cloudmap 1.3.3__tar.gz → 1.3.4__tar.gz

cloudmap-1.3.4/.github/workflows/ci.yml

@@ -0,0 +1,51 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        # 3.9 is the floor the README promises; 3.13 catches what is about to break.
+        # Windows and macOS are here because the package claims OS Independent and
+        # an ubuntu-only matrix let a Windows-breaking bug ship: `az` installs as
+        # az.cmd there, and subprocess without shell=True never finds it. macOS is
+        # the cheap third data point for path and encoding assumptions.
+        include:
+          - {os: ubuntu-latest,  python-version: "3.9"}
+          - {os: ubuntu-latest,  python-version: "3.13"}
+          - {os: windows-latest, python-version: "3.13"}
+          - {os: macos-latest,   python-version: "3.13"}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: pip install -e ".[dev]"
+      - run: ruff check .
+      - run: pytest
+      # The suite includes tests/test_fixtures_safe.py, which fails if a fixture
+      # ever carries a credential or an unscrubbed GUID. That guard is the reason
+      # CI runs on pull requests too.
+
+      # A smoke test of the path a stranger actually takes first, on every OS:
+      # writing all five artifacts to disk exercises the file encodings and the
+      # path joining that a pure-unit suite never touches.
+      - name: demo trace writes every artifact
+        run: >
+          cloudmap trace contoso-web --from demo -d smoke
+          --json smoke/x.json --html smoke/x.html --csv smoke/x.csv --mermaid smoke/x.mmd
+      - name: the artifacts exist and are not empty
+        shell: python
+        run: |
+          import pathlib, sys
+          missing = [str(p) for p in [pathlib.Path("smoke", f"x.{e}")
+                                      for e in ("json", "html", "csv", "mmd")]
+                     if not pathlib.Path(p).exists() or pathlib.Path(p).stat().st_size == 0]
+          if missing:
+              sys.exit("empty or missing: " + ", ".join(missing))

{cloudmap-1.3.3 → cloudmap-1.3.4}/ARCHITECTURE.md

@@ -78,7 +78,7 @@ flowchart TD
 | `cloudmap/cli.py` | Orchestration + argparse | `_cmd_trace` wires the stages; `_cmd_capture`/`_cmd_scrub` produce committable fixtures; `_cmd_ask` loads a saved map and prints the computed answer, proof lines included. |
 | `cloudmap/data/contoso.json` | The packaged demo estate | `--from demo` must work for a pip-only install - the first command a stranger runs cannot depend on cloning the repo. |
 | `fixtures/` | Synthetic + scrubbed-golden estates | Fixture-first development → zero cloud contact in tests. |
-| `tests/` | 468 tests | Behaviour-named; includes a conformance sweep of all 4,687 published Azure resource types (`tests/data/azure_resource_types.txt`) through every dependency channel, a realistic-estate suite with the property names Azure genuinely returns, and `test_fixtures_safe.py`, which fails CI if a fixture ever carries a credential. |
+| `tests/` | 536 tests | Behaviour-named; includes a conformance sweep of all 4,687 published Azure resource types (`tests/data/azure_resource_types.txt`) through every dependency channel, a realistic-estate suite with the property names Azure genuinely returns, `test_fixtures_safe.py` (fails CI if a fixture ever carries a credential), `test_deterministic_output.py` (subprocesses with different hash seeds - the in-process suite cannot see that class of bug) and `test_sovereign_clouds.py`. |
 | `.gitignore` | Safety | `live/`, `*.live.json`, `*.blast.drawio` and every artifact extension at the repo root are ignored → output from a real tenant cannot be committed by accident. |
 
 ## Execution Flow
@@ -149,13 +149,24 @@ flowchart TD
 ## Open Questions / Risks
 
 - **Live validation breadth**: the engine is conformance-tested against every
-  published type, but has been exercised against one real tenant. Property
-  shapes in other tenants/clouds may surface new false-positive classes like
-  the shared `ftpsHostName` one (found live, fixed, regression-pinned).
-- **Deep config readers exist for App Service and AKS only.** Other types'
-  runtime config (Logic Apps run history, Data Factory linked-service secrets)
-  needs per-type API calls; today those dependencies appear only if expressed
-  in ARM properties, and the blind spot says so.
+  published type, but has been exercised against one real tenant, in the public
+  cloud, on Linux. Property shapes elsewhere may surface new false-positive
+  classes like the shared `ftpsHostName` one (found live, fixed,
+  regression-pinned). The sovereign clouds are covered by construction rather
+  than by a live run: an edge's kind now comes from the resolved target's ARM
+  type, not from its DNS suffix (`extractors.kind_for_target`), so
+  `vault.usgovcloudapi.net` and `vault.azure.cn` need no table entry. Windows
+  and macOS are covered by CI rather than by a table of assumptions.
+- **Deep config readers exist for App Service and AKS only** - the two common
+  types whose config Resource Graph withholds. Checked, not assumed: Logic Apps,
+  Container Apps, ML workspaces, Cognitive Services and API Management all return
+  theirs in `properties`. What remains hidden is a different shape - child
+  resources a provider never registered with Resource Graph (Data Factory and
+  Synapse linked services, Automation runbooks, Stream Analytics inputs) and
+  data planes with their own API (Databricks secret scopes). Those types are
+  listed in `cli._CONFIG_HIDDEN_TYPES` and declared as a blind spot on every
+  map that contains one, live or fixture, so an empty result cannot pass for an
+  answer. A reader for them is roadmap, not present.
 - **Cost of `--enrich all`** on large tenants: one `az` round-trip per app,
   `CLOUDMAP_ENRICH_WORKERS` (default 12) at a time. No cache between runs yet -
   every trace pays the scan again.

{cloudmap-1.3.3 → cloudmap-1.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cloudmap
-Version: 1.3.3
+Version: 1.3.4
 Summary: Trace the blast radius of an Azure resource: one name in, a verified dependency graph out.
 Project-URL: Homepage, https://github.com/KatsaounisThanasis/cloudmap
 Project-URL: Repository, https://github.com/KatsaounisThanasis/cloudmap
@@ -70,8 +70,9 @@ graph, and draws it.
 pip install cloudmap
 ```
 
-Python 3.9+. Two runtime dependencies (`rich` and `questionary`, both for the
-terminal UI). Live mode additionally needs the [Azure CLI](https://learn.microsoft.com/cli/azure/install-azure-cli)
+Python 3.9+, on Linux, macOS or Windows (CI runs all three). Two runtime
+dependencies (`rich` and `questionary`, both for the terminal UI). Live mode
+additionally needs the [Azure CLI](https://learn.microsoft.com/cli/azure/install-azure-cli)
 on your PATH. The optional AI passes need a local model server - [ollama](https://ollama.com)
 works out of the box, and any OpenAI-compatible server (LM Studio, llama.cpp,
 vLLM, LocalAI) works via two env vars:
@@ -318,6 +319,38 @@ from that map):
 answer from an incomplete map is never allowed to read as "nothing depends on
 this".
 
+### Types cloudmap cannot map honestly, and says so
+
+Five types keep their dependencies somewhere Resource Graph does not return, and
+have no reader: **Data Factory** and **Synapse** (linked services are child
+resources Resource Graph does not index), **Automation accounts** (runbooks,
+variables, connections), **Stream Analytics** (inputs and outputs) and
+**Databricks** (secret scopes live in the workspace's own data plane).
+
+Tracing one of these still works - it appears on maps, RBAC and ARM references
+resolve normally - but a **blind spot is written on the map**, because an empty
+result for a Data Factory is not evidence that the factory depends on nothing.
+
+This list is short because it was checked rather than assumed. Logic Apps
+(`definition`), Container Apps (`configuration`), ML workspaces, Cognitive
+Services and API Management all return their config in `properties`, so the four
+generic channels find their dependencies with no special handling. App Service
+and AKS hide config too - they are the two that have readers.
+
+### Government, China and the other sovereign clouds
+
+Supported, with nothing to configure. The DNS suffixes differ per cloud
+(`vault.usgovcloudapi.net`, `vault.azure.cn`, `database.chinacloudapi.cn`), but
+cloudmap does not read the service off the suffix: once a hostname resolves to a
+scanned resource, that resource's ARM type is what decides the edge kind. The
+HTML viewer's portal deep-links follow the cloud your account is in
+(`portal.azure.us`, `portal.azure.cn`, ...), taken from `az account show`.
+
+The one place a suffix still matters is a host that resolves to **nothing
+scanned**: with no resource to consult, only the public-cloud suffixes are
+recognised by name, so an unresolved sovereign host is surfaced as a generic
+external reference rather than a categorised one. It is never dropped.
+
 ### My map came back empty or thinner than expected
 
 In order:

{cloudmap-1.3.3 → cloudmap-1.3.4}/README.md

@@ -36,8 +36,9 @@ graph, and draws it.
 pip install cloudmap
 ```
 
-Python 3.9+. Two runtime dependencies (`rich` and `questionary`, both for the
-terminal UI). Live mode additionally needs the [Azure CLI](https://learn.microsoft.com/cli/azure/install-azure-cli)
+Python 3.9+, on Linux, macOS or Windows (CI runs all three). Two runtime
+dependencies (`rich` and `questionary`, both for the terminal UI). Live mode
+additionally needs the [Azure CLI](https://learn.microsoft.com/cli/azure/install-azure-cli)
 on your PATH. The optional AI passes need a local model server - [ollama](https://ollama.com)
 works out of the box, and any OpenAI-compatible server (LM Studio, llama.cpp,
 vLLM, LocalAI) works via two env vars:
@@ -284,6 +285,38 @@ from that map):
 answer from an incomplete map is never allowed to read as "nothing depends on
 this".
 
+### Types cloudmap cannot map honestly, and says so
+
+Five types keep their dependencies somewhere Resource Graph does not return, and
+have no reader: **Data Factory** and **Synapse** (linked services are child
+resources Resource Graph does not index), **Automation accounts** (runbooks,
+variables, connections), **Stream Analytics** (inputs and outputs) and
+**Databricks** (secret scopes live in the workspace's own data plane).
+
+Tracing one of these still works - it appears on maps, RBAC and ARM references
+resolve normally - but a **blind spot is written on the map**, because an empty
+result for a Data Factory is not evidence that the factory depends on nothing.
+
+This list is short because it was checked rather than assumed. Logic Apps
+(`definition`), Container Apps (`configuration`), ML workspaces, Cognitive
+Services and API Management all return their config in `properties`, so the four
+generic channels find their dependencies with no special handling. App Service
+and AKS hide config too - they are the two that have readers.
+
+### Government, China and the other sovereign clouds
+
+Supported, with nothing to configure. The DNS suffixes differ per cloud
+(`vault.usgovcloudapi.net`, `vault.azure.cn`, `database.chinacloudapi.cn`), but
+cloudmap does not read the service off the suffix: once a hostname resolves to a
+scanned resource, that resource's ARM type is what decides the edge kind. The
+HTML viewer's portal deep-links follow the cloud your account is in
+(`portal.azure.us`, `portal.azure.cn`, ...), taken from `az account show`.
+
+The one place a suffix still matters is a host that resolves to **nothing
+scanned**: with no resource to consult, only the public-cloud suffixes are
+recognised by name, so an unresolved sovereign host is surfaced as a generic
+external reference rather than a categorised one. It is never dropped.
+
 ### My map came back empty or thinner than expected
 
 In order:

{cloudmap-1.3.3 → cloudmap-1.3.4}/SECURITY.md

@@ -29,10 +29,17 @@ The interesting failure modes for a tool like this:
 - **Scope escalation**: cloudmap must only ever read what the caller's own
   `az login` token can read, and must never perform a write operation against
   the tenant.
-- **Injection through cloud-controlled data**: resource names, tags and
-  properties are attacker-influenceable in shared tenants; anything that lets
+- **Injection through cloud-controlled data**: resource names, ids, tags and
+  properties are attacker-influenceable in shared tenants, and a fixture or a
+  capture from someone else is untrusted input by definition; anything that lets
   them break out of an `az` argument list, the HTML viewer, or the draw.io XML
-  is in scope.
+  is in scope. One shipped: the viewer's portal button interpolated a resource
+  id straight into an `href="..."`, so an id carrying a double quote closed the
+  attribute and the rest parsed as attributes - `kv" onmouseover="..."` became a
+  live event handler in a file meant to be handed to a colleague. Fixed with
+  encodeURI + escaping at that interpolation, and `tests/test_hostile_names.py`
+  now runs every renderer against names built to break each escape context,
+  asserting on the parsed DOM and XML tree rather than on substrings.
 
 ## If you are about to point this at a real tenant
 

{cloudmap-1.3.3 → cloudmap-1.3.4}/cloudmap/__init__.py

@@ -1,3 +1,3 @@
 """cloudmap - trace an Azure resource's full dependency graph and export it."""
 
-__version__ = "1.3.3"
+__version__ = "1.3.4"

{cloudmap-1.3.3 → cloudmap-1.3.4}/cloudmap/cli.py

@@ -12,7 +12,30 @@ from .render.json_out import to_json
 from .render.mermaid import to_mermaid
 
 
+def _force_utf8_output():
+    """Make our own stdout/stderr able to carry the map.
+
+    The summary is drawn with box characters and one emoji per resource type. A
+    Python stream not attached to a terminal encodes with
+    locale.getpreferredencoding() - cp1252 on a stock Windows install - and the
+    first 🌐 raises UnicodeEncodeError mid-render, exit code 1. So on Windows
+    `cloudmap trace ... > map.txt`, or any CI step that captures the output,
+    crashed while the same command in the console worked.
+
+    errors="replace" is the belt: a terminal that genuinely cannot do UTF-8
+    should print a '?' and carry on, never lose the run. Streams that are not
+    TextIOWrappers (a test harness, a pytest capture) have no reconfigure() and
+    are left exactly as they are.
+    """
+    for stream in (sys.stdout, sys.stderr):
+        try:
+            stream.reconfigure(encoding="utf-8", errors="replace")
+        except Exception:
+            pass
+
+
 def main(argv=None):
+    _force_utf8_output()
     # Interactive mode if no arguments are provided
     if (argv is None and len(sys.argv) == 1) or (argv is not None and len(argv) == 0):
         # The wizard hands the terminal to questionary; in a pipe / cron / CI
@@ -116,6 +139,18 @@ def main(argv=None):
     return 1
 
 
+def _active_portal():
+    """The portal base URL of the cloud the scan ran against.
+
+    Imported lazily and defensively: the fixture path must keep working with no
+    Azure CLI installed at all, which is the whole point of `--from demo`."""
+    try:
+        from .ingest.azure import active_portal
+        return active_portal()
+    except Exception:
+        return "https://portal.azure.com"
+
+
 def _cmd_trace(args):
     read_gaps, blind_spots = [], []
     if args.live:
@@ -217,7 +252,23 @@ def _cmd_trace(args):
     if args.level == "high":
         sub = collapse_high_level(sub, seed)
 
-    meta = {"truncated": truncated, "read_gaps": read_gaps, "blind_spots": blind_spots}
+    # A type whose dependencies Resource Graph never returns is a blind spot on
+    # every path, live or fixture, enriched or not - so it is declared here
+    # rather than in the live-only enrichment step. Without this, tracing a Data
+    # Factory returns a confident empty map.
+    for hidden in sorted({n.type for n in sub.nodes.values() if n.type in _CONFIG_HIDDEN_TYPES}):
+        names = sorted(n.name for n in sub.nodes.values() if n.type == hidden)
+        blind_spots.append(
+            f"{hidden} ({', '.join(names[:4])}{', ...' if len(names) > 4 else ''}): "
+            f"{_CONFIG_HIDDEN_TYPES[hidden]}. Those dependencies cannot appear on this map, "
+            f"and cloudmap has no reader for them - an empty result here is not evidence."
+        )
+
+    meta = {"truncated": truncated, "read_gaps": read_gaps, "blind_spots": blind_spots,
+            # Which cloud's portal the viewer should deep-link into. Live runs
+            # learn it from the account; a fixture has no cloud to ask, so the
+            # public portal stands in.
+            "portal": _active_portal()}
 
     _export_outputs(sub, seed, args, meta)
     return 0
@@ -241,29 +292,39 @@ def _export_outputs(sub, seed, args, meta):
     out = args.out or (None if other_asked else f"{name}.blast.drawio")
     if out:
         _ensure_parent(out)
-        with open(out, "w", encoding="utf-8") as f:
+        with open(out, "w", encoding="utf-8", newline="\n") as f:
             f.write(to_drawio(sub, seed))
     if args.mermaid:
         _ensure_parent(args.mermaid)
-        with open(args.mermaid, "w", encoding="utf-8") as f:
+        with open(args.mermaid, "w", encoding="utf-8", newline="\n") as f:
             f.write(to_mermaid(sub, seed))
     if args.json_out:
         _ensure_parent(args.json_out)
-        with open(args.json_out, "w", encoding="utf-8") as f:
+        with open(args.json_out, "w", encoding="utf-8", newline="\n") as f:
             f.write(to_json(sub, seed, meta=meta))
     if args.html_out:
         _ensure_parent(args.html_out)
-        with open(args.html_out, "w", encoding="utf-8") as f:
+        with open(args.html_out, "w", encoding="utf-8", newline="\n") as f:
             f.write(to_html(sub, seed, meta=meta))
     if args.csv_out:
         _ensure_parent(args.csv_out)
         from .render.csv_export import to_csv
-        with open(args.csv_out, "w", encoding="utf-8") as f:
+        # newline="" is mandatory for csv output: without it Windows translates
+        # the writer's line terminator a second time and every record gains a
+        # blank line after it.
+        with open(args.csv_out, "w", encoding="utf-8", newline="") as f:
             f.write(to_csv(sub, seed, meta=meta))
 
-    _print_summary(sub, seed, out, truncated=meta.get("truncated", False),
-                   blind_spots=meta.get("blind_spots", []),
-                   single_sub=bool(getattr(args, "single_sub", False)))
+    # Every artifact is on disk by now, so a failure to DRAW the summary must not
+    # throw away a scan that may have taken minutes against a live tenant. The
+    # terminal view is a convenience; the files are the result.
+    try:
+        _print_summary(sub, seed, out, truncated=meta.get("truncated", False),
+                       blind_spots=meta.get("blind_spots", []),
+                       single_sub=bool(getattr(args, "single_sub", False)))
+    except Exception as e:
+        print(f"cloudmap: could not draw the terminal summary ({type(e).__name__}: {e}). "
+              f"The exported files are complete and unaffected.", file=sys.stderr)
 
 
 _WEBAPP = "microsoft.web/sites"
@@ -303,6 +364,34 @@ _CONFIG_REFERENCED_TYPES = frozenset({
     "microsoft.app/containerapps",
 })
 
+# Types that keep their dependencies somewhere Resource Graph does not return,
+# and for which cloudmap has no reader. Two shapes of hiding place:
+#
+#   - CHILD resources a provider never registered with Resource Graph. A Data
+#     Factory's linked services are `factories/linkedservices` objects; the
+#     factory's own `properties` names none of them.
+#   - A DATA PLANE with its own API, like Databricks secret scopes.
+#
+# App Service and AKS belong to this list by nature and are absent from it
+# because they are the two that HAVE readers (`enrich_webapps`,
+# `enrich_aks_clusters`). Everything here is a declared gap instead: an empty map
+# for one of these types is not evidence of anything, and must not be presented
+# as if it were. Verified against Resource Graph rather than assumed - Logic
+# Apps, Container Apps, ML workspaces, Cognitive Services and API Management
+# service objects all return their config in `properties`, so they are NOT here.
+_CONFIG_HIDDEN_TYPES = {
+    "microsoft.datafactory/factories":
+        "linked services and pipelines are child resources Resource Graph does not index",
+    "microsoft.synapse/workspaces":
+        "linked services are child resources Resource Graph does not index",
+    "microsoft.databricks/workspaces":
+        "secret scopes and notebooks live in the workspace's own data plane",
+    "microsoft.automation/automationaccounts":
+        "runbooks, variables and connections are child resources Resource Graph does not index",
+    "microsoft.streamanalytics/streamingjobs":
+        "inputs and outputs are child resources Resource Graph does not index",
+}
+
 
 def _enrichment_targets(graph, seed, mode, direction):
     """Which workloads to deep-enrich, and which stay a blind spot.
@@ -498,7 +587,7 @@ def _write_export(path, resources, scrubbed, meta=None):
 
     _ensure_parent(path)
     doc = {"meta": dict(meta or {}, scrubbed=scrubbed), "data": resources}
-    with open(path, "w", encoding="utf-8") as f:
+    with open(path, "w", encoding="utf-8", newline="\n") as f:
         _json.dump(doc, f, indent=2)
 
 
@@ -577,6 +666,13 @@ def _ensure_parent(path):
         os.makedirs(parent, exist_ok=True)
 
 
+# How many levels of the dependency tree the terminal prints. Past roughly this
+# the tree stops being readable, and past a few hundred the recursion that builds
+# it hits Python's frame limit - so the cut is both a UX and a safety one. Every
+# exported format carries the full graph regardless.
+_MAX_TREE_DEPTH = 40
+
+
 def _print_summary(graph, seed, out, truncated=False, blind_spots=(), single_sub=False):
     try:
         from rich.console import Console
@@ -616,10 +712,18 @@ def _print_summary(graph, seed, out, truncated=False, blind_spots=(), single_sub
             if "observes" in kind: return "dim white"
             return "blue"
 
-        def _build_tree(node_id, seen, upward):
+        cut = []          # branches the depth cap stopped, explained under the panel
+
+        def _build_tree(node_id, seen, upward, depth=0):
             """Walk one direction only. Upward reads "what depends on me", so its
             arrows are drawn pointing back at the parent - printing them like
-            downstream edges would state the dependency backwards."""
+            downstream edges would state the dependency backwards.
+
+            The depth cap is not cosmetic. This recurses once per level, so a long
+            enough chain raised RecursionError and killed the summary outright -
+            with a traceback, which reads as a broken tool. A terminal tree that
+            deep is unreadable long before it is dangerous, so it is cut with a
+            note pointing at the exports, which carry the whole chain."""
             tree = Tree(_label(graph.nodes[node_id]))
             seen.add(node_id)
             for e in graph.edges:
@@ -630,8 +734,15 @@ def _print_summary(graph, seed, out, truncated=False, blind_spots=(), single_sub
                        else f"[{_kind_colour(e.kind)}]--{e.kind}-->[/{_kind_colour(e.kind)}]")
                 if nxt in seen:
                     tree.add(f"{lbl} [dim]{graph.nodes[nxt].name} (cycle)[/dim]")
+                elif depth >= _MAX_TREE_DEPTH:
+                    # Recorded, not explained here: at this depth the indentation
+                    # alone is wider than a normal terminal, so a note attached to
+                    # the node is wrapped away and the tree just appears to stop.
+                    # The explanation is printed under the panel instead.
+                    cut.append(graph.nodes[nxt].name)
+                    tree.add(f"{lbl} [dim]{graph.nodes[nxt].name} …[/dim]")
                 else:
-                    branch = _build_tree(nxt, set(seen), upward)
+                    branch = _build_tree(nxt, set(seen), upward, depth + 1)
                     branch.label = f"{lbl} " + str(branch.label)
                     tree.add(branch)
             return tree
@@ -645,21 +756,34 @@ def _print_summary(graph, seed, out, truncated=False, blind_spots=(), single_sub
         if not graph.edges:
             # A lonely one-node map is a real answer, but an unexplained one is
             # indistinguishable from a broken tool. Say what could hide it.
-            console.print(
-                "[bold yellow]No dependencies found.[/bold yellow] Nothing in the scanned "
-                "scope references this resource and it references nothing scanned. Worth "
-                "checking: whether its dependents live in another subscription (this scan "
-                "was scoped), and whether --enrich all would reveal a config-only reference."
-                if single_sub else
-                "[bold yellow]No dependencies found.[/bold yellow] Nothing in the scanned "
-                "scope references this resource and it references nothing scanned."
-            )
+            reasons = ["the resource genuinely has no dependencies in the scanned scope"]
+            if single_sub:
+                reasons.append("its dependents live in another subscription "
+                               "(this scan was scoped with --single-sub)")
+            reasons.append("the reference exists only in config that was not deep-read "
+                           "(try --enrich all)")
+            if graph.nodes[seed].type in _CONFIG_HIDDEN_TYPES:
+                reasons.append("[bold]this type keeps its dependencies where Resource Graph "
+                               "cannot see them[/bold] - see the blind spot above, which is "
+                               "the likeliest explanation of the three")
+            console.print("[bold yellow]No dependencies found.[/bold yellow] "
+                          "Any of these could be why:")
+            for reason in reasons:
+                console.print(f"  - {reason}")
         if down or not up:
             console.print(Panel(_build_tree(seed, set(), upward=False),
                                 title=f"Depends on ({len(down)})", border_style="blue"))
         if up:
             console.print(Panel(_build_tree(seed, set(), upward=True),
                                 title=f"What depends on it ({len(up)})", border_style="magenta"))
+        if cut:
+            # Flush left, outside the panel: at 40 levels of indentation any note
+            # attached to the node itself is wrapped off the edge of the screen,
+            # and a tree that silently stops looks like a bug rather than a cut.
+            console.print(
+                f"[yellow]Tree cut at {_MAX_TREE_DEPTH} levels[/yellow] "
+                f"({len(cut)} branch(es), e.g. {cut[0]}). The printed tree is a "
+                f"preview - every exported format has the whole graph.")
         if out:
             console.print(f"🔗 [bold]draw.io:[/bold] {out}\n")
     else:

{cloudmap-1.3.3 → cloudmap-1.3.4}/cloudmap/extract/extractors.py

@@ -129,6 +129,58 @@ def domain_kind(host):
     return "references", "external service"
 
 
+# The same relationships as _DOMAIN_KIND, keyed on the ARM type instead of the
+# DNS suffix. This is the ground truth: `_DOMAIN_KIND` guesses a service from
+# the shape of a hostname, but once a host has resolved to a SCANNED resource we
+# know exactly what it is.
+#
+# It also makes the tool cloud-agnostic for free. The suffixes above are the
+# public cloud's; Azure Government, China and the other sovereign clouds use
+# different ones (`vault.usgovcloudapi.net`, `vault.azure.cn`,
+# `database.chinacloudapi.cn`, ...). Before this, a Gov tenant still got the
+# right EDGES - the generic host index resolves on the first DNS label, which is
+# cloud-independent - but every one of them came out as a bare `references`,
+# losing exactly the distinction ("who reads this vault") the map is for.
+_TYPE_KIND = {
+    "microsoft.keyvault/vaults": "reads-secret",
+    "microsoft.keyvault/managedhsms": "reads-secret",
+    "microsoft.sql/servers": "connects-to",
+    "microsoft.sql/servers/databases": "connects-to",
+    "microsoft.documentdb/databaseaccounts": "connects-to",
+    "microsoft.cache/redis": "connects-to",
+    "microsoft.cache/redisenterprise": "connects-to",
+    "microsoft.servicebus/namespaces": "connects-to",
+    "microsoft.eventhub/namespaces": "connects-to",
+    "microsoft.search/searchservices": "connects-to",
+    "microsoft.cognitiveservices/accounts": "connects-to",
+    "microsoft.storage/storageaccounts": "connects-to",
+    "microsoft.containerregistry/registries": "pulls-image",
+    "microsoft.web/sites": "calls",
+    "microsoft.app/containerapps": "calls",
+    "microsoft.insights/components": "sends-telemetry",
+    "microsoft.operationalinsights/workspaces": "uses-workspace",
+}
+for _prefix, _kind in (("microsoft.dbforpostgresql/", "connects-to"),
+                       ("microsoft.dbformysql/", "connects-to"),
+                       ("microsoft.dbformariadb/", "connects-to")):
+    _TYPE_KIND[_prefix] = _kind
+
+
+def kind_for_target(node_type, host):
+    """The edge kind for a host reference that RESOLVED to a scanned resource.
+
+    Prefers what the target actually is over what its hostname looks like, and
+    falls back to the suffix table for a type with no entry (which still catches
+    the public-cloud hosts of services this map does not name)."""
+    t = (node_type or "").lower()
+    if t in _TYPE_KIND:
+        return _TYPE_KIND[t]
+    for prefix, kind in _TYPE_KIND.items():
+        if prefix.endswith("/") and t.startswith(prefix):
+            return kind
+    return domain_kind(host)[0]
+
+
 def _vault_refs(text):
     names = set()
     for inner in _KV_REF.findall(text):
@@ -233,6 +285,8 @@ class Resolver:
     can look up whether an endpoint host corresponds to a scanned resource."""
 
     def __init__(self, nodes):
+        self.nodes = nodes         # id -> Node, so a resolved target's ARM type
+                                   # can decide an edge kind (see kind_for_target)
         self.by_id = {}
         self.by_host = {}          # endpoint hostname -> node_id
         self.by_principal = {}
@@ -656,7 +710,8 @@ def extract_edges(nodes):
                 continue
             if _is_containment(path):
                 continue
-            kind = "observes" if n.type in _OBSERVER_TYPES else domain_kind(host)[0]
+            kind = ("observes" if n.type in _OBSERVER_TYPES
+                    else kind_for_target(nodes[tgt].type, host))
             add(n.id, tgt, kind, f"references host {host} at {path}")
             known.add((n.id, tgt))
 
@@ -734,7 +789,8 @@ def _config_edges(n, values, r, add, label="app config"):
     for word in words:
         if word in r.by_host:
             hit_hosts[r.by_host[word].lower()] = word
-            add(n.id, r.by_host[word], domain_kind(word)[0], f"{label} references host {word}")
+            add(n.id, r.by_host[word], kind_for_target(r.nodes[r.by_host[word]].type, word),
+                f"{label} references host {word}")
         if word in r.by_ik:
             add(n.id, r.by_ik[word], "sends-telemetry", f"{label} contains instrumentation key")