Enhance Azure Resource Visualizer with Draw.io

plugin/skills/azure-resource-visualizer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: azure-resource-visualizer
-description: "Analyze Azure resource groups and generate detailed Mermaid architecture diagrams showing the relationships between individual resources. WHEN: create architecture diagram, visualize Azure resources, show resource relationships, generate Mermaid diagram, analyze resource group, diagram my resources, architecture visualization, resource topology, map Azure infrastructure."
+description: "Analyze Azure resource groups and generate detailed architecture diagrams as Mermaid or Draw.io. Supports live Azure resource discovery, sketch/description-to-diagram conversion, and detailed relationship mapping. WHEN: create architecture diagram, visualize Azure resources, show resource relationships, generate Mermaid diagram, analyze resource group, diagram my resources, architecture visualization, resource topology, map Azure infrastructure, draw.io diagram, sketch to diagram, convert sketch to architecture, generate draw.io, create draw.io from azure. DO NOT USE FOR: IaC-generation, drift detection, cost analysis, security assessment, performance tuning"
 license: MIT
 metadata:
   author: Microsoft
@@ -9,26 +9,49 @@ metadata:
 
 # Azure Resource Visualizer - Architecture Diagram Generator
 
-A user may ask for help understanding how individual resources fit together, or to create a diagram showing their relationships. Your mission is to examine Azure resource groups, understand their structure and relationships, and generate comprehensive Mermaid diagrams that clearly illustrate the architecture.
+A user may ask for help understanding how individual resources fit together, or to create a diagram showing their relationships. Your mission is to examine Azure resource groups, understand their structure and relationships, and generate comprehensive architecture diagrams (Mermaid or Draw.io) that clearly illustrate the architecture.
+
+## Prerequisites
+
+- Active connection to Azure through MCP tools or Azure CLI
+- Draw.io MCP server (only recommended when creating Draw.io output)
+- Draw.io VS Code extension (optional, for viewing `.drawio` files)
+
+## Output Format Routing
+
+Choose the diagram format based on the user's request. If unspecified, default to Mermaid.
+
+| Trigger | Workflow |
+|---|---|
+| "sketch" / "whiteboard" / "description" | [sketch-to-diagram-workflow.md](references/sketch-to-diagram-workflow.md) |
+| "draw.io" / "drawio" / "rich diagram" | [drawio-diagram-workflow.md](references/drawio-diagram-workflow.md) |
+| "mermaid" / default | [mermaid-diagram-workflow.md](references/mermaid-diagram-workflow.md) |
+
+See also: [drawio-diagram-conventions.md](references/drawio-diagram-conventions.md) for Draw.io shape, stencil, and layout conventions.
 
 ## Core Responsibilities
 
 1. **Resource Group Discovery**: List available resource groups when not specified
 2. **Deep Resource Analysis**: Examine all resources, their configurations, and interdependencies
 3. **Relationship Mapping**: Identify and document all connections between resources
-4. **Diagram Generation**: Create detailed, accurate Mermaid diagrams
-5. **Documentation Creation**: Produce clear markdown files with embedded diagrams
+4. **Diagram Generation**: Create detailed, accurate Mermaid or Draw.io diagrams
+5. **Documentation Creation**: Produce a rich output, either in a Draw.io diagram or in markdown files with embedded mermaid diagrams
 
 ## Workflow Process
 
+Steps 1 and 2 are the shared discovery procedure used by every renderer (Mermaid and Draw.io). Step 3 routes to the format-specific workflow.
+
 ### Step 1: Resource Group Selection
 
-If the user hasn't specified a resource group:
+> **Sketch/description input:** If the user provides a sketch, image, or text description instead of a live Azure scope, follow [references/sketch-to-diagram-workflow.md](references/sketch-to-diagram-workflow.md) for input analysis, clarification, and doc-check gating, then continue with Step 3.
+
+If the user hasn't provided a sketch, image, or text description and hasn't specified a resource group:
 
-1. Use your tools to query available resource groups. If you do not have a tool for this, use `az`.
-2. Present a numbered list of resource groups with their locations
-3. Ask the user to select one by number or name
-4. Wait for user response before proceeding
+1. **Verify Azure session first** — see [procedures/azure-authentication.md](references/procedures/azure-authentication.md). **HARD GATE** — stop if not authenticated.
+2. Use your tools to query available resource groups. If you do not have a tool for this, use `az`.
+3. Present a numbered list of resource groups with their locations
+4. Ask the user to select one by number or name
+5. Wait for user response before proceeding
 
 If a resource group is specified, validate it exists and proceed.
 
@@ -48,32 +71,35 @@ Once you have the resource group:
    - Identity and access (Managed Identity, RBAC)
    - Dependencies and connections
 
-3. **Map relationships** by identifying:
-   - **Network connections**: VNet peering, subnet assignments, NSG rules, private endpoints
+3. **Map relationships** — run the per-resource-type probes in [procedures/relationship-discovery.md](references/procedures/relationship-discovery.md).
+
+   High-level relationship categories to look for (see the procedure for concrete `az` commands):
+    - **Network connections**: VNet peering, subnet assignments, NSG rules, private endpoints
    - **Data flow**: Apps → Databases, Functions → Storage, API Management → Backends
    - **Identity**: Managed identities connecting to resources
    - **Configuration**: App Settings pointing to Key Vaults, connection strings
    - **Dependencies**: Parent-child relationships, required resources
 
+4. **Filter the resource list** by applying the "Exclude for Diagrams" column in [procedures/resource-filtering.md](references/procedures/resource-filtering.md). Remove auto-created, hidden, and non-architectural resources.
+
+5. **Check scope size**: If >50 resources remain after filtering, warn the user and offer to split by resource group or layer.
+
 > **Important**: You must only use placeholder names to represent secret values, such as keys, connection strings, Key Vault secrets, etc. Use meaningful placeholder names to represent each secret in the diagram. Never put secret values in the resource diagram.
 
 ### Step 3: Diagram Construction
 
-Create a **detailed Mermaid diagram** using the `graph TB` (top-to-bottom) or `graph LR` (left-to-right) format.
+Hand the resource model off to the renderer matching the user's requested format. The format-specific workflow handles diagram construction and file saving.
 
-See [example-diagram.md](./assets/example-diagram.md) for a complete sample architecture diagram.
+- **Mermaid** (default): [references/mermaid-diagram-workflow.md](references/mermaid-diagram-workflow.md)
+- **Draw.io**: [references/drawio-diagram-workflow.md](references/drawio-diagram-workflow.md)
 
-**Key Diagram Requirements:**
+**Key Diagram Requirements** (apply to both formats):
 
 - **Group by layer or purpose**: Network, Compute, Data, Security, Monitoring
-- **Include details**: SKUs, tiers, important settings in node labels (use `<br/>` for line breaks)
+- **Include details**: SKUs, tiers, important settings in node labels
 - **Label all connections**: Describe what flows between resources (data, identity, network)
 - **Use meaningful node IDs**: Abbreviations that make sense (APP, FUNC, SQL, KV)
-- **Visual hierarchy**: Subgraphs for logical grouping
-- **Connection types**:
-  - `-->` for data flow or dependencies
-  - `-.->` for optional/conditional connections
-  - `==>` for critical/primary paths
+- **Visual hierarchy**: Use subgraphs (Mermaid) or containers (Draw.io) for logical grouping
 
 **Resource Type Examples:**
 - App Service: Include plan tier (B1, S1, P1v2)
@@ -83,23 +109,12 @@ See [example-diagram.md](./assets/example-diagram.md) for a complete sample arch
 - VNets: Include address space
 - Subnets: Include address range
 
-### Step 4: File Creation
-
-Use [template-architecture.md](./assets/template-architecture.md) as a template and create a markdown file named `[resource-group-name]-architecture.md` with:
-
-1. **Header**: Resource group name, subscription, region
-2. **Summary**: Brief overview of the architecture (2-3 paragraphs)
-3. **Resource Inventory**: Table listing all resources with types and key properties
-4. **Architecture Diagram**: The complete Mermaid diagram
-5. **Relationship Details**: Explanation of key connections and data flows
-6. **Notes**: Any important observations, potential issues, or recommendations
-
 ## Operating Guidelines
 
 ### Quality Standards
 
 - **Accuracy**: Verify all resource details before including in diagram
-- **Completeness**: Don't omit resources; include everything in the resource group
+- **Completeness**: Use [resource-filtering.md](references/procedures/resource-filtering.md) rules to find relevant resources and relationships
 - **Clarity**: Use clear, descriptive labels and logical grouping
 - **Detail Level**: Include configuration details that matter for architecture understanding
 - **Relationships**: Show ALL significant connections, not just obvious ones
@@ -112,10 +127,7 @@ Use [template-architecture.md](./assets/template-architecture.md) as a template
    - Use `intent="get resource details"` for individual resource analysis
    - Use `command` parameter when you need specific Azure operations
 
-2. **File Creation**:
-   - Always create in workspace root or a `docs/` folder if it exists
-   - Use clear, descriptive filenames: `[rg-name]-architecture.md`
-   - Ensure Mermaid syntax is valid (test syntax mentally before output)
+2. **File Creation**: Defer to the format-specific workflow selected in Step 3 for output paths, filenames, and file formats. Do not invent alternative locations or extensions here.
 
 3. **Terminal (when needed)**:
    - Use Azure CLI for complex queries not available via MCP
@@ -132,52 +144,41 @@ Use [template-architecture.md](./assets/template-architecture.md) as a template
 - ✅ Include configuration details in node labels
 - ✅ Group resources logically with subgraphs
 - ✅ Label all connections descriptively
-- ✅ Create a complete markdown file with diagram
+- ✅ Save the diagram to a file using the path/format dictated by the selected workflow
 
 **Never Do:**
 - ❌ Skip resources because they seem unimportant
 - ❌ Make assumptions about resource relationships without verification
 - ❌ Create incomplete or placeholder diagrams
 - ❌ Omit configuration details that affect architecture
 - ❌ Proceed without confirming resource group selection
-- ❌ Generate invalid Mermaid syntax
+- ❌ Generate invalid Mermaid or Draw.io syntax
 - ❌ Modify or delete Azure resources (read-only analysis)
 
 ### Edge Cases & Error Handling
 
 - **No resources found**: Inform user and verify resource group name
 - **Permission issues**: Explain what's missing and suggest checking RBAC
-- **Complex architectures (50+ resources)**: Consider creating multiple diagrams by layer
+- **Complex architectures (50+ resources)**: Warn the user and offer to split by layer or resource group
 - **Cross-resource-group dependencies**: Note external dependencies in diagram notes
 - **Resources without clear relationships**: Group in "Other Resources" section
+- **Unsupported resource type (Draw.io)**: No stencil mapping available — use a generic labeled node and call out the limitation
+- **Draw.io MCP tool not found**: Output `.drawio` XML to a file; the user can open it with the Draw.io VS Code extension
+- **Invalid diagram syntax**: For Mermaid, validate before output; for Draw.io, simplify and retry with generic shapes if XML is malformed
 
 ## Output Format Specifications
 
-### Mermaid Diagram Syntax
-- Use `graph TB` (top-to-bottom) for vertical layouts
-- Use `graph LR` (left-to-right) for horizontal layouts (better for wide architectures)
-- Subgraph syntax: `subgraph "Descriptive Name"`
-- Node syntax: `ID["Display Name<br/>Details"]`
-- Connection syntax: `SOURCE -->|"Label"| TARGET`
-
-### Markdown Structure
-- Use H1 for main title
-- Use H2 for major sections
-- Use H3 for subsections
-- Use tables for resource inventories
-- Use bullet lists for notes and recommendations
-- Use code blocks with `mermaid` language tag for diagrams
-
+For format-specific syntax (Mermaid graph direction, Draw.io XML, stencil paths), output file paths, filenames, and document structure, see the renderer workflow selected in Step 3. 
 ## Success Criteria
 
 A successful analysis includes:
 - ✅ Valid resource group identified
 - ✅ All resources discovered and analyzed
 - ✅ All significant relationships mapped
-- ✅ Detailed Mermaid diagram with proper grouping
-- ✅ Complete markdown file created
+- ✅ Detailed Mermaid or Draw.io diagram with proper grouping
+- ✅ Complete output file created (markdown for Mermaid, `.drawio` for Draw.io)
 - ✅ Clear, actionable documentation
-- ✅ Valid Mermaid syntax that renders correctly
+- ✅ Valid diagram syntax that renders correctly
 - ✅ Professional, architect-level output
 
-Your goal is to provide clarity and insight into Azure architectures, making complex resource relationships easy to understand through excellent visualization.
+Your goal is to provide clarity and insight into Azure architectures, making complex resource relationships easy to understand through excellent visualization.

plugin/skills/azure-resource-visualizer/references/azure-resource-model.md

@@ -0,0 +1,91 @@
+# Azure Resource Metadata Model
+
+Standardized JSON schema for representing Azure resources and their relationships, used across workflows for analysis, comparison, and generation.
+
+## Schema
+
+Each Azure environment is represented as a **resource model** — a JSON structure with the following shape:
+
+```json
+{
+  "resources": [
+    {
+      "id": "<unique-identifier>",
+      "type": "<Azure-resource-type>",
+      "name": "<resource-name>",
+      "resourceGroup": "<resource-group-name>",
+      "location": "<azure-region>",
+      "properties": {},
+      "tags": {},
+      "relationships": [
+        {
+          "targetId": "<id-of-related-resource>",
+          "type": "<relationship-type>"
+        }
+      ]
+    }
+  ]
+}
+```
+
+## Field Definitions
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `id` | string | Yes | Unique identifier within the model. Use a short slug (e.g., `vm-web-01`). |
+| `type` | string | Yes | Azure resource provider type (e.g., `Microsoft.Compute/virtualMachines`). |
+| `name` | string | Yes | Display name of the resource. |
+| `resourceGroup` | string | No | Resource group the resource belongs to. |
+| `location` | string | No | Azure region (e.g., `eastus`, `westeurope`). |
+| `properties` | object | No | Resource-specific properties (SKU, tier, size, etc.). |
+| `tags` | object | No | Azure resource tags as key-value pairs. |
+| `relationships` | array | No | Connections to other resources in the model. |
+
+## Relationship Types
+
+| Type | Description | Example |
+|------|-------------|---------|
+| `contains` | Parent contains child resource | VNet contains Subnet |
+| `connects` | Network or data flow connection | VM connects to Storage Account |
+| `depends` | Deployment dependency | App Service depends on App Service Plan |
+| `peers` | Bidirectional peering | VNet peers with VNet |
+| `secures` | Security association | NSG secures Subnet |
+| `routes` | Traffic routing | Load Balancer routes to VM |
+
+## Common Azure Resource Types
+
+| Resource Type | Short Name |
+|---------------|------------|
+| `Microsoft.Compute/virtualMachines` | VM |
+| `Microsoft.Web/sites` | App Service |
+| `Microsoft.Web/serverfarms` | App Service Plan |
+| `Microsoft.Storage/storageAccounts` | Storage Account |
+| `Microsoft.Sql/servers` | SQL Server |
+| `Microsoft.Sql/servers/databases` | SQL Database |
+| `Microsoft.Network/virtualNetworks` | VNet |
+| `Microsoft.Network/virtualNetworks/subnets` | Subnet |
+| `Microsoft.Network/networkSecurityGroups` | NSG |
+| `Microsoft.Network/loadBalancers` | Load Balancer |
+| `Microsoft.Network/applicationGateways` | App Gateway |
+| `Microsoft.Network/publicIPAddresses` | Public IP |
+| `Microsoft.Network/networkInterfaces` | NIC |
+| `Microsoft.Network/privateDnsZones` | Private DNS Zone |
+| `Microsoft.Network/privateEndpoints` | Private Endpoint |
+| `Microsoft.Network/virtualNetworkGateways` | VPN Gateway |
+| `Microsoft.KeyVault/vaults` | Key Vault |
+| `Microsoft.ContainerRegistry/registries` | Container Registry |
+| `Microsoft.ContainerService/managedClusters` | AKS |
+| `Microsoft.App/containerApps` | Container App |
+| `Microsoft.App/managedEnvironments` | Container App Environment |
+| `Microsoft.DocumentDB/databaseAccounts` | Cosmos DB |
+| `Microsoft.ServiceBus/namespaces` | Service Bus |
+| `Microsoft.EventHub/namespaces` | Event Hub |
+| `Microsoft.Cache/redis` | Redis Cache |
+| `Microsoft.Insights/components` | Application Insights |
+| `Microsoft.OperationalInsights/workspaces` | Log Analytics Workspace |
+| `Microsoft.ApiManagement/service` | API Management |
+| `Microsoft.SignalRService/signalR` | SignalR |
+| `Microsoft.CognitiveServices/accounts` | Cognitive Services |
+| `Microsoft.ManagedIdentity/userAssignedIdentities` | Managed Identity |
+| `Microsoft.Authorization/roleAssignments` | Role Assignment |
+| `Microsoft.Resources/resourceGroups` | Resource Group |