@flowuent-org/diagramming-core 1.3.10 → 1.4.1

package/packages/diagrams/src/lib/templates/cloud-arch/utils/cloudValidation.ts

@@ -1,930 +1,930 @@
-import { Node } from 'reactflow';
-import { validateResourcePlacement, getValidationSummary } from './genericValidation';
-import { CloudProvider } from '../types/validation';
-
-interface ValidationResult {
-  isValid: boolean;
-  message?: string;
-  suggestions?: string[];
-}
-
-interface ValidationWarning {
-  message: string;
-  severity: 'warning' | 'info' | 'error';
-  suggestions?: string[];
-}
-
-export const validateCloudProviderPlacement = (
-  tempNode: Node,
-  parentNode: Node | null,
-  nodes: Node[],
-  cloudProvider?: CloudProvider
-): ValidationResult => {
-  // Check for cross-provider contamination
-  const crossProviderValidation = validateCrossProviderPlacement(tempNode, nodes, cloudProvider);
-  if (!crossProviderValidation.isValid) {
-    return crossProviderValidation;
-  }
-
-  // Direct validation for AWS (working implementation)
-  if (cloudProvider === 'aws') {
-    const childService = tempNode.data?.service;
-    const parentService = parentNode?.data?.service;
-    
-    // Root level validation
-    if (!parentNode) {
-      if (childService === 'account') {
-        return { isValid: true, message: 'AWS Account can be placed at root level' };
-      } else {
-        return { 
-          isValid: false, 
-          message: `${childService} cannot be at root level. Only AWS Account can be at root.`,
-          suggestions: ['Create an AWS Account first', 'Place this inside an AWS Account']
-        };
-      }
-    }
-    
-    // AWS Account containment rules
-    if (parentService === 'account') {
-      const allowedInAccount = ['vpc', 'availability-zone', 'local-zone'];
-      if (allowedInAccount.includes(childService)) {
-        return { isValid: true, message: `AWS Account can contain ${childService}` };
-      } else {
-        return {
-          isValid: false,
-          message: `${childService} cannot be placed directly in AWS Account. Use VPC → Subnet hierarchy.`,
-          suggestions: ['Create VPC first', 'Place services in Subnet within VPC']
-        };
-      }
-    }
-    
-    // VPC containment rules
-    if (parentService === 'vpc') {
-      const allowedInVpc = ['subnet', 'availability-zone', 'security-group'];
-      if (allowedInVpc.includes(childService)) {
-        return { isValid: true, message: `VPC can contain ${childService}` };
-      } else {
-        return {
-          isValid: false,
-          message: `${childService} cannot be placed directly in VPC. Place in Subnet within VPC.`,
-          suggestions: ['Create Subnet first', 'Place services in Subnet']
-        };
-      }
-    }
-    
-    // Subnet containment rules
-    if (parentService === 'subnet') {
-      const forbiddenInSubnet = ['account', 'vpc', 'subnet'];
-      if (forbiddenInSubnet.includes(childService)) {
-        return {
-          isValid: false,
-          message: `${childService} cannot be placed inside Subnet. Check AWS hierarchy.`,
-          suggestions: ['Place containers at appropriate level']
-        };
-      }
-      return { isValid: true, message: `Subnet can contain ${childService} service` };
-    }
-    
-    // Other AWS containers
-    if (parentService === 'availability-zone') {
-      return { isValid: true, message: `Availability Zone can contain ${childService}` };
-    }
-    
-    if (parentService === 'security-group') {
-      return { isValid: true, message: `Security Group can contain ${childService}` };
-    }
-    
-    // Default fallback - allow but warn
-    console.warn(`AWS validation: Unknown parent-child relationship: ${parentService} → ${childService}`);
-    return { 
-      isValid: true, 
-      message: `${parentService || 'container'} can contain ${childService}` 
-    };
-  }
-
-  // Use generic validation system for other providers
-  if (cloudProvider) {
-    const restrictionResults = validateResourcePlacement(tempNode, parentNode, nodes, cloudProvider);
-    const summary = getValidationSummary(restrictionResults);
-    
-    return {
-      isValid: summary.isValid,
-      message: summary.message,
-      suggestions: summary.suggestions
-    };
-  }
-
-  return { isValid: true };
-};
-
-/**
- * Validates cross-provider placement to prevent mixing incompatible services
- */
-const validateCrossProviderPlacement = (
-  tempNode: Node,
-  nodes: Node[],
-  cloudProvider?: CloudProvider
-): ValidationResult => {
-  if (!cloudProvider) return { isValid: true };
-
-  const existingProviders = new Set(
-    nodes
-      .filter(node => node.data?.cloudProvider)
-      .map(node => node.data.cloudProvider)
-  );
-
-  if (existingProviders.size > 0 && !existingProviders.has(cloudProvider)) {
-    const existingProvidersList = Array.from(existingProviders).join(', ');
-    return {
-      isValid: false,
-      message: `Cannot mix cloud providers. This diagram already contains ${existingProvidersList} services. Please use a separate diagram for ${cloudProvider} services.`,
-      suggestions: [
-        'Create a separate diagram for each cloud provider',
-        'Use hybrid/multi-cloud architecture patterns if needed',
-        'Consider using a multi-cloud management service'
-      ]
-    };
-  }
-
-  return { isValid: true };
-};
-
-/**
- * Automatically finds the best parent node based on position and schema rules
- * @param nodePosition - Position where the node will be placed
- * @param service - Service type of the node
- * @param cloudProvider - Cloud provider (aws, azure, gcp)
- * @param nodes - All existing nodes
- * @returns The best parent node or null if no valid parent found
- */
-export const findAutoParent = (
-  nodePosition: { x: number; y: number },
-  service: string,
-  cloudProvider: 'aws' | 'azure' | 'gcp',
-  nodes: Node[]
-): Node | null => {
-  // Get all potential parent nodes (container nodes)
-  const potentialParents = nodes.filter(node => 
-    node.type === 'subnetNode' && 
-    node.data?.cloudProvider === cloudProvider
-  );
-
-  // First, find all containers that actually contain the drop position
-  const containingParents = potentialParents.filter(parent => 
-    isPositionWithinNode(nodePosition, parent, nodes)
-  );
-
-  // Debug logging for development
-  if (process.env.NODE_ENV === 'development') {
-    console.log(`Finding auto parent for ${service} at position:`, {
-      position: nodePosition,
-      potentialParents: potentialParents.map(p => ({ id: p.id, label: p.data?.label, service: p.data?.service })),
-      containingParents: containingParents.map(p => ({ id: p.id, label: p.data?.label, service: p.data?.service }))
-    });
-  }
-
-  // If we have containers that contain the position, prioritize those
-  if (containingParents.length > 0) {
-    // Sort containing containers by specificity (smallest area first for most specific container)
-    const sortedContainingParents = containingParents.sort((a, b) => {
-      // First sort by z-index (highest first - more specific layers)
-    const aZIndex = a.style?.zIndex || 0;
-    const bZIndex = b.style?.zIndex || 0;
-    
-    if (aZIndex !== bZIndex) {
-      return (bZIndex as number) - (aZIndex as number);
-    }
-
-      // Then sort by area (smallest first - most specific container)
-    const aArea = (Number(a.style?.width) || 0) * (Number(a.style?.height) || 0);
-    const bArea = (Number(b.style?.width) || 0) * (Number(b.style?.height) || 0);
-    return aArea - bArea;
-  });
-
-    // Find the best containing parent based on validation rules
-    for (const potentialParent of sortedContainingParents) {
-      // Create a temporary node to test validation
-      const tempNode: Node = {
-        id: `temp-${Date.now()}`,
-        type: 'serviceNode',
-        position: nodePosition,
-        data: {
-          service,
-          cloudProvider,
-        },
-        parentNode: potentialParent.id,
-      };
-
-      // Validate if this placement is allowed
-      const validation = validateCloudProviderPlacement(
-        tempNode,
-        potentialParent,
-        nodes,
-        cloudProvider
-      );
-
-      if (validation.isValid) {
-        return potentialParent;
-      }
-    }
-  }
-
-  // If no containing containers found or none are valid, fall back to default behavior
-  // Sort all potential parents by z-index and area as fallback
-  const sortedParents = potentialParents.sort((a, b) => {
-    const aZIndex = a.style?.zIndex || 0;
-    const bZIndex = b.style?.zIndex || 0;
-    
-    if (aZIndex !== bZIndex) {
-      return (bZIndex as number) - (aZIndex as number);
-    }
-
-    // If same z-index, prefer smaller containers
-    const aArea = (Number(a.style?.width) || 0) * (Number(a.style?.height) || 0);
-    const bArea = (Number(b.style?.width) || 0) * (Number(b.style?.height) || 0);
-    return aArea - bArea;
-  });
-
-  // Try each potential parent with validation
-  for (const potentialParent of sortedParents) {
-    // Create a temporary node to test validation
-    const tempNode: Node = {
-      id: `temp-${Date.now()}`,
-      type: 'serviceNode',
-      position: nodePosition,
-      data: {
-        service,
-        cloudProvider,
-      },
-      parentNode: potentialParent.id,
-    };
-
-    // Validate if this placement is allowed
-    const validation = validateCloudProviderPlacement(
-      tempNode,
-      potentialParent,
-      nodes,
-      cloudProvider
-    );
-
-    if (validation.isValid) {
-      return potentialParent;
-    }
-  }
-
-  // If no valid parent found in containers, check if it can be placed at root
-  const tempNode: Node = {
-    id: `temp-${Date.now()}`,
-    type: 'serviceNode',
-    position: nodePosition,
-    data: {
-      service,
-      cloudProvider,
-    },
-  };
-
-  const rootValidation = validateCloudProviderPlacement(
-    tempNode,
-    null,
-    nodes,
-    cloudProvider
-  );
-
-  return rootValidation.isValid ? null : getDefaultParent(service, cloudProvider, nodes);
-};
-
-/**
- * Checks if a position is within the bounds of a node
- * Handles nested node positioning correctly by calculating absolute coordinates
- */
-const isPositionWithinNode = (
-  position: { x: number; y: number },
-  node: Node,
-  allNodes?: Node[]
-): boolean => {
-  // Calculate absolute position of the node (considering parent positioning)
-  let nodeX = node.position.x;
-  let nodeY = node.position.y;
-  
-  // If the node has a parent, we need to calculate the absolute position
-  // by traversing up the parent chain
-  if (node.parentNode && allNodes) {
-    const parentNode = allNodes.find(n => n.id === node.parentNode);
-    if (parentNode) {
-      // Recursively calculate parent's absolute position
-      const parentAbsolutePos = getAbsolutePosition(parentNode, allNodes);
-      nodeX = parentAbsolutePos.x + node.position.x;
-      nodeY = parentAbsolutePos.y + node.position.y;
-    }
-  }
-  
-  const nodeWidth = (node.style?.width as number) || (node.data?.width as number) || 200;
-  const nodeHeight = (node.style?.height as number) || (node.data?.height as number) || 150;
-
-  // Add some padding to make it easier to drop items near edges
-  const padding = 10;
-  
-  const isWithin = (
-    position.x >= nodeX - padding &&
-    position.x <= nodeX + nodeWidth + padding &&
-    position.y >= nodeY - padding &&
-    position.y <= nodeY + nodeHeight + padding
-  );
-
-  // Debug logging for development
-  if (process.env.NODE_ENV === 'development') {
-    console.log(`Position check for ${node.data?.service || 'unknown'} (${node.data?.label || 'no label'}):`, {
-      dropPosition: position,
-      originalPosition: node.position,
-      calculatedPosition: { x: nodeX, y: nodeY },
-      nodeSize: { width: nodeWidth, height: nodeHeight },
-      bounds: {
-        left: nodeX - padding,
-        right: nodeX + nodeWidth + padding,
-        top: nodeY - padding,
-        bottom: nodeY + nodeHeight + padding
-      },
-      isWithin,
-      hasParent: !!node.parentNode,
-      parentNode: node.parentNode
-    });
-  }
-
-  return isWithin;
-};
-
-/**
- * Recursively calculates the absolute position of a node by traversing up the parent chain
- */
-const getAbsolutePosition = (node: Node, allNodes: Node[]): { x: number; y: number } => {
-  let absoluteX = node.position.x;
-  let absoluteY = node.position.y;
-  
-  if (node.parentNode) {
-    const parentNode = allNodes.find(n => n.id === node.parentNode);
-    if (parentNode) {
-      const parentAbsolutePos = getAbsolutePosition(parentNode, allNodes);
-      absoluteX = parentAbsolutePos.x + node.position.x;
-      absoluteY = parentAbsolutePos.y + node.position.y;
-    }
-  }
-  
-  return { x: absoluteX, y: absoluteY };
-};
-
-/**
- * Gets the default parent based on service type and cloud provider
- */
-const getDefaultParent = (
-  service: string,
-  cloudProvider: 'aws' | 'azure' | 'gcp',
-  nodes: Node[]
-): Node | null => {
-  // Define comprehensive default parent hierarchy for each cloud provider
-  const defaultParents = {
-    aws: {
-      // Compute services
-      compute: ['subnet', 'availability-zone', 'vpc', 'account'],
-      ec2: ['subnet', 'availability-zone', 'vpc', 'account'],
-      lambda: ['account'],
-      'elastic-beanstalk': ['account'],
-      fargate: ['subnet', 'vpc', 'account'],
-      batch: ['subnet', 'vpc', 'account'],
-      'app-runner': ['account'],
-      'serverless-application-repository': ['account'],
-      
-      // Database services
-      database: ['subnet', 'vpc', 'account'],
-      rds: ['subnet', 'vpc', 'account'],
-      aurora: ['subnet', 'vpc', 'account'],
-      dynamodb: ['account'],
-      elasticache: ['subnet', 'vpc', 'account'],
-      neptune: ['subnet', 'vpc', 'account'],
-      documentdb: ['subnet', 'vpc', 'account'],
-      keyspaces: ['account'],
-      timestream: ['account'],
-      
-      // Storage services
-      storage: ['account'],
-      s3: ['account'],
-      ebs: ['account'],
-      efs: ['account'],
-      fsx: ['account'],
-      backup: ['account'],
-      'storage-gateway': ['account'],
-      
-      // Networking services
-      networking: ['vpc', 'account'],
-      'elastic-load-balancing': ['subnet', 'vpc', 'account'],
-      'route-53': ['account'],
-      'direct-connect': ['account'],
-      'transit-gateway': ['account'],
-      'global-accelerator': ['account'],
-      'site-to-site-vpn': ['vpc', 'account'],
-      'client-vpn': ['vpc', 'account'],
-      
-      // Security services
-      security: ['account'],
-      iam: ['account'],
-      cognito: ['account'],
-      kms: ['account'],
-      'secrets-manager': ['account'],
-      'certificate-manager': ['account'],
-      waf: ['account'],
-      shield: ['account'],
-      guardduty: ['account'],
-      'security-hub': ['account'],
-      'network-firewall': ['subnet', 'vpc', 'account'],
-      
-      // Container services
-      containers: ['subnet', 'vpc', 'account'],
-      ecs: ['subnet', 'vpc', 'account'],
-      'elastic-container-service': ['subnet', 'vpc', 'account'],
-      eks: ['subnet', 'vpc', 'account'],
-      'elastic-kubernetes-service': ['subnet', 'vpc', 'account'],
-      'elastic-container-registry': ['account'],
-      
-      // Serverless services
-      serverless: ['account'],
-    },
-    azure: {
-      // Compute services
-      virtualMachine: ['subnet', 'virtual-network', 'resource-group', 'subscription'],
-      'virtual-machines': ['subnet', 'virtual-network', 'resource-group', 'subscription'],
-      'app-services': ['resource-group', 'subscription'],
-      'app-service': ['resource-group', 'subscription'],
-      'function-apps': ['resource-group', 'subscription'],
-      'batch-accounts': ['resource-group', 'subscription'],
-      'kubernetes-services': ['resource-group', 'subscription'],
-      'container-instances': ['resource-group', 'subscription'],
-      'virtual-machine-scale-sets': ['resource-group', 'subscription'],
-      
-      // Database services
-      database: ['resource-group', 'subscription'],
-      'sql-database': ['resource-group', 'subscription'],
-      'cosmos-db': ['resource-group', 'subscription'],
-      'mysql-server': ['resource-group', 'subscription'],
-      'postgresql-server': ['resource-group', 'subscription'],
-      'redis-cache': ['resource-group', 'subscription'],
-      
-      // Storage services
-      storageAccount: ['resource-group', 'subscription'],
-      'storage-accounts': ['resource-group', 'subscription'],
-      'managed-disks': ['resource-group', 'subscription'],
-      'blob-storage': ['resource-group', 'subscription'],
-      'file-storage': ['resource-group', 'subscription'],
-      
-      // Networking services
-      networkInterface: ['subnet', 'virtual-network', 'resource-group', 'subscription'],
-      'network-interfaces': ['subnet', 'virtual-network', 'resource-group', 'subscription'],
-      loadBalancer: ['resource-group', 'subscription'],
-      'load-balancers': ['resource-group', 'subscription'],
-      'application-gateway': ['subnet', 'virtual-network', 'resource-group', 'subscription'],
-      'vpn-gateway': ['virtual-network', 'resource-group', 'subscription'],
-      'express-route': ['resource-group', 'subscription'],
-      'cdn-profiles': ['resource-group', 'subscription'],
-      
-      // Security services
-      'key-vaults': ['resource-group', 'subscription'],
-      'security-center': ['subscription'],
-      'azure-firewall': ['subnet', 'virtual-network', 'resource-group', 'subscription'],
-      'network-security-groups': ['resource-group', 'subscription'],
-      'azure-active-directory': ['subscription'],
-    },
-    gcp: {
-      // Compute services
-      compute: ['subnet', 'vpc', 'project'],
-      'compute-engine': ['subnet', 'vpc', 'project'],
-      'app-engine': ['project'],
-      'cloud-functions': ['project'],
-      'kubernetes-engine': ['project'],
-      'cloud-run': ['project'],
-      'cloud-build': ['project'],
-      
-      // Database services
-      database: ['project'],
-      'cloud-sql': ['project'],
-      'cloud-spanner': ['project'],
-      'cloud-bigtable': ['project'],
-      'cloud-firestore': ['project'],
-      'cloud-memorystore': ['project'],
-      
-      // Storage services
-      storage: ['project'],
-      'cloud-storage': ['project'],
-      'persistent-disk': ['project'],
-      'filestore': ['project'],
-      
-      // Networking services
-      networking: ['vpc', 'project'],
-      'cloud-load-balancing': ['project'],
-      'cloud-cdn': ['project'],
-      'cloud-dns': ['project'],
-      'cloud-interconnect': ['project'],
-      'cloud-vpn': ['vpc', 'project'],
-      'cloud-nat': ['vpc', 'project'],
-      'cloud-router': ['vpc', 'project'],
-      
-      // Security services
-      'cloud-iam': ['project'],
-      'cloud-kms': ['project'],
-      'cloud-security-command-center': ['project'],
-      'cloud-armor': ['project'],
-      'binary-authorization': ['project'],
-      'cloud-asset-inventory': ['project'],
-      
-      // Serverless services
-      cloudFunction: ['project'],
-      cloudRun: ['project'],
-    },
-  };
-
-  // Get the service category/type
-  const serviceType = getServiceType(service, cloudProvider);
-  const parentHierarchy = defaultParents[cloudProvider]?.[serviceType as keyof typeof defaultParents[typeof cloudProvider]];
-
-  if (!parentHierarchy) {
-    // If no specific hierarchy found, use the service name directly
-    const directHierarchy = defaultParents[cloudProvider]?.[service as keyof typeof defaultParents[typeof cloudProvider]];
-    if (directHierarchy) {
-      return findParentFromHierarchy(directHierarchy, nodes, cloudProvider);
-    }
-    return null;
-  }
-
-  return findParentFromHierarchy(parentHierarchy, nodes, cloudProvider);
-};
-
-/**
- * Finds the first available parent from a hierarchy
- */
-const findParentFromHierarchy = (
-  hierarchy: string[],
-  nodes: Node[],
-  cloudProvider: 'aws' | 'azure' | 'gcp'
-): Node | null => {
-  for (const parentType of hierarchy) {
-    const parent = nodes.find(node => 
-      node.type === 'subnetNode' && 
-      node.data?.service === parentType &&
-      node.data?.cloudProvider === cloudProvider
-    );
-
-    if (parent) {
-      return parent;
-    }
-  }
-  return null;
-};
-
-/**
- * Maps service to service type/category with comprehensive mapping
- */
-const getServiceType = (service: string, cloudProvider: 'aws' | 'azure' | 'gcp'): string => {
-  const serviceTypeMap = {
-    aws: {
-      // Compute services
-      ec2: 'compute',
-      lambda: 'serverless',
-      'elastic-beanstalk': 'compute',
-      fargate: 'containers',
-      batch: 'compute',
-      'app-runner': 'compute',
-      'application-auto-scaling': 'compute',
-      'ec2-auto-scaling': 'compute',
-      'serverless-application-repository': 'serverless',
-      
-      // Database services
-      rds: 'database',
-      aurora: 'database',
-      dynamodb: 'database',
-      elasticache: 'database',
-      neptune: 'database',
-      documentdb: 'database',
-      keyspaces: 'database',
-      timestream: 'database',
-      'database-migration-service': 'database',
-      
-      // Storage services
-      s3: 'storage',
-      ebs: 'storage',
-      efs: 'storage',
-      fsx: 'storage',
-      backup: 'storage',
-      'storage-gateway': 'storage',
-      snowball: 'storage',
-      'snowball-edge': 'storage',
-      snowcone: 'storage',
-      snowmobile: 'storage',
-      
-      // Networking services
-      vpc: 'networking',
-      'elastic-load-balancing': 'networking',
-      'route-53': 'networking',
-      'direct-connect': 'networking',
-      'transit-gateway': 'networking',
-      'global-accelerator': 'networking',
-      'site-to-site-vpn': 'networking',
-      'client-vpn': 'networking',
-      'app-mesh': 'networking',
-      'cloud-map': 'networking',
-      'cloud-wan': 'networking',
-      privatelink: 'networking',
-      'vpc-lattice': 'networking',
-      
-      // Security services
-      'security-group': 'security',
-      iam: 'security',
-      cognito: 'security',
-      kms: 'security',
-      'secrets-manager': 'security',
-      'certificate-manager': 'security',
-      waf: 'security',
-      shield: 'security',
-      guardduty: 'security',
-      'security-hub': 'security',
-      'network-firewall': 'security',
-      inspector: 'security',
-      macie: 'security',
-      detective: 'security',
-      
-      // Container services
-      ecs: 'containers',
-      'elastic-container-service': 'containers',
-      eks: 'containers',
-      'elastic-kubernetes-service': 'containers',
-      'elastic-container-registry': 'containers',
-      'ecs-anywhere': 'containers',
-      'eks-anywhere': 'containers',
-      'eks-cloud': 'containers',
-      'eks-distro': 'containers',
-    },
-    azure: {
-      // Compute services
-      'virtual-machine': 'virtualMachine',
-      'virtual-machines': 'virtualMachine',
-      'app-services': 'appService',
-      'app-service': 'appService',
-      'function-apps': 'appService',
-      'batch-accounts': 'compute',
-      'kubernetes-services': 'containers',
-      'container-instances': 'containers',
-      'virtual-machine-scale-sets': 'virtualMachine',
-      
-      // Database services
-      'sql-database': 'database',
-      'cosmos-db': 'database',
-      'mysql-server': 'database',
-      'postgresql-server': 'database',
-      'redis-cache': 'database',
-      'mariadb-server': 'database',
-      'managed-database': 'database',
-      
-      // Storage services
-      'storage-account': 'storageAccount',
-      'storage-accounts': 'storageAccount',
-      'managed-disks': 'storageAccount',
-      'blob-storage': 'storageAccount',
-      'file-storage': 'storageAccount',
-      
-      // Networking services
-      'network-interface': 'networkInterface',
-      'network-interfaces': 'networkInterface',
-      'load-balancer': 'loadBalancer',
-      'load-balancers': 'loadBalancer',
-      'application-gateway': 'loadBalancer',
-      'vpn-gateway': 'networking',
-      'express-route': 'networking',
-      'cdn-profiles': 'networking',
-      
-      // Security services
-      'key-vaults': 'security',
-      'security-center': 'security',
-      'azure-firewall': 'security',
-      'network-security-groups': 'security',
-      'azure-active-directory': 'security',
-    },
-    gcp: {
-      // Compute services
-      'compute-engine': 'compute',
-      'app-engine': 'compute',
-      'cloud-functions': 'cloudFunction',
-      'kubernetes-engine': 'containers',
-      'cloud-run': 'cloudRun',
-      'cloud-build': 'compute',
-      
-      // Database services
-      'cloud-sql': 'database',
-      'cloud-spanner': 'database',
-      'cloud-bigtable': 'database',
-      'cloud-firestore': 'database',
-      'cloud-memorystore': 'database',
-      
-      // Storage services
-      'cloud-storage': 'storage',
-      'persistent-disk': 'storage',
-      'filestore': 'storage',
-      
-      // Networking services
-      'cloud-load-balancing': 'networking',
-      'cloud-cdn': 'networking',
-      'cloud-dns': 'networking',
-      'cloud-interconnect': 'networking',
-      'cloud-vpn': 'networking',
-      'cloud-nat': 'networking',
-      'cloud-router': 'networking',
-      'cloud-firewall-rules': 'networking',
-      'virtual-private-cloud': 'networking',
-      
-      // Security services
-      'cloud-iam': 'security',
-      'cloud-kms': 'security',
-      'cloud-security-command-center': 'security',
-      'cloud-armor': 'security',
-      'binary-authorization': 'security',
-      'cloud-asset-inventory': 'security',
-      iam: 'security',
-      'data-loss-prevention-api': 'security',
-      beyondcorp: 'security',
-    },
-  };
-
-  return serviceTypeMap[cloudProvider]?.[service as keyof typeof serviceTypeMap[typeof cloudProvider]] || service;
-};
-
-/**
- * Provides smart placement suggestions based on best practices
- */
-export const getPlacementSuggestions = (
-  service: string,
-  cloudProvider: 'aws' | 'azure' | 'gcp',
-  nodes: Node[]
-): string[] => {
-  const suggestions: string[] = [];
-  
-  // Check if recommended containers exist
-  const serviceType = getServiceType(service, cloudProvider);
-  const recommendedContainers = getRecommendedContainers(service, cloudProvider);
-  
-  for (const container of recommendedContainers) {
-    const exists = nodes.some(node => 
-      node.type === 'subnetNode' && 
-      node.data?.service === container &&
-      node.data?.cloudProvider === cloudProvider
-    );
-    
-    if (!exists) {
-      suggestions.push(`Consider creating a ${container} container first for better organization`);
-    }
-  }
-  
-  // Add cloud-specific best practice suggestions
-  if (cloudProvider === 'aws') {
-    if (serviceType === 'compute' && !nodes.some(n => n.data?.service === 'subnet')) {
-      suggestions.push('AWS compute resources should be placed in subnets for proper network isolation');
-    }
-    if (serviceType === 'database' && !nodes.some(n => n.data?.service === 'subnet')) {
-      suggestions.push('AWS database resources should be placed in private subnets for security');
-    }
-  } else if (cloudProvider === 'azure') {
-    if (serviceType === 'virtualMachine' && !nodes.some(n => n.data?.service === 'subnet')) {
-      suggestions.push('Azure VMs should be placed in subnets within a Virtual Network');
-    }
-    if (!nodes.some(n => n.data?.service === 'resource-group')) {
-      suggestions.push('Azure resources should be organized in Resource Groups');
-    }
-  } else if (cloudProvider === 'gcp') {
-    if (!nodes.some(n => n.data?.service === 'project')) {
-      suggestions.push('GCP resources must be organized within a Project');
-    }
-    if (serviceType === 'compute' && !nodes.some(n => n.data?.service === 'subnet')) {
-      suggestions.push('GCP compute resources should be placed in subnets for network organization');
-    }
-  }
-  
-  return suggestions;
-};
-
-/**
- * Gets recommended containers for a service
- */
-const getRecommendedContainers = (service: string, cloudProvider: 'aws' | 'azure' | 'gcp'): string[] => {
-  const containerRecommendations = {
-    aws: {
-      compute: ['account', 'vpc', 'subnet'],
-      database: ['account', 'vpc', 'subnet'],
-      storage: ['account'],
-      networking: ['account', 'vpc'],
-      security: ['account'],
-      containers: ['account', 'vpc', 'subnet'],
-      serverless: ['account'],
-    },
-    azure: {
-      virtualMachine: ['subscription', 'resource-group', 'virtual-network', 'subnet'],
-      database: ['subscription', 'resource-group'],
-      storageAccount: ['subscription', 'resource-group'],
-      appService: ['subscription', 'resource-group'],
-      networking: ['subscription', 'resource-group'],
-      security: ['subscription', 'resource-group'],
-    },
-    gcp: {
-      compute: ['project', 'vpc', 'subnet'],
-      database: ['project'],
-      storage: ['project'],
-      networking: ['project', 'vpc'],
-      security: ['project'],
-      containers: ['project'],
-    },
-  };
-
-  const serviceType = getServiceType(service, cloudProvider);
-  return containerRecommendations[cloudProvider]?.[serviceType as keyof typeof containerRecommendations[typeof cloudProvider]] || [];
-};
-
-/**
- * Validates placement and provides warnings for sub-optimal configurations
- */
-export const validatePlacementWithWarnings = (
-  node: Node,
-  parentNode: Node | null,
-  nodes: Node[],
-  cloudProvider: 'aws' | 'azure' | 'gcp'
-): { isValid: boolean; warnings: ValidationWarning[] } => {
-  const warnings: ValidationWarning[] = [];
-  
-  // Check for sub-optimal placements
-  const serviceType = getServiceType(node.data?.service, cloudProvider);
-  
-  if (cloudProvider === 'aws') {
-    // Check for compute resources not in subnets
-    if (serviceType === 'compute' && (!parentNode || parentNode.data?.service !== 'subnet')) {
-      warnings.push({
-        message: 'Compute resources should be placed in subnets for proper network isolation',
-        severity: 'warning',
-        suggestions: ['Create a subnet and place the compute resource within it']
-      });
-    }
-    
-    // Check for database resources not in private subnets
-    if (serviceType === 'database' && (!parentNode || parentNode.data?.service !== 'subnet')) {
-      warnings.push({
-        message: 'Database resources should be placed in private subnets for security',
-        severity: 'warning',
-        suggestions: ['Create a private subnet and place the database within it']
-      });
-    }
-  } else if (cloudProvider === 'azure') {
-    // Check for VMs not in subnets
-    if (serviceType === 'virtualMachine' && (!parentNode || parentNode.data?.service !== 'subnet')) {
-      warnings.push({
-        message: 'Virtual machines should be placed in subnets for network organization',
-        severity: 'warning',
-        suggestions: ['Create a subnet within a virtual network and place the VM there']
-      });
-    }
-  } else if (cloudProvider === 'gcp') {
-    // Check for compute resources not in subnets
-    if (serviceType === 'compute' && (!parentNode || parentNode.data?.service !== 'subnet')) {
-      warnings.push({
-        message: 'Compute resources should be placed in subnets for network organization',
-        severity: 'warning',
-        suggestions: ['Create a subnet within a VPC and place the compute resource there']
-      });
-    }
-  }
-  
-  return { isValid: true, warnings };
-};
-
-/**
- * Automatically assigns parent during drag and drop based on drop position
- * @param draggedNode - The node being dragged
- * @param dropPosition - Position where the node is dropped
- * @param nodes - All existing nodes
- * @returns Updated node with automatic parent assignment
- */
-export const autoAssignParentOnDrop = (
-  draggedNode: Node,
-  dropPosition: { x: number; y: number },
-  nodes: Node[]
-): Node => {
-  const cloudProvider = draggedNode.data?.cloudProvider;
-  const service = draggedNode.data?.service;
-
-  if (!cloudProvider || !service) {
-    return draggedNode;
-  }
-
-  // Find the best parent based on drop position
-  const bestParent = findAutoParent(dropPosition, service, cloudProvider, nodes);
-
-  // Update the node with the new parent
-  const updatedNode: Node = {
-    ...draggedNode,
-    position: dropPosition,
-    parentNode: bestParent?.id,
-    extent: bestParent ? 'parent' : undefined,
-  };
-
-  return updatedNode;
+import { Node } from 'reactflow';
+import { validateResourcePlacement, getValidationSummary } from './genericValidation';
+import { CloudProvider } from '../types/validation';
+
+interface ValidationResult {
+  isValid: boolean;
+  message?: string;
+  suggestions?: string[];
+}
+
+interface ValidationWarning {
+  message: string;
+  severity: 'warning' | 'info' | 'error';
+  suggestions?: string[];
+}
+
+export const validateCloudProviderPlacement = (
+  tempNode: Node,
+  parentNode: Node | null,
+  nodes: Node[],
+  cloudProvider?: CloudProvider
+): ValidationResult => {
+  // Check for cross-provider contamination
+  const crossProviderValidation = validateCrossProviderPlacement(tempNode, nodes, cloudProvider);
+  if (!crossProviderValidation.isValid) {
+    return crossProviderValidation;
+  }
+
+  // Direct validation for AWS (working implementation)
+  if (cloudProvider === 'aws') {
+    const childService = tempNode.data?.service;
+    const parentService = parentNode?.data?.service;
+    
+    // Root level validation
+    if (!parentNode) {
+      if (childService === 'account') {
+        return { isValid: true, message: 'AWS Account can be placed at root level' };
+      } else {
+        return { 
+          isValid: false, 
+          message: `${childService} cannot be at root level. Only AWS Account can be at root.`,
+          suggestions: ['Create an AWS Account first', 'Place this inside an AWS Account']
+        };
+      }
+    }
+    
+    // AWS Account containment rules
+    if (parentService === 'account') {
+      const allowedInAccount = ['vpc', 'availability-zone', 'local-zone'];
+      if (allowedInAccount.includes(childService)) {
+        return { isValid: true, message: `AWS Account can contain ${childService}` };
+      } else {
+        return {
+          isValid: false,
+          message: `${childService} cannot be placed directly in AWS Account. Use VPC → Subnet hierarchy.`,
+          suggestions: ['Create VPC first', 'Place services in Subnet within VPC']
+        };
+      }
+    }
+    
+    // VPC containment rules
+    if (parentService === 'vpc') {
+      const allowedInVpc = ['subnet', 'availability-zone', 'security-group'];
+      if (allowedInVpc.includes(childService)) {
+        return { isValid: true, message: `VPC can contain ${childService}` };
+      } else {
+        return {
+          isValid: false,
+          message: `${childService} cannot be placed directly in VPC. Place in Subnet within VPC.`,
+          suggestions: ['Create Subnet first', 'Place services in Subnet']
+        };
+      }
+    }
+    
+    // Subnet containment rules
+    if (parentService === 'subnet') {
+      const forbiddenInSubnet = ['account', 'vpc', 'subnet'];
+      if (forbiddenInSubnet.includes(childService)) {
+        return {
+          isValid: false,
+          message: `${childService} cannot be placed inside Subnet. Check AWS hierarchy.`,
+          suggestions: ['Place containers at appropriate level']
+        };
+      }
+      return { isValid: true, message: `Subnet can contain ${childService} service` };
+    }
+    
+    // Other AWS containers
+    if (parentService === 'availability-zone') {
+      return { isValid: true, message: `Availability Zone can contain ${childService}` };
+    }
+    
+    if (parentService === 'security-group') {
+      return { isValid: true, message: `Security Group can contain ${childService}` };
+    }
+    
+    // Default fallback - allow but warn
+    console.warn(`AWS validation: Unknown parent-child relationship: ${parentService} → ${childService}`);
+    return { 
+      isValid: true, 
+      message: `${parentService || 'container'} can contain ${childService}` 
+    };
+  }
+
+  // Use generic validation system for other providers
+  if (cloudProvider) {
+    const restrictionResults = validateResourcePlacement(tempNode, parentNode, nodes, cloudProvider);
+    const summary = getValidationSummary(restrictionResults);
+    
+    return {
+      isValid: summary.isValid,
+      message: summary.message,
+      suggestions: summary.suggestions
+    };
+  }
+
+  return { isValid: true };
+};
+
+/**
+ * Validates cross-provider placement to prevent mixing incompatible services
+ */
+const validateCrossProviderPlacement = (
+  tempNode: Node,
+  nodes: Node[],
+  cloudProvider?: CloudProvider
+): ValidationResult => {
+  if (!cloudProvider) return { isValid: true };
+
+  const existingProviders = new Set(
+    nodes
+      .filter(node => node.data?.cloudProvider)
+      .map(node => node.data.cloudProvider)
+  );
+
+  if (existingProviders.size > 0 && !existingProviders.has(cloudProvider)) {
+    const existingProvidersList = Array.from(existingProviders).join(', ');
+    return {
+      isValid: false,
+      message: `Cannot mix cloud providers. This diagram already contains ${existingProvidersList} services. Please use a separate diagram for ${cloudProvider} services.`,
+      suggestions: [
+        'Create a separate diagram for each cloud provider',
+        'Use hybrid/multi-cloud architecture patterns if needed',
+        'Consider using a multi-cloud management service'
+      ]
+    };
+  }
+
+  return { isValid: true };
+};
+
+/**
+ * Automatically finds the best parent node based on position and schema rules
+ * @param nodePosition - Position where the node will be placed
+ * @param service - Service type of the node
+ * @param cloudProvider - Cloud provider (aws, azure, gcp)
+ * @param nodes - All existing nodes
+ * @returns The best parent node or null if no valid parent found
+ */
+export const findAutoParent = (
+  nodePosition: { x: number; y: number },
+  service: string,
+  cloudProvider: 'aws' | 'azure' | 'gcp',
+  nodes: Node[]
+): Node | null => {
+  // Get all potential parent nodes (container nodes)
+  const potentialParents = nodes.filter(node => 
+    node.type === 'subnetNode' && 
+    node.data?.cloudProvider === cloudProvider
+  );
+
+  // First, find all containers that actually contain the drop position
+  const containingParents = potentialParents.filter(parent => 
+    isPositionWithinNode(nodePosition, parent, nodes)
+  );
+
+  // Debug logging for development
+  if (process.env.NODE_ENV === 'development') {
+    console.log(`Finding auto parent for ${service} at position:`, {
+      position: nodePosition,
+      potentialParents: potentialParents.map(p => ({ id: p.id, label: p.data?.label, service: p.data?.service })),
+      containingParents: containingParents.map(p => ({ id: p.id, label: p.data?.label, service: p.data?.service }))
+    });
+  }
+
+  // If we have containers that contain the position, prioritize those
+  if (containingParents.length > 0) {
+    // Sort containing containers by specificity (smallest area first for most specific container)
+    const sortedContainingParents = containingParents.sort((a, b) => {
+      // First sort by z-index (highest first - more specific layers)
+    const aZIndex = a.style?.zIndex || 0;
+    const bZIndex = b.style?.zIndex || 0;
+    
+    if (aZIndex !== bZIndex) {
+      return (bZIndex as number) - (aZIndex as number);
+    }
+
+      // Then sort by area (smallest first - most specific container)
+    const aArea = (Number(a.style?.width) || 0) * (Number(a.style?.height) || 0);
+    const bArea = (Number(b.style?.width) || 0) * (Number(b.style?.height) || 0);
+    return aArea - bArea;
+  });
+
+    // Find the best containing parent based on validation rules
+    for (const potentialParent of sortedContainingParents) {
+      // Create a temporary node to test validation
+      const tempNode: Node = {
+        id: `temp-${Date.now()}`,
+        type: 'serviceNode',
+        position: nodePosition,
+        data: {
+          service,
+          cloudProvider,
+        },
+        parentNode: potentialParent.id,
+      };
+
+      // Validate if this placement is allowed
+      const validation = validateCloudProviderPlacement(
+        tempNode,
+        potentialParent,
+        nodes,
+        cloudProvider
+      );
+
+      if (validation.isValid) {
+        return potentialParent;
+      }
+    }
+  }
+
+  // If no containing containers found or none are valid, fall back to default behavior
+  // Sort all potential parents by z-index and area as fallback
+  const sortedParents = potentialParents.sort((a, b) => {
+    const aZIndex = a.style?.zIndex || 0;
+    const bZIndex = b.style?.zIndex || 0;
+    
+    if (aZIndex !== bZIndex) {
+      return (bZIndex as number) - (aZIndex as number);
+    }
+
+    // If same z-index, prefer smaller containers
+    const aArea = (Number(a.style?.width) || 0) * (Number(a.style?.height) || 0);
+    const bArea = (Number(b.style?.width) || 0) * (Number(b.style?.height) || 0);
+    return aArea - bArea;
+  });
+
+  // Try each potential parent with validation
+  for (const potentialParent of sortedParents) {
+    // Create a temporary node to test validation
+    const tempNode: Node = {
+      id: `temp-${Date.now()}`,
+      type: 'serviceNode',
+      position: nodePosition,
+      data: {
+        service,
+        cloudProvider,
+      },
+      parentNode: potentialParent.id,
+    };
+
+    // Validate if this placement is allowed
+    const validation = validateCloudProviderPlacement(
+      tempNode,
+      potentialParent,
+      nodes,
+      cloudProvider
+    );
+
+    if (validation.isValid) {
+      return potentialParent;
+    }
+  }
+
+  // If no valid parent found in containers, check if it can be placed at root
+  const tempNode: Node = {
+    id: `temp-${Date.now()}`,
+    type: 'serviceNode',
+    position: nodePosition,
+    data: {
+      service,
+      cloudProvider,
+    },
+  };
+
+  const rootValidation = validateCloudProviderPlacement(
+    tempNode,
+    null,
+    nodes,
+    cloudProvider
+  );
+
+  return rootValidation.isValid ? null : getDefaultParent(service, cloudProvider, nodes);
+};
+
+/**
+ * Checks if a position is within the bounds of a node
+ * Handles nested node positioning correctly by calculating absolute coordinates
+ */
+const isPositionWithinNode = (
+  position: { x: number; y: number },
+  node: Node,
+  allNodes?: Node[]
+): boolean => {
+  // Calculate absolute position of the node (considering parent positioning)
+  let nodeX = node.position.x;
+  let nodeY = node.position.y;
+  
+  // If the node has a parent, we need to calculate the absolute position
+  // by traversing up the parent chain
+  if (node.parentNode && allNodes) {
+    const parentNode = allNodes.find(n => n.id === node.parentNode);
+    if (parentNode) {
+      // Recursively calculate parent's absolute position
+      const parentAbsolutePos = getAbsolutePosition(parentNode, allNodes);
+      nodeX = parentAbsolutePos.x + node.position.x;
+      nodeY = parentAbsolutePos.y + node.position.y;
+    }
+  }
+  
+  const nodeWidth = (node.style?.width as number) || (node.data?.width as number) || 200;
+  const nodeHeight = (node.style?.height as number) || (node.data?.height as number) || 150;
+
+  // Add some padding to make it easier to drop items near edges
+  const padding = 10;
+  
+  const isWithin = (
+    position.x >= nodeX - padding &&
+    position.x <= nodeX + nodeWidth + padding &&
+    position.y >= nodeY - padding &&
+    position.y <= nodeY + nodeHeight + padding
+  );
+
+  // Debug logging for development
+  if (process.env.NODE_ENV === 'development') {
+    console.log(`Position check for ${node.data?.service || 'unknown'} (${node.data?.label || 'no label'}):`, {
+      dropPosition: position,
+      originalPosition: node.position,
+      calculatedPosition: { x: nodeX, y: nodeY },
+      nodeSize: { width: nodeWidth, height: nodeHeight },
+      bounds: {
+        left: nodeX - padding,
+        right: nodeX + nodeWidth + padding,
+        top: nodeY - padding,
+        bottom: nodeY + nodeHeight + padding
+      },
+      isWithin,
+      hasParent: !!node.parentNode,
+      parentNode: node.parentNode
+    });
+  }
+
+  return isWithin;
+};
+
+/**
+ * Recursively calculates the absolute position of a node by traversing up the parent chain
+ */
+const getAbsolutePosition = (node: Node, allNodes: Node[]): { x: number; y: number } => {
+  let absoluteX = node.position.x;
+  let absoluteY = node.position.y;
+  
+  if (node.parentNode) {
+    const parentNode = allNodes.find(n => n.id === node.parentNode);
+    if (parentNode) {
+      const parentAbsolutePos = getAbsolutePosition(parentNode, allNodes);
+      absoluteX = parentAbsolutePos.x + node.position.x;
+      absoluteY = parentAbsolutePos.y + node.position.y;
+    }
+  }
+  
+  return { x: absoluteX, y: absoluteY };
+};
+
+/**
+ * Gets the default parent based on service type and cloud provider
+ */
+const getDefaultParent = (
+  service: string,
+  cloudProvider: 'aws' | 'azure' | 'gcp',
+  nodes: Node[]
+): Node | null => {
+  // Define comprehensive default parent hierarchy for each cloud provider
+  const defaultParents = {
+    aws: {
+      // Compute services
+      compute: ['subnet', 'availability-zone', 'vpc', 'account'],
+      ec2: ['subnet', 'availability-zone', 'vpc', 'account'],
+      lambda: ['account'],
+      'elastic-beanstalk': ['account'],
+      fargate: ['subnet', 'vpc', 'account'],
+      batch: ['subnet', 'vpc', 'account'],
+      'app-runner': ['account'],
+      'serverless-application-repository': ['account'],
+      
+      // Database services
+      database: ['subnet', 'vpc', 'account'],
+      rds: ['subnet', 'vpc', 'account'],
+      aurora: ['subnet', 'vpc', 'account'],
+      dynamodb: ['account'],
+      elasticache: ['subnet', 'vpc', 'account'],
+      neptune: ['subnet', 'vpc', 'account'],
+      documentdb: ['subnet', 'vpc', 'account'],
+      keyspaces: ['account'],
+      timestream: ['account'],
+      
+      // Storage services
+      storage: ['account'],
+      s3: ['account'],
+      ebs: ['account'],
+      efs: ['account'],
+      fsx: ['account'],
+      backup: ['account'],
+      'storage-gateway': ['account'],
+      
+      // Networking services
+      networking: ['vpc', 'account'],
+      'elastic-load-balancing': ['subnet', 'vpc', 'account'],
+      'route-53': ['account'],
+      'direct-connect': ['account'],
+      'transit-gateway': ['account'],
+      'global-accelerator': ['account'],
+      'site-to-site-vpn': ['vpc', 'account'],
+      'client-vpn': ['vpc', 'account'],
+      
+      // Security services
+      security: ['account'],
+      iam: ['account'],
+      cognito: ['account'],
+      kms: ['account'],
+      'secrets-manager': ['account'],
+      'certificate-manager': ['account'],
+      waf: ['account'],
+      shield: ['account'],
+      guardduty: ['account'],
+      'security-hub': ['account'],
+      'network-firewall': ['subnet', 'vpc', 'account'],
+      
+      // Container services
+      containers: ['subnet', 'vpc', 'account'],
+      ecs: ['subnet', 'vpc', 'account'],
+      'elastic-container-service': ['subnet', 'vpc', 'account'],
+      eks: ['subnet', 'vpc', 'account'],
+      'elastic-kubernetes-service': ['subnet', 'vpc', 'account'],
+      'elastic-container-registry': ['account'],
+      
+      // Serverless services
+      serverless: ['account'],
+    },
+    azure: {
+      // Compute services
+      virtualMachine: ['subnet', 'virtual-network', 'resource-group', 'subscription'],
+      'virtual-machines': ['subnet', 'virtual-network', 'resource-group', 'subscription'],
+      'app-services': ['resource-group', 'subscription'],
+      'app-service': ['resource-group', 'subscription'],
+      'function-apps': ['resource-group', 'subscription'],
+      'batch-accounts': ['resource-group', 'subscription'],
+      'kubernetes-services': ['resource-group', 'subscription'],
+      'container-instances': ['resource-group', 'subscription'],
+      'virtual-machine-scale-sets': ['resource-group', 'subscription'],
+      
+      // Database services
+      database: ['resource-group', 'subscription'],
+      'sql-database': ['resource-group', 'subscription'],
+      'cosmos-db': ['resource-group', 'subscription'],
+      'mysql-server': ['resource-group', 'subscription'],
+      'postgresql-server': ['resource-group', 'subscription'],
+      'redis-cache': ['resource-group', 'subscription'],
+      
+      // Storage services
+      storageAccount: ['resource-group', 'subscription'],
+      'storage-accounts': ['resource-group', 'subscription'],
+      'managed-disks': ['resource-group', 'subscription'],
+      'blob-storage': ['resource-group', 'subscription'],
+      'file-storage': ['resource-group', 'subscription'],
+      
+      // Networking services
+      networkInterface: ['subnet', 'virtual-network', 'resource-group', 'subscription'],
+      'network-interfaces': ['subnet', 'virtual-network', 'resource-group', 'subscription'],
+      loadBalancer: ['resource-group', 'subscription'],
+      'load-balancers': ['resource-group', 'subscription'],
+      'application-gateway': ['subnet', 'virtual-network', 'resource-group', 'subscription'],
+      'vpn-gateway': ['virtual-network', 'resource-group', 'subscription'],
+      'express-route': ['resource-group', 'subscription'],
+      'cdn-profiles': ['resource-group', 'subscription'],
+      
+      // Security services
+      'key-vaults': ['resource-group', 'subscription'],
+      'security-center': ['subscription'],
+      'azure-firewall': ['subnet', 'virtual-network', 'resource-group', 'subscription'],
+      'network-security-groups': ['resource-group', 'subscription'],
+      'azure-active-directory': ['subscription'],
+    },
+    gcp: {
+      // Compute services
+      compute: ['subnet', 'vpc', 'project'],
+      'compute-engine': ['subnet', 'vpc', 'project'],
+      'app-engine': ['project'],
+      'cloud-functions': ['project'],
+      'kubernetes-engine': ['project'],
+      'cloud-run': ['project'],
+      'cloud-build': ['project'],
+      
+      // Database services
+      database: ['project'],
+      'cloud-sql': ['project'],
+      'cloud-spanner': ['project'],
+      'cloud-bigtable': ['project'],
+      'cloud-firestore': ['project'],
+      'cloud-memorystore': ['project'],
+      
+      // Storage services
+      storage: ['project'],
+      'cloud-storage': ['project'],
+      'persistent-disk': ['project'],
+      'filestore': ['project'],
+      
+      // Networking services
+      networking: ['vpc', 'project'],
+      'cloud-load-balancing': ['project'],
+      'cloud-cdn': ['project'],
+      'cloud-dns': ['project'],
+      'cloud-interconnect': ['project'],
+      'cloud-vpn': ['vpc', 'project'],
+      'cloud-nat': ['vpc', 'project'],
+      'cloud-router': ['vpc', 'project'],
+      
+      // Security services
+      'cloud-iam': ['project'],
+      'cloud-kms': ['project'],
+      'cloud-security-command-center': ['project'],
+      'cloud-armor': ['project'],
+      'binary-authorization': ['project'],
+      'cloud-asset-inventory': ['project'],
+      
+      // Serverless services
+      cloudFunction: ['project'],
+      cloudRun: ['project'],
+    },
+  };
+
+  // Get the service category/type
+  const serviceType = getServiceType(service, cloudProvider);
+  const parentHierarchy = defaultParents[cloudProvider]?.[serviceType as keyof typeof defaultParents[typeof cloudProvider]];
+
+  if (!parentHierarchy) {
+    // If no specific hierarchy found, use the service name directly
+    const directHierarchy = defaultParents[cloudProvider]?.[service as keyof typeof defaultParents[typeof cloudProvider]];
+    if (directHierarchy) {
+      return findParentFromHierarchy(directHierarchy, nodes, cloudProvider);
+    }
+    return null;
+  }
+
+  return findParentFromHierarchy(parentHierarchy, nodes, cloudProvider);
+};
+
+/**
+ * Finds the first available parent from a hierarchy
+ */
+const findParentFromHierarchy = (
+  hierarchy: string[],
+  nodes: Node[],
+  cloudProvider: 'aws' | 'azure' | 'gcp'
+): Node | null => {
+  for (const parentType of hierarchy) {
+    const parent = nodes.find(node => 
+      node.type === 'subnetNode' && 
+      node.data?.service === parentType &&
+      node.data?.cloudProvider === cloudProvider
+    );
+
+    if (parent) {
+      return parent;
+    }
+  }
+  return null;
+};
+
+/**
+ * Maps service to service type/category with comprehensive mapping
+ */
+const getServiceType = (service: string, cloudProvider: 'aws' | 'azure' | 'gcp'): string => {
+  const serviceTypeMap = {
+    aws: {
+      // Compute services
+      ec2: 'compute',
+      lambda: 'serverless',
+      'elastic-beanstalk': 'compute',
+      fargate: 'containers',
+      batch: 'compute',
+      'app-runner': 'compute',
+      'application-auto-scaling': 'compute',
+      'ec2-auto-scaling': 'compute',
+      'serverless-application-repository': 'serverless',
+      
+      // Database services
+      rds: 'database',
+      aurora: 'database',
+      dynamodb: 'database',
+      elasticache: 'database',
+      neptune: 'database',
+      documentdb: 'database',
+      keyspaces: 'database',
+      timestream: 'database',
+      'database-migration-service': 'database',
+      
+      // Storage services
+      s3: 'storage',
+      ebs: 'storage',
+      efs: 'storage',
+      fsx: 'storage',
+      backup: 'storage',
+      'storage-gateway': 'storage',
+      snowball: 'storage',
+      'snowball-edge': 'storage',
+      snowcone: 'storage',
+      snowmobile: 'storage',
+      
+      // Networking services
+      vpc: 'networking',
+      'elastic-load-balancing': 'networking',
+      'route-53': 'networking',
+      'direct-connect': 'networking',
+      'transit-gateway': 'networking',
+      'global-accelerator': 'networking',
+      'site-to-site-vpn': 'networking',
+      'client-vpn': 'networking',
+      'app-mesh': 'networking',
+      'cloud-map': 'networking',
+      'cloud-wan': 'networking',
+      privatelink: 'networking',
+      'vpc-lattice': 'networking',
+      
+      // Security services
+      'security-group': 'security',
+      iam: 'security',
+      cognito: 'security',
+      kms: 'security',
+      'secrets-manager': 'security',
+      'certificate-manager': 'security',
+      waf: 'security',
+      shield: 'security',
+      guardduty: 'security',
+      'security-hub': 'security',
+      'network-firewall': 'security',
+      inspector: 'security',
+      macie: 'security',
+      detective: 'security',
+      
+      // Container services
+      ecs: 'containers',
+      'elastic-container-service': 'containers',
+      eks: 'containers',
+      'elastic-kubernetes-service': 'containers',
+      'elastic-container-registry': 'containers',
+      'ecs-anywhere': 'containers',
+      'eks-anywhere': 'containers',
+      'eks-cloud': 'containers',
+      'eks-distro': 'containers',
+    },
+    azure: {
+      // Compute services
+      'virtual-machine': 'virtualMachine',
+      'virtual-machines': 'virtualMachine',
+      'app-services': 'appService',
+      'app-service': 'appService',
+      'function-apps': 'appService',
+      'batch-accounts': 'compute',
+      'kubernetes-services': 'containers',
+      'container-instances': 'containers',
+      'virtual-machine-scale-sets': 'virtualMachine',
+      
+      // Database services
+      'sql-database': 'database',
+      'cosmos-db': 'database',
+      'mysql-server': 'database',
+      'postgresql-server': 'database',
+      'redis-cache': 'database',
+      'mariadb-server': 'database',
+      'managed-database': 'database',
+      
+      // Storage services
+      'storage-account': 'storageAccount',
+      'storage-accounts': 'storageAccount',
+      'managed-disks': 'storageAccount',
+      'blob-storage': 'storageAccount',
+      'file-storage': 'storageAccount',
+      
+      // Networking services
+      'network-interface': 'networkInterface',
+      'network-interfaces': 'networkInterface',
+      'load-balancer': 'loadBalancer',
+      'load-balancers': 'loadBalancer',
+      'application-gateway': 'loadBalancer',
+      'vpn-gateway': 'networking',
+      'express-route': 'networking',
+      'cdn-profiles': 'networking',
+      
+      // Security services
+      'key-vaults': 'security',
+      'security-center': 'security',
+      'azure-firewall': 'security',
+      'network-security-groups': 'security',
+      'azure-active-directory': 'security',
+    },
+    gcp: {
+      // Compute services
+      'compute-engine': 'compute',
+      'app-engine': 'compute',
+      'cloud-functions': 'cloudFunction',
+      'kubernetes-engine': 'containers',
+      'cloud-run': 'cloudRun',
+      'cloud-build': 'compute',
+      
+      // Database services
+      'cloud-sql': 'database',
+      'cloud-spanner': 'database',
+      'cloud-bigtable': 'database',
+      'cloud-firestore': 'database',
+      'cloud-memorystore': 'database',
+      
+      // Storage services
+      'cloud-storage': 'storage',
+      'persistent-disk': 'storage',
+      'filestore': 'storage',
+      
+      // Networking services
+      'cloud-load-balancing': 'networking',
+      'cloud-cdn': 'networking',
+      'cloud-dns': 'networking',
+      'cloud-interconnect': 'networking',
+      'cloud-vpn': 'networking',
+      'cloud-nat': 'networking',
+      'cloud-router': 'networking',
+      'cloud-firewall-rules': 'networking',
+      'virtual-private-cloud': 'networking',
+      
+      // Security services
+      'cloud-iam': 'security',
+      'cloud-kms': 'security',
+      'cloud-security-command-center': 'security',
+      'cloud-armor': 'security',
+      'binary-authorization': 'security',
+      'cloud-asset-inventory': 'security',
+      iam: 'security',
+      'data-loss-prevention-api': 'security',
+      beyondcorp: 'security',
+    },
+  };
+
+  return serviceTypeMap[cloudProvider]?.[service as keyof typeof serviceTypeMap[typeof cloudProvider]] || service;
+};
+
+/**
+ * Provides smart placement suggestions based on best practices
+ */
+export const getPlacementSuggestions = (
+  service: string,
+  cloudProvider: 'aws' | 'azure' | 'gcp',
+  nodes: Node[]
+): string[] => {
+  const suggestions: string[] = [];
+  
+  // Check if recommended containers exist
+  const serviceType = getServiceType(service, cloudProvider);
+  const recommendedContainers = getRecommendedContainers(service, cloudProvider);
+  
+  for (const container of recommendedContainers) {
+    const exists = nodes.some(node => 
+      node.type === 'subnetNode' && 
+      node.data?.service === container &&
+      node.data?.cloudProvider === cloudProvider
+    );
+    
+    if (!exists) {
+      suggestions.push(`Consider creating a ${container} container first for better organization`);
+    }
+  }
+  
+  // Add cloud-specific best practice suggestions
+  if (cloudProvider === 'aws') {
+    if (serviceType === 'compute' && !nodes.some(n => n.data?.service === 'subnet')) {
+      suggestions.push('AWS compute resources should be placed in subnets for proper network isolation');
+    }
+    if (serviceType === 'database' && !nodes.some(n => n.data?.service === 'subnet')) {
+      suggestions.push('AWS database resources should be placed in private subnets for security');
+    }
+  } else if (cloudProvider === 'azure') {
+    if (serviceType === 'virtualMachine' && !nodes.some(n => n.data?.service === 'subnet')) {
+      suggestions.push('Azure VMs should be placed in subnets within a Virtual Network');
+    }
+    if (!nodes.some(n => n.data?.service === 'resource-group')) {
+      suggestions.push('Azure resources should be organized in Resource Groups');
+    }
+  } else if (cloudProvider === 'gcp') {
+    if (!nodes.some(n => n.data?.service === 'project')) {
+      suggestions.push('GCP resources must be organized within a Project');
+    }
+    if (serviceType === 'compute' && !nodes.some(n => n.data?.service === 'subnet')) {
+      suggestions.push('GCP compute resources should be placed in subnets for network organization');
+    }
+  }
+  
+  return suggestions;
+};
+
+/**
+ * Gets recommended containers for a service
+ */
+const getRecommendedContainers = (service: string, cloudProvider: 'aws' | 'azure' | 'gcp'): string[] => {
+  const containerRecommendations = {
+    aws: {
+      compute: ['account', 'vpc', 'subnet'],
+      database: ['account', 'vpc', 'subnet'],
+      storage: ['account'],
+      networking: ['account', 'vpc'],
+      security: ['account'],
+      containers: ['account', 'vpc', 'subnet'],
+      serverless: ['account'],
+    },
+    azure: {
+      virtualMachine: ['subscription', 'resource-group', 'virtual-network', 'subnet'],
+      database: ['subscription', 'resource-group'],
+      storageAccount: ['subscription', 'resource-group'],
+      appService: ['subscription', 'resource-group'],
+      networking: ['subscription', 'resource-group'],
+      security: ['subscription', 'resource-group'],
+    },
+    gcp: {
+      compute: ['project', 'vpc', 'subnet'],
+      database: ['project'],
+      storage: ['project'],
+      networking: ['project', 'vpc'],
+      security: ['project'],
+      containers: ['project'],
+    },
+  };
+
+  const serviceType = getServiceType(service, cloudProvider);
+  return containerRecommendations[cloudProvider]?.[serviceType as keyof typeof containerRecommendations[typeof cloudProvider]] || [];
+};
+
+/**
+ * Validates placement and provides warnings for sub-optimal configurations
+ */
+export const validatePlacementWithWarnings = (
+  node: Node,
+  parentNode: Node | null,
+  nodes: Node[],
+  cloudProvider: 'aws' | 'azure' | 'gcp'
+): { isValid: boolean; warnings: ValidationWarning[] } => {
+  const warnings: ValidationWarning[] = [];
+  
+  // Check for sub-optimal placements
+  const serviceType = getServiceType(node.data?.service, cloudProvider);
+  
+  if (cloudProvider === 'aws') {
+    // Check for compute resources not in subnets
+    if (serviceType === 'compute' && (!parentNode || parentNode.data?.service !== 'subnet')) {
+      warnings.push({
+        message: 'Compute resources should be placed in subnets for proper network isolation',
+        severity: 'warning',
+        suggestions: ['Create a subnet and place the compute resource within it']
+      });
+    }
+    
+    // Check for database resources not in private subnets
+    if (serviceType === 'database' && (!parentNode || parentNode.data?.service !== 'subnet')) {
+      warnings.push({
+        message: 'Database resources should be placed in private subnets for security',
+        severity: 'warning',
+        suggestions: ['Create a private subnet and place the database within it']
+      });
+    }
+  } else if (cloudProvider === 'azure') {
+    // Check for VMs not in subnets
+    if (serviceType === 'virtualMachine' && (!parentNode || parentNode.data?.service !== 'subnet')) {
+      warnings.push({
+        message: 'Virtual machines should be placed in subnets for network organization',
+        severity: 'warning',
+        suggestions: ['Create a subnet within a virtual network and place the VM there']
+      });
+    }
+  } else if (cloudProvider === 'gcp') {
+    // Check for compute resources not in subnets
+    if (serviceType === 'compute' && (!parentNode || parentNode.data?.service !== 'subnet')) {
+      warnings.push({
+        message: 'Compute resources should be placed in subnets for network organization',
+        severity: 'warning',
+        suggestions: ['Create a subnet within a VPC and place the compute resource there']
+      });
+    }
+  }
+  
+  return { isValid: true, warnings };
+};
+
+/**
+ * Automatically assigns parent during drag and drop based on drop position
+ * @param draggedNode - The node being dragged
+ * @param dropPosition - Position where the node is dropped
+ * @param nodes - All existing nodes
+ * @returns Updated node with automatic parent assignment
+ */
+export const autoAssignParentOnDrop = (
+  draggedNode: Node,
+  dropPosition: { x: number; y: number },
+  nodes: Node[]
+): Node => {
+  const cloudProvider = draggedNode.data?.cloudProvider;
+  const service = draggedNode.data?.service;
+
+  if (!cloudProvider || !service) {
+    return draggedNode;
+  }
+
+  // Find the best parent based on drop position
+  const bestParent = findAutoParent(dropPosition, service, cloudProvider, nodes);
+
+  // Update the node with the new parent
+  const updatedNode: Node = {
+    ...draggedNode,
+    position: dropPosition,
+    parentNode: bestParent?.id,
+    extent: bestParent ? 'parent' : undefined,
+  };
+
+  return updatedNode;
 };