cloudg 0.5.0__tar.gz → 0.5.2__tar.gz

{cloudg-0.5.0 → cloudg-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cloudg
-Version: 0.5.0
+Version: 0.5.2
 Summary: cloudg (cloud graphing) - multi-cloud infrastructure mapping, knowledge graphs and security intelligence for AWS, Azure and GCP
 Project-URL: Homepage, https://github.com/morpheuslord/cloudg
 Project-URL: Repository, https://github.com/morpheuslord/cloudg
@@ -38,6 +38,7 @@ Requires-Dist: azure-mgmt-compute>=30.0; extra == 'all'
 Requires-Dist: azure-mgmt-keyvault>=10.0; extra == 'all'
 Requires-Dist: azure-mgmt-network>=25.0; extra == 'all'
 Requires-Dist: azure-mgmt-resource>=23.0; extra == 'all'
+Requires-Dist: azure-mgmt-resourcegraph>=8.0.0; extra == 'all'
 Requires-Dist: azure-mgmt-sql>=3.0; extra == 'all'
 Requires-Dist: azure-mgmt-storage>=21.0; extra == 'all'
 Requires-Dist: boto3>=1.28; extra == 'all'
@@ -52,6 +53,7 @@ Requires-Dist: azure-mgmt-compute>=30.0; extra == 'azure'
 Requires-Dist: azure-mgmt-keyvault>=10.0; extra == 'azure'
 Requires-Dist: azure-mgmt-network>=25.0; extra == 'azure'
 Requires-Dist: azure-mgmt-resource>=23.0; extra == 'azure'
+Requires-Dist: azure-mgmt-resourcegraph>=8.0.0; extra == 'azure'
 Requires-Dist: azure-mgmt-sql>=3.0; extra == 'azure'
 Requires-Dist: azure-mgmt-storage>=21.0; extra == 'azure'
 Provides-Extra: dev
@@ -80,6 +82,12 @@ cloudg (cloud graphing) maps AWS, Azure and GCP infrastructure into a graph, run
 
 This is the complete reference: every CLI command, the exact input and output formats, the data models, the full Python API with integration examples, configuration, plugins and authentication. Release history lives in the [changelog](https://github.com/morpheuslord/cloudg/blob/main/CHANGELOG.md).
 
+The inventory mapper (`cloudg map`, `cloudg deps`, `cloudg.inventory`) has three deeper companion documents:
+
+- [Inventory reference](INVENTORY_REFERENCE.md): the structure of every return value and exported file, field by field, with annotated examples (`CloudAsset`, `NetworkEdge`, relation objects, `InventoryResult`, `summary`, coverage records, dependency trees, blast radius, security coverage, `inventory-map.json`, `inventory-graph.json`, GraphML, `inventory-organization.json`, `asset-map.json`, `compliance-map.json`, `cloudg deps --json`).
+- [Inventory catalog](INVENTORY_CATALOG.md): all 156 asset types with the native resource types mapped to each, the metadata keys and relations each one carries, and the full relationship matrix.
+- [Inventory internals](INVENTORY_INTERNALS.md): how a mapping run works, every module, the 133 AWS collector tasks, the linker's resolution rules, the Azure and GCP extractor frameworks, dependency semantics, catalogs, and recipes for adding collectors, extractors and asset types.
+
 Contents:
 
 - [Installation](#installation)
@@ -177,12 +185,15 @@ cloudg collect -p gcp --project-id <id>
 
 ### cloudg map
 
-Scanner-independent inventory mapping: everything deployed or default, linked into one map. No scanner runs and none needs to be installed.
+Scanner-independent inventory mapping: everything deployed or default, linked into one map of typed interdependencies. No scanner runs and none needs to be installed.
 
 ```bash
 cloudg map -p aws --regions all
 cloudg map -p all --regions all
-cloudg map -p aws --findings ./reports/raw-findings.json   # merge scanner output
+cloudg map -p aws --org --regions all                       # every account in the Organization / Control Tower
+cloudg map -p aws --org --ou Workloads --exclude-account 111122223333
+cloudg map -p aws --services containers,serverless,security  # narrow the run
+cloudg map -p aws --findings ./reports/raw-findings.json     # merge scanner output
 ```
 
 | Flag | Meaning |
@@ -190,18 +201,93 @@ cloudg map -p aws --findings ./reports/raw-findings.json   # merge scanner outpu
 | `-p, --provider` | `aws`, `azure`, `gcp` or `all`; repeatable |
 | `--regions` | `all` for auto-discovery, or a comma-separated list |
 | `--profile` | AWS CLI profile |
+| `--accounts`, `--role-name` | AWS: explicit account list and the role to assume in each |
+| `--org / --no-org` | AWS: discover and map every account of the Organization (run from the management account or a delegated administrator) |
+| `--org-role` | AWS: role assumed in member accounts; defaults to `AWSControlTowerExecution` |
+| `--ou` | AWS: only accounts under this OU (ID, ARN or name, nested OUs included); repeatable |
+| `--exclude-account` | AWS: skip an account; repeatable |
+| `--ct-home-region` | AWS: Control Tower home region, auto-detected when omitted |
+| `--services`, `--exclude-services` | service families or collector names, comma-separated (see below) |
+| `--kubernetes / --no-kubernetes` | map workloads inside EKS clusters through the Kubernetes API |
+| `--cloud-control / --no-cloud-control` | AWS Cloud Control breadth sweep, on by default |
 | `--subscription-id`, `--project-id` | Azure / GCP identity |
 | `--findings` | existing cloudg findings JSON (`raw-findings.json` or a report); repeatable |
 | `--sweep / --no-sweep` | catch-all sweep, on by default |
 | `-o, --output` | output directory |
 
-Coverage comes in three layers:
+Coverage comes in four layers.
+
+1. Dedicated deep collectors. On AWS, 133 collectors grouped into service families you can select with `--services` / `--exclude-services` (family or collector names):
+
+   | Family | Collected |
+   |---|---|
+   | `network` | VPCs, subnets, security groups, route tables, internet / NAT / egress-only gateways, ENIs, Elastic IPs, NACLs, VPC peering, transit gateways, attachments, route tables and peering, VPC endpoints and endpoint services (PrivateLink, allowed principals, consumers), managed prefix lists, ALB/NLB listeners, rules, certificates and target groups, classic ELB, CloudFront (origins, aliases, certificates, Lambda@Edge, functions, OAC, logging), Global Accelerator, VPC Lattice |
+   | `hybrid` | site-to-site VPN, customer and virtual private gateways, Direct Connect connections, VIFs and gateways, Cloud WAN / Network Manager |
+   | `compute` | EC2, Auto Scaling groups, launch templates, AMIs (with sharing), Batch, App Runner, Elastic Beanstalk |
+   | `containers` | ECR (+ public), ECS clusters, services, task definitions, capacity providers, container instances, Cloud Map, EKS clusters, nodegroups, Fargate profiles, addons, access entries, pod identity |
+   | `kubernetes` | inside EKS clusters: namespaces, Deployments, StatefulSets, DaemonSets, CronJobs, Services, Ingresses, ServiceAccounts |
+   | `serverless` | Lambda (triggers, URLs, images, layers, DLQs, aliases), API Gateway REST / HTTP APIs, authorizers, VPC links and custom domains, Step Functions |
+   | `integration` | SQS, SNS, EventBridge buses, rules, archives, API destinations, Scheduler, Pipes, Kinesis, Firehose, MSK, Amazon MQ |
+   | `storage` | S3 (notifications, replication, logging, account and bucket Block Public Access), access points and multi-region access points, EBS volumes and snapshots, EFS, FSx, Transfer Family, DataSync |
+   | `data` | RDS, Aurora, proxies, global clusters, manual snapshot sharing, DynamoDB (KMS, streams, replicas, PITR, policies), ElastiCache, MemoryDB, DAX, OpenSearch (+ Serverless), Redshift (+ Serverless) |
+   | `analytics`, `ml` | Glue, Lake Formation permissions, EMR (+ Serverless), Athena; SageMaker, Bedrock agents, knowledge bases, guardrails and invocation logging |
+   | `identity` | the IAM graph (users, groups, roles, trust, grants, instance profiles, OIDC and SAML providers, access key metadata), IAM Identity Center (instances, permission sets, assignments, users, groups), Roles Anywhere, Cognito user and identity pools, KMS (aliases, rotation, key policy and grant principals), Secrets Manager, ACM |
+   | `governance` | RAM resource shares, Service Catalog portfolios and provisioned products (Account Factory), CloudFormation StackSets |
+   | `security` | GuardDuty, Security Hub, Inspector (per-resource coverage), Macie, AWS Config, IAM Access Analyzer, Detective, WAF, Network Firewall, Shield Advanced |
+   | `logging`, `operations`, `backup` | CloudTrail, flow logs, log groups, subscription filters and destinations, cross-account observability (OAM); CloudWatch alarms, SSM parameters (metadata only), managed instances, documents, associations, maintenance windows; AWS Backup plans, selections and vaults |
+   | `dns`, `iac`, `cicd` | Route 53 zones and records, Resolver endpoints, rules and DNS Firewall; CloudFormation stacks and the resources they manage; CodePipeline, CodeBuild, CodeDeploy, CodeConnections |
+
+   Account-wide services are collected once per account, in the primary region, so `--regions all` does not repeat them. Security services that are not enabled appear as placeholder nodes with `enabled: false`, so detection gaps show on the map. Values that could be secret (parameter values, environment variables, passwords, VPN pre-shared keys, Direct Connect auth keys) are never collected.
 
-1. Dedicated deep collectors. Everything the standard collectors know, plus the network fabric: route tables, internet and NAT gateways, network interfaces, EBS volumes and managed disks, Elastic and public IPs, NACLs, VPC peering connections, transit gateways, and customer-managed IAM policies (AWS); NICs, public IPs, disks, load balancers and route tables (Azure).
-2. Catch-all sweeps. The AWS Resource Groups Tagging API, Azure Resource Manager's full `resources.list()`, and GCP Cloud Asset Inventory each enumerate every resource in scope, so services without a dedicated collector still appear on the map (classified by ARN/ARM/asset type, or `OTHER`). A sweep hit that duplicates a dedicated collector's asset is dropped; the richer asset wins.
-3. The relationship linker. A post-collection pass that derives edges purely from asset metadata: instance → security group (`ATTACHED_TO`), subnet ⊃ resource (`CONTAINS`), route table → gateway (`ROUTE`), Lambda → execution role, secret → KMS key, CloudFront → origin (`REFERENCES`), VPC peering (`PEERING`), Azure VM → NIC → NSG/subnet/public IP chains, GCP parent containment and IAM policy bindings, and finally a generic pass that resolves any ARN, Azure resource ID or GCP resource name found in one asset's metadata to another collected asset.
+   Azure is collected through Azure Resource Graph (`azure-mgmt-resourcegraph`, in the `azure` extra) with every resource's full properties, so PaaS services get real relationships: managed identities and role assignments (principal → scope, with role names), private endpoints, AKS node pools, kubelet identity and ACR pulls, App Service plans, VNet integration and container images, Container Apps, subnets, peering, NICs, disks and disk encryption sets, firewalls and route-table next hops, Application Gateway and Front Door backends and WAF policies, Key Vault access policies, storage and SQL network rules, Defender for Cloud plans per subscription. Every Enabled subscription is collected when none are configured (`azure.all_subscriptions`), and the management group → subscription → resource group hierarchy, Azure Landing Zone archetypes and Azure Policy assignments and exemptions are mapped (`azure.map_management_groups`). Without the Resource Graph SDK, cloudg falls back to the per-service SDK collectors plus the ARM sweep. Permissions: Reader at the tenant root management group (Resource Graph scopes to what the credential can read).
 
-Outputs: `inventory-map.json` (assets, edges, and a summary covering services, types, regions, accounts, internet exposure and unlinked assets), `inventory-map.graphml`, `inventory-graph.json` (D3). With `--findings`, additionally `asset-map.json` (per-asset finding counts and severity breakdowns, riskiest first) and `compliance-map.json` (framework → findings and affected assets). The map does not depend on the scanners; findings from any earlier run merge in whenever they exist.
+   GCP is collected through Cloud Asset Inventory `list_assets` with the full resource JSON, once at `organizations/<organization_id>` when that is set (`gcp.collection_scope`), otherwise per project. Relations cover instances (service accounts, subnets, disks, external IPs), firewall semantics (target tags and service accounts, source ranges, priorities), the load-balancing chain down to NEGs and Cloud Armor, managed instance groups and templates, GKE clusters and node pools with Workload Identity, Cloud Run and Functions v2 (service accounts, images in Artifact Registry, secrets, VPC connectors, triggers), Pub/Sub (subscriptions, push endpoints, dead-letter and export targets), Eventarc, logging sinks, CMEK keys, Shared VPC, Cloud SQL / Redis / Filestore networks and DNS zones. IAM bindings resolve to service accounts or to principal nodes (users, groups, workload identity pools); only `allUsers` / `allAuthenticatedUsers` mark a resource internet-exposed. With an organization ID, the organization → folder → project tree, organization policies and VPC Service Controls perimeters are mapped too (`gcp.map_hierarchy`, `org_policies`, `vpc_service_controls`). Permissions: `roles/cloudasset.viewer` on the organization (or each project) and the Cloud Asset API enabled on the quota project.
+2. Breadth sweeps, so services without a dedicated collector still appear on the map.
+   - AWS Cloud Control API: every CloudFormation resource type with a list handler (800+ types) is listed, tagged or not. Types already mapped by a deep collector are skipped, account-wide types run once per account, types that need a parent identifier or fail are skipped and counted in coverage (`cloud_control_skipped_types`). The listable-type catalogue is discovered once and cached for a week (`$CLOUDG_CACHE_DIR`, default `~/.cache/cloudg`). Secret-bearing properties (passwords, tokens, SSM parameter values, environment variables, user data) are never copied. Turn it off with `--no-cloud-control`, or narrow it with `inventory.cloud_control_types` / `cloud_control_exclude` (type names or prefixes such as `AWS::Glue::`).
+   - AWS Resource Groups Tagging API: tagged resources only (AWS never returns resources that were never tagged), kept for tag enrichment.
+   - Azure Resource Manager's full `resources.list()` and GCP Cloud Asset Inventory enumerate their scopes.
+
+   Precedence when the same resource is found twice: dedicated collector, then Cloud Control, then the tagging API.
+3. The relationship linker. Collectors declare what each asset talks to; the linker resolves those identifiers across services, regions and accounts into typed edges, then applies provider rules and a generic reference pass. See [Relationships](#relationships) below.
+4. Account hierarchy. Every account gets a `CLOUD_ACCOUNT` node that contains its top-level resources. With `--org`, accounts hang under the OU tree, next to SCPs, the Control Tower landing zone and its enabled controls.
+
+Outputs: `inventory-map.json` (assets, edges, unresolved references, and a summary covering services, types, regions, accounts, relationship counts, cross-account edges, external accounts, security service gaps, internet exposure and unlinked assets), `inventory-map.graphml`, `inventory-graph.json` (D3, with account and relationship attributes), `inventory-dependencies.json` (most shared dependencies, largest blast radius, cross-account edges, security coverage including workloads no vulnerability scanner covers and internet-facing endpoints without a WAF), and with `--org` `inventory-organization.json`. With `--findings`, additionally `asset-map.json` (per-asset finding counts and severity breakdowns, riskiest first) and `compliance-map.json` (framework → findings and affected assets). The map does not depend on the scanners; findings from any earlier run merge in whenever they exist.
+
+#### Relationships
+
+Every edge has a coarse `edge_type` and, when known, a fine-grained `relationship` (an ontology relation name) plus `properties`. Direction always reads "source verb target".
+
+| Edge type | Example |
+|---|---|
+| `INVOKES` | S3 bucket → Lambda (notification), SQS → Lambda (`TRIGGERED_BY`, event source mapping), SNS → SQS (`STREAMS_TO`), EventBridge rule → target, API Gateway → Lambda, Step Functions → anything its definition calls |
+| `USES_IMAGE` | task definition / Kubernetes workload / Lambda → ECR repository |
+| `ASSUMES_ROLE` | Lambda, task definition, nodegroup, Kubernetes service account (IRSA or Pod Identity), instance profile → IAM role |
+| `IAM_TRUST` | principal / external account / OIDC provider → role it may assume (`CROSS_ACCOUNT_TRUST` across accounts) |
+| `GRANTS_ACCESS` | principal → resource its policy names; principal → EKS cluster (access entry, with access policies); bucket / queue / repository policy grants |
+| `IAM_POLICY_ATTACHMENT` | user, group or role → managed policy |
+| `PROTECTS` | WAF → ALB / API Gateway / CloudFront, Network Firewall → VPC, Shield → resource |
+| `MONITORS` | Inspector → each scanned EC2 / ECR / Lambda, GuardDuty / Config / CloudTrail / Macie → account, Security Hub → the services it ingests from, flow log → VPC/subnet/ENI |
+| `MANAGES` | CloudFormation stack → resource, ASG → instance, nodegroup → ASG, landing zone → OUs and shared accounts |
+| `GOVERNS` | SCP / RCP / tag policy and Control Tower control or baseline → OU or account |
+| `LOGS_TO` | trail, flow log, load balancer, API stage, task definition, function → log destination |
+| `LOAD_BALANCER_TARGET` | load balancer → target group → instance / IP / Lambda, Kubernetes Service → workload |
+| `ROUTE` | route table → gateway, DNS record → load balancer / distribution, transit gateway → attached VPC, Ingress → Service |
+| `CONTAINS`, `ATTACHED_TO`, `PEERING`, `REFERENCES` | containment, security-group attachment, VPC peering, everything else (KMS keys, secrets, DLQs, layers, ...) |
+
+Identifier resolution is scoped: an ambiguous name such as `default` resolves within the referencing asset's account and region, and is left unresolved rather than guessed when it could belong to several accounts. References into accounts that were not mapped become `CLOUD_ACCOUNT` nodes with `external: true`, so a role trusted by a vendor account or a bucket replicating to another account stays visible. References that resolve to nothing (a deleted queue still configured as a DLQ) are listed under `unresolved_references`.
+
+### cloudg deps
+
+Interdependency queries over a saved map; no cloud access needed.
+
+```bash
+cloudg deps arn:aws:iam::123456789012:role/app-role        # both directions
+cloudg deps jobs-queue --direction down --depth 5           # blast radius
+cloudg deps --map ./reports                                 # overview
+cloudg deps my-function --direction up --json               # machine-readable
+```
+
+Each edge is read as "dependent needs dependency": a function needs its role, image, key and the queue that triggers it; an ALB needs the WAF protecting it; a resource needs the stack managing it. `--direction up` shows what an asset needs, `down` what needs it (what breaks or changes with it), `both` the two trees. Without an asset, `deps` prints the most shared dependencies (one KMS key behind forty resources), the largest blast radius, and every cross-account edge. Assets are matched by ARN or resource ID, internal ID, or a unique name.
 
 ### cloudg scan
 
@@ -318,8 +404,12 @@ All commands write into the output directory (`./reports` by default).
 | `rag_chunks.jsonl`, `rag_metadata_index.json` | retrieval-ready chunks, one JSON object per line |
 | `terraform/*.tf.json`, `terraform/import.sh` | Terraform recreation of live infrastructure, 25+ asset types |
 | `inventory-map.json`, `inventory-map.graphml`, `inventory-graph.json` | scanner-independent inventory map: assets, interconnections, summary (`cloudg map`) |
+| `inventory-dependencies.json` | shared dependencies, blast radius, cross-account edges, security service coverage (`cloudg map`) |
+| `inventory-organization.json` | AWS Organization / Control Tower topology (`cloudg map --org`) |
 | `asset-map.json`, `compliance-map.json` | inventory overlaid with scanner findings (`cloudg map --findings`) |
 
+The inventory files are specified field by field in the [inventory reference](INVENTORY_REFERENCE.md).
+
 `findings.json` has this shape:
 
 ```json
@@ -381,17 +471,44 @@ The unit every scanner and parser produces.
 | `id` | `str` | auto UUID |
 | `arn` | `str \| None` | native identifier |
 | `name` | `str` | |
-| `asset_type` | `AssetType` | 45-value taxonomy: `EC2`, `S3_BUCKET`, `IAM_ROLE`, `VPC`, `KMS_KEY`, ... |
+| `asset_type` | `AssetType` | 156-value taxonomy covering compute, networking, storage, databases, IAM and identity federation, keys and secrets, logging, containers and Kubernetes, integration, data and ML platforms, DNS and deployment, security services and scanners, organization and governance, hybrid networking, `OTHER`; the full list with what maps to each is in the [inventory catalog](INVENTORY_CATALOG.md#asset-types-by-category) |
 | `provider` | `CloudProvider` | `AWS`, `AZURE`, `GCP` |
 | `region` | `str` | `"global"` for regionless resources |
 | `account_id` | `str \| None` | |
 | `tags` | `dict[str, str]` | |
-| `metadata` | `dict[str, Any]` | normalised extra attributes |
-| `is_internet_exposed` | `bool` | set by the graph analysis |
+| `metadata` | `dict[str, Any]` | normalised extra attributes; inventory assets also carry declared `relations` and identifier `aliases` |
+| `collected_at` | `datetime` | when the asset was built |
+| `is_internet_exposed` | `bool` | set by the collector or the graph analysis |
+| `raw_data` | `dict[str, Any]` | raw API payload, never serialised |
+| `display_id` | computed `str` | `arn` or `id` |
+
+`id` is regenerated on every run; correlate assets across runs by `arn`.
 
 ### NetworkEdge
 
-Directed edge between two asset IDs. `edge_type` is one of `SECURITY_GROUP_RULE`, `NACL_RULE`, `ROUTE`, `IAM_TRUST`, `IAM_POLICY_ATTACHMENT`, `CONTAINS`, `PEERING`, `LOAD_BALANCER_TARGET`, `INTERNET_EXPOSED`, `ATTACHED_TO`, `REFERENCES`; the model also carries `ports`, `port_range`, `protocol`, `cidr` and `direction`. `ATTACHED_TO` and `REFERENCES` are produced by the inventory relationship linker (attachment and generic cross-service dependency respectively).
+Directed edge between two asset IDs (`source_id`, `target_id`); direction always reads "source verb target".
+
+| Field | Type | Notes |
+|---|---|---|
+| `id` | `str` | auto UUID |
+| `source_id`, `target_id` | `str` | asset IDs; network rule edges can use a CIDR or native security group ID as an endpoint |
+| `edge_type` | `EdgeType` | coarse class, below |
+| `relationship` | `str \| None` | fine-grained ontology relation (`TRIGGERED_BY`, `RUNS_ON`, `CROSS_ACCOUNT_TRUST`, `ENCRYPTED_BY_KMS`, ...) |
+| `properties` | `dict[str, Any]` | relation detail: trust conditions, granted actions, EKS access policies, notification events, `cross_account`, `external_reference`, `hierarchy` |
+| `description` | `str \| None` | human-readable explanation |
+| `ports`, `port_range`, `protocol`, `cidr`, `direction` | | network rule edges |
+
+`edge_type` values:
+
+| Group | Values |
+|---|---|
+| Network | `SECURITY_GROUP_RULE`, `NACL_RULE`, `ROUTE`, `PEERING`, `LOAD_BALANCER_TARGET`, `INTERNET_EXPOSED` |
+| Structure | `CONTAINS`, `ATTACHED_TO`, `REFERENCES` |
+| Identity | `IAM_TRUST`, `IAM_POLICY_ATTACHMENT`, `ASSUMES_ROLE`, `GRANTS_ACCESS` |
+| Workload | `INVOKES`, `USES_IMAGE`, `LOGS_TO` |
+| Security and governance | `PROTECTS`, `MONITORS`, `MANAGES`, `GOVERNS` |
+
+What each one means, its typical endpoints and how it counts for dependency analysis is in the [inventory reference](INVENTORY_REFERENCE.md#6-edge-types-and-direction); every observed source type → relationship → target type combination is in the [relationship matrix](INVENTORY_CATALOG.md#relationship-matrix).
 
 ### ComplianceResult
 
@@ -418,6 +535,17 @@ aws:
   profile: null
   max_retries: 10
   retry_mode: adaptive
+  organization:                 # AWS Organizations / Control Tower (cloudg map)
+    enabled: false
+    role_name: null             # default AWSControlTowerExecution
+    include_ous: []             # IDs, ARNs or names; nested OUs included
+    exclude_accounts: []
+    include_management_account: true
+    include_suspended: false
+    use_governed_regions: true  # regions [all] -> Control Tower governed regions
+    control_tower: true
+    home_region: null           # auto-detected
+    map_structure: true         # org, OU, account, SCP, control nodes
 
 azure:
   subscription_ids: []
@@ -427,10 +555,19 @@ azure:
   certificate_path: null
   federated_token_file: null
   use_managed_identity: false
+  all_subscriptions: true       # every Enabled subscription when subscription_ids is empty
+  map_management_groups: true   # management groups, subscriptions, Azure Policy
   regions: [ALL]
 
 gcp:
   project_ids: []
+  organization_id: null         # set to collect org-wide and map folders / org policy
+  collection_scope: auto        # auto | organization | project
+  skip_asset_types: [...]       # high-churn types (Pods, ReplicaSets, Events, ...) by default
+  iam_policies: true
+  map_hierarchy: true
+  org_policies: true
+  vpc_service_controls: true
   credentials_file: null
   impersonate_service_account: null
   regions: [ALL]
@@ -446,6 +583,18 @@ scanners:
 inventory:
   tagging_sweep: true           # AWS catch-all sweep (Resource Groups Tagging API)
   link_references: true         # generic cross-service REFERENCES edges
+  services: [all]               # families or collector names (see cloudg map)
+  exclude_services: []
+  kubernetes: true              # workloads inside EKS clusters
+  kubernetes_timeout: 10
+  iam_resource_edges: true      # principal -> granted resource edges
+  max_images_per_repository: 20
+  stack_resources: true         # CloudFormation stack -> resource edges
+  account_hierarchy: true       # account nodes containing top-level resources
+  cloud_control: true           # AWS breadth sweep over every listable resource type
+  cloud_control_types: []       # only these CloudFormation types / prefixes
+  cloud_control_exclude: []
+  cloud_control_concurrency: 6
 
 graph:
   persist_graphml: true
@@ -550,7 +699,32 @@ print(inventory.summary)                     # services, types, regions, exposur
 inventory.export("./reports")                # inventory-map.json / .graphml / graph
 ```
 
-`InventoryResult` carries `assets`, `edges`, `coverage`, `providers`, `regions` and a computed `summary` (totals, per-service/type/region/account breakdowns, edge types, internet-exposed and unlinked counts). `export(dir)` writes `inventory-map.json`, `inventory-map.graphml` and `inventory-graph.json`.
+`InventoryResult` carries `assets`, `edges`, `coverage`, `providers`, `regions`, `organization` (the discovered topology, when mapped) and `unresolved_references`, plus a computed `summary` (totals, per-service/type/region/account breakdowns, edge types and relationships, cross-account edges, external accounts, security service gaps, internet-exposed and unlinked counts). `export(dir)` writes `inventory-map.json`, `inventory-map.graphml`, `inventory-graph.json`, `inventory-dependencies.json` and, for an organization, `inventory-organization.json`; `InventoryResult.load(dir_or_file)` reads a map back.
+
+Interdependency questions go through `DependencyGraph`:
+
+```python
+graph = inventory.dependency_graph()
+role = graph.find("arn:aws:iam::123456789012:role/app-role")
+needs = graph.depends_on(role.id)           # upstream, breadth-first
+needed_by = graph.dependents(role.id)       # downstream: blast radius
+view = graph.tree(role.id, direction="both", max_depth=3)
+graph.shared_dependencies(top=25)
+graph.blast_radius(top=25)
+inventory.analysis()                        # everything above + coverage
+```
+
+Organizations and Control Tower discovery is usable on its own:
+
+```python
+import boto3
+from cloudg.inventory import discover_organization
+
+topology = discover_organization(boto3.Session())
+topology.governed_regions, topology.shared_accounts      # Control Tower
+topology.target_accounts(include_ous=["Workloads"])     # nested OUs included
+assets = topology.to_assets()                            # org, OUs, accounts, SCPs, controls
+```
 
 Merging scanner findings (from `scan()`, `ingest_reports()`, or a saved `raw-findings.json`) happens after the fact, so the mapper never touches the scanners:
 
@@ -565,10 +739,18 @@ mapper.export_merged(inventory, findings, "./reports")          # asset-map.json
 ```python
 linker = RelationshipLinker(assets)
 linker.seed_existing(existing_edges)   # don't duplicate edges you already have
-edges = linker.link()                  # ATTACHED_TO / CONTAINS / ROUTE / PEERING / REFERENCES
+edges = linker.link()                  # typed edges, see Relationships
+linker.external_assets                 # placeholder nodes for unmapped accounts
+linker.unresolved                      # declared references that resolved to nothing
 ```
 
-The deep collectors are public too, when you want single-region, single-account control: `AWSDeepInventoryCollector(session, region, account_id, tagging_sweep=True)`, `AzureDeepInventoryCollector(credential, subscription_id)` and `GCPDeepInventoryCollector(project_id, credentials)` all implement the standard `collect()` / `collect_edges()` / `run()` collector interface.
+Reference data lives in YAML catalogs under `cloudg/inventory/catalogs/` rather than in code: `aws_cloudcontrol.yaml` (types the deep collectors already cover, account-wide types, CloudFormation type → asset type, per-type secret fields), `aws_arn_types.yaml` (ARN → asset type for sweep hits), `azure_arm_types.yaml` (ARM resource type → asset type) and `gcp_asset_types.yaml` (Cloud Asset Inventory type → asset type). Point `$CLOUDG_CATALOG_DIR` at a directory holding files of the same names to extend or override them without touching cloudg: mappings merge key by key, lists are extended. Unknown asset type names are rejected at load time.
+
+Your own collectors can declare relationships the same way the built-in ones do, by listing them in `metadata["relations"]`: `{"target": <any identifier>, "edge": "INVOKES", "relationship": "TRIGGERED_BY", "reverse": false}`.
+
+The deep collectors are public too, when you want single-region, single-account control: `AWSDeepInventoryCollector(session, region="us-east-1", account_id=None, tagging_sweep=True, **options)` (keyword options `is_primary_region`, `services`, `exclude_services`, `kubernetes`, `kubernetes_timeout`, `iam_resource_edges`, `max_images_per_repository`, `stack_resources`, `cloud_control`, `cloud_control_types`, `cloud_control_exclude`, `cloud_control_concurrency`; an unknown option raises `TypeError`), `AzureDeepInventoryCollector(credential, subscription_id, graph_client_factory=None, use_resource_graph=True)` and `GCPDeepInventoryCollector(project_id, credentials=None, **options)` (keyword options `organization_id`, `scope`, `project_filter`, `skip_asset_types`, `page_size`, `include_iam`, `client`, `coverage`, `timeout`, `link_locally`) all implement the standard `collect()` / `collect_edges()` / `run()` collector interface. Their assets carry declared relations; pass them through `RelationshipLinker` for the typed edges.
+
+Every structure above, from `summary` to the dependency tree, is specified field by field in the [inventory reference](INVENTORY_REFERENCE.md).
 
 ### The deeper toolkit
 
@@ -584,6 +766,11 @@ Modules the pipeline uses internally that are equally useful standalone:
 | `cloudg.normaliser` | `FindingsNormaliser` | the full dedupe / cross-scanner merge / CVSS rescore / compliance mapping pass, on any `list[Finding]` |
 | `cloudg.ingest` | `parse_report`, `ingest_reports` | every scanner's parser, standalone; no engine, no credentials |
 | `cloudg.coverage` | `CollectionCoverage` | per-service success/failure/asset-count records every collector produces |
+| `cloudg.inventory.dependencies` | `DependencyGraph`, `cross_account_edges`, `security_coverage` | dependency walks, shared dependencies, blast radius, cross-account edges and security service coverage over any assets and edges |
+| `cloudg.inventory.linker` | `RelationshipLinker` | resolve declared relations and identifiers across services, regions and accounts into typed edges |
+| `cloudg.inventory.organization` | `discover_organization`, `OrganizationTopology` | AWS Organizations and Control Tower discovery, account selection, map nodes |
+| `cloudg.inventory.kubernetes` | `collect_eks_workloads`, `KubernetesReader` | read-only Kubernetes object mapping for EKS clusters |
+| `cloudg.inventory.catalogs` | `load_catalog`, `asset_type_map` | the YAML reference catalogs with `$CLOUDG_CATALOG_DIR` overlays |
 | `cloudg.registry` | `PluginRegistry` | entry-point discovery of collector and scanner plugins |
 
 ### PipelineResult
@@ -795,13 +982,15 @@ myscanner = "my_package.scanner:MyScanner"
 mycloud = "my_package.collector:MyCollector"
 ```
 
-After `pip install`, the name is available in `scanners.enabled` and `--scanners`. Collectors follow the base interface in `cloudg/collectors/base.py`. If your scanner emits a stable check ID in `source_finding_id`, you can add it to `rules/check_equivalence.yaml` so its findings merge with equivalent checks from other tools.
+After `pip install`, the name is available in `scanners.enabled` and `--scanners`. Collectors follow the base interface in `cloudg/collectors/base.py`. A collector plugin's assets join the inventory map like the built-in ones: declare what each asset talks to in `metadata["relations"]` and extra identifiers in `metadata["aliases"]`, and the relationship linker resolves them (see [Inventory internals](INVENTORY_INTERNALS.md#156-declare-relations-from-your-own-collector-or-plugin)). If your scanner emits a stable check ID in `source_finding_id`, you can add it to `rules/check_equivalence.yaml` so its findings merge with equivalent checks from other tools.
 
 ## Authentication
 
 Every provider supports several methods, resolved in a fixed priority order, so the same config works on a laptop, in CI and on cloud compute.
 
-AWS, in priority order: direct keys (`--aws-key`, `--aws-secret`, `--aws-session-token` or the standard env vars); OIDC web identity federation (`--aws-role-arn` with `--aws-web-identity-token-file`, the GitHub Actions, GitLab CI and EKS pattern with no long-lived keys); a named CLI profile via `--profile`, SSO included; or nothing, letting the default chain pick up env vars, cached SSO or the instance role. On top of any of these, STS role assumption with `--aws-role-arn` and, for the third-party auditor pattern, `--aws-external-id`. Multi-account fan-out uses `accounts` plus `role_name` in the config, assuming that role in each account before collecting.
+AWS, in priority order: direct keys (`--aws-key`, `--aws-secret`, `--aws-session-token` or the standard env vars); OIDC web identity federation (`--aws-role-arn` with `--aws-web-identity-token-file`, the GitHub Actions, GitLab CI and EKS pattern with no long-lived keys); a named CLI profile via `--profile`, SSO included; or nothing, letting the default chain pick up env vars, cached SSO or the instance role. On top of any of these, STS role assumption with `--aws-role-arn` and, for the third-party auditor pattern, `--aws-external-id`. Multi-account fan-out uses `accounts` plus `role_name` in the config, assuming that role in each account before collecting; the caller's own account is collected with the base credentials.
+
+AWS Organizations and Control Tower: run `cloudg map --org` with credentials for the management account (Organizations APIs also work from a delegated administrator; the Control Tower APIs need the management account). cloudg lists the org read-only (`organizations:Describe*`/`List*`, `controltower:List*`/`Get*`) and then assumes the member role in each selected account. `AWSControlTowerExecution` exists in every account Control Tower enrolled, but it carries administrator permissions; the `aws-controltower-ReadOnlyExecutionRole` cannot be used directly because it only trusts a Lambda-only role in the audit account. For production, deploy a dedicated read-only role (for example `cloudg-readonly` with the `SecurityAudit` and `ViewOnlyAccess` managed policies, trusting the management account) to all accounts with a service-managed CloudFormation StackSet targeting your OUs, and pass it with `--org-role cloudg-readonly`. Mapping Kubernetes workloads additionally needs an EKS access entry for that role with `AmazonEKSViewPolicy`.
 
 Azure, in priority order: workload identity federation (`--azure-tenant-id`, `--azure-client-id`, `--azure-federated-token-file`); a service principal with a client secret (`--azure-client-secret`) or a certificate (`--azure-cert-path`); managed identity (`--azure-managed-identity`, with `managed_identity_client_id` in config for user-assigned identities); or the `DefaultAzureCredential` chain, which covers `az login`.
 

{cloudg-0.5.0 → cloudg-0.5.2}/README.md

@@ -5,7 +5,7 @@
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green.svg" alt="License: MIT"></a>
   <img src="https://img.shields.io/badge/python-3.11%2B-blue.svg" alt="Python 3.11+">
-  <img src="https://img.shields.io/badge/version-0.5.0-4c1.svg" alt="Version 0.5.0">
+  <img src="https://img.shields.io/badge/version-0.5.2-4c1.svg" alt="Version 0.5.2">
   <a href="https://github.com/astral-sh/uv"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/uv/main/assets/badge/v0.json" alt="uv"></a>
 </p>
 
@@ -20,7 +20,7 @@ One command collects assets from every configured provider in parallel, feeds th
 
 Need the map without the security tooling? `cloudg map` is a scanner-independent inventory mapper: it deep-collects everything deployed (or default) in an account, down to the network fabric, sweeps every service for the rest, and links it all into one asset map you can overlay with scanner findings later. See [Inventory mapping](#inventory-mapping).
 
-**Full documentation:** the rendered handbook lives at [morpheuslord.github.io/cloudg](https://morpheuslord.github.io/cloudg/), with the same content as markdown in the [feature reference](https://github.com/morpheuslord/cloudg/blob/main/docs/DOCUMENTATION.md) and release notes in the [changelog](https://github.com/morpheuslord/cloudg/blob/main/CHANGELOG.md).
+**Full documentation:** the rendered handbook lives at [morpheuslord.github.io/cloudg](https://morpheuslord.github.io/cloudg/), with the same content as markdown in the [feature reference](https://github.com/morpheuslord/cloudg/blob/main/docs/DOCUMENTATION.md) and release notes in the [changelog](https://github.com/morpheuslord/cloudg/blob/main/CHANGELOG.md). The inventory mapper has its own deep-dive documents: the [inventory reference](https://github.com/morpheuslord/cloudg/blob/main/docs/INVENTORY_REFERENCE.md) (every return structure and output file, field by field), the [inventory catalog](https://github.com/morpheuslord/cloudg/blob/main/docs/INVENTORY_CATALOG.md) (all 156 asset types, their metadata and relationships) and the [inventory internals](https://github.com/morpheuslord/cloudg/blob/main/docs/INVENTORY_INTERNALS.md) (how it works and how to extend it).
 
 ---
 
@@ -77,24 +77,31 @@ docker compose run --rm cloudg run -p aws --regions us-east-1
 
 ## Inventory mapping
 
-`cloudg map` answers a different question than `cloudg run`: what exists, and how is it wired together. Finding out what is wrong stays the scanners' job, and none of them runs here or even needs to be installed. Three things make the map complete:
+`cloudg map` answers a different question than `cloudg run`: what exists, and how is it wired together. Finding out what is wrong stays the scanners' job, and none of them runs here or even needs to be installed. What makes the map complete:
 
-- Catch-all enumeration per provider. Beyond the dedicated collectors, the AWS Resource Groups Tagging API, Azure Resource Manager's full subscription listing, and GCP Cloud Asset Inventory each list every resource in scope, so a service without a hand-written collector still lands on the map instead of silently missing.
-- The network fabric: route tables, internet and NAT gateways, network interfaces, volumes, Elastic and public IPs, NACLs, VPC peering, transit gateways. These are the pieces that turn a resource list into a topology.
-- A relationship linker that walks every asset's metadata and derives attachment, containment, routing and reference edges: instance → security group, subnet ⊃ database, route table → gateway, Lambda → IAM role, secret → KMS key, CloudFront → origin bucket, VM → NIC → NSG, plus a generic pass that resolves any ARN or resource-ID reference between collected assets.
+- Deep service collectors. Containers (ECR repositories, ECS services and task definitions, EKS clusters, nodegroups, Fargate profiles, addons, access entries) and the Kubernetes workloads running inside EKS; Lambda with its triggers, function URLs, images and layers; API Gateway, SQS, SNS, EventBridge, Step Functions, Kinesis; data stores; Route 53; CloudFormation stacks and the resources they manage; the whole IAM graph; and the security services and scanners watching the account (GuardDuty, Security Hub, Inspector, Macie, Config, Access Analyzer, WAF, Network Firewall, Shield, CloudTrail), including where they are not enabled.
+- Breadth across every service. On AWS, a Cloud Control API sweep lists every resource type that supports listing (800+), tagged or not, next to 133 dedicated collectors. Azure is read through Azure Resource Graph across every subscription and management group, GCP through Cloud Asset Inventory across the whole organization, both with full resource properties.
+- Every account at once. `--org` discovers the AWS Organization from the management account (OU tree, accounts, SCPs, and the Control Tower landing zone with its governed regions and enabled controls) and maps every member account.
+- Typed interdependencies. Edges say what they mean: S3 `INVOKES` Lambda, task definition `USES_IMAGE` ECR repository, function `ASSUMES_ROLE` role, WAF `PROTECTS` ALB, Inspector `MONITORS` instance, stack `MANAGES` resource, SCP `GOVERNS` OU, plus cross-account trust to accounts you did not map. `cloudg deps` then answers "what does this need" and "what breaks if it goes".
 
 ```bash
 # map one provider
 cloudg map -p aws --regions all
 
+# every account in the AWS Organization / Control Tower landing zone
+cloudg map -p aws --org --regions all
+
 # map everything, everywhere
 cloudg map -p all --regions all
 
+# what depends on this role, and what does it depend on?
+cloudg deps arn:aws:iam::123456789012:role/app-role
+
 # overlay scanner findings you generated earlier -> asset map + compliance map
 cloudg map -p aws --regions all --findings ./reports/raw-findings.json
 ```
 
-Outputs: `inventory-map.json` (assets, interconnections, summary), `inventory-map.graphml`, and `inventory-graph.json` for viewers. With `--findings`, additionally `asset-map.json` (each asset with its findings and severity breakdown) and `compliance-map.json` (framework → affected assets). The map never depends on the scanners; you can map today and merge in findings from a scan you run next week.
+Outputs: `inventory-map.json` (assets, interconnections, summary), `inventory-map.graphml`, `inventory-graph.json` for viewers, `inventory-dependencies.json` (shared dependencies, blast radius, cross-account edges, security coverage gaps) and, with `--org`, `inventory-organization.json`. With `--findings`, additionally `asset-map.json` (each asset with its findings and severity breakdown) and `compliance-map.json` (framework → affected assets). The map never depends on the scanners; you can map today and merge in findings from a scan you run next week. Every file is specified field by field, with annotated examples, in the [inventory reference](https://github.com/morpheuslord/cloudg/blob/main/docs/INVENTORY_REFERENCE.md).
 
 All of this is also a library API, see [Using it as a library](#using-it-as-a-library):
 

{cloudg-0.5.0 → cloudg-0.5.2}/cloudg/__init__.py

@@ -1,6 +1,6 @@
 """cloudg — cloud graphing: multi-cloud mapping and security intelligence."""
 
-__version__ = "0.5.0"
+__version__ = "0.5.2"
 
 from cloudg.api import (
     AnalysisResult,

{cloudg-0.5.0 → cloudg-0.5.2}/cloudg/cli.py

@@ -21,10 +21,10 @@ from cloudg.cli_helpers import (
     _build_scan_jobs,
     _gather_ingest_reports,
     _parse_ingest_reports,
-    _parse_region_flag,
     _render_ingest_reports,
     _run_scan_jobs,
 )
+from cloudg.cli_inventory import deps, map_inventory
 from cloudg.ui import console
 
 # Global config reference (set by CLI group)
@@ -169,157 +169,6 @@ def collect(
     ui.artifact("Inventory", inventory_path)
 
 
-# ─────────────────────────────────────────────────────────────────────
-# MAP command (scanner-independent inventory mapping)
-# ─────────────────────────────────────────────────────────────────────
-
-
-@cli.command(name="map")
-@click.option(
-    "-p",
-    "--provider",
-    type=click.Choice(["aws", "azure", "gcp", "all"], case_sensitive=False),
-    multiple=True,
-    default=("aws",),
-    show_default=True,
-    help="Provider(s) to map. Use multiple times or 'all'.",
-)
-@click.option("--profile", default=None, help="AWS profile name")
-@click.option(
-    "--regions",
-    "scan_regions",
-    default=None,
-    help="Regions: 'all' for auto-discovery, or comma-separated list",
-)
-@click.option("--subscription-id", default=None, help="Azure subscription ID")
-@click.option("--project-id", default=None, help="GCP project ID")
-@click.option(
-    "--findings",
-    "findings_paths",
-    multiple=True,
-    help="Existing cloudg findings JSON (raw-findings.json or a cloudg report) "
-    "to merge into asset/compliance maps. Repeatable.",
-)
-@click.option(
-    "--sweep/--no-sweep",
-    default=True,
-    show_default=True,
-    help="Catch-all sweep (AWS Resource Groups Tagging API) for resources "
-    "without a dedicated collector",
-)
-@click.option("-o", "--output", default="./reports", help="Output directory")
-def map_inventory(
-    provider: tuple[str, ...],
-    profile: str | None,
-    scan_regions: str | None,
-    subscription_id: str | None,
-    project_id: str | None,
-    findings_paths: tuple[str, ...],
-    sweep: bool,
-    output: str,
-) -> None:
-    """Map the complete infrastructure inventory — no scanners involved.
-
-    Deep-collects everything deployed (or default) across the configured
-    providers, including the network fabric (route tables, gateways, ENIs,
-    volumes, peering) and a catch-all sweep so services without a dedicated
-    collector still appear. Every asset is then linked into an
-    interconnected map: attachment, containment, routing, and
-    cross-service references.
-
-    Optionally merge previously generated scanner findings to produce an
-    asset map and a compliance map:
-
-        cloudg map -p aws --regions all --findings ./reports/raw-findings.json
-    """
-    ui.section("Inventory Mapping")
-
-    from cloudg.config import CloudGConfig
-    from cloudg.inventory import InventoryMapper
-
-    cfg: CloudGConfig = _config or CloudGConfig()
-
-    providers_list = list(provider)
-    if "all" in providers_list:
-        providers_list = ["aws", "azure", "gcp"]
-    cfg.providers = providers_list
-
-    if scan_regions:
-        region_list = _parse_region_flag(scan_regions)
-        cfg.aws.regions = region_list
-        cfg.azure.regions = region_list
-        cfg.gcp.regions = region_list
-    if profile:
-        cfg.aws.profile = profile
-    if subscription_id:
-        cfg.azure.subscription_ids = [subscription_id]
-    if project_id:
-        cfg.gcp.project_ids = [project_id]
-
-    ui.config_panel(
-        "Map Configuration",
-        {
-            "Providers": ", ".join(cfg.providers),
-            "AWS regions": ", ".join(cfg.aws.regions),
-            "Catch-all sweep": "enabled" if sweep else "disabled",
-            "Scanners": "none (inventory mapping is scanner-independent)",
-        },
-    )
-
-    mapper = InventoryMapper(cfg, tagging_sweep=sweep)
-
-    try:
-        with console.status("[accent]Mapping infrastructure inventory…[/]", spinner="dots"):
-            result = mapper.map_inventory_sync()
-    except Exception as exc:
-        ui.error_panel("Inventory mapping failed", exc)
-        sys.exit(1)
-
-    output_dir = Path(output)
-    paths = result.export(output_dir)
-
-    summary = result.summary
-    ui.stats_table(
-        "Inventory Summary",
-        {
-            "Assets": summary["total_assets"],
-            "Interconnections": summary["total_edges"],
-            "Services": len(summary["assets_by_service"]),
-            "Internet-exposed": summary["internet_exposed"],
-            "Unlinked assets": summary["unlinked_assets"],
-        },
-    )
-    for svc, count in list(summary["assets_by_service"].items())[:15]:
-        ui.detail(f"{svc}: {count} assets")
-
-    ui.artifact("Inventory map", paths["map"])
-    ui.artifact("GraphML", paths["graphml"])
-    ui.artifact("Graph JSON", paths["graph"])
-
-    # Optional merge with existing scanner findings
-    if findings_paths:
-        from cloudg.schema.models import Finding
-
-        findings: list[Any] = []
-        for fpath in findings_paths:
-            try:
-                with open(fpath) as f:
-                    data = json.load(f)
-                raw = data if isinstance(data, list) else data.get("findings", [])
-                findings.extend(Finding.model_validate(item) for item in raw)
-            except (OSError, ValueError) as exc:
-                ui.warn(f"Skipping findings file {fpath}: {exc}")
-
-        if findings:
-            merged_paths = mapper.export_merged(result, findings, output_dir)
-            ui.success(f"Merged [metric]{len(findings)}[/] findings into the inventory")
-            ui.artifact("Asset map", merged_paths["asset_map"])
-            ui.artifact("Compliance map", merged_paths["compliance_map"])
-
-    console.print()
-    ui.success(f"Inventory map saved to [path]{output_dir}[/]")
-
-
 # ─────────────────────────────────────────────────────────────────────
 # SCAN command
 # ─────────────────────────────────────────────────────────────────────
@@ -565,9 +414,12 @@ def ingest(
 
 # ─────────────────────────────────────────────────────────────────────
 # RUN command (full pipeline) — defined in cloudg.cli_commands
+# MAP / DEPS commands (inventory mapping) — defined in cloudg.cli_inventory
 # ─────────────────────────────────────────────────────────────────────
 
 cli.add_command(run)
+cli.add_command(map_inventory)
+cli.add_command(deps)
 
 
 if __name__ == "__main__":