cloudwright-ai-cli 1.3.0__tar.gz → 1.5.0__tar.gz

{cloudwright_ai_cli-1.3.0 → cloudwright_ai_cli-1.5.0}/.gitignore

@@ -18,3 +18,5 @@ node_modules/
 CLAUDE.md
 packages/*/CLAUDE.md
 docs/fix-plan.md
+tmp/
+_recording*/

{cloudwright_ai_cli-1.3.0 → cloudwright_ai_cli-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudwright-ai-cli
-Version: 1.3.0
+Version: 1.5.0
 Summary: CLI for Cloudwright architecture intelligence
 Project-URL: Homepage, https://github.com/xmpuspus/cloudwright
 Project-URL: Repository, https://github.com/xmpuspus/cloudwright

cloudwright_ai_cli-1.5.0/cloudwright_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.5.0"

{cloudwright_ai_cli-1.3.0 → cloudwright_ai_cli-1.5.0}/cloudwright_cli/commands/chat_ui.py

@@ -16,7 +16,7 @@ Commands:
   /yaml                     Show YAML for last architecture
   /cost                     Show cost estimate for last architecture
   /validate [fw]            Run compliance check (hipaa, pci-dss, soc2, fedramp, gdpr)
-  /export <fmt>             Export last architecture (terraform, mermaid, d2, cloudformation, sbom, aibom)
+  /export <fmt>             Export last architecture (terraform, pulumi-ts, pulumi-python, mermaid, d2, cloudformation, sbom, aibom)
   /terraform                Export last architecture as Terraform
   /new                      Start a new architecture from scratch
   /help, /?                 Show this help

cloudwright_ai_cli-1.5.0/cloudwright_cli/commands/compliance_cmd.py

@@ -0,0 +1,104 @@
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Annotated
+
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from cloudwright_cli.output import emit_stream, emit_success, is_json_mode, should_stream
+from cloudwright_cli.utils import handle_error
+
+console = Console()
+
+_SEVERITY_ORDER = {"critical": 0, "high": 1, "medium": 2, "low": 3, "none": 4}
+
+
+def compliance_scan(
+    ctx: typer.Context,
+    spec_file: Annotated[Path, typer.Argument(help="Path to ArchSpec YAML file", exists=True)],
+    frameworks: Annotated[
+        str | None,
+        typer.Option("--frameworks", "-f", help="Comma list: hipaa,soc2,pci-dss,fedramp,gdpr,iso27001,nist"),
+    ] = None,
+    checkov: Annotated[
+        bool | None,
+        typer.Option("--checkov/--no-checkov", help="Force or skip the Checkov deep scan (auto-detected by default)"),
+    ] = None,
+    fail_on: Annotated[str, typer.Option("--fail-on", help="Fail on: critical, high, medium, none")] = "high",
+    output: Annotated[str | None, typer.Option("--output", "-o", help="Write a markdown control report")] = None,
+) -> None:
+    """Scan an ArchSpec and map every finding to framework control IDs.
+
+    Maps design-stage findings to HIPAA / SOC 2 / PCI-DSS / FedRAMP / GDPR /
+    ISO 27001 / NIST 800-53 controls before any infrastructure exists. Folds in
+    a Checkov deep scan against the exported Terraform when Checkov is on PATH.
+    """
+    try:
+        from cloudwright import ArchSpec
+        from cloudwright.compliance import ComplianceScanner, render_markdown
+
+        spec = ArchSpec.from_file(spec_file)
+        fw_list = [f for f in (frameworks.split(",") if frameworks else []) if f.strip()]
+        report = ComplianceScanner().scan(spec, frameworks=fw_list or None, run_checkov=checkov)
+
+        if output:
+            Path(output).write_text(render_markdown(spec, report))
+
+        if is_json_mode(ctx):
+            if should_stream(ctx):
+                for f in report.findings:
+                    emit_stream(f.as_dict())
+            else:
+                emit_success(ctx, report.as_dict())
+            _maybe_exit(report, fail_on)
+            return
+
+        console.print(f"\nCompliance Scan: {spec_file.name}  (scanner: {report.scanner})\n")
+
+        posture = Table("Framework", "Satisfied", "Violated controls", "Findings", "Status")
+        for s in report.frameworks:
+            sat = f"{s.controls_total - len(s.controls_violated)}/{s.controls_total}"
+            viol = ", ".join(s.controls_violated) if s.controls_violated else "-"
+            style = "green" if s.status == "pass" else "red"
+            posture.add_row(s.framework, sat, viol, str(s.findings), f"[{style}]{s.status.upper()}[/{style}]")
+        console.print(posture)
+        console.print()
+
+        if not report.findings:
+            console.print("[green][PASS][/green] No control violations detected.")
+        else:
+            for f in report.findings:
+                sev = f.severity.upper()
+                color = {"CRITICAL": "bold red", "HIGH": "red", "MEDIUM": "yellow"}.get(sev, "dim")
+                console.print(f"  [{color}][{sev}][/{color}] {f.message}  [dim]({f.source})[/dim]")
+                if f.controls:
+                    ctrl = ", ".join(f"{c.framework} {c.control_id}" for c in f.controls)
+                    console.print(f"           Controls: {ctrl}", style="cyan")
+                console.print(f"           Remediation: {f.remediation}", style="dim")
+                console.print()
+
+        crit = report.critical_count
+        high = report.high_count
+        console.print(f"{len(report.findings)} finding(s) ({crit} critical, {high} high)")
+        threshold = _SEVERITY_ORDER.get(fail_on, 1)
+        worst = min((_SEVERITY_ORDER.get(f.severity, 4) for f in report.findings), default=4)
+        status = "PASSED" if worst > threshold else "FAILED"
+        console.print(f"Status: [{'green' if status == 'PASSED' else 'red'}]{status}[/] (fail-on={fail_on})")
+        if output:
+            console.print(f"\nReport written to {output}", style="dim")
+
+        _maybe_exit(report, fail_on)
+
+    except typer.Exit:
+        raise
+    except Exception as e:
+        handle_error(ctx, e)
+
+
+def _maybe_exit(report, fail_on: str) -> None:
+    threshold = _SEVERITY_ORDER.get(fail_on, 1)
+    for f in report.findings:
+        if _SEVERITY_ORDER.get(f.severity, 4) <= threshold:
+            raise typer.Exit(1)

{cloudwright_ai_cli-1.3.0 → cloudwright_ai_cli-1.5.0}/cloudwright_cli/commands/export.py

@@ -15,6 +15,10 @@ console = Console()
 
 _SYNTAX_MAP = {
     "terraform": "hcl",
+    "pulumi-ts": "typescript",
+    "pulumi-typescript": "typescript",
+    "pulumi-python": "python",
+    "pulumi-py": "python",
     "cloudformation": "yaml",
     "mermaid": "text",
     "d2": "text",
@@ -25,6 +29,26 @@ _SYNTAX_MAP = {
     "aibom": "json",
 }
 
+# Formats that produce a multi-file project layout when --output points at a
+# directory (or any extensionless path). Keep in sync with the dispatch in
+# cloudwright.exporter.export_spec.
+_DIRECTORY_FORMATS = {
+    "terraform",
+    "pulumi-ts",
+    "pulumi-typescript",
+    "pulumi-python",
+    "pulumi-py",
+}
+
+# Primary entry filename per directory-format, used only for status messages.
+_DIRECTORY_ENTRY = {
+    "terraform": "main.tf",
+    "pulumi-ts": "index.ts",
+    "pulumi-typescript": "index.ts",
+    "pulumi-python": "__main__.py",
+    "pulumi-py": "__main__.py",
+}
+
 
 def export(
     ctx: typer.Context,
@@ -39,9 +63,10 @@ def export(
     ],
     output: Annotated[Path | None, typer.Option("--output", "-o", help="Output file or directory")] = None,
 ) -> None:
-    """Export an architecture spec to Terraform, CloudFormation, Mermaid, SVG, PNG, SBOM, or AIBOM."""
+    """Export an architecture spec to Terraform, Pulumi (TS/Python), CloudFormation, Mermaid, SVG, PNG, SBOM, or AIBOM."""
     fmt = format.lower().strip()
-    if fmt not in FORMATS and fmt != "cfn":
+    _aliases = {"cfn", "pulumi-typescript", "pulumi-py"}
+    if fmt not in FORMATS and fmt not in _aliases:
         emit_error(ctx, ValueError(f"Unknown format {fmt!r}"), action=f"Use one of: {', '.join(FORMATS)}")
 
     if output:
@@ -55,11 +80,11 @@ def export(
     output_str = str(output) if output else None
     output_dir_str = None
 
-    # Terraform with a directory target writes main.tf inside the dir
-    if fmt == "terraform" and output and output.is_dir():
+    # Terraform / Pulumi with a directory target writes a project layout in the dir
+    if fmt in _DIRECTORY_FORMATS and output and output.is_dir():
         output_dir_str = output_str
         output_str = None
-    elif fmt == "terraform" and output and not output.suffix:
+    elif fmt in _DIRECTORY_FORMATS and output and not output.suffix:
         # Treat extensionless output as a directory path
         output_dir_str = output_str
         output_str = None
@@ -104,7 +129,8 @@ def export(
 
     if output:
         if output_dir_str:
-            console.print(f"[green]Written to {output_dir_str}/main.tf[/green]")
+            entry = _DIRECTORY_ENTRY.get(fmt, "main.tf")
+            console.print(f"[green]Written to {output_dir_str}/{entry}[/green]")
         else:
             console.print(f"[green]Written to {output}[/green]")
     else:

cloudwright_ai_cli-1.5.0/cloudwright_cli/commands/import_live_cmd.py

@@ -0,0 +1,172 @@
+"""Import live cloud infrastructure into an ArchSpec via provider APIs.
+
+Supports AWS (boto3), GCP (google-cloud SDKs), and Azure (azure-mgmt SDKs):
+
+    cloudwright import-live --provider aws   --region us-east-1
+    cloudwright import-live --provider gcp   --project my-project
+    cloudwright import-live --provider azure --subscription <SUB_ID>
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+from typing import Annotated
+
+import typer
+from rich.console import Console
+
+from cloudwright_cli.output import emit_success, err_console, is_json_mode, validate_output_path
+from cloudwright_cli.utils import handle_error
+
+console = Console()
+
+
+def import_live(
+    ctx: typer.Context,
+    provider: Annotated[
+        str,
+        typer.Option("--provider", help="Cloud provider to scan: aws | gcp | azure"),
+    ] = "aws",
+    region: Annotated[
+        str,
+        typer.Option("--region", help="Cloud region (e.g. us-east-1). Recorded in metadata for gcp/azure."),
+    ] = "us-east-1",
+    profile: Annotated[
+        str | None,
+        typer.Option("--profile", help="AWS named profile (~/.aws/credentials)"),
+    ] = None,
+    project: Annotated[
+        str | None,
+        typer.Option("--project", help="GCP project ID (or set GOOGLE_CLOUD_PROJECT)"),
+    ] = None,
+    subscription: Annotated[
+        str | None,
+        typer.Option("--subscription", help="Azure subscription ID (or set AZURE_SUBSCRIPTION_ID)"),
+    ] = None,
+    services: Annotated[
+        str | None,
+        typer.Option(
+            "--services",
+            help="Comma-separated subset of services to scan. Default: all for the provider.",
+        ),
+    ] = None,
+    output: Annotated[
+        str | None,
+        typer.Option("--output", "-o", help="Write ArchSpec YAML to this file instead of stdout"),
+    ] = None,
+    name: Annotated[
+        str | None,
+        typer.Option("--name", help="Override the architecture name"),
+    ] = None,
+) -> None:
+    """Walk live cloud APIs and produce an ArchSpec from running infrastructure."""
+    try:
+        provider_norm = (provider or "aws").lower()
+        if provider_norm == "google":
+            provider_norm = "gcp"
+        if provider_norm not in {"aws", "gcp", "azure"}:
+            raise typer.BadParameter(f"Unknown --provider {provider!r}. Supported: aws, gcp, azure.")
+
+        try:
+            from cloudwright.importer.live_aws import LiveImportError
+        except ImportError as exc:
+            err_console.print(
+                "[red]Live import core is unavailable.[/red] Install with: pip install 'cloudwright-ai[live-import]'"
+            )
+            raise typer.Exit(code=1) from exc
+
+        json_mode = is_json_mode(ctx)
+
+        def _progress(msg: str) -> None:
+            if not json_mode:
+                err_console.print(msg)
+
+        services_list: list[str] | None = None
+        if services:
+            services_list = [s.strip().lower() for s in services.split(",") if s.strip()]
+
+        scope_label = region
+        try:
+            if provider_norm == "aws":
+                from cloudwright.importer.live_aws import SUPPORTED_SERVICES, import_live_aws
+
+                _check_services(services_list, SUPPORTED_SERVICES)
+                spec = import_live_aws(
+                    region=region,
+                    profile=profile,
+                    services=services_list,
+                    progress=_progress,
+                    name=name,
+                )
+                scope_label = region
+            elif provider_norm == "gcp":
+                from cloudwright.importer.live_gcp import SUPPORTED_SERVICES, import_live_gcp
+
+                _check_services(services_list, SUPPORTED_SERVICES)
+                spec = import_live_gcp(
+                    project=project,
+                    region=region,
+                    services=services_list,
+                    progress=_progress,
+                    name=name,
+                )
+                scope_label = project or "project"
+            else:  # azure
+                from cloudwright.importer.live_azure import SUPPORTED_SERVICES, import_live_azure
+
+                _check_services(services_list, SUPPORTED_SERVICES)
+                spec = import_live_azure(
+                    subscription=subscription,
+                    region=region,
+                    services=services_list,
+                    progress=_progress,
+                    name=name,
+                )
+                scope_label = subscription or "subscription"
+        except LiveImportError as exc:
+            err_console.print(f"[red]error:[/red] {exc}")
+            raise typer.Exit(code=1) from exc
+
+        if name:
+            spec = spec.model_copy(update={"name": name})
+
+        if json_mode:
+            emit_success(ctx, {"spec": json.loads(spec.to_json())})
+            return
+
+        content = spec.to_yaml()
+        n_comps = len(spec.components)
+        n_bounds = len(spec.boundaries)
+
+        if output:
+            validate_output_path(output)
+            Path(output).write_text(content)
+            err_console.print()
+            err_console.print(
+                f"[green]Imported[/green] {n_comps} component(s), {n_bounds} boundary(ies) "
+                f"from {scope_label} -> [bold]{output}[/bold]"
+            )
+            err_console.print(f"Run [bold]cloudwright cost {output}[/bold] to estimate.")
+        else:
+            sys.stdout.write(content)
+            err_console.print()
+            err_console.print(
+                f"[green]Imported[/green] {n_comps} component(s), {n_bounds} boundary(ies) from {scope_label}"
+            )
+
+    except typer.Exit:
+        raise
+    except typer.BadParameter:
+        raise
+    except Exception as e:
+        handle_error(ctx, e)
+
+
+def _check_services(services_list: list[str] | None, supported: tuple[str, ...]) -> None:
+    if not services_list:
+        return
+    unknown = [s for s in services_list if s not in supported]
+    if unknown:
+        raise typer.BadParameter(f"Unknown service(s): {sorted(set(unknown))}. Supported: {list(supported)}")

cloudwright_ai_cli-1.5.0/cloudwright_cli/commands/plan_cmd.py

@@ -0,0 +1,75 @@
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Annotated
+
+import typer
+from rich.console import Console
+
+from cloudwright_cli.output import emit_success, is_json_mode
+from cloudwright_cli.utils import handle_error
+
+console = Console()
+
+
+def plan(
+    ctx: typer.Context,
+    spec_file: Annotated[Path, typer.Argument(help="Path to ArchSpec YAML file", exists=True)],
+    target: Annotated[
+        str,
+        typer.Option("--target", "-t", help="terraform | pulumi-python | pulumi-ts"),
+    ] = "terraform",
+    no_plan: Annotated[
+        bool,
+        typer.Option("--no-plan", help="Validate only; skip the credential-requiring plan/preview step"),
+    ] = False,
+    timeout: Annotated[int, typer.Option("--timeout", help="Seconds before the plan step is aborted")] = 180,
+) -> None:
+    """Prove the exported infrastructure is deployable.
+
+    Runs `terraform validate`/`plan` or `pulumi preview` against the generated
+    artifact. Read-only — nothing is applied. `validate` needs no credentials
+    and is the offline proof of deployability; `plan` adds a real resource
+    diff when cloud credentials are available.
+    """
+    try:
+        from cloudwright import ArchSpec
+        from cloudwright.planner import plan as run_plan
+
+        spec = ArchSpec.from_file(spec_file)
+        result = run_plan(spec, target=target, run_plan=not no_plan, timeout=timeout)
+
+        if is_json_mode(ctx):
+            emit_success(ctx, result.as_dict())
+            if not result.ok:
+                raise typer.Exit(1)
+            return
+
+        console.print(f"\nPlan ({result.tool}): {spec_file.name}\n")
+        if not result.available:
+            console.print(f"[yellow][SKIP][/yellow] {result.messages[0]}")
+            raise typer.Exit(1)
+
+        for msg in result.messages:
+            console.print(f"  {msg}")
+        if result.summary is not None:
+            s = result.summary
+            console.print(
+                f"\n  Resource diff: [green]+{s['add']}[/green] "
+                f"[yellow]~{s['change']}[/yellow] [red]-{s['destroy']}[/red]"
+            )
+        if result.output_tail:
+            console.print("\n[dim]--- tool output (tail) ---[/dim]")
+            console.print(f"[dim]{result.output_tail}[/dim]")
+
+        verdict = "DEPLOYABLE" if result.ok else "NOT DEPLOYABLE"
+        style = "green" if result.ok else "red"
+        plan_note = "" if result.plan_ran else " (validate only — no credentials for full plan)"
+        console.print(f"\nVerdict: [{style}]{verdict}[/{style}]{plan_note}")
+        if not result.ok:
+            raise typer.Exit(1)
+
+    except typer.Exit:
+        raise
+    except Exception as e:
+        handle_error(ctx, e)

{cloudwright_ai_cli-1.3.0 → cloudwright_ai_cli-1.5.0}/cloudwright_cli/completions.py

@@ -47,6 +47,8 @@ def complete_workload_profile(incomplete: str) -> list[tuple[str, str]]:
 def complete_export_format(incomplete: str) -> list[tuple[str, str]]:
     formats = [
         ("terraform", "HashiCorp Terraform HCL"),
+        ("pulumi-ts", "Pulumi TypeScript (@pulumi/aws, @pulumi/gcp, @pulumi/azure-native)"),
+        ("pulumi-python", "Pulumi Python (pulumi_aws, pulumi_gcp, pulumi_azure_native)"),
         ("cloudformation", "AWS CloudFormation YAML"),
         ("mermaid", "Mermaid diagram syntax"),
         ("d2", "D2 diagram language"),

{cloudwright_ai_cli-1.3.0 → cloudwright_ai_cli-1.5.0}/cloudwright_cli/main.py

@@ -6,6 +6,7 @@ from cloudwright_cli.commands.analyze_cmd import analyze
 from cloudwright_cli.commands.catalog_cmd import catalog_app
 from cloudwright_cli.commands.chat import chat
 from cloudwright_cli.commands.compare import compare
+from cloudwright_cli.commands.compliance_cmd import compliance_scan
 from cloudwright_cli.commands.cost import cost
 from cloudwright_cli.commands.databricks_cmd import databricks_validate
 from cloudwright_cli.commands.design import design
@@ -13,10 +14,12 @@ from cloudwright_cli.commands.diff import diff
 from cloudwright_cli.commands.drift_cmd import drift
 from cloudwright_cli.commands.export import export
 from cloudwright_cli.commands.import_cmd import import_infra
+from cloudwright_cli.commands.import_live_cmd import import_live
 from cloudwright_cli.commands.init_cmd import init
 from cloudwright_cli.commands.lint_cmd import lint
 from cloudwright_cli.commands.mcp_cmd import mcp_serve
 from cloudwright_cli.commands.modify_cmd import modify
+from cloudwright_cli.commands.plan_cmd import plan
 from cloudwright_cli.commands.policy import policy
 from cloudwright_cli.commands.refresh_cmd import refresh
 from cloudwright_cli.commands.schema_cmd import schema
@@ -68,8 +71,10 @@ app.command()(diff)
 app.command()(drift)
 app.command()(modify)
 app.command(name="import")(import_infra)
+app.command(name="import-live")(import_live)
 app.command()(chat)
 app.command()(init)
+app.command()(plan)
 app.command()(policy)
 app.command()(score)
 app.command()(analyze)
@@ -77,6 +82,7 @@ app.command()(refresh)
 app.command()(lint)
 app.command()(databricks_validate)
 app.command(name="security")(security_scan)
+app.command(name="compliance")(compliance_scan)
 app.command(name="adr")(adr)
 app.command()(schema)
 app.command(name="mcp")(mcp_serve)

cloudwright_ai_cli-1.3.0/cloudwright_cli/__init__.py

@@ -1 +0,0 @@
-__version__ = "1.3.0"