? lb.LoadBalancerArn : null;
+  const state = lb && lb.State && lb.State.Code ? lb.State.Code : null;
+  const record = baseInventoryRecord(plan, region, "alb", "elbv2", arn || name, name, state, "LoadBalancer");
+  record.albArn = arn;
+  record.albType = lb && lb.Type ? lb.Type : null;
+  record.albScheme = lb && lb.Scheme ? lb.Scheme : null;
+  record.albDnsName = lb && lb.DNSName ? lb.DNSName : null;
+  record.albVpcId = lb && lb.VpcId ? lb.VpcId : null;
+  record.albListenerPorts = null;
+  regionRecords.push(record);
+}
+
+function addTargetGroupRecord(regionRecords, plan, region, tg) {
+  const arn = tg && tg.TargetGroupArn ? tg.TargetGroupArn : null;
+  const name = tg && tg.TargetGroupName ? tg.TargetGroupName : null;
+  const record = baseInventoryRecord(plan, region, "target_group", "elbv2", arn || name, name, null, "TargetGroup");
+  record.targetGroupArn = arn;
+  record.targetGroupType = tg && tg.TargetType ? tg.TargetType : null;
+  record.targetGroupPort = tg && typeof tg.Port === "number" ? tg.Port : null;
+  record.targetGroupProtocol = tg && tg.Protocol ? tg.Protocol : null;
+  record.targetGroupVpcId = tg && tg.VpcId ? tg.VpcId : null;
+  const lbs = Array.isArray(tg && tg.LoadBalancerArns ? tg.LoadBalancerArns : null) ? tg.LoadBalancerArns : [];
+  record.targetGroupLoadBalancers = lbs.length ? lbs.join(",") : null;
+  regionRecords.push(record);
+}
+
+function addAsgRecord(regionRecords, plan, region, asg) {
+  const name = asg && asg.AutoScalingGroupName ? asg.AutoScalingGroupName : null;
+  const state = asg && asg.Status ? asg.Status : "InService";
+  const record = baseInventoryRecord(plan, region, "asg", "autoscaling", name, name, state, "AutoScalingGroup");
+  record.asgName = name;
+  record.asgDesiredCapacity = asg && typeof asg.DesiredCapacity === "number" ? asg.DesiredCapacity : null;
+  record.asgMinSize = asg && typeof asg.MinSize === "number" ? asg.MinSize : null;
+  record.asgMaxSize = asg && typeof asg.MaxSize === "number" ? asg.MaxSize : null;
+  record.asgInstanceCount = Array.isArray(asg && asg.Instances ? asg.Instances : null) ? asg.Instances.length : 0;
+  record.asgLaunchTemplate = asg && asg.LaunchTemplate && asg.LaunchTemplate.LaunchTemplateName
+    ? asg.LaunchTemplate.LaunchTemplateName
+    : null;
+  regionRecords.push(record);
+}
+
+function addRdsRecord(regionRecords, plan, region, db) {
+  const identifier = db && db.DBInstanceIdentifier ? db.DBInstanceIdentifier : null;
+  const arn = db && db.DBInstanceArn ? db.DBInstanceArn : identifier;
+  const status = db && db.DBInstanceStatus ? db.DBInstanceStatus : null;
+  const record = baseInventoryRecord(plan, region, "rds", "rds", arn, identifier, status, "RDS");
+  record.rdsIdentifier = identifier;
+  record.rdsEngine = db && db.Engine ? db.Engine : null;
+  record.rdsEngineVersion = db && db.EngineVersion ? db.EngineVersion : null;
+  record.rdsStatus = status;
+  record.rdsMultiAz = db && typeof db.MultiAZ === "boolean" ? db.MultiAZ : null;
+  record.rdsEndpoint = db && db.Endpoint && db.Endpoint.Address ? db.Endpoint.Address : null;
+  record.rdsStorageGb = db && typeof db.AllocatedStorage === "number" ? db.AllocatedStorage : null;
+  regionRecords.push(record);
+}
+
+function addElastiCacheRecord(regionRecords, plan, region, cluster) {
+  const id = cluster && cluster.CacheClusterId ? cluster.CacheClusterId : null;
+  const arn = cluster && cluster.ARN ? cluster.ARN : id;
+  const status = cluster && cluster.CacheClusterStatus ? cluster.CacheClusterStatus : null;
+  const record = baseInventoryRecord(plan, region, "elasticache", "elasticache", arn, id, status, "ElastiCache");
+  record.elasticacheClusterId = id;
+  record.elasticacheEngine = cluster && cluster.Engine ? cluster.Engine : null;
+  record.elasticacheEngineVersion = cluster && cluster.EngineVersion ? cluster.EngineVersion : null;
+  record.elasticacheNodeType = cluster && cluster.CacheNodeType ? cluster.CacheNodeType : null;
+  record.elasticacheStatus = status;
+  record.elasticacheNumNodes = cluster && typeof cluster.NumCacheNodes === "number" ? cluster.NumCacheNodes : null;
+  regionRecords.push(record);
+}
+
+function addRoute53ZoneRecord(records, plan, zone, recordSetCount) {
+  const zoneId = zone && zone.Id ? String(zone.Id).replace("/hostedzone/", "") : null;
+  const zoneName = zone && zone.Name ? zone.Name : null;
+  const privateZone = Boolean(zone && zone.Config && zone.Config.PrivateZone);
+  const record = baseInventoryRecord(plan, "global", "route53_zone", "route53", zoneId || zoneName, zoneName, "active", "Route53");
+  record.route53ZoneId = zoneId;
+  record.route53ZoneName = zoneName;
+  record.route53PrivateZone = privateZone;
+  record.route53RecordSetCount = typeof recordSetCount === "number" ? recordSetCount : null;
+  record.route53CallerReference = zone && zone.CallerReference ? zone.CallerReference : null;
+  records.push(record);
+}
+
 async function collectInventory(config, plans, warnings, requiredActions) {
-  const { ec2, ssm } = loadAwsModules();
+  const { ec2, ssm, lambda, elbv2, autoScaling, rds, elasticache, route53 } = loadAwsModules();
   const stats = {
     profiles: 0,
     regions: 0,
     regionErrors: 0,
     instancesScanned: 0,
+    lambdaFunctionsScanned: 0,
+    loadBalancersScanned: 0,
+    targetGroupsScanned: 0,
+    autoScalingGroupsScanned: 0,
+    rdsInstancesScanned: 0,
+    elasticacheClustersScanned: 0,
+    route53ZonesScanned: 0,
     remediationAttempts: 0,
     remediationChanged: 0
   };
@@ -924,106 +1332,278 @@ async function collectInventory(config, plans, warnings, requiredActions) {
     for (const region of plan.regions) {
       stats.regions += 1;
       const scopeLabel = `${plan.profileLabel}/${region}`;
-      const ec2Client = new ec2.EC2Client(awsClientConfig(plan.profileName, region));
-      const ssmClient = new ssm.SSMClient(awsClientConfig(plan.profileName, region));
+      const ec2Client = config.includeEc2 ? new ec2.EC2Client(awsClientConfig(plan.profileName, region)) : null;
+      const ssmClient = config.includeEc2 ? new ssm.SSMClient(awsClientConfig(plan.profileName, region)) : null;
+      const lambdaClient = config.includeLambda ? new lambda.LambdaClient(awsClientConfig(plan.profileName, region)) : null;
+      const elbv2Client = config.includeAlb ? new elbv2.ElasticLoadBalancingV2Client(awsClientConfig(plan.profileName, region)) : null;
+      const asgClient = config.includeAsg ? new autoScaling.AutoScalingClient(awsClientConfig(plan.profileName, region)) : null;
+      const rdsClient = config.includeRds ? new rds.RDSClient(awsClientConfig(plan.profileName, region)) : null;
+      const elasticacheClient = config.includeElastiCache ? new elasticache.ElastiCacheClient(awsClientConfig(plan.profileName, region)) : null;
 
       const regionRecords = [];
-      try {
-        let nextToken = undefined;
-        do {
-          const response = await ec2Client.send(new ec2.DescribeInstancesCommand({ NextToken: nextToken }));
-          for (const reservation of response.Reservations || []) {
-            for (const instance of reservation.Instances || []) {
-              if (!instance || !instance.InstanceId) continue;
-              stats.instancesScanned += 1;
-              if (instanceFilter && !instanceFilter.has(instance.InstanceId)) continue;
-              if (config.publicOnly && !instance.PublicIpAddress) continue;
-
-              regionRecords.push({
-                profile: plan.profileLabel,
-                accountId: plan.accountId,
-                region,
-                instanceId: instance.InstanceId,
-                name: getTagValue(instance.Tags, "Name"),
-                state: instance.State && instance.State.Name ? instance.State.Name : null,
-                privateIp: instance.PrivateIpAddress || null,
-                publicIp: instance.PublicIpAddress || null,
-                publicDns: instance.PublicDnsName || null,
-                platform: instancePlatform(instance),
-                iamInstanceProfileArn: instance.IamInstanceProfile && instance.IamInstanceProfile.Arn ? instance.IamInstanceProfile.Arn : null,
-                ssmManaged: false,
-                ssmOnline: false,
-                ssmPingStatus: null,
-                ssmLastPingDateTime: null,
-                ssmAgentVersion: null,
-                ssmPlatformName: null,
-                ssmPlatformVersion: null,
-                remediationStatus: null,
-                runtimeSnapshot: null
-              });
+      if (config.includeEc2) {
+        try {
+          let nextToken = undefined;
+          do {
+            const response = await ec2Client.send(new ec2.DescribeInstancesCommand({ NextToken: nextToken }));
+            for (const reservation of response.Reservations || []) {
+              for (const instance of reservation.Instances || []) {
+                if (!instance || !instance.InstanceId) continue;
+                stats.instancesScanned += 1;
+                if (instanceFilter && !instanceFilter.has(instance.InstanceId)) continue;
+                if (config.publicOnly && !instance.PublicIpAddress) continue;
+
+                addEc2Record(regionRecords, plan, region, instance);
+              }
+            }
+            nextToken = response.NextToken;
+          } while (nextToken);
+
+          const ec2Records = regionRecords.filter((r) => r.resourceType === "ec2");
+          const ssmInfo = await fetchSsmInfoMap(
+            ssmClient,
+            ec2Records.map((r) => r.instanceId),
+            warnings,
+            scopeLabel
+          );
+          for (const record of ec2Records) {
+            applySsmInfo(record, ssmInfo.get(record.instanceId));
+          }
+        } catch (error) {
+          stats.regionErrors += 1;
+          warnings.push(`[${scopeLabel}] EC2/SSM collection failed: ${error.message || String(error)}`);
+        }
+      }
+
+      if (config.includeLambda) {
+        try {
+          let marker = undefined;
+          do {
+            const response = await lambdaClient.send(
+              new lambda.ListFunctionsCommand({ Marker: marker, MaxItems: 50 })
+            );
+            for (const fn of response.Functions || []) {
+              stats.lambdaFunctionsScanned += 1;
+              addLambdaRecord(regionRecords, plan, region, fn);
             }
+            marker = response.NextMarker;
+          } while (marker);
+        } catch (error) {
+          stats.regionErrors += 1;
+          const detail = `${error.name || "Error"}: ${error.message || String(error)}`;
+          warnings.push(`[${scopeLabel}] Lambda collection failed: ${detail}`);
+          const lower = detail.toLowerCase();
+          if (lower.includes("accessdenied") || lower.includes("not authorized")) {
+            pushRequiredAction(requiredActions, {
+              code: "LAMBDA_LIST_PERMISSION_REQUIRED",
+              message: `Missing Lambda list permission for ${scopeLabel}.`,
+              hint: "Need lambda:ListFunctions permission."
+            });
           }
-          nextToken = response.NextToken;
-        } while (nextToken);
+        }
+      }
 
-        const ssmInfo = await fetchSsmInfoMap(
-          ssmClient,
-          regionRecords.map((r) => r.instanceId),
-          warnings,
-          scopeLabel
-        );
-        for (const record of regionRecords) {
-          applySsmInfo(record, ssmInfo.get(record.instanceId));
+      if (config.includeAlb) {
+        try {
+          let marker = undefined;
+          do {
+            const response = await elbv2Client.send(
+              new elbv2.DescribeLoadBalancersCommand({ Marker: marker, PageSize: 100 })
+            );
+            for (const lb of response.LoadBalancers || []) {
+              stats.loadBalancersScanned += 1;
+              addAlbRecord(regionRecords, plan, region, lb);
+            }
+            marker = response.NextMarker;
+          } while (marker);
+
+          let tgMarker = undefined;
+          do {
+            const response = await elbv2Client.send(
+              new elbv2.DescribeTargetGroupsCommand({ Marker: tgMarker, PageSize: 100 })
+            );
+            for (const tg of response.TargetGroups || []) {
+              stats.targetGroupsScanned += 1;
+              addTargetGroupRecord(regionRecords, plan, region, tg);
+            }
+            tgMarker = response.NextMarker;
+          } while (tgMarker);
+        } catch (error) {
+          stats.regionErrors += 1;
+          const detail = `${error.name || "Error"}: ${error.message || String(error)}`;
+          warnings.push(`[${scopeLabel}] ELBv2 collection failed: ${detail}`);
+          const lower = detail.toLowerCase();
+          if (lower.includes("accessdenied") || lower.includes("not authorized")) {
+            pushRequiredAction(requiredActions, {
+              code: "ELBV2_LIST_PERMISSION_REQUIRED",
+              message: `Missing ELBv2 list permission for ${scopeLabel}.`,
+              hint: "Need elasticloadbalancing:DescribeLoadBalancers + elasticloadbalancing:DescribeTargetGroups."
+            });
+          }
         }
+      }
 
-        if (config.autoRemediateSsm) {
-          const unmanaged = regionRecords.filter((r) => !r.ssmManaged);
-          let changedInRegion = 0;
-
-          for (const record of unmanaged) {
-            stats.remediationAttempts += 1;
-            const remediation = await remediateInstanceProfile(
-              ec2Client,
-              record.instanceId,
-              config,
-              warnings,
-              requiredActions,
-              scopeLabel
+      if (config.includeAsg) {
+        try {
+          let nextToken = undefined;
+          do {
+            const response = await asgClient.send(
+              new autoScaling.DescribeAutoScalingGroupsCommand({ NextToken: nextToken, MaxRecords: 100 })
             );
-            record.remediationStatus = remediation.status;
-            if (remediation.changed) {
-              stats.remediationChanged += 1;
-              changedInRegion += 1;
+            for (const asg of response.AutoScalingGroups || []) {
+              stats.autoScalingGroupsScanned += 1;
+              addAsgRecord(regionRecords, plan, region, asg);
             }
+            nextToken = response.NextToken;
+          } while (nextToken);
+        } catch (error) {
+          stats.regionErrors += 1;
+          const detail = `${error.name || "Error"}: ${error.message || String(error)}`;
+          warnings.push(`[${scopeLabel}] AutoScaling collection failed: ${detail}`);
+          const lower = detail.toLowerCase();
+          if (lower.includes("accessdenied") || lower.includes("not authorized")) {
+            pushRequiredAction(requiredActions, {
+              code: "ASG_LIST_PERMISSION_REQUIRED",
+              message: `Missing Auto Scaling list permission for ${scopeLabel}.`,
+              hint: "Need autoscaling:DescribeAutoScalingGroups."
+            });
           }
+        }
+      }
 
-          if (changedInRegion > 0 && config.remediationWaitSec > 0) {
-            warnings.push(`[${scopeLabel}] Waiting ${config.remediationWaitSec}s for SSM registration after remediation.`);
-            await sleep(config.remediationWaitSec * 1000);
+      if (config.includeRds) {
+        try {
+          let marker = undefined;
+          do {
+            const response = await rdsClient.send(
+              new rds.DescribeDBInstancesCommand({ Marker: marker, MaxRecords: 100 })
+            );
+            for (const db of response.DBInstances || []) {
+              stats.rdsInstancesScanned += 1;
+              addRdsRecord(regionRecords, plan, region, db);
+            }
+            marker = response.Marker;
+          } while (marker);
+        } catch (error) {
+          stats.regionErrors += 1;
+          const detail = `${error.name || "Error"}: ${error.message || String(error)}`;
+          warnings.push(`[${scopeLabel}] RDS collection failed: ${detail}`);
+          const lower = detail.toLowerCase();
+          if (lower.includes("accessdenied") || lower.includes("not authorized")) {
+            pushRequiredAction(requiredActions, {
+              code: "RDS_LIST_PERMISSION_REQUIRED",
+              message: `Missing RDS list permission for ${scopeLabel}.`,
+              hint: "Need rds:DescribeDBInstances."
+            });
+          }
+        }
+      }
 
-            const recheck = await fetchSsmInfoMap(
-              ssmClient,
-              regionRecords.map((r) => r.instanceId),
-              warnings,
-              scopeLabel
+      if (config.includeElastiCache) {
+        try {
+          let marker = undefined;
+          do {
+            const response = await elasticacheClient.send(
+              new elasticache.DescribeCacheClustersCommand({
+                Marker: marker,
+                MaxRecords: 100,
+                ShowCacheNodeInfo: false
+              })
             );
-            for (const record of regionRecords) {
-              const wasOnline = record.ssmOnline;
-              applySsmInfo(record, recheck.get(record.instanceId));
-              if (record.remediationStatus && record.ssmOnline && !wasOnline) {
-                record.remediationStatus = `${record.remediationStatus};ssm-online`;
-              }
+            for (const cluster of response.CacheClusters || []) {
+              stats.elasticacheClustersScanned += 1;
+              addElastiCacheRecord(regionRecords, plan, region, cluster);
             }
+            marker = response.Marker;
+          } while (marker);
+        } catch (error) {
+          stats.regionErrors += 1;
+          const detail = `${error.name || "Error"}: ${error.message || String(error)}`;
+          warnings.push(`[${scopeLabel}] ElastiCache collection failed: ${detail}`);
+          const lower = detail.toLowerCase();
+          if (lower.includes("accessdenied") || lower.includes("not authorized")) {
+            pushRequiredAction(requiredActions, {
+              code: "ELASTICACHE_LIST_PERMISSION_REQUIRED",
+              message: `Missing ElastiCache list permission for ${scopeLabel}.`,
+              hint: "Need elasticache:DescribeCacheClusters."
+            });
           }
         }
+      }
 
+      if (regionRecords.length) {
         records.push(...regionRecords);
+      }
+
+      if (ec2Client) ec2Client.destroy();
+      if (ssmClient) ssmClient.destroy();
+      if (lambdaClient) lambdaClient.destroy();
+      if (elbv2Client) elbv2Client.destroy();
+      if (asgClient) asgClient.destroy();
+      if (rdsClient) rdsClient.destroy();
+      if (elasticacheClient) elasticacheClient.destroy();
+    }
+
+    if (config.includeRoute53) {
+      const scopeLabel = `${plan.profileLabel}/global`;
+      const route53Client = new route53.Route53Client(awsClientConfig(plan.profileName, "us-east-1"));
+      try {
+        let marker = undefined;
+        let isTruncated = false;
+        do {
+          const response = await route53Client.send(
+            new route53.ListHostedZonesCommand({ Marker: marker, MaxItems: "100" })
+          );
+          for (const zone of response.HostedZones || []) {
+            stats.route53ZonesScanned += 1;
+            let recordSetCount = null;
+            if (zone && zone.Id) {
+              try {
+                let rsCount = 0;
+                let nextName = undefined;
+                let nextType = undefined;
+                let nextId = undefined;
+                let truncated = false;
+                do {
+                  const rsResp = await route53Client.send(
+                    new route53.ListResourceRecordSetsCommand({
+                      HostedZoneId: String(zone.Id).replace("/hostedzone/", ""),
+                      StartRecordName: nextName,
+                      StartRecordType: nextType,
+                      StartRecordIdentifier: nextId,
+                      MaxItems: "100"
+                    })
+                  );
+                  rsCount += Array.isArray(rsResp.ResourceRecordSets) ? rsResp.ResourceRecordSets.length : 0;
+                  truncated = Boolean(rsResp.IsTruncated);
+                  nextName = rsResp.NextRecordName;
+                  nextType = rsResp.NextRecordType;
+                  nextId = rsResp.NextRecordIdentifier;
+                } while (truncated);
+                recordSetCount = rsCount;
+              } catch (err) {
+                warnings.push(`[${scopeLabel}] ListResourceRecordSets failed for zone ${zone.Name || zone.Id}: ${err.message || String(err)}`);
+              }
+            }
+            addRoute53ZoneRecord(records, plan, zone, recordSetCount);
+          }
+          marker = response.NextMarker;
+          isTruncated = Boolean(response.IsTruncated);
+        } while (isTruncated && marker);
       } catch (error) {
+        const detail = `${error.name || "Error"}: ${error.message || String(error)}`;
+        warnings.push(`[${scopeLabel}] Route53 collection failed: ${detail}`);
         stats.regionErrors += 1;
-        warnings.push(`[${scopeLabel}] EC2/SSM collection failed: ${error.message || String(error)}`);
+        const lower = detail.toLowerCase();
+        if (lower.includes("accessdenied") || lower.includes("not authorized")) {
+          pushRequiredAction(requiredActions, {
+            code: "ROUTE53_LIST_PERMISSION_REQUIRED",
+            message: `Missing Route53 list permission for ${scopeLabel}.`,
+            hint: "Need route53:ListHostedZones (+ route53:ListResourceRecordSets for record counts)."
+          });
+        }
       } finally {
-        ec2Client.destroy();
-        ssmClient.destroy();
+        route53Client.destroy();
       }
     }
   }
@@ -1224,6 +1804,91 @@ async function mapWithConcurrency(items, concurrency, fn) {
   await Promise.all(workers);
 }
 
+function groupEc2RecordsByScope(records) {
+  const map = new Map();
+  for (const record of records) {
+    if (!record || record.resourceType !== "ec2" || !record.instanceId) continue;
+    const key = [record.profile || "", record.accountId || "", record.region || ""].join("|");
+    if (!map.has(key)) map.set(key, []);
+    map.get(key).push(record);
+  }
+  return map;
+}
+
+async function collectRemediation(config, records, plans, warnings, requiredActions) {
+  if (!config.autoRemediateSsm) {
+    return { attempted: 0, changed: 0 };
+  }
+
+  const { ec2, ssm } = loadAwsModules();
+  const planLookup = new Map(plans.map((p) => [`${p.profileLabel}::${p.accountId}`, p]));
+  const scoped = groupEc2RecordsByScope(records);
+  let attempted = 0;
+  let changed = 0;
+
+  for (const [scopeKey, scopeRecords] of scoped.entries()) {
+    const [profile, accountId, region] = scopeKey.split("|");
+    const plan = planLookup.get(`${profile}::${accountId}`);
+    if (!plan) {
+      for (const record of scopeRecords) {
+        if (!record.ssmManaged) {
+          record.remediationStatus = "skipped-no-plan";
+        }
+      }
+      continue;
+    }
+
+    const scopeLabel = `${profile}/${region}`;
+    const ec2Client = new ec2.EC2Client(awsClientConfig(plan.profileName, region));
+    const ssmClient = new ssm.SSMClient(awsClientConfig(plan.profileName, region));
+    const unmanaged = scopeRecords.filter((r) => !r.ssmManaged);
+    let changedInScope = 0;
+
+    try {
+      for (const record of unmanaged) {
+        attempted += 1;
+        const remediation = await remediateInstanceProfile(
+          ec2Client,
+          record.instanceId,
+          config,
+          warnings,
+          requiredActions,
+          scopeLabel
+        );
+        record.remediationStatus = remediation.status;
+        if (remediation.changed) {
+          changed += 1;
+          changedInScope += 1;
+        }
+      }
+
+      if (changedInScope > 0 && config.remediationWaitSec > 0) {
+        warnings.push(`[${scopeLabel}] Waiting ${config.remediationWaitSec}s for SSM registration after remediation.`);
+        await sleep(config.remediationWaitSec * 1000);
+
+        const recheck = await fetchSsmInfoMap(
+          ssmClient,
+          scopeRecords.map((r) => r.instanceId),
+          warnings,
+          scopeLabel
+        );
+        for (const record of scopeRecords) {
+          const wasOnline = record.ssmOnline;
+          applySsmInfo(record, recheck.get(record.instanceId));
+          if (record.remediationStatus && record.ssmOnline && !wasOnline) {
+            record.remediationStatus = `${record.remediationStatus};ssm-online`;
+          }
+        }
+      }
+    } finally {
+      ec2Client.destroy();
+      ssmClient.destroy();
+    }
+  }
+
+  return { attempted, changed };
+}
+
 async function collectSnapshots(config, records, plans, warnings, requiredActions) {
   if (!config.runtimeSnapshot) return { attempted: 0, succeeded: 0 };
   const targets = records.filter((r) => r.ssmOnline === true);
@@ -1242,10 +1907,23 @@ async function collectSnapshots(config, records, plans, warnings, requiredAction
   return { attempted, succeeded };
 }
 
+async function executeRuntimeOperations(config, records, plans, warnings, requiredActions) {
+  const remediation = await collectRemediation(config, records, plans, warnings, requiredActions);
+  const snapshots = await collectSnapshots(config, records, plans, warnings, requiredActions);
+  return {
+    remediationAttempts: remediation.attempted,
+    remediationChanged: remediation.changed,
+    snapshotAttempted: snapshots.attempted,
+    snapshotSucceeded: snapshots.succeeded
+  };
+}
+
 function aggregate(config, records) {
   let out = records.slice();
-  if (config.managedOnly) out = out.filter((r) => r.ssmManaged === true);
-  out.sort((a, b) => [a.profile || "", a.accountId || "", a.region || "", a.instanceId || ""].join("|").localeCompare([b.profile || "", b.accountId || "", b.region || "", b.instanceId || ""].join("|")));
+  if (config.managedOnly) {
+    out = out.filter((r) => r.resourceType !== "ec2" || r.ssmManaged === true);
+  }
+  out.sort((a, b) => [a.profile || "", a.accountId || "", a.region || "", a.resourceType || "", a.resourceId || a.instanceId || ""].join("|").localeCompare([b.profile || "", b.accountId || "", b.region || "", b.resourceType || "", b.resourceId || b.instanceId || ""].join("|")));
   return out;
 }
 
@@ -1257,6 +1935,9 @@ function csvEscape(value) {
 
 function toCsvRow(record) {
   return {
+    resourceType: record.resourceType,
+    service: record.service,
+    resourceId: record.resourceId,
     profile: record.profile,
     accountId: record.accountId,
     region: record.region,
@@ -1276,6 +1957,53 @@ function toCsvRow(record) {
     ssmPlatformName: record.ssmPlatformName,
     ssmPlatformVersion: record.ssmPlatformVersion,
     remediationStatus: record.remediationStatus,
+    lambdaFunctionName: record.lambdaFunctionName,
+    lambdaFunctionArn: record.lambdaFunctionArn,
+    lambdaRuntime: record.lambdaRuntime,
+    lambdaHandler: record.lambdaHandler,
+    lambdaRole: record.lambdaRole,
+    lambdaLastModified: record.lambdaLastModified,
+    lambdaState: record.lambdaState,
+    lambdaPackageType: record.lambdaPackageType,
+    lambdaTimeoutSec: record.lambdaTimeoutSec,
+    lambdaMemoryMb: record.lambdaMemoryMb,
+    lambdaVpcConfigured: record.lambdaVpcConfigured,
+    albArn: record.albArn,
+    albType: record.albType,
+    albScheme: record.albScheme,
+    albDnsName: record.albDnsName,
+    albVpcId: record.albVpcId,
+    albListenerPorts: record.albListenerPorts,
+    targetGroupArn: record.targetGroupArn,
+    targetGroupType: record.targetGroupType,
+    targetGroupPort: record.targetGroupPort,
+    targetGroupProtocol: record.targetGroupProtocol,
+    targetGroupVpcId: record.targetGroupVpcId,
+    targetGroupLoadBalancers: record.targetGroupLoadBalancers,
+    asgName: record.asgName,
+    asgDesiredCapacity: record.asgDesiredCapacity,
+    asgMinSize: record.asgMinSize,
+    asgMaxSize: record.asgMaxSize,
+    asgInstanceCount: record.asgInstanceCount,
+    asgLaunchTemplate: record.asgLaunchTemplate,
+    rdsIdentifier: record.rdsIdentifier,
+    rdsEngine: record.rdsEngine,
+    rdsEngineVersion: record.rdsEngineVersion,
+    rdsStatus: record.rdsStatus,
+    rdsMultiAz: record.rdsMultiAz,
+    rdsEndpoint: record.rdsEndpoint,
+    rdsStorageGb: record.rdsStorageGb,
+    elasticacheClusterId: record.elasticacheClusterId,
+    elasticacheEngine: record.elasticacheEngine,
+    elasticacheEngineVersion: record.elasticacheEngineVersion,
+    elasticacheNodeType: record.elasticacheNodeType,
+    elasticacheStatus: record.elasticacheStatus,
+    elasticacheNumNodes: record.elasticacheNumNodes,
+    route53ZoneId: record.route53ZoneId,
+    route53ZoneName: record.route53ZoneName,
+    route53PrivateZone: record.route53PrivateZone,
+    route53RecordSetCount: record.route53RecordSetCount,
+    route53CallerReference: record.route53CallerReference,
     runtimeSnapshotStatus: record.runtimeSnapshot ? record.runtimeSnapshot.status : null,
     runtimeSnapshotCollectedAt: record.runtimeSnapshot ? record.runtimeSnapshot.collectedAt : null,
     runtimeSnapshotOutput: record.runtimeSnapshot ? record.runtimeSnapshot.output : null,
@@ -1288,9 +2016,19 @@ function renderOutput(config, records) {
     return JSON.stringify(records, null, 2);
   }
   const fields = [
+    "resourceType", "service", "resourceId",
     "profile", "accountId", "region", "instanceId", "name", "state", "privateIp", "publicIp", "publicDns",
     "platform", "iamInstanceProfileArn", "ssmManaged", "ssmOnline", "ssmPingStatus", "ssmLastPingDateTime",
-    "ssmAgentVersion", "ssmPlatformName", "ssmPlatformVersion", "remediationStatus", "runtimeSnapshotStatus",
+    "ssmAgentVersion", "ssmPlatformName", "ssmPlatformVersion", "remediationStatus",
+    "lambdaFunctionName", "lambdaFunctionArn", "lambdaRuntime", "lambdaHandler", "lambdaRole", "lambdaLastModified",
+    "lambdaState", "lambdaPackageType", "lambdaTimeoutSec", "lambdaMemoryMb", "lambdaVpcConfigured",
+    "albArn", "albType", "albScheme", "albDnsName", "albVpcId", "albListenerPorts",
+    "targetGroupArn", "targetGroupType", "targetGroupPort", "targetGroupProtocol", "targetGroupVpcId", "targetGroupLoadBalancers",
+    "asgName", "asgDesiredCapacity", "asgMinSize", "asgMaxSize", "asgInstanceCount", "asgLaunchTemplate",
+    "rdsIdentifier", "rdsEngine", "rdsEngineVersion", "rdsStatus", "rdsMultiAz", "rdsEndpoint", "rdsStorageGb",
+    "elasticacheClusterId", "elasticacheEngine", "elasticacheEngineVersion", "elasticacheNodeType", "elasticacheStatus", "elasticacheNumNodes",
+    "route53ZoneId", "route53ZoneName", "route53PrivateZone", "route53RecordSetCount", "route53CallerReference",
+    "runtimeSnapshotStatus",
     "runtimeSnapshotCollectedAt", "runtimeSnapshotOutput", "runtimeSnapshotError"
   ];
   const lines = [fields.join(",")];
@@ -1315,18 +2053,19 @@ async function runWorkflow(config) {
   const warnings = [];
   const requiredActions = [];
 
-  progress(config, 1, "orchestrator: parse CLI/env parameters");
-  eprint(`Inputs: profiles=${config.profiles ? config.profiles.join(",") : "auto"}, regions=${config.regions ? config.regions.join(",") : "auto"}, public_only=${config.publicOnly ? "on" : "off"}, managed_only=${config.managedOnly ? "on" : "off"}, auto_remediate_ssm=${config.autoRemediateSsm ? "on" : "off"}, runtime_snapshot=${config.runtimeSnapshot ? "on" : "off"}, auto_sso_login=${config.autoSsoLogin ? "on" : "off"}`);
+  progress(config, 1, "orchestrator: parse user request and operation scope");
+  eprint(`Inputs: execution_mode=${INTERNAL_BACKEND_ID}, profiles=${config.profiles ? config.profiles.join(",") : "auto"}, regions=${config.regions ? config.regions.join(",") : "auto"}, include_ec2=${config.includeEc2 ? "on" : "off"}, include_lambda=${config.includeLambda ? "on" : "off"}, include_alb=${config.includeAlb ? "on" : "off"}, include_asg=${config.includeAsg ? "on" : "off"}, include_rds=${config.includeRds ? "on" : "off"}, include_elasticache=${config.includeElastiCache ? "on" : "off"}, include_route53=${config.includeRoute53 ? "on" : "off"}, public_only=${config.publicOnly ? "on" : "off"}, managed_only=${config.managedOnly ? "on" : "off"}, auto_remediate_ssm=${config.autoRemediateSsm ? "on" : "off"}, runtime_snapshot=${config.runtimeSnapshot ? "on" : "off"}, auto_sso_login=${config.autoSsoLogin ? "on" : "off"}`);
 
   progress(config, 2, "config_validator: validate settings and output path");
   validateConfig(config, warnings, requiredActions);
 
-  progress(config, 3, "ssm_readiness_planner: check remediation and snapshot options");
-  if (config.autoRemediateSsm) {
-    eprint(`Remediation target: ${config.ssmInstanceProfileArn || config.ssmInstanceProfileName} (replace=${config.allowReplaceProfile ? "on" : "off"})`);
-  }
+  progress(config, 3, "execution_resolver: resolve internal execution modules");
+  eprint(`Execution mode: ${INTERNAL_BACKEND_ID}`);
+
+  progress(config, 4, "aws_discovery_planner: build operation graph and discovery plan");
+  const operationPlan = buildOperationPlan(config);
+  eprint(`Operation plan: inventory=${operationPlan.inventoryOps.length ? operationPlan.inventoryOps.join(",") : "none"}; runtime=${operationPlan.runtimeOps.length ? operationPlan.runtimeOps.join(",") : "none"}`);
 
-  progress(config, 4, "aws_discovery_planner: validate credentials and profile/region plan");
   const plans = await buildDiscoveryPlan(config, warnings, requiredActions);
   if (plans.length) {
     eprint("Discovery plan: " + plans.map((p) => `${p.profileLabel}(${p.regions.length} regions)`).join(", "));
@@ -1334,14 +2073,21 @@ async function runWorkflow(config) {
     warnings.push("No usable AWS profiles were found after validation.");
   }
 
-  progress(config, 5, "ec2_inventory_collector: collect EC2 + SSM inventory");
-  const { records, stats } = await collectInventory(config, plans, warnings, requiredActions);
+  if (config.autoRemediateSsm) {
+    eprint(`Remediation target: ${config.ssmInstanceProfileArn || config.ssmInstanceProfileName} (replace=${config.allowReplaceProfile ? "on" : "off"})`);
+  }
+
+  progress(config, 5, "resource_inventory_collector: collect multi-service inventory");
+  const inventoryResult = await collectInventory(config, plans, warnings, requiredActions);
+  const records = inventoryResult.records;
+  const stats = inventoryResult.stats;
   eprint(`Collected inventory records: ${records.length}`);
 
-  progress(config, 6, "ssm_connectivity_checker: evaluate managed/online status");
-  const unmanaged = records.filter((r) => !r.ssmManaged).length;
-  const offline = records.filter((r) => r.ssmManaged && !r.ssmOnline).length;
-  eprint(`SSM state: unmanaged=${unmanaged}, managed_offline=${offline}`);
+  progress(config, 6, "runtime_operation_executor: execute runtime snapshot/remediation tasks");
+  const ec2Records = records.filter((r) => r.resourceType === "ec2");
+  const unmanaged = ec2Records.filter((r) => !r.ssmManaged).length;
+  const offline = ec2Records.filter((r) => r.ssmManaged && !r.ssmOnline).length;
+  eprint(`Pre-runtime SSM state: unmanaged=${unmanaged}, managed_offline=${offline}`);
 
   if (unmanaged > 0 && !config.autoRemediateSsm) {
     pushRequiredAction(requiredActions, {
@@ -1351,18 +2097,28 @@ async function runWorkflow(config) {
     });
   }
 
-  progress(config, 7, "runtime_snapshot_collector: collect runtime snapshots");
-  const snapshotStats = await collectSnapshots(config, records, plans, warnings, requiredActions);
+  const runtimeStats = await executeRuntimeOperations(config, records, plans, warnings, requiredActions);
 
-  progress(config, 8, "cli_output_formatter: render JSON/CSV");
+  progress(config, 7, "result_aggregator: normalize records/warnings/actions");
   const outputRecords = aggregate(config, records);
+
+  progress(config, 8, "cli_output_formatter: render JSON/CSV and guidance payload");
   writeOutput(config, renderOutput(config, outputRecords));
 
-  progress(config, 9, "END: summarize execution");
-  const ssmManaged = outputRecords.filter((r) => r.ssmManaged).length;
-  const ssmOnline = outputRecords.filter((r) => r.ssmOnline).length;
-  const publicCount = outputRecords.filter((r) => Boolean(r.publicIp)).length;
-  eprint(`Summary: profiles=${stats.profiles}, regions_scanned=${stats.regions}, region_errors=${stats.regionErrors}, instances_scanned=${stats.instancesScanned}, output_records=${outputRecords.length}, public_ip_records=${publicCount}, ssm_managed=${ssmManaged}, ssm_online=${ssmOnline}, remediation_attempts=${stats.remediationAttempts}, remediation_changed=${stats.remediationChanged}, runtime_snapshot_attempted=${snapshotStats.attempted}, runtime_snapshot_succeeded=${snapshotStats.succeeded}, warnings=${warnings.length}, required_actions=${requiredActions.length}`);
+  progress(config, 9, "END: emit execution summary and evidence metadata");
+  const outputEc2 = outputRecords.filter((r) => r.resourceType === "ec2");
+  const outputLambda = outputRecords.filter((r) => r.resourceType === "lambda");
+  const outputAlb = outputRecords.filter((r) => r.resourceType === "alb");
+  const outputTargetGroups = outputRecords.filter((r) => r.resourceType === "target_group");
+  const outputAsg = outputRecords.filter((r) => r.resourceType === "asg");
+  const outputRds = outputRecords.filter((r) => r.resourceType === "rds");
+  const outputElastiCache = outputRecords.filter((r) => r.resourceType === "elasticache");
+  const outputRoute53 = outputRecords.filter((r) => r.resourceType === "route53_zone");
+  const ssmManaged = outputEc2.filter((r) => r.ssmManaged).length;
+  const ssmOnline = outputEc2.filter((r) => r.ssmOnline).length;
+  const publicCount = outputEc2.filter((r) => Boolean(r.publicIp)).length;
+  eprint(`Summary: execution_mode=${INTERNAL_BACKEND_ID}, profiles=${stats.profiles}, regions_scanned=${stats.regions}, region_errors=${stats.regionErrors}, ec2_scanned=${stats.instancesScanned}, lambda_scanned=${stats.lambdaFunctionsScanned}, alb_scanned=${stats.loadBalancersScanned}, targetgroup_scanned=${stats.targetGroupsScanned}, asg_scanned=${stats.autoScalingGroupsScanned}, rds_scanned=${stats.rdsInstancesScanned}, elasticache_scanned=${stats.elasticacheClustersScanned}, route53_zone_scanned=${stats.route53ZonesScanned}, output_records=${outputRecords.length}, output_ec2=${outputEc2.length}, output_lambda=${outputLambda.length}, output_alb=${outputAlb.length}, output_target_group=${outputTargetGroups.length}, output_asg=${outputAsg.length}, output_rds=${outputRds.length}, output_elasticache=${outputElastiCache.length}, output_route53_zone=${outputRoute53.length}, ec2_public_ip_records=${publicCount}, ec2_ssm_managed=${ssmManaged}, ec2_ssm_online=${ssmOnline}, remediation_attempts=${runtimeStats.remediationAttempts}, remediation_changed=${runtimeStats.remediationChanged}, runtime_snapshot_attempted=${runtimeStats.snapshotAttempted}, runtime_snapshot_succeeded=${runtimeStats.snapshotSucceeded}, warnings=${warnings.length}, required_actions=${requiredActions.length}`);
+  eprint(`EvidenceMeta: workflow_id=b60f0f18-cc45-4af9-a7c7-217284457759; schema=gesia.orflow.contract.v2; step_count=${TOTAL_STEPS}; execution_mode=${INTERNAL_BACKEND_ID}; inventory_ops=${operationPlan.inventoryOps.length}; runtime_ops=${operationPlan.runtimeOps.length}`);
 
   for (const warning of warnings) eprint(`WARNING: ${warning}`);
   for (const action of requiredActions) {