@jadenrazo/cloudcost-mcp 1.0.0 → 1.2.0

package/dist/{chunk-E7KOWAMW.js → chunk-CGMU4ETN.js}

@@ -8,10 +8,11 @@ import {
   getGcpSqlPricing,
   getGcpStoragePricing,
   getInstanceMap,
+  getPricingMetadata,
   getRegionMappings,
   getRegionPriceMultipliers,
   getStorageMap
-} from "./chunk-TRRAOOVF.js";
+} from "./chunk-LWTVE7UY.js";
 
 // src/config.ts
 import { readFileSync, existsSync } from "fs";
@@ -39,9 +40,39 @@ var DEFAULT_CONFIG = {
   },
   budget: {
     warn_percentage: 80
+  },
+  guardrail: {
+    warn_ratio: 0.8
   }
 };
 
+// src/logger.ts
+var LEVEL_ORDER = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3
+};
+var currentLevel = "info";
+function setLogLevel(level) {
+  currentLevel = level;
+}
+function shouldLog(level) {
+  return LEVEL_ORDER[level] >= LEVEL_ORDER[currentLevel];
+}
+function log(level, message, data) {
+  if (!shouldLog(level)) return;
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  const entry = data ? `[${timestamp}] ${level.toUpperCase()}: ${message} ${JSON.stringify(data)}` : `[${timestamp}] ${level.toUpperCase()}: ${message}`;
+  process.stderr.write(entry + "\n");
+}
+var logger = {
+  debug: (msg, data) => log("debug", msg, data),
+  info: (msg, data) => log("info", msg, data),
+  warn: (msg, data) => log("warn", msg, data),
+  error: (msg, data) => log("error", msg, data)
+};
+
 // src/config.ts
 function getConfigDir() {
   return join(homedir(), ".cloudcost");
@@ -51,7 +82,11 @@ function loadFileConfig() {
   if (!existsSync(configPath)) return {};
   try {
     return JSON.parse(readFileSync(configPath, "utf-8"));
-  } catch {
+  } catch (err) {
+    logger.warn("Ignoring malformed config file; using defaults", {
+      path: configPath,
+      error: err instanceof Error ? err.message : String(err)
+    });
     return {};
   }
 }
@@ -101,6 +136,23 @@ function loadEnvConfig() {
       ...warnPct !== void 0 && !isNaN(warnPct) && { warn_percentage: warnPct }
     };
   }
+  if (env.CLOUDCOST_GUARDRAIL_MAX_MONTHLY || env.CLOUDCOST_GUARDRAIL_MAX_PER_RESOURCE || env.CLOUDCOST_GUARDRAIL_WARN_RATIO) {
+    const parsePositive = (raw) => {
+      if (!raw) return void 0;
+      const v = parseFloat(raw);
+      return Number.isFinite(v) && v > 0 ? v : void 0;
+    };
+    const maxMonthly = parsePositive(env.CLOUDCOST_GUARDRAIL_MAX_MONTHLY);
+    const maxPerResource = parsePositive(env.CLOUDCOST_GUARDRAIL_MAX_PER_RESOURCE);
+    const warnRatioRaw = env.CLOUDCOST_GUARDRAIL_WARN_RATIO ? parseFloat(env.CLOUDCOST_GUARDRAIL_WARN_RATIO) : NaN;
+    const warnRatio = Number.isFinite(warnRatioRaw) && warnRatioRaw > 0 && warnRatioRaw <= 1 ? warnRatioRaw : void 0;
+    config.guardrail = {
+      ...DEFAULT_CONFIG.guardrail,
+      ...maxMonthly !== void 0 && { max_monthly: maxMonthly },
+      ...maxPerResource !== void 0 && { max_per_resource: maxPerResource },
+      ...warnRatio !== void 0 && { warn_ratio: warnRatio }
+    };
+  }
   return config;
 }
 function loadConfig() {
@@ -133,43 +185,94 @@ function loadConfig() {
       ...DEFAULT_CONFIG.budget,
       ...fileConfig.budget,
       ...envConfig.budget
+    },
+    guardrail: {
+      ...DEFAULT_CONFIG.guardrail,
+      ...fileConfig.guardrail,
+      ...envConfig.guardrail
     }
   };
 }
 
-// src/pricing/cache.ts
-import Database from "better-sqlite3";
-import { mkdirSync } from "fs";
-import { dirname } from "path";
-
-// src/logger.ts
-var LEVEL_ORDER = {
-  debug: 0,
-  info: 1,
-  warn: 2,
-  error: 3
+// src/currency.ts
+var SUPPORTED_CURRENCIES = [
+  "USD",
+  "EUR",
+  "GBP",
+  "JPY",
+  "CAD",
+  "AUD",
+  "INR",
+  "BRL"
+];
+var EXCHANGE_RATES_AS_OF = "2026-03";
+var EXCHANGE_RATES = {
+  USD: 1,
+  EUR: 0.92,
+  GBP: 0.79,
+  JPY: 149.5,
+  CAD: 1.36,
+  AUD: 1.53,
+  INR: 83.1,
+  BRL: 4.97
 };
-var currentLevel = "info";
-function setLogLevel(level) {
-  currentLevel = level;
+function convertCurrency(amountUsd, targetCurrency) {
+  const rate = EXCHANGE_RATES[targetCurrency];
+  if (rate === void 0 || rate === 1) {
+    return amountUsd;
+  }
+  return amountUsd * rate;
 }
-function shouldLog(level) {
-  return LEVEL_ORDER[level] >= LEVEL_ORDER[currentLevel];
+function getExchangeRateInfo(currency) {
+  return {
+    rate: EXCHANGE_RATES[currency] ?? 1,
+    rate_as_of: EXCHANGE_RATES_AS_OF
+  };
 }
-function log(level, message, data) {
-  if (!shouldLog(level)) return;
-  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  const entry = data ? `[${timestamp}] ${level.toUpperCase()}: ${message} ${JSON.stringify(data)}` : `[${timestamp}] ${level.toUpperCase()}: ${message}`;
-  process.stderr.write(entry + "\n");
+function convertLineItem(item, currency) {
+  return {
+    ...item,
+    unit_price: convertCurrency(item.unit_price, currency),
+    monthly_cost: convertCurrency(item.monthly_cost, currency)
+  };
+}
+function convertCostEstimate(estimate, currency) {
+  return {
+    ...estimate,
+    monthly_cost: convertCurrency(estimate.monthly_cost, currency),
+    yearly_cost: convertCurrency(estimate.yearly_cost, currency),
+    currency,
+    breakdown: estimate.breakdown.map((item) => convertLineItem(item, currency))
+  };
+}
+function convertBreakdownCurrency(breakdown, currency) {
+  const original_usd = {
+    total_monthly: breakdown.total_monthly,
+    total_yearly: breakdown.total_yearly
+  };
+  const convertedByService = {};
+  for (const [service, amount] of Object.entries(breakdown.by_service)) {
+    convertedByService[service] = convertCurrency(amount, currency);
+  }
+  return {
+    ...breakdown,
+    total_monthly: convertCurrency(breakdown.total_monthly, currency),
+    total_yearly: convertCurrency(breakdown.total_yearly, currency),
+    currency,
+    by_service: convertedByService,
+    by_resource: breakdown.by_resource.map((est) => convertCostEstimate(est, currency)),
+    ...breakdown.estimated_egress_monthly !== void 0 && {
+      estimated_egress_monthly: convertCurrency(breakdown.estimated_egress_monthly, currency)
+    },
+    original_usd,
+    exchange_rate: getExchangeRateInfo(currency)
+  };
 }
-var logger = {
-  debug: (msg, data) => log("debug", msg, data),
-  info: (msg, data) => log("info", msg, data),
-  warn: (msg, data) => log("warn", msg, data),
-  error: (msg, data) => log("error", msg, data)
-};
 
 // src/pricing/cache.ts
+import Database from "better-sqlite3";
+import { mkdirSync } from "fs";
+import { dirname } from "path";
 var SCHEMA = `
   CREATE TABLE IF NOT EXISTS pricing_cache (
     key        TEXT PRIMARY KEY,
@@ -525,6 +628,15 @@ var PricingCache = class {
   }
 };
 
+// src/pricing/effective-date.ts
+function resolveEffectiveDate(effectiveDate) {
+  if (effectiveDate) {
+    const t = new Date(effectiveDate);
+    if (!Number.isNaN(t.getTime())) return t.toISOString();
+  }
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+
 // src/pricing/aws/aws-normalizer.ts
 function extractUsdPrice(priceDimensions) {
   for (const dim of Object.values(priceDimensions)) {
@@ -562,87 +674,131 @@ function extractFromTerms(onDemandTerms, defaultUnit) {
   }
   return { price: 0, unit: defaultUnit };
 }
-function normalizeAwsCompute(rawProduct, rawPrice, region) {
-  const attrs = rawProduct?.attributes ?? {};
+function normalize(rawPrice, region, effectiveDate, spec) {
   const terms = rawPrice?.terms?.OnDemand ?? {};
-  const { price, unit } = extractFromTerms(terms, "Hrs");
+  const { price, unit } = extractFromTerms(terms, spec.defaultUnit);
   return {
     provider: "aws",
-    service: "ec2",
-    resource_type: attrs.instanceType ?? "unknown",
+    service: spec.service,
+    resource_type: spec.resourceType,
     region,
     unit,
     price_per_unit: price,
     currency: "USD",
+    description: spec.description,
+    attributes: {
+      ...spec.attributes,
+      pricing_source: "live"
+    },
+    effective_date: resolveEffectiveDate(effectiveDate)
+  };
+}
+function normalizeAwsCompute(rawProduct, rawPrice, region, effectiveDate) {
+  const attrs = rawProduct?.attributes ?? {};
+  return normalize(rawPrice, region, effectiveDate, {
+    service: "ec2",
+    defaultUnit: "Hrs",
+    resourceType: attrs.instanceType ?? "unknown",
     description: attrs.instanceType ? `AWS EC2 ${attrs.instanceType} (${attrs.operatingSystem ?? "Linux"})` : void 0,
     attributes: {
       instance_type: attrs.instanceType ?? "",
       vcpu: attrs.vcpu ?? "",
       memory: attrs.memory ?? "",
       operating_system: attrs.operatingSystem ?? "Linux",
-      tenancy: attrs.tenancy ?? "Shared",
-      pricing_source: "live"
-    },
-    effective_date: (/* @__PURE__ */ new Date()).toISOString()
-  };
+      tenancy: attrs.tenancy ?? "Shared"
+    }
+  });
 }
-function normalizeAwsDatabase(rawProduct, rawPrice, region) {
+function normalizeAwsDatabase(rawProduct, rawPrice, region, effectiveDate) {
   const attrs = rawProduct?.attributes ?? {};
-  const terms = rawPrice?.terms?.OnDemand ?? {};
-  const { price, unit } = extractFromTerms(terms, "Hrs");
-  return {
-    provider: "aws",
+  return normalize(rawPrice, region, effectiveDate, {
     service: "rds",
-    resource_type: attrs.instanceType ?? "unknown",
-    region,
-    unit,
-    price_per_unit: price,
-    currency: "USD",
+    defaultUnit: "Hrs",
+    resourceType: attrs.instanceType ?? "unknown",
     description: attrs.instanceType ? `AWS RDS ${attrs.instanceType} (${attrs.databaseEngine ?? "MySQL"})` : void 0,
     attributes: {
       instance_type: attrs.instanceType ?? "",
       database_engine: attrs.databaseEngine ?? "",
       deployment_option: attrs.deploymentOption ?? "Single-AZ",
       vcpu: attrs.vcpu ?? "",
-      memory: attrs.memory ?? "",
-      pricing_source: "live"
-    },
-    effective_date: (/* @__PURE__ */ new Date()).toISOString()
-  };
+      memory: attrs.memory ?? ""
+    }
+  });
 }
-function normalizeAwsStorage(rawProduct, rawPrice, region) {
+function normalizeAwsStorage(rawProduct, rawPrice, region, effectiveDate) {
   const attrs = rawProduct?.attributes ?? {};
-  const terms = rawPrice?.terms?.OnDemand ?? {};
-  const { price, unit } = extractFromTerms(terms, "GB-Mo");
   const volumeType = attrs.volumeApiName ?? attrs.volumeType ?? "gp3";
-  return {
-    provider: "aws",
+  return normalize(rawPrice, region, effectiveDate, {
     service: "ebs",
-    resource_type: volumeType,
-    region,
-    unit,
-    price_per_unit: price,
-    currency: "USD",
+    defaultUnit: "GB-Mo",
+    resourceType: volumeType,
     description: `AWS EBS ${volumeType} volume`,
     attributes: {
       volume_type: volumeType,
       max_iops: attrs.maxIopsvolume ?? "",
-      max_throughput: attrs.maxThroughputvolume ?? "",
-      pricing_source: "live"
-    },
-    effective_date: (/* @__PURE__ */ new Date()).toISOString()
-  };
+      max_throughput: attrs.maxThroughputvolume ?? ""
+    }
+  });
 }
 
 // src/pricing/fetch-utils.ts
+var DEFAULT_MAX_RESPONSE_BYTES = 100 * 1024 * 1024;
+var DEFAULT_TIMEOUT_MS = 6e4;
+function assertUrlAllowed(url, options) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`fetchWithRetry: invalid URL`);
+  }
+  const requireHttps = options.requireHttps ?? true;
+  if (requireHttps && parsed.protocol !== "https:") {
+    throw new Error(`fetchWithRetry: rejected non-https URL (scheme=${parsed.protocol})`);
+  }
+  if (options.allowedHosts && options.allowedHosts.length > 0) {
+    if (!options.allowedHosts.includes(parsed.host)) {
+      throw new Error(`fetchWithRetry: host ${parsed.host} not in allowlist`);
+    }
+  }
+  return parsed;
+}
+function capResponseBody(res, maxBytes) {
+  if (!res.body) return res;
+  if (!Number.isFinite(maxBytes)) return res;
+  let seen = 0;
+  const limiter = new TransformStream({
+    transform(chunk, controller) {
+      seen += chunk.byteLength;
+      if (seen > maxBytes) {
+        controller.error(new Error(`fetchWithRetry: response body exceeded ${maxBytes} bytes`));
+        return;
+      }
+      controller.enqueue(chunk);
+    }
+  });
+  const limited = res.body.pipeThrough(limiter);
+  return new Response(limited, {
+    status: res.status,
+    statusText: res.statusText,
+    headers: res.headers
+  });
+}
+function withDefaultSignal(init, timeoutMs) {
+  if (init?.signal) return init;
+  return { ...init ?? {}, signal: AbortSignal.timeout(timeoutMs) };
+}
 async function fetchWithRetry(url, init, options = {}) {
   const maxRetries = options.maxRetries ?? 3;
   const baseDelay = options.baseDelay ?? 1e3;
   const maxDelay = options.maxDelay ?? 1e4;
+  const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+  const defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+  assertUrlAllowed(url, options);
+  const safeInit = withDefaultSignal(init, defaultTimeoutMs);
   let lastError;
   for (let attempt = 0; attempt <= maxRetries; attempt++) {
     try {
-      const res = await fetch(url, init);
+      const res = await fetch(url, safeInit);
       if (res.status === 429 || res.status >= 500 && res.status < 600) {
         if (attempt < maxRetries) {
           const delay = Math.min(baseDelay * Math.pow(2, attempt), maxDelay);
@@ -656,7 +812,7 @@ async function fetchWithRetry(url, init, options = {}) {
           continue;
         }
       }
-      return res;
+      return capResponseBody(res, maxResponseBytes);
     } catch (err) {
       lastError = err;
       if (attempt < maxRetries) {
@@ -677,13 +833,14 @@ async function fetchWithRetry(url, init, options = {}) {
       }
     }
   }
-  throw lastError ?? new Error(`fetchWithRetry: all ${maxRetries} retries failed for ${url}`);
+  if (lastError instanceof Error) throw lastError;
+  throw new Error(`fetchWithRetry: all ${maxRetries} retries failed for ${url}`);
 }
 function sleep(ms) {
   if (process.env.NODE_ENV === "test" || process.env.VITEST) {
     return Promise.resolve();
   }
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 var CIRCUIT_FAILURE_THRESHOLD = 5;
 var CIRCUIT_OPEN_DURATION_MS = 5 * 60 * 1e3;
@@ -901,6 +1058,11 @@ var EC2_BASE_PRICES = {
   "m7i.large": 0.1008,
   "m7i.xlarge": 0.2016,
   "m7i.2xlarge": 0.4032,
+  "m7i-flex.large": 0.0958,
+  "m7i-flex.xlarge": 0.1915,
+  "m7i-flex.2xlarge": 0.383,
+  "m7i-flex.4xlarge": 0.7661,
+  "m7i-flex.8xlarge": 1.5322,
   "m7g.large": 0.0816,
   "m7g.xlarge": 0.1632,
   "m7g.2xlarge": 0.3264,
@@ -918,10 +1080,10 @@ var EC2_BASE_PRICES = {
   "c6g.xlarge": 0.136,
   "c6g.2xlarge": 0.272,
   "c6g.4xlarge": 0.544,
-  "c7i.large": 0.089,
-  "c7i.xlarge": 0.178,
+  "c7i.large": 0.0893,
+  "c7i.xlarge": 0.1785,
   "c7i.2xlarge": 0.357,
-  "c7g.large": 0.072,
+  "c7g.large": 0.0725,
   "c7g.xlarge": 0.145,
   "c7g.2xlarge": 0.29,
   "c7g.4xlarge": 0.58,
@@ -934,65 +1096,63 @@ var EC2_BASE_PRICES = {
   "r6i.large": 0.126,
   "r6i.xlarge": 0.252,
   "r6i.2xlarge": 0.504,
-  "r6g.large": 0.101,
-  "r6g.xlarge": 0.202,
-  "r6g.2xlarge": 0.403,
-  "r6g.4xlarge": 0.806,
-  "r7i.large": 0.133,
-  "r7i.xlarge": 0.266,
-  "r7i.2xlarge": 0.532,
-  "r7g.large": 0.107,
-  "r7g.xlarge": 0.214,
-  "r7g.2xlarge": 0.428,
-  "r7g.4xlarge": 0.856,
-  // 8th-gen Graviton4 families
-  "m8g.large": 0.077,
-  "m8g.xlarge": 0.154,
-  "m8g.2xlarge": 0.308,
-  "m8g.4xlarge": 0.616,
-  "c8g.large": 0.068,
-  "c8g.xlarge": 0.136,
-  "c8g.2xlarge": 0.272,
-  "c8g.4xlarge": 0.544,
-  "r8g.large": 0.101,
-  "r8g.xlarge": 0.202,
-  "r8g.2xlarge": 0.404,
-  "r8g.4xlarge": 0.808,
-  // GPU instances
+  "r6g.large": 0.1008,
+  "r6g.xlarge": 0.2016,
+  "r6g.2xlarge": 0.4032,
+  "r6g.4xlarge": 0.8064,
+  "r7i.large": 0.1323,
+  "r7i.xlarge": 0.2646,
+  "r7i.2xlarge": 0.5292,
+  "r7g.large": 0.1071,
+  "r7g.xlarge": 0.2142,
+  "r7g.2xlarge": 0.4284,
+  "r7g.4xlarge": 0.8568,
+  "m8g.large": 0.0898,
+  "m8g.xlarge": 0.1795,
+  "m8g.2xlarge": 0.359,
+  "m8g.4xlarge": 0.7181,
+  "c8g.large": 0.0798,
+  "c8g.xlarge": 0.1595,
+  "c8g.2xlarge": 0.319,
+  "c8g.4xlarge": 0.6381,
+  "r8g.large": 0.1178,
+  "r8g.xlarge": 0.2356,
+  "r8g.2xlarge": 0.4713,
+  "r8g.4xlarge": 0.9426,
   "g5.xlarge": 1.006,
   "g5.2xlarge": 1.212,
   "g5.4xlarge": 1.624,
   "g5.8xlarge": 2.448,
   "g5.12xlarge": 5.672,
-  "p4d.24xlarge": 32.7726
+  "p4d.24xlarge": 21.9576
 };
 var RDS_BASE_PRICES = {
-  "db.t3.micro": 0.017,
-  "db.t3.small": 0.034,
-  "db.t3.medium": 0.068,
-  "db.t3.large": 0.136,
+  "db.t3.micro": 0.018,
+  "db.t3.small": 0.036,
+  "db.t3.medium": 0.072,
+  "db.t3.large": 0.145,
   "db.t4g.micro": 0.016,
   "db.t4g.small": 0.032,
   "db.t4g.medium": 0.065,
   "db.t4g.large": 0.129,
   "db.t4g.xlarge": 0.258,
-  "db.m5.large": 0.171,
-  "db.m5.xlarge": 0.342,
-  "db.m6g.large": 0.154,
-  "db.m6g.xlarge": 0.308,
-  "db.m6g.2xlarge": 0.616,
-  "db.m6i.large": 0.171,
-  "db.m6i.xlarge": 0.342,
-  "db.m6i.2xlarge": 0.684,
+  "db.m5.large": 0.178,
+  "db.m5.xlarge": 0.356,
+  "db.m6g.large": 0.159,
+  "db.m6g.xlarge": 0.318,
+  "db.m6g.2xlarge": 0.636,
+  "db.m6i.large": 0.178,
+  "db.m6i.xlarge": 0.356,
+  "db.m6i.2xlarge": 0.712,
   "db.m7g.large": 0.168,
-  "db.m7g.xlarge": 0.336,
-  "db.m7g.2xlarge": 0.672,
+  "db.m7g.xlarge": 0.337,
+  "db.m7g.2xlarge": 0.674,
   "db.r5.large": 0.25,
   "db.r5.xlarge": 0.5,
   "db.r5.2xlarge": 1,
-  "db.r6g.large": 0.218,
-  "db.r6g.xlarge": 0.437,
-  "db.r6g.2xlarge": 0.874,
+  "db.r6g.large": 0.225,
+  "db.r6g.xlarge": 0.45,
+  "db.r6g.2xlarge": 0.899,
   "db.r6i.large": 0.25,
   "db.r6i.xlarge": 0.5,
   "db.r6i.2xlarge": 1
@@ -1012,6 +1172,24 @@ var NAT_PER_GB = 0.045;
 var EKS_HOURLY = 0.1;
 var CACHE_TTL = 86400;
 var BULK_PRICING_BASE = "https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws";
+var AWS_PRICING_HOST = "pricing.us-east-1.amazonaws.com";
+var AWS_REGION_RE = /^[a-z]{2}(?:-(?:gov|iso|isob))?-[a-z]+-\d+$/;
+var AWS_PRICING_SERVICES = /* @__PURE__ */ new Set([
+  "AmazonEC2",
+  "AmazonRDS",
+  "AmazonElastiCache",
+  "AmazonRedshift"
+]);
+function assertValidAwsRegion(region) {
+  if (typeof region !== "string" || !AWS_REGION_RE.test(region)) {
+    throw new Error(`invalid AWS region: ${JSON.stringify(region).slice(0, 64)}`);
+  }
+}
+function assertValidAwsPricingService(service) {
+  if (typeof service !== "string" || !AWS_PRICING_SERVICES.has(service)) {
+    throw new Error(`invalid AWS pricing service: ${JSON.stringify(service).slice(0, 64)}`);
+  }
+}
 var SIZE_ORDER = [
   "nano",
   "micro",
@@ -1028,11 +1206,12 @@ var SIZE_ORDER = [
   "32xlarge",
   "48xlarge"
 ];
-function regionMultiplier(region) {
-  const multipliers = getRegionPriceMultipliers();
-  const mult = multipliers.aws[region.toLowerCase()];
+
+// src/pricing/region-multiplier.ts
+function regionMultiplier(provider, region) {
+  const mult = getRegionPriceMultipliers()[provider][region.toLowerCase()];
   if (mult === void 0) {
-    logger.warn("region-multiplier: unknown AWS region, defaulting to 1.0x", { region });
+    logger.warn("region-multiplier: unknown region, defaulting to 1.0x", { provider, region });
     return 1;
   }
   return mult;
@@ -1041,13 +1220,16 @@ function regionMultiplier(region) {
 // src/pricing/aws/bulk-loader.ts
 var AwsBulkLoader = class {
   cache;
+  /** Cache TTL for pricing writes (seconds); from config.cache.ttl_seconds. */
+  ttlSeconds;
   /**
    * Deduplicates concurrent streaming CSV fetches for the same region.
    * Keyed by region; value is the in-flight Promise<boolean>.
    */
   ec2CsvFetchInProgress = /* @__PURE__ */ new Map();
-  constructor(cache) {
+  constructor(cache, ttlSeconds = CACHE_TTL) {
     this.cache = cache;
+    this.ttlSeconds = ttlSeconds;
   }
   // -------------------------------------------------------------------------
   // Public API
@@ -1074,7 +1256,7 @@ var AwsBulkLoader = class {
       if (bulk) {
         const result = this.extractEc2Price(bulk, instanceType, region, os);
         if (result) {
-          this.cache.set(cacheKey, result, "aws", "ec2", region, CACHE_TTL);
+          this.cache.set(cacheKey, result, "aws", "ec2", region, this.ttlSeconds);
           return result;
         }
       }
@@ -1096,7 +1278,7 @@ var AwsBulkLoader = class {
       if (bulk) {
         const result = this.extractRdsPrice(bulk, instanceClass, region, engine);
         if (result) {
-          this.cache.set(cacheKey, result, "aws", "rds", region, CACHE_TTL);
+          this.cache.set(cacheKey, result, "aws", "rds", region, this.ttlSeconds);
           return result;
         }
       }
@@ -1118,7 +1300,7 @@ var AwsBulkLoader = class {
       if (bulk) {
         const result = this.extractEbsPrice(bulk, volumeType, region);
         if (result) {
-          this.cache.set(cacheKey, result, "aws", "ebs", region, CACHE_TTL);
+          this.cache.set(cacheKey, result, "aws", "ebs", region, this.ttlSeconds);
           return result;
         }
       }
@@ -1131,9 +1313,9 @@ var AwsBulkLoader = class {
     }
     return this.fallbackStoragePrice(volumeType, region, cacheKey);
   }
-  async getLoadBalancerPrice(region) {
-    const multiplier = regionMultiplier(region);
-    return {
+  getLoadBalancerPrice(region) {
+    const multiplier = regionMultiplier("aws", region);
+    return Promise.resolve({
       provider: "aws",
       service: "elb",
       resource_type: "alb",
@@ -1147,11 +1329,11 @@ var AwsBulkLoader = class {
         pricing_model: "fixed_plus_lcu"
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
-  async getNatGatewayPrice(region) {
-    const multiplier = regionMultiplier(region);
-    return {
+  getNatGatewayPrice(region) {
+    const multiplier = regionMultiplier("aws", region);
+    return Promise.resolve({
       provider: "aws",
       service: "vpc",
       resource_type: "nat-gateway",
@@ -1164,11 +1346,11 @@ var AwsBulkLoader = class {
         per_gb_price: String(NAT_PER_GB * multiplier)
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
-  async getKubernetesPrice(region) {
-    const multiplier = regionMultiplier(region);
-    return {
+  getKubernetesPrice(region) {
+    const multiplier = regionMultiplier("aws", region);
+    return Promise.resolve({
       provider: "aws",
       service: "eks",
       resource_type: "cluster",
@@ -1179,7 +1361,7 @@ var AwsBulkLoader = class {
       description: "AWS EKS control plane (per cluster/hour)",
       attributes: {},
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
   // -------------------------------------------------------------------------
   // Internal helpers – EC2 CSV streaming
@@ -1209,7 +1391,8 @@ var AwsBulkLoader = class {
     return promise;
   }
   async _doFetchAndCacheEc2CsvPrices(region) {
-    const url = `${BULK_PRICING_BASE}/AmazonEC2/current/${region}/index.csv`;
+    assertValidAwsRegion(region);
+    const url = `${BULK_PRICING_BASE}/AmazonEC2/current/${encodeURIComponent(region)}/index.csv`;
     logger.debug("Streaming AWS EC2 CSV pricing", { url, region });
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), 12e4);
@@ -1220,7 +1403,11 @@ var AwsBulkLoader = class {
         {
           maxRetries: 1,
           baseDelay: 500,
-          maxDelay: 2e3
+          maxDelay: 2e3,
+          allowedHosts: [AWS_PRICING_HOST],
+          // AWS EC2 CSVs run ~267 MiB today; allow headroom for growth while
+          // still hard-bounding at 512 MiB to prevent adversarial OOM.
+          maxResponseBytes: 512 * 1024 * 1024
         }
       );
       if (!res.ok) {
@@ -1247,7 +1434,7 @@ var AwsBulkLoader = class {
       let headerFound = false;
       let leftover = "";
       let cachedCount = 0;
-      const effectiveDate = (/* @__PURE__ */ new Date()).toISOString();
+      let effectiveDate = (/* @__PURE__ */ new Date()).toISOString();
       while (true) {
         const { value, done } = await reader.read();
         if (done) break;
@@ -1258,6 +1445,17 @@ var AwsBulkLoader = class {
           const line = rawLine.trimEnd();
           if (!line) continue;
           if (!headerFound) {
+            if (line.startsWith('"Publication Date"') || line.startsWith("Publication Date")) {
+              const metaFields = parseCsvLine(line);
+              const rawDate = (metaFields[1] ?? "").trim();
+              if (rawDate) {
+                const parsed = new Date(rawDate);
+                if (!isNaN(parsed.getTime())) {
+                  effectiveDate = parsed.toISOString();
+                }
+              }
+              continue;
+            }
             if (line.startsWith('"SKU"') || line.startsWith("SKU")) {
               const headers = parseCsvLine(line);
               for (let h = 0; h < headers.length; h++) {
@@ -1330,7 +1528,7 @@ var AwsBulkLoader = class {
             },
             effective_date: effectiveDate
           };
-          this.cache.set(csvCacheKey, normalized, "aws", "ec2", region, CACHE_TTL);
+          this.cache.set(csvCacheKey, normalized, "aws", "ec2", region, this.ttlSeconds);
           cachedCount++;
         }
       }
@@ -1362,12 +1560,12 @@ var AwsBulkLoader = class {
                   tenancy: "Shared",
                   pricing_source: "live"
                 },
-                effective_date: (/* @__PURE__ */ new Date()).toISOString()
+                effective_date: effectiveDate
               },
               "aws",
               "ec2",
               region,
-              CACHE_TTL
+              this.ttlSeconds
             );
             cachedCount++;
           }
@@ -1399,14 +1597,19 @@ var AwsBulkLoader = class {
   // Internal helpers – live API fetch
   // -------------------------------------------------------------------------
   async fetchBulkPricing(service, region) {
-    const url = `${BULK_PRICING_BASE}/${service}/current/${region}/index.json`;
+    assertValidAwsPricingService(service);
+    assertValidAwsRegion(region);
+    const url = `${BULK_PRICING_BASE}/${encodeURIComponent(service)}/current/${encodeURIComponent(region)}/index.json`;
     logger.debug("Fetching AWS bulk pricing", { url });
     const res = await fetchWithRetryAndCircuitBreaker(
       url,
       {
         signal: AbortSignal.timeout(3e4)
       },
-      { maxRetries: 0 }
+      {
+        maxRetries: 0,
+        allowedHosts: [AWS_PRICING_HOST]
+      }
     );
     if (!res.ok) {
       throw new Error(`HTTP ${res.status} from ${url}`);
@@ -1422,6 +1625,7 @@ var AwsBulkLoader = class {
   extractEc2Price(bulk, instanceType, region, os) {
     const products = bulk?.products ?? {};
     const onDemand = bulk?.terms?.OnDemand ?? {};
+    const publicationDate = bulk?.publicationDate;
     const sortedEntries = Object.entries(products).sort(([a], [b]) => a.localeCompare(b));
     for (const [sku, product] of sortedEntries) {
       const attrs = product?.attributes ?? {};
@@ -1431,7 +1635,8 @@ var AwsBulkLoader = class {
           return normalizeAwsCompute(
             product,
             { terms: { OnDemand: { [sku]: priceTerms } } },
-            region
+            region,
+            publicationDate
           );
         }
       }
@@ -1441,6 +1646,7 @@ var AwsBulkLoader = class {
   extractRdsPrice(bulk, instanceClass, region, engine) {
     const products = bulk?.products ?? {};
     const onDemand = bulk?.terms?.OnDemand ?? {};
+    const publicationDate = bulk?.publicationDate;
     const sortedEntries = Object.entries(products).sort(([a], [b]) => a.localeCompare(b));
     for (const [sku, product] of sortedEntries) {
       const attrs = product?.attributes ?? {};
@@ -1450,7 +1656,8 @@ var AwsBulkLoader = class {
           return normalizeAwsDatabase(
             product,
             { terms: { OnDemand: { [sku]: priceTerms } } },
-            region
+            region,
+            publicationDate
           );
         }
       }
@@ -1460,6 +1667,7 @@ var AwsBulkLoader = class {
   extractEbsPrice(bulk, volumeType, region) {
     const products = bulk?.products ?? {};
     const onDemand = bulk?.terms?.OnDemand ?? {};
+    const publicationDate = bulk?.publicationDate;
     const sortedEntries = Object.entries(products).sort(([a], [b]) => a.localeCompare(b));
     for (const [sku, product] of sortedEntries) {
       const attrs = product?.attributes ?? {};
@@ -1470,7 +1678,8 @@ var AwsBulkLoader = class {
           return normalizeAwsStorage(
             product,
             { terms: { OnDemand: { [sku]: priceTerms } } },
-            region
+            region,
+            publicationDate
           );
         }
       }
@@ -1486,7 +1695,7 @@ var AwsBulkLoader = class {
       logger.warn("No fallback price found for EC2 instance type", { instanceType });
       return null;
     }
-    const multiplier = regionMultiplier(region);
+    const multiplier = regionMultiplier("aws", region);
     const result = {
       provider: "aws",
       service: "ec2",
@@ -1504,7 +1713,7 @@ var AwsBulkLoader = class {
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
     };
-    this.cache.set(cacheKey, result, "aws", "ec2", region, CACHE_TTL);
+    this.cache.set(cacheKey, result, "aws", "ec2", region, this.ttlSeconds);
     return result;
   }
   fallbackDatabasePrice(instanceClass, region, engine, cacheKey) {
@@ -1513,7 +1722,7 @@ var AwsBulkLoader = class {
       logger.warn("No fallback price found for RDS instance class", { instanceClass });
       return null;
     }
-    const multiplier = regionMultiplier(region);
+    const multiplier = regionMultiplier("aws", region);
     const result = {
       provider: "aws",
       service: "rds",
@@ -1531,7 +1740,7 @@ var AwsBulkLoader = class {
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
     };
-    this.cache.set(cacheKey, result, "aws", "rds", region, CACHE_TTL);
+    this.cache.set(cacheKey, result, "aws", "rds", region, this.ttlSeconds);
     return result;
   }
   fallbackStoragePrice(volumeType, region, cacheKey) {
@@ -1540,7 +1749,7 @@ var AwsBulkLoader = class {
       logger.warn("No fallback price found for EBS volume type", { volumeType });
       return null;
     }
-    const multiplier = regionMultiplier(region);
+    const multiplier = regionMultiplier("aws", region);
     const result = {
       provider: "aws",
       service: "ebs",
@@ -1556,74 +1765,411 @@ var AwsBulkLoader = class {
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
     };
-    this.cache.set(cacheKey, result, "aws", "ebs", region, CACHE_TTL);
+    this.cache.set(cacheKey, result, "aws", "ebs", region, this.ttlSeconds);
     return result;
   }
 };
 
-// src/pricing/azure/azure-normalizer.ts
-function normalizeAzureCompute(item) {
-  return {
-    provider: "azure",
-    service: "virtual-machines",
-    resource_type: item.skuName ?? item.armSkuName ?? "unknown",
-    region: item.armRegionName ?? item.location ?? "",
-    unit: item.unitOfMeasure ?? "1 Hour",
-    price_per_unit: item.retailPrice ?? item.unitPrice ?? 0,
-    currency: item.currencyCode ?? "USD",
-    tier: item.tierMinimumUnits !== void 0 ? String(item.tierMinimumUnits) : void 0,
-    description: item.productName ?? void 0,
-    attributes: {
-      sku_name: item.skuName ?? "",
-      arm_sku_name: item.armSkuName ?? "",
-      service_name: item.serviceName ?? "Virtual Machines",
-      product_name: item.productName ?? "",
-      meter_name: item.meterName ?? "",
-      pricing_source: "live"
-    },
-    effective_date: item.effectiveStartDate ?? (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function normalizeAzureDatabase(item) {
-  return {
-    provider: "azure",
-    service: "azure-database",
-    resource_type: item.skuName ?? item.armSkuName ?? "unknown",
-    region: item.armRegionName ?? item.location ?? "",
-    unit: item.unitOfMeasure ?? "1 Hour",
-    price_per_unit: item.retailPrice ?? item.unitPrice ?? 0,
-    currency: item.currencyCode ?? "USD",
-    description: item.productName ?? void 0,
-    attributes: {
-      sku_name: item.skuName ?? "",
-      service_name: item.serviceName ?? "",
-      product_name: item.productName ?? "",
-      meter_name: item.meterName ?? "",
-      pricing_source: "live"
-    },
-    effective_date: item.effectiveStartDate ?? (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function normalizeAzureStorage(item) {
-  return {
-    provider: "azure",
-    service: "managed-disks",
-    resource_type: item.skuName ?? item.armSkuName ?? "unknown",
-    region: item.armRegionName ?? item.location ?? "",
-    unit: item.unitOfMeasure ?? "1 GiB/Month",
-    price_per_unit: item.retailPrice ?? item.unitPrice ?? 0,
-    currency: item.currencyCode ?? "USD",
-    description: item.productName ?? void 0,
-    attributes: {
-      sku_name: item.skuName ?? "",
-      service_name: item.serviceName ?? "",
-      product_name: item.productName ?? "",
-      meter_name: item.meterName ?? "",
+// src/pricing/aws/spot-client.ts
+var SPOT_ADVISOR_URL = "https://website.spot.ec2.aws.a2z.com/spot.json";
+var SPOT_ADVISOR_CACHE_KEY = "aws/spot-advisor/v1";
+var AwsSpotClient = class {
+  cache;
+  /** Cache TTL for pricing writes (seconds); from config.cache.ttl_seconds. */
+  ttlSeconds;
+  /** In-flight fetch deduplication. */
+  inflight = null;
+  constructor(cache, ttlSeconds = CACHE_TTL) {
+    this.cache = cache;
+    this.ttlSeconds = ttlSeconds;
+  }
+  /**
+   * Get the spot discount factor (0–1) for an instance type in a region.
+   *
+   * Returns a fraction representing the **portion of on-demand you pay** — i.e.
+   * `hourly_spot = hourly_on_demand * factor`. Returns null when the live data
+   * is unavailable or doesn't cover the given instance/region combination;
+   * callers should fall back to static family-based estimates in that case.
+   */
+  async getSpotFactor(instanceType, region, os = "Linux") {
+    try {
+      const doc = await this.loadDocument();
+      if (!doc) return null;
+      const regionData = doc.spot_advisor?.[region];
+      if (!regionData) return null;
+      const osKey = os === "Windows" ? "Windows" : "Linux";
+      const osData = regionData[osKey];
+      if (!osData) return null;
+      const entry = osData[instanceType];
+      if (!entry || typeof entry.s !== "number") return null;
+      const savingsPct = Math.max(0, Math.min(95, entry.s));
+      const factor = 1 - savingsPct / 100;
+      return Math.max(0.05, factor);
+    } catch (err) {
+      logger.debug("AwsSpotClient.getSpotFactor failed", {
+        instanceType,
+        region,
+        err: err instanceof Error ? err.message : String(err)
+      });
+      return null;
+    }
+  }
+  /**
+   * Fetch and cache the full Spot Advisor document. Uses the shared SQLite
+   * cache with the same TTL as other AWS bulk data. Deduplicates concurrent
+   * callers via an in-flight promise.
+   */
+  loadDocument() {
+    const cached = this.cache.get(SPOT_ADVISOR_CACHE_KEY);
+    if (cached) return Promise.resolve(cached);
+    if (this.inflight) return this.inflight;
+    this.inflight = this.doFetchDocument().finally(() => {
+      this.inflight = null;
+    });
+    return this.inflight;
+  }
+  async doFetchDocument() {
+    logger.debug("Fetching AWS Spot Advisor JSON", { url: SPOT_ADVISOR_URL });
+    try {
+      const res = await fetchWithRetryAndCircuitBreaker(
+        SPOT_ADVISOR_URL,
+        { signal: AbortSignal.timeout(2e4) },
+        { maxRetries: 1, baseDelay: 500, maxDelay: 2e3 }
+      );
+      if (!res.ok) {
+        logger.debug("AWS Spot Advisor fetch returned non-OK", { status: res.status });
+        return null;
+      }
+      const doc = await res.json();
+      if (!doc || typeof doc.spot_advisor !== "object") {
+        logger.debug("AWS Spot Advisor response missing spot_advisor key");
+        return null;
+      }
+      this.cache.set(SPOT_ADVISOR_CACHE_KEY, doc, "aws", "spot-advisor", "global", this.ttlSeconds);
+      return doc;
+    } catch (err) {
+      logger.debug("AWS Spot Advisor fetch failed", {
+        err: err instanceof Error ? err.message : String(err)
+      });
+      return null;
+    }
+  }
+};
+
+// src/pricing/aws/reserved-client.ts
+var HOURS_IN_TERM = {
+  "1yr": 24 * 365,
+  "3yr": 24 * 365 * 3
+};
+function extractRiRatesFromBulk(bulk, instanceType, os = "Linux") {
+  const products = bulk?.products ?? {};
+  const onDemand = bulk?.terms?.OnDemand ?? {};
+  const reserved = bulk?.terms?.Reserved ?? {};
+  let targetSku = null;
+  for (const [sku, product] of Object.entries(products)) {
+    const attrs = product?.attributes ?? {};
+    if (attrs.instanceType === instanceType && (attrs.operatingSystem ?? "").toLowerCase() === os.toLowerCase() && attrs.tenancy === "Shared" && attrs.capacitystatus === "Used") {
+      targetSku = sku;
+      break;
+    }
+  }
+  if (!targetSku) return [];
+  const onDemandHourly = firstHourlyPrice(onDemand[targetSku]);
+  if (!onDemandHourly || onDemandHourly <= 0) return [];
+  const reservedOffers = reserved[targetSku];
+  if (!reservedOffers) return [];
+  const rates = [];
+  for (const offer of Object.values(reservedOffers)) {
+    const lease = offer.termAttributes?.LeaseContractLength;
+    const purchase = offer.termAttributes?.PurchaseOption;
+    const term = normalizeTerm(lease);
+    const payment = normalizePayment(purchase);
+    if (!term || !payment) continue;
+    const effectiveHourly = computeEffectiveHourly(offer, term);
+    if (effectiveHourly === null) continue;
+    const rate = 1 - effectiveHourly / onDemandHourly;
+    if (rate <= 0 || rate >= 0.9) continue;
+    rates.push({ term, payment, rate });
+  }
+  return rates;
+}
+var AwsReservedClient = class {
+  cache;
+  /** Cache TTL for pricing writes (seconds); from config.cache.ttl_seconds. */
+  ttlSeconds;
+  constructor(cache, ttlSeconds = CACHE_TTL) {
+    this.cache = cache;
+    this.ttlSeconds = ttlSeconds;
+  }
+  async getRiRates(service, instanceType, region, os = "Linux") {
+    if (service === "AmazonEC2") {
+      logger.debug(
+        "AwsReservedClient: refusing AmazonEC2 (bulk JSON too large for in-memory parse)",
+        {
+          instanceType,
+          region
+        }
+      );
+      return null;
+    }
+    const cacheKey = `aws/ri/${service.toLowerCase()}/${region.toLowerCase()}/${instanceType.toLowerCase()}/${os.toLowerCase()}`;
+    const cached = this.cache.get(cacheKey);
+    if (cached && Array.isArray(cached.rates)) return cached.rates;
+    assertValidAwsPricingService(service);
+    assertValidAwsRegion(region);
+    const url = `${BULK_PRICING_BASE}/${encodeURIComponent(service)}/current/${encodeURIComponent(region)}/index.json`;
+    logger.debug("Fetching AWS bulk pricing for RI rates", { url });
+    try {
+      const res = await fetchWithRetryAndCircuitBreaker(
+        url,
+        { signal: AbortSignal.timeout(6e4) },
+        {
+          maxRetries: 0,
+          allowedHosts: [AWS_PRICING_HOST]
+        }
+      );
+      if (!res.ok) {
+        logger.debug("AWS RI bulk fetch non-OK", { status: res.status });
+        return null;
+      }
+      const bulk = await res.json();
+      const rates = extractRiRatesFromBulk(bulk, instanceType, os);
+      if (rates.length === 0) return null;
+      const entry = {
+        price_per_unit: 0,
+        unit: "none",
+        rates
+      };
+      this.cache.set(cacheKey, entry, "aws", "ri", region, this.ttlSeconds);
+      return rates;
+    } catch (err) {
+      logger.debug("AWS RI bulk fetch failed, will use static fallback", {
+        instanceType,
+        region,
+        err: err instanceof Error ? err.message : String(err)
+      });
+      return null;
+    }
+  }
+};
+function firstHourlyPrice(terms) {
+  if (!terms) return null;
+  for (const term of Object.values(terms)) {
+    for (const dim of Object.values(term.priceDimensions ?? {})) {
+      if ((dim.unit ?? "").toLowerCase().startsWith("hr")) {
+        const price = parseFloat(dim.pricePerUnit?.USD ?? "");
+        if (isFinite(price) && price > 0) return price;
+      }
+    }
+  }
+  return null;
+}
+function computeEffectiveHourly(offer, term) {
+  let upfront = 0;
+  let hourly = 0;
+  let sawAnything = false;
+  for (const dim of Object.values(offer.priceDimensions ?? {})) {
+    const unit = (dim.unit ?? "").toLowerCase();
+    const value = parseFloat(dim.pricePerUnit?.USD ?? "");
+    if (!isFinite(value)) continue;
+    if (unit.startsWith("hr")) {
+      hourly = value;
+      sawAnything = true;
+    } else if (unit === "quantity") {
+      upfront = value;
+      sawAnything = true;
+    }
+  }
+  if (!sawAnything) return null;
+  return hourly + upfront / HOURS_IN_TERM[term];
+}
+function normalizeTerm(lease) {
+  if (lease === "1yr") return "1yr";
+  if (lease === "3yr") return "3yr";
+  return null;
+}
+function normalizePayment(purchase) {
+  switch (purchase) {
+    case "No Upfront":
+      return "no_upfront";
+    case "All Upfront":
+      return "all_upfront";
+    case "Partial Upfront":
+      return "partial_upfront";
+    default:
+      return null;
+  }
+}
+
+// src/pricing/azure/azure-normalizer.ts
+function normalize2(item, spec) {
+  return {
+    provider: "azure",
+    service: spec.service,
+    resource_type: item.skuName ?? item.armSkuName ?? "unknown",
+    region: item.armRegionName ?? item.location ?? "",
+    unit: item.unitOfMeasure ?? spec.defaultUnit,
+    price_per_unit: item.retailPrice ?? item.unitPrice ?? 0,
+    currency: item.currencyCode ?? "USD",
+    tier: spec.includeTier && item.tierMinimumUnits !== void 0 ? String(item.tierMinimumUnits) : void 0,
+    description: item.productName ?? void 0,
+    attributes: {
+      sku_name: item.skuName ?? "",
+      ...spec.extraAttributes?.(item),
+      service_name: item.serviceName ?? spec.defaultServiceName ?? "",
+      product_name: item.productName ?? "",
+      meter_name: item.meterName ?? "",
       pricing_source: "live"
     },
-    effective_date: item.effectiveStartDate ?? (/* @__PURE__ */ new Date()).toISOString()
+    effective_date: resolveEffectiveDate(item.effectiveStartDate)
   };
 }
+function normalizeAzureCompute(item) {
+  return normalize2(item, {
+    service: "virtual-machines",
+    defaultUnit: "1 Hour",
+    includeTier: true,
+    defaultServiceName: "Virtual Machines",
+    extraAttributes: (i) => ({ arm_sku_name: i.armSkuName ?? "" })
+  });
+}
+function normalizeAzureDatabase(item) {
+  return normalize2(item, {
+    service: "azure-database",
+    defaultUnit: "1 Hour"
+  });
+}
+function normalizeAzureStorage(item) {
+  return normalize2(item, {
+    service: "managed-disks",
+    defaultUnit: "1 GiB/Month"
+  });
+}
+
+// src/pricing/azure/arm-regions.ts
+var ARM_REGION_MAP = {
+  // Americas
+  eastus: "eastus",
+  eastus2: "eastus2",
+  eastus3: "eastus3",
+  southcentralus: "southcentralus",
+  westus: "westus",
+  westus2: "westus2",
+  westus3: "westus3",
+  centralus: "centralus",
+  northcentralus: "northcentralus",
+  westcentralus: "westcentralus",
+  canadacentral: "canadacentral",
+  canadaeast: "canadaeast",
+  brazilsouth: "brazilsouth",
+  brazilsoutheast: "brazilsoutheast",
+  mexicocentral: "mexicocentral",
+  // Europe
+  northeurope: "northeurope",
+  westeurope: "westeurope",
+  uksouth: "uksouth",
+  ukwest: "ukwest",
+  francecentral: "francecentral",
+  francesouth: "francesouth",
+  germanywestcentral: "germanywestcentral",
+  germanynorth: "germanynorth",
+  switzerlandnorth: "switzerlandnorth",
+  switzerlandwest: "switzerlandwest",
+  norwayeast: "norwayeast",
+  norwaywest: "norwaywest",
+  swedencentral: "swedencentral",
+  swedensouth: "swedensouth",
+  polandcentral: "polandcentral",
+  italynorth: "italynorth",
+  spaincentral: "spaincentral",
+  // Asia Pacific
+  eastasia: "eastasia",
+  southeastasia: "southeastasia",
+  japaneast: "japaneast",
+  japanwest: "japanwest",
+  australiaeast: "australiaeast",
+  australiasoutheast: "australiasoutheast",
+  australiacentral: "australiacentral",
+  australiacentral2: "australiacentral2",
+  centralindia: "centralindia",
+  southindia: "southindia",
+  westindia: "westindia",
+  jioindiawest: "jioindiawest",
+  jioindiacentral: "jioindiacentral",
+  koreacentral: "koreacentral",
+  koreasouth: "koreasouth",
+  // Middle East / Africa
+  uaenorth: "uaenorth",
+  uaecentral: "uaecentral",
+  qatarcentral: "qatarcentral",
+  israelcentral: "israelcentral",
+  southafricanorth: "southafricanorth",
+  southafricawest: "southafricawest"
+};
+var ALIASES = {
+  // Americas
+  eastus: "eastus",
+  eastus2: "eastus2",
+  eastus3: "eastus3",
+  southcentralus: "southcentralus",
+  westus: "westus",
+  westus2: "westus2",
+  westus3: "westus3",
+  centralus: "centralus",
+  northcentralus: "northcentralus",
+  westcentralus: "westcentralus",
+  canadacentral: "canadacentral",
+  canadaeast: "canadaeast",
+  brazilsouth: "brazilsouth",
+  brazilsoutheast: "brazilsoutheast",
+  mexicocentral: "mexicocentral",
+  // Europe
+  northeurope: "northeurope",
+  westeurope: "westeurope",
+  uksouth: "uksouth",
+  ukwest: "ukwest",
+  francecentral: "francecentral",
+  francesouth: "francesouth",
+  germanywestcentral: "germanywestcentral",
+  germanynorth: "germanynorth",
+  switzerlandnorth: "switzerlandnorth",
+  switzerlandwest: "switzerlandwest",
+  norwayeast: "norwayeast",
+  norwaywest: "norwaywest",
+  swedencentral: "swedencentral",
+  swedensouth: "swedensouth",
+  polandcentral: "polandcentral",
+  italynorth: "italynorth",
+  spaincentral: "spaincentral",
+  // Asia Pacific
+  eastasia: "eastasia",
+  southeastasia: "southeastasia",
+  japaneast: "japaneast",
+  japanwest: "japanwest",
+  australiaeast: "australiaeast",
+  australiasoutheast: "australiasoutheast",
+  australiacentral: "australiacentral",
+  australiacentral2: "australiacentral2",
+  centralindia: "centralindia",
+  southindia: "southindia",
+  westindia: "westindia",
+  jioindiawest: "jioindiawest",
+  jioindiacentral: "jioindiacentral",
+  koreacentral: "koreacentral",
+  koreasouth: "koreasouth",
+  // Middle East / Africa
+  uaenorth: "uaenorth",
+  uaecentral: "uaecentral",
+  qatarcentral: "qatarcentral",
+  israelcentral: "israelcentral",
+  southafricanorth: "southafricanorth",
+  southafricawest: "southafricawest"
+};
+function toArmRegionName(region) {
+  if (!region) return region;
+  const key = region.toLowerCase().replace(/[^a-z0-9]/g, "");
+  return ALIASES[key] ?? ARM_REGION_MAP[key] ?? key;
+}
 
 // src/pricing/azure/fallback-data.ts
 var VM_BASE_PRICES = {
@@ -1655,27 +2201,26 @@ var VM_BASE_PRICES = {
   standard_e32s_v5: 2.016,
   standard_e2ds_v5: 0.144,
   standard_e4ds_v5: 0.288,
-  standard_f2s_v2: 0.085,
-  standard_f4s_v2: 0.17,
-  standard_f8s_v2: 0.34,
-  standard_f16s_v2: 0.68,
-  standard_f32s_v2: 1.36,
-  standard_l8s_v3: 0.624,
-  standard_l16s_v3: 1.248,
+  standard_f2s_v2: 0.0846,
+  standard_f4s_v2: 0.169,
+  standard_f8s_v2: 0.338,
+  standard_f16s_v2: 0.677,
+  standard_f32s_v2: 1.353,
+  standard_l8s_v3: 0.696,
+  standard_l16s_v3: 1.392,
   standard_nc4as_t4_v3: 0.526,
   standard_nc8as_t4_v3: 0.752,
   standard_e2ps_v5: 0.101,
   standard_e4ps_v5: 0.202,
   standard_e8ps_v5: 0.403,
-  // v6 series
-  standard_d2s_v6: 0.096,
-  standard_d4s_v6: 0.192,
-  standard_d8s_v6: 0.384,
-  standard_d16s_v6: 0.768,
-  standard_e2s_v6: 0.126,
-  standard_e4s_v6: 0.252,
-  standard_e8s_v6: 0.504,
-  standard_e16s_v6: 1.008
+  standard_d2s_v6: 0.101,
+  standard_d4s_v6: 0.202,
+  standard_d8s_v6: 0.403,
+  standard_d16s_v6: 0.806,
+  standard_e2s_v6: 0.132,
+  standard_e4s_v6: 0.265,
+  standard_e8s_v6: 0.529,
+  standard_e16s_v6: 1.058
 };
 var DISK_BASE_PRICES = {
   premium_lrs: 0.132,
@@ -1710,21 +2255,15 @@ var NAT_PER_GB2 = 0.045;
 var AKS_HOURLY = 0.1;
 var CACHE_TTL2 = 86400;
 var RETAIL_API_BASE = "https://prices.azure.com/api/retail/prices";
-function regionMultiplier2(region) {
-  const multipliers = getRegionPriceMultipliers();
-  const mult = multipliers.azure[region.toLowerCase()];
-  if (mult === void 0) {
-    logger.warn("region-multiplier: unknown Azure region, defaulting to 1.0x", { region });
-    return 1;
-  }
-  return mult;
-}
 
 // src/pricing/azure/retail-client.ts
 var AzureRetailClient = class {
   cache;
-  constructor(cache) {
+  /** Cache TTL for pricing writes (seconds); from config.cache.ttl_seconds. */
+  ttlSeconds;
+  constructor(cache, ttlSeconds = CACHE_TTL2) {
     this.cache = cache;
+    this.ttlSeconds = ttlSeconds;
   }
   // -------------------------------------------------------------------------
   // Public API
@@ -1734,13 +2273,13 @@ var AzureRetailClient = class {
     const cached = this.cache.get(cacheKey);
     if (cached) return cached;
     try {
-      const armRegion = region.toLowerCase().replace(/\s+/g, "");
+      const armRegion = toArmRegionName(region);
       const filter = this.buildODataFilter("Virtual Machines", armRegion, vmSize, true);
       const items = await this.queryPricing(filter);
       const match = this.pickVmItem(items, vmSize, os);
       if (match) {
         const result = normalizeAzureCompute(match);
-        this.cache.set(cacheKey, result, "azure", "vm", region, CACHE_TTL2);
+        this.cache.set(cacheKey, result, "azure", "vm", region, this.ttlSeconds);
         return result;
       }
     } catch (err) {
@@ -1757,11 +2296,11 @@ var AzureRetailClient = class {
     const cached = this.cache.get(cacheKey);
     if (cached) return cached;
     try {
-      const armRegion = region.toLowerCase().replace(/\s+/g, "");
+      const armRegion = toArmRegionName(region);
       const serviceName = `Azure Database for ${engine}`;
       const result = await this.queryDatabasePrice(tier, armRegion, serviceName);
       if (result) {
-        this.cache.set(cacheKey, result, "azure", "db", region, CACHE_TTL2);
+        this.cache.set(cacheKey, result, "azure", "db", region, this.ttlSeconds);
         return result;
       }
       logger.warn("Azure Retail API returned no matching DB pricing", {
@@ -1816,28 +2355,34 @@ var AzureRetailClient = class {
   /**
    * Parse a VM name like "Standard_D2s_v3" into series info.
    * Returns { series: "Dsv3", vcpus: 2 } or null if unparseable.
+   *
+   * Real-world Azure SKUs have a lot of shape variation we have to handle:
+   *   Standard_D2s_v5            – 1-letter family, lower-case variant
+   *   Standard_M64ms_v2          – multi-digit vCPU count
+   *   Standard_DC4s_v3           – 2-letter family (confidential compute)
+   *   Standard_E96ias_v5         – longer (3-letter) variant
+   *   Standard_NC4as_T4_v3       – mid-name accelerator segment (T4)
+   *   Standard_Eb8as_v5          – single-letter "sub-family" prefix (b)
+   *
+   * The regex below accepts:
+   *   <FAMILY 1-2 letters><optional sub-family letter><vCPU digits>
+   *   <variant letters><optional _SEG segments like _T4>_v<version digits>
    */
   parseVmSeries(vmName) {
-    const match = vmName.match(/Standard_([A-Z])(\d+)([a-z]*)_v(\d+)/i);
-    if (!match) return null;
-    const [, family, vcpuStr, variant, version] = match;
-    const vcpus = parseInt(vcpuStr, 10);
-    if (isNaN(vcpus) || vcpus === 0) return null;
-    const series = `${family}${variant}v${version}`;
-    return { series, vcpus };
+    return parseAzureVmSeries(vmName);
   }
   async getStoragePrice(diskType, region) {
     const cacheKey = this.buildCacheKey("disk", region, diskType);
     const cached = this.cache.get(cacheKey);
     if (cached) return cached;
     try {
-      const armRegion = region.toLowerCase().replace(/\s+/g, "");
+      const armRegion = toArmRegionName(region);
       const filter = this.buildODataFilter("Storage", armRegion, diskType);
       const items = await this.queryPricing(filter);
       if (items.length > 0) {
         items.sort((a, b) => (a.skuId ?? "").localeCompare(b.skuId ?? ""));
         const result = normalizeAzureStorage(items[0]);
-        this.cache.set(cacheKey, result, "azure", "storage", region, CACHE_TTL2);
+        this.cache.set(cacheKey, result, "azure", "storage", region, this.ttlSeconds);
         return result;
       }
       logger.warn("Azure Retail API returned no matching storage pricing", {
@@ -1853,9 +2398,9 @@ var AzureRetailClient = class {
     }
     return this.fallbackStoragePrice(diskType, region, cacheKey);
   }
-  async getLoadBalancerPrice(region) {
-    const multiplier = regionMultiplier2(region);
-    return {
+  getLoadBalancerPrice(region) {
+    const multiplier = regionMultiplier("azure", region);
+    return Promise.resolve({
       provider: "azure",
       service: "load-balancer",
       resource_type: "standard",
@@ -1869,11 +2414,11 @@ var AzureRetailClient = class {
         pricing_model: "fixed_plus_rules"
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
-  async getNatGatewayPrice(region) {
-    const multiplier = regionMultiplier2(region);
-    return {
+  getNatGatewayPrice(region) {
+    const multiplier = regionMultiplier("azure", region);
+    return Promise.resolve({
       provider: "azure",
       service: "nat-gateway",
       resource_type: "nat-gateway",
@@ -1886,11 +2431,11 @@ var AzureRetailClient = class {
         per_gb_price: String(NAT_PER_GB2 * multiplier)
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
-  async getKubernetesPrice(region) {
-    const multiplier = regionMultiplier2(region);
-    return {
+  getKubernetesPrice(region) {
+    const multiplier = regionMultiplier("azure", region);
+    return Promise.resolve({
       provider: "azure",
       service: "aks",
       resource_type: "cluster",
@@ -1901,7 +2446,113 @@ var AzureRetailClient = class {
       description: "Azure Kubernetes Service (uptime SLA tier, per cluster/hour)",
       attributes: {},
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
+  }
+  /**
+   * Fetch the live Spot VM price for a given VM size/region/OS from the Azure
+   * Retail Prices API. Spot VMs are exposed as distinct rows where the
+   * `meterName` contains "Spot" (e.g. "D2s v5 Spot"). Returns `null` when no
+   * spot row is found — callers should fall back to static discount factors.
+   *
+   * Cache key is namespaced under "vm-spot" so spot and on-demand entries
+   * don't collide.
+   */
+  async getSpotPrice(vmSize, region, os = "linux") {
+    const cacheKey = this.buildCacheKey("vm-spot", region, vmSize, os);
+    const cached = this.cache.get(cacheKey);
+    if (cached) return cached;
+    try {
+      const armRegion = toArmRegionName(region);
+      const filter = this.buildODataFilter("Virtual Machines", armRegion, vmSize, true);
+      const items = await this.queryPricing(filter);
+      const isWindows = os.toLowerCase().includes("windows");
+      const spotItems = items.filter((i) => {
+        const meter = (i.meterName ?? "").toLowerCase();
+        const sku = (i.skuName ?? "").toLowerCase();
+        const hasWindows = sku.includes("windows") || meter.includes("windows");
+        const isSpot = meter.includes("spot") || sku.includes("spot");
+        return isSpot && (isWindows && hasWindows || !isWindows && !hasWindows);
+      });
+      if (spotItems.length > 0) {
+        spotItems.sort((a, b) => (a.skuId ?? "").localeCompare(b.skuId ?? ""));
+        const result = normalizeAzureCompute(spotItems[0]);
+        result.attributes.pricing_source = "live";
+        result.attributes.purchase_option = "spot";
+        this.cache.set(cacheKey, result, "azure", "vm-spot", region, this.ttlSeconds);
+        return result;
+      }
+    } catch (err) {
+      logger.warn("Azure Retail API Spot fetch failed", {
+        region,
+        vmSize,
+        err: err instanceof Error ? err.message : String(err)
+      });
+    }
+    return null;
+  }
+  /**
+   * Fetch the live Reservation price for a VM size/region/term from the Azure
+   * Retail Prices API. The API exposes reservations via `priceType eq
+   * 'Reservation'`, with `reservationTerm` of "1 Year" or "3 Years". Returns
+   * `null` when no reservation row matches — callers should fall back to
+   * static discount factors.
+   *
+   * The returned NormalizedPrice uses the reservation's `unitOfMeasure`
+   * (typically "1 Hour" after Azure's per-hour amortisation but sometimes
+   * "1/Year" for upfront payment). The `retailPrice` is the total reservation
+   * price as returned — callers are expected to convert to an hourly rate
+   * themselves using the unit.
+   */
+  async getReservationPrice(vmSize, region, term) {
+    const cacheKey = this.buildCacheKey("vm-ri", region, vmSize, term);
+    const cached = this.cache.get(cacheKey);
+    if (cached) return cached;
+    try {
+      const armRegion = toArmRegionName(region);
+      const termLabel = term === "1yr" ? "1 Year" : "3 Years";
+      const filter = `serviceName eq 'Virtual Machines' and armRegionName eq '${armRegion}' and priceType eq 'Reservation' and armSkuName eq '${vmSize}'`;
+      const items = await this.queryPricing(filter);
+      const matches = items.filter((i) => (i.reservationTerm ?? "") === termLabel);
+      if (matches.length > 0) {
+        matches.sort((a, b) => (a.skuId ?? "").localeCompare(b.skuId ?? ""));
+        const result = normalizeAzureCompute(matches[0]);
+        result.attributes.pricing_source = "live";
+        result.attributes.purchase_option = "reservation";
+        result.attributes.reservation_term = termLabel;
+        this.cache.set(cacheKey, result, "azure", "vm-ri", region, this.ttlSeconds);
+        return result;
+      }
+    } catch (err) {
+      logger.warn("Azure Retail API Reservation fetch failed", {
+        region,
+        vmSize,
+        term,
+        err: err instanceof Error ? err.message : String(err)
+      });
+    }
+    return null;
+  }
+  /**
+   * Convenience helper: given a VM size and region, return the effective
+   * *hourly* reservation rate (amortised). Returns `null` when the live API
+   * has no matching reservation. This wraps `getReservationPrice` and
+   * converts "1/Year" / "1/3 Years" billed units into an hourly equivalent
+   * using a 730h/month * 12 / 36 month assumption.
+   */
+  async getReservationHourlyRate(vmSize, region, term) {
+    const price = await this.getReservationPrice(vmSize, region, term);
+    if (!price) return null;
+    const unit = (price.unit ?? "").toLowerCase();
+    const raw = price.price_per_unit;
+    if (!isFinite(raw) || raw <= 0) return null;
+    if (unit.includes("hour")) {
+      return raw;
+    }
+    if (unit.includes("year")) {
+      const years = term === "1yr" ? 1 : 3;
+      return raw / (8760 * years);
+    }
+    return raw;
   }
   // -------------------------------------------------------------------------
   // Internal helpers – live API
@@ -1927,8 +2578,8 @@ var AzureRetailClient = class {
     }
     return allItems;
   }
-  buildODataFilter(service, armRegion, skuName, exactArmSku) {
-    let filter = `serviceName eq '${service}' and armRegionName eq '${armRegion}' and priceType eq 'Consumption'`;
+  buildODataFilter(service, armRegion, skuName, exactArmSku, priceType = "Consumption") {
+    let filter = `serviceName eq '${service}' and armRegionName eq '${armRegion}' and priceType eq '${priceType}'`;
     if (skuName) {
       if (exactArmSku) {
         filter += ` and armSkuName eq '${skuName}'`;
@@ -1949,16 +2600,20 @@ var AzureRetailClient = class {
   pickVmItem(items, vmSize, os) {
     if (items.length === 0) return null;
     const sorted = [...items].sort((a, b) => (a.skuId ?? "").localeCompare(b.skuId ?? ""));
-    const vmLower = vmSize.toLowerCase();
+    const skuFragment = vmSize.toLowerCase().replace(/^standard_/, "").replace(/_/g, " ");
     const isWindows = os.toLowerCase().includes("windows");
-    for (const item of sorted) {
+    const onDemand = sorted.filter((item) => {
+      const meterLower = (item.meterName ?? "").toLowerCase();
+      return !meterLower.includes("low priority") && !meterLower.includes("spot");
+    });
+    for (const item of onDemand) {
       const skuLower = (item.skuName ?? "").toLowerCase();
-      const hasWindows = skuLower.includes("windows");
-      if (skuLower.includes(vmLower) && (isWindows && hasWindows || !isWindows && !hasWindows)) {
+      const hasWindows = skuLower.includes("windows") || (item.productName ?? "").toLowerCase().includes("windows");
+      if (skuLower.includes(skuFragment) && (isWindows && hasWindows || !isWindows && !hasWindows)) {
         return item;
       }
     }
-    return sorted[0];
+    return onDemand[0] ?? sorted[0];
   }
   // -------------------------------------------------------------------------
   // Internal helpers – size interpolation
@@ -1998,7 +2653,7 @@ var AzureRetailClient = class {
       logger.warn("No fallback price found for Azure VM size", { vmSize });
       return null;
     }
-    const multiplier = regionMultiplier2(region);
+    const multiplier = regionMultiplier("azure", region);
     const result = {
       provider: "azure",
       service: "virtual-machines",
@@ -2015,7 +2670,7 @@ var AzureRetailClient = class {
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
     };
-    this.cache.set(cacheKey, result, "azure", "vm", region, CACHE_TTL2);
+    this.cache.set(cacheKey, result, "azure", "vm", region, this.ttlSeconds);
     return result;
   }
   fallbackDatabasePrice(tier, region, engine, cacheKey) {
@@ -2025,7 +2680,7 @@ var AzureRetailClient = class {
       logger.warn("No fallback price found for Azure DB tier", { tier });
       return null;
     }
-    const multiplier = regionMultiplier2(region);
+    const multiplier = regionMultiplier("azure", region);
     const result = {
       provider: "azure",
       service: "azure-database",
@@ -2042,7 +2697,7 @@ var AzureRetailClient = class {
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
     };
-    this.cache.set(cacheKey, result, "azure", "db", region, CACHE_TTL2);
+    this.cache.set(cacheKey, result, "azure", "db", region, this.ttlSeconds);
     return result;
   }
   fallbackStoragePrice(diskType, region, cacheKey) {
@@ -2052,7 +2707,7 @@ var AzureRetailClient = class {
       logger.warn("No fallback price found for Azure disk type", { diskType });
       return null;
     }
-    const multiplier = regionMultiplier2(region);
+    const multiplier = regionMultiplier("azure", region);
     const result = {
       provider: "azure",
       service: "managed-disks",
@@ -2068,79 +2723,77 @@ var AzureRetailClient = class {
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
     };
-    this.cache.set(cacheKey, result, "azure", "storage", region, CACHE_TTL2);
+    this.cache.set(cacheKey, result, "azure", "storage", region, this.ttlSeconds);
     return result;
   }
 };
+function parseAzureVmSeries(vmName) {
+  const match = vmName.match(
+    /^Standard_([A-Z]{1,2})([a-z]?)(\d+)([a-z]*)((?:_[A-Za-z0-9]+)*)_v(\d+)$/i
+  );
+  if (!match) return null;
+  const [, family, subFamily, vcpuStr, variant, extras, version] = match;
+  const vcpus = parseInt(vcpuStr, 10);
+  if (isNaN(vcpus) || vcpus === 0) return null;
+  const extrasJoined = (extras ?? "").replace(/_/g, "");
+  const series = `${family}${subFamily}${variant}${extrasJoined}v${version}`;
+  return { series, vcpus };
+}
 
 // src/pricing/gcp/gcp-normalizer.ts
-function normalizeGcpCompute(machineType, hourlyPrice, region) {
+function normalize3(resourceType, pricePerUnit, region, spec, opts) {
   return {
     provider: "gcp",
-    service: "compute-engine",
-    resource_type: machineType,
+    service: spec.service,
+    resource_type: resourceType,
     region,
-    unit: "h",
-    price_per_unit: hourlyPrice,
+    unit: spec.unit,
+    price_per_unit: pricePerUnit,
     currency: "USD",
-    description: `GCP Compute Engine ${machineType}`,
+    description: `${spec.descriptionPrefix} ${resourceType}`,
     attributes: {
-      machine_type: machineType,
-      pricing_source: "bundled"
+      [spec.attrKey]: resourceType,
+      ...opts.skuId !== void 0 ? { sku_id: opts.skuId } : {},
+      pricing_source: opts.source
     },
-    effective_date: (/* @__PURE__ */ new Date()).toISOString()
+    effective_date: resolveEffectiveDate(opts.effectiveDate)
   };
 }
+var COMPUTE_SPEC = {
+  service: "compute-engine",
+  unit: "h",
+  descriptionPrefix: "GCP Compute Engine",
+  attrKey: "machine_type"
+};
+var DATABASE_SPEC = {
+  service: "cloud-sql",
+  unit: "h",
+  descriptionPrefix: "GCP Cloud SQL",
+  attrKey: "tier"
+};
+var STORAGE_SPEC = {
+  service: "cloud-storage",
+  unit: "GiBy.mo",
+  descriptionPrefix: "GCP Cloud Storage",
+  attrKey: "storage_class"
+};
+var DISK_SPEC = {
+  service: "persistent-disk",
+  unit: "GiBy.mo",
+  descriptionPrefix: "GCP Persistent Disk",
+  attrKey: "disk_type"
+};
+function normalizeGcpCompute(machineType, hourlyPrice, region) {
+  return normalize3(machineType, hourlyPrice, region, COMPUTE_SPEC, { source: "bundled" });
+}
 function normalizeGcpDatabase(tier, hourlyPrice, region) {
-  return {
-    provider: "gcp",
-    service: "cloud-sql",
-    resource_type: tier,
-    region,
-    unit: "h",
-    price_per_unit: hourlyPrice,
-    currency: "USD",
-    description: `GCP Cloud SQL ${tier}`,
-    attributes: {
-      tier,
-      pricing_source: "bundled"
-    },
-    effective_date: (/* @__PURE__ */ new Date()).toISOString()
-  };
+  return normalize3(tier, hourlyPrice, region, DATABASE_SPEC, { source: "bundled" });
 }
 function normalizeGcpStorage(storageClass, pricePerGb, region) {
-  return {
-    provider: "gcp",
-    service: "cloud-storage",
-    resource_type: storageClass,
-    region,
-    unit: "GiBy.mo",
-    price_per_unit: pricePerGb,
-    currency: "USD",
-    description: `GCP Cloud Storage ${storageClass}`,
-    attributes: {
-      storage_class: storageClass,
-      pricing_source: "bundled"
-    },
-    effective_date: (/* @__PURE__ */ new Date()).toISOString()
-  };
+  return normalize3(storageClass, pricePerGb, region, STORAGE_SPEC, { source: "bundled" });
 }
 function normalizeGcpDisk(diskType, pricePerGb, region) {
-  return {
-    provider: "gcp",
-    service: "persistent-disk",
-    resource_type: diskType,
-    region,
-    unit: "GiBy.mo",
-    price_per_unit: pricePerGb,
-    currency: "USD",
-    description: `GCP Persistent Disk ${diskType}`,
-    attributes: {
-      disk_type: diskType,
-      pricing_source: "bundled"
-    },
-    effective_date: (/* @__PURE__ */ new Date()).toISOString()
-  };
+  return normalize3(diskType, pricePerGb, region, DISK_SPEC, { source: "bundled" });
 }
 
 // src/pricing/gcp/bundled-loader.ts
@@ -2150,20 +2803,11 @@ var NAT_HOURLY3 = 0.044;
 var NAT_PER_GB3 = 0.045;
 var GKE_STANDARD_HOURLY = 0.1;
 var GKE_AUTOPILOT_VCPU_HOURLY = 0.0445;
-function regionMultiplier3(region) {
-  const multipliers = getRegionPriceMultipliers();
-  const mult = multipliers.gcp[region.toLowerCase()];
-  if (mult === void 0) {
-    logger.warn("region-multiplier: unknown GCP region, defaulting to 1.0x", { region });
-    return 1;
-  }
-  return mult;
-}
 var GcpBundledLoader = class {
   // -------------------------------------------------------------------------
   // Public API
   // -------------------------------------------------------------------------
-  async getComputePrice(machineType, region) {
+  getComputePrice(machineType, region) {
     try {
       const pricing = getGcpComputePricing();
       const regionPrices = pricing[region];
@@ -2172,7 +2816,7 @@ var GcpBundledLoader = class {
           region,
           machineType
         });
-        return null;
+        return Promise.resolve(null);
       }
       const price = regionPrices[machineType];
       if (price === void 0) {
@@ -2180,19 +2824,19 @@ var GcpBundledLoader = class {
           region,
           machineType
         });
-        return null;
+        return Promise.resolve(null);
       }
-      return normalizeGcpCompute(machineType, price, region);
+      return Promise.resolve(normalizeGcpCompute(machineType, price, region));
     } catch (err) {
       logger.error("GCP compute pricing load error", {
         machineType,
         region,
         err: err instanceof Error ? err.message : String(err)
       });
-      return null;
+      return Promise.resolve(null);
     }
   }
-  async getDatabasePrice(tier, region) {
+  getDatabasePrice(tier, region) {
     try {
       const pricing = getGcpSqlPricing();
       const regionPrices = pricing[region];
@@ -2201,7 +2845,7 @@ var GcpBundledLoader = class {
           region,
           tier
         });
-        return null;
+        return Promise.resolve(null);
       }
       const price = regionPrices[tier];
       if (price === void 0 || tier === "storage_per_gb" || tier === "ha_multiplier") {
@@ -2209,19 +2853,19 @@ var GcpBundledLoader = class {
           region,
           tier
         });
-        return null;
+        return Promise.resolve(null);
       }
-      return normalizeGcpDatabase(tier, price, region);
+      return Promise.resolve(normalizeGcpDatabase(tier, price, region));
     } catch (err) {
       logger.error("GCP SQL pricing load error", {
         tier,
         region,
         err: err instanceof Error ? err.message : String(err)
       });
-      return null;
+      return Promise.resolve(null);
     }
   }
-  async getStoragePrice(storageClass, region) {
+  getStoragePrice(storageClass, region) {
     try {
       const pricing = getGcpStoragePricing();
       const regionPrices = pricing[region];
@@ -2230,7 +2874,7 @@ var GcpBundledLoader = class {
           region,
           storageClass
         });
-        return null;
+        return Promise.resolve(null);
       }
       const classKey = storageClass.toUpperCase();
       const price = regionPrices[classKey];
@@ -2239,19 +2883,19 @@ var GcpBundledLoader = class {
           region,
           storageClass
         });
-        return null;
+        return Promise.resolve(null);
       }
-      return normalizeGcpStorage(storageClass.toUpperCase(), price, region);
+      return Promise.resolve(normalizeGcpStorage(storageClass.toUpperCase(), price, region));
     } catch (err) {
       logger.error("GCP Storage pricing load error", {
         storageClass,
         region,
         err: err instanceof Error ? err.message : String(err)
       });
-      return null;
+      return Promise.resolve(null);
     }
   }
-  async getDiskPrice(diskType, region) {
+  getDiskPrice(diskType, region) {
     try {
       const pricing = getGcpDiskPricing();
       const regionPrices = pricing[region];
@@ -2260,7 +2904,7 @@ var GcpBundledLoader = class {
           region,
           diskType
         });
-        return null;
+        return Promise.resolve(null);
       }
       const diskKey = diskType;
       const price = regionPrices[diskKey];
@@ -2269,21 +2913,21 @@ var GcpBundledLoader = class {
           region,
           diskType
         });
-        return null;
+        return Promise.resolve(null);
       }
-      return normalizeGcpDisk(diskType, price, region);
+      return Promise.resolve(normalizeGcpDisk(diskType, price, region));
     } catch (err) {
       logger.error("GCP Disk pricing load error", {
         diskType,
         region,
         err: err instanceof Error ? err.message : String(err)
       });
-      return null;
+      return Promise.resolve(null);
     }
   }
-  async getLoadBalancerPrice(region) {
-    const multiplier = regionMultiplier3(region);
-    return {
+  getLoadBalancerPrice(region) {
+    const multiplier = regionMultiplier("gcp", region);
+    return Promise.resolve({
       provider: "gcp",
       service: "cloud-load-balancing",
       resource_type: "forwarding-rule",
@@ -2296,11 +2940,11 @@ var GcpBundledLoader = class {
         per_gb_price: String(LB_PER_GB * multiplier)
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
-  async getNatGatewayPrice(region) {
-    const multiplier = regionMultiplier3(region);
-    return {
+  getNatGatewayPrice(region) {
+    const multiplier = regionMultiplier("gcp", region);
+    return Promise.resolve({
       provider: "gcp",
       service: "cloud-nat",
       resource_type: "nat-gateway",
@@ -2313,12 +2957,12 @@ var GcpBundledLoader = class {
         per_gb_price: String(NAT_PER_GB3 * multiplier)
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
-  async getKubernetesPrice(region, mode = "standard") {
-    const multiplier = regionMultiplier3(region);
+  getKubernetesPrice(region, mode = "standard") {
+    const multiplier = regionMultiplier("gcp", region);
     const baseHourly = mode === "autopilot" ? GKE_AUTOPILOT_VCPU_HOURLY : GKE_STANDARD_HOURLY;
-    return {
+    return Promise.resolve({
       provider: "gcp",
       service: "gke",
       resource_type: "cluster",
@@ -2335,7 +2979,7 @@ var GcpBundledLoader = class {
         }
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
 };
 
@@ -2344,7 +2988,9 @@ var BILLING_API_BASE = "https://cloudbilling.googleapis.com/v1/services";
 var SERVICE_IDS = {
   COMPUTE: "6F81-5844-456A",
   CLOUD_SQL: "9662-B51E-5089",
-  CLOUD_STORAGE: "95FF-2EF5-5EA1"
+  CLOUD_STORAGE: "95FF-2EF5-5EA1",
+  // GKE (Kubernetes Engine) service — used to locate Autopilot pod SKUs.
+  GKE: "CCD8-9BF1-090E"
 };
 var CACHE_TTL3 = 86400;
 function protoToFloat(units, nanos) {
@@ -2372,8 +3018,11 @@ function skuCoversRegion(sku, region) {
 }
 var CloudBillingClient = class {
   cache;
-  constructor(cache) {
+  /** Cache TTL for pricing writes (seconds); from config.cache.ttl_seconds. */
+  ttlSeconds;
+  constructor(cache, ttlSeconds = CACHE_TTL3) {
     this.cache = cache;
+    this.ttlSeconds = ttlSeconds;
   }
   // -------------------------------------------------------------------------
   // Public fetch methods
@@ -2391,7 +3040,7 @@ var CloudBillingClient = class {
       const family = this.machineFamily(machineType);
       const result = this.extractComputePrice(skus, machineType, family, region);
       if (result) {
-        this.cache.set(cacheKey, result, "gcp", "compute", region, CACHE_TTL3);
+        this.cache.set(cacheKey, result, "gcp", "compute", region, this.ttlSeconds);
         return result;
       }
     } catch (err) {
@@ -2414,7 +3063,7 @@ var CloudBillingClient = class {
       const skus = await this.fetchSkus(SERVICE_IDS.CLOUD_SQL, region);
       const result = this.extractDatabasePrice(skus, tier, region);
       if (result) {
-        this.cache.set(cacheKey, result, "gcp", "cloud-sql", region, CACHE_TTL3);
+        this.cache.set(cacheKey, result, "gcp", "cloud-sql", region, this.ttlSeconds);
         return result;
       }
     } catch (err) {
@@ -2438,7 +3087,7 @@ var CloudBillingClient = class {
       const skus = await this.fetchSkus(SERVICE_IDS.CLOUD_STORAGE, region);
       const result = this.extractStoragePrice(skus, storageClass, region);
       if (result) {
-        this.cache.set(cacheKey, result, "gcp", "cloud-storage", region, CACHE_TTL3);
+        this.cache.set(cacheKey, result, "gcp", "cloud-storage", region, this.ttlSeconds);
         return result;
       }
     } catch (err) {
@@ -2450,6 +3099,141 @@ var CloudBillingClient = class {
     }
     return null;
   }
+  /**
+   * Fetch Compute Engine GPU (accelerator) SKUs and return the hourly price
+   * for the given accelerator type (e.g. "nvidia-tesla-t4", "nvidia-a100").
+   *
+   * GPUs live under the Compute service (6F81-5844-456A) with
+   * `category.resourceFamily == "Compute"` and
+   * `category.resourceGroup == "GPU"`. Descriptions follow the pattern
+   * "Nvidia Tesla T4 GPU running in Americas".
+   */
+  async fetchGpuSkus(accelerator, region) {
+    const cacheKey = `gcp/gpu/${region}/${accelerator.toLowerCase()}`;
+    const cached = this.cache.get(cacheKey);
+    if (cached) return cached;
+    try {
+      const skus = await this.fetchSkus(SERVICE_IDS.COMPUTE, region);
+      const result = this.extractGpuPrice(skus, accelerator, region);
+      if (result) {
+        this.cache.set(cacheKey, result, "gcp", "compute-gpu", region, this.ttlSeconds);
+        return result;
+      }
+    } catch (err) {
+      logger.warn("GCP Cloud Billing GPU fetch failed", {
+        accelerator,
+        region,
+        err: err instanceof Error ? err.message : String(err)
+      });
+    }
+    return null;
+  }
+  /**
+   * Fetch Committed Use Discount (CUD) rates for the Compute service in a
+   * region. Returns discount fractions (0..1) against OnDemand base rates,
+   * derived by comparing matching Commit1Yr / Commit3Yr SKUs to their
+   * OnDemand counterparts for the same resource group (e.g. "N1Standard").
+   *
+   * If the API call fails or no matching SKUs are found, returns null and
+   * callers should fall back to static rates.
+   */
+  async fetchCudRates(region) {
+    const cacheKey = `gcp/cud/${region}`;
+    const cached = this.cache.get(cacheKey);
+    if (cached) return cached;
+    try {
+      const skus = await this.fetchSkus(SERVICE_IDS.COMPUTE, region);
+      const onDemand = /* @__PURE__ */ new Map();
+      const commit1 = /* @__PURE__ */ new Map();
+      const commit3 = /* @__PURE__ */ new Map();
+      const keyOf = (sku) => {
+        const group = sku.category.resourceGroup ?? "";
+        if (!group) return null;
+        const desc = sku.description.toLowerCase();
+        let flavour;
+        if (desc.includes("core") || desc.includes("vcpu")) {
+          flavour = "core";
+        } else if (desc.includes("ram") || desc.includes("memory")) {
+          flavour = "ram";
+        } else {
+          return null;
+        }
+        return `${group}|${flavour}`;
+      };
+      for (const sku of skus) {
+        if (sku.category.resourceFamily !== "Compute") continue;
+        const price = extractUnitPrice(sku);
+        if (price === null) continue;
+        const key = keyOf(sku);
+        if (!key) continue;
+        const usage = sku.category.usageType;
+        if (usage === "OnDemand") {
+          const existing = onDemand.get(key);
+          if (existing === void 0 || price < existing) onDemand.set(key, price);
+        } else if (usage === "Commit1Yr") {
+          const existing = commit1.get(key);
+          if (existing === void 0 || price < existing) commit1.set(key, price);
+        } else if (usage === "Commit3Yr") {
+          const existing = commit3.get(key);
+          if (existing === void 0 || price < existing) commit3.set(key, price);
+        }
+      }
+      const averageDiscount = (commits) => {
+        const ratios = [];
+        for (const [key, commitPrice] of commits) {
+          const base = onDemand.get(key);
+          if (base === void 0 || base <= 0) continue;
+          const discount = 1 - commitPrice / base;
+          if (discount > 0 && discount < 1) ratios.push(discount);
+        }
+        if (ratios.length === 0) return null;
+        const sum = ratios.reduce((a, b) => a + b, 0);
+        return sum / ratios.length;
+      };
+      const result = {
+        term1yr: averageDiscount(commit1),
+        term3yr: averageDiscount(commit3),
+        sample_count: onDemand.size
+      };
+      if (result.term1yr === null && result.term3yr === null) {
+        return null;
+      }
+      this.cache.set(cacheKey, result, "gcp", "compute-cud", region, this.ttlSeconds);
+      return result;
+    } catch (err) {
+      logger.warn("GCP Cloud Billing CUD fetch failed", {
+        region,
+        err: err instanceof Error ? err.message : String(err)
+      });
+      return null;
+    }
+  }
+  /**
+   * Fetch GKE Autopilot pod resource rates (per-vCPU-hour, per-GB-memory-hour,
+   * per-GB-ephemeral-storage-hour) from the GKE service catalog. Returns a
+   * NormalizedPrice whose `price_per_unit` is the vCPU rate and whose
+   * `attributes` carry the memory/storage rates as strings — callers that
+   * know a pod's resource request can compute an exact per-pod price.
+   */
+  async fetchAutopilotPodRates(region) {
+    const cacheKey = `gcp/gke-autopilot/${region}`;
+    const cached = this.cache.get(cacheKey);
+    if (cached) return cached;
+    try {
+      const skus = await this.fetchSkus(SERVICE_IDS.GKE, region);
+      const result = this.extractAutopilotPodRates(skus, region);
+      if (result) {
+        this.cache.set(cacheKey, result, "gcp", "gke-autopilot", region, this.ttlSeconds);
+        return result;
+      }
+    } catch (err) {
+      logger.warn("GCP Cloud Billing GKE Autopilot fetch failed", {
+        region,
+        err: err instanceof Error ? err.message : String(err)
+      });
+    }
+    return null;
+  }
   // -------------------------------------------------------------------------
   // Internal – API fetch
   // -------------------------------------------------------------------------
@@ -2467,10 +3251,14 @@ var CloudBillingClient = class {
     do {
       const pageUrl = pageToken ? `${url}?pageToken=${pageToken}` : url;
       logger.debug("GCP Cloud Billing API request", { url: pageUrl, serviceId, region });
-      const res = await fetch(pageUrl, {
-        signal: AbortSignal.timeout(3e4),
-        headers: { Accept: "application/json" }
-      });
+      const res = await fetchWithRetryAndCircuitBreaker(
+        pageUrl,
+        {
+          signal: AbortSignal.timeout(3e4),
+          headers: { Accept: "application/json" }
+        },
+        { maxRetries: 2 }
+      );
       if (!res.ok) {
         throw new Error(`GCP Billing API HTTP ${res.status} for service ${serviceId}`);
       }
@@ -2599,28 +3387,140 @@ var CloudBillingClient = class {
     if (price === null) return null;
     return {
       provider: "gcp",
-      service: "cloud-storage",
-      resource_type: classUpper,
+      service: "cloud-storage",
+      resource_type: classUpper,
+      region,
+      unit: "GiBy.mo",
+      price_per_unit: price,
+      currency: "USD",
+      description: `GCP Cloud Storage ${classUpper} (live: ${sku.description})`,
+      attributes: {
+        storage_class: classUpper,
+        sku_id: sku.skuId,
+        pricing_source: "live"
+      },
+      effective_date: sku.pricingInfo?.[0]?.effectiveTime ?? (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  /**
+   * Extract a GPU hourly price for the requested accelerator type.
+   * Matches SKUs with resourceGroup == "GPU" whose description contains the
+   * human-readable model name (e.g. "Tesla T4", "A100 40GB").
+   */
+  extractGpuPrice(skus, accelerator, region) {
+    const lower = accelerator.toLowerCase();
+    const stripped = lower.replace(/^nvidia-?/, "");
+    const tokens = stripped.split(/[-\s]+/).filter((t) => t.length > 0);
+    if (tokens.length === 0) return null;
+    const candidates = skus.filter((s) => {
+      if (s.category.resourceFamily !== "Compute") return false;
+      if (s.category.resourceGroup !== "GPU") return false;
+      if (s.category.usageType !== "OnDemand") return false;
+      const desc = s.description.toLowerCase();
+      return tokens.every((tok) => desc.includes(tok));
+    });
+    if (candidates.length === 0) return null;
+    candidates.sort((a, b) => a.skuId.localeCompare(b.skuId));
+    const sku = candidates[0];
+    const price = extractUnitPrice(sku);
+    if (price === null) return null;
+    return {
+      provider: "gcp",
+      service: "compute-engine",
+      resource_type: accelerator,
+      region,
+      unit: "h",
+      price_per_unit: price,
+      currency: "USD",
+      description: `GCP GPU ${accelerator} (live: ${sku.description})`,
+      attributes: {
+        accelerator,
+        sku_id: sku.skuId,
+        pricing_source: "live"
+      },
+      effective_date: sku.pricingInfo?.[0]?.effectiveTime ?? (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  /**
+   * Extract GKE Autopilot pod resource rates. Autopilot exposes separate
+   * SKUs per resource dimension (vCPU, memory, ephemeral storage) under the
+   * GKE service. We look for SKUs whose description contains "Autopilot"
+   * and the matching dimension keyword.
+   */
+  extractAutopilotPodRates(skus, region) {
+    const autopilotSkus = skus.filter((s) => {
+      const desc = s.description.toLowerCase();
+      return s.category.usageType === "OnDemand" && desc.includes("autopilot") && !desc.includes("spot") && !desc.includes("preemptible");
+    });
+    if (autopilotSkus.length === 0) return null;
+    const find = (keywords) => {
+      const matches = autopilotSkus.filter((s) => {
+        const desc = s.description.toLowerCase();
+        return keywords.every((kw) => desc.includes(kw));
+      });
+      if (matches.length === 0) return void 0;
+      matches.sort((a, b) => a.skuId.localeCompare(b.skuId));
+      return matches[0];
+    };
+    const vcpuSku = find(["cpu"]) ?? find(["core"]) ?? find(["vcpu"]);
+    const memorySku = find(["memory"]) ?? find(["ram"]);
+    const storageSku = find(["ephemeral", "storage"]) ?? find(["storage"]);
+    if (!vcpuSku) return null;
+    const vcpuPrice = extractUnitPrice(vcpuSku);
+    if (vcpuPrice === null) return null;
+    const memoryPrice = memorySku ? extractUnitPrice(memorySku) : null;
+    const storagePrice = storageSku ? extractUnitPrice(storageSku) : null;
+    const attributes = {
+      mode: "autopilot",
+      pricing_model: "per_pod_resource",
+      pricing_source: "live",
+      vcpu_hourly: String(vcpuPrice),
+      sku_id_vcpu: vcpuSku.skuId,
+      pricing_note: "Autopilot charges per pod: vCPU, memory, and ephemeral storage are billed separately. price_per_unit reports the vCPU/hr rate; see attributes for memory/storage rates."
+    };
+    if (memoryPrice !== null && memorySku) {
+      attributes.memory_gb_hourly = String(memoryPrice);
+      attributes.sku_id_memory = memorySku.skuId;
+    }
+    if (storagePrice !== null && storageSku) {
+      attributes.ephemeral_storage_gb_hourly = String(storagePrice);
+      attributes.sku_id_storage = storageSku.skuId;
+    }
+    return {
+      provider: "gcp",
+      service: "gke",
+      resource_type: "autopilot-pod",
       region,
-      unit: "GiBy.mo",
-      price_per_unit: price,
+      unit: "h",
+      price_per_unit: vcpuPrice,
       currency: "USD",
-      description: `GCP Cloud Storage ${classUpper} (live: ${sku.description})`,
-      attributes: {
-        storage_class: classUpper,
-        sku_id: sku.skuId,
-        pricing_source: "live"
-      },
-      effective_date: sku.pricingInfo?.[0]?.effectiveTime ?? (/* @__PURE__ */ new Date()).toISOString()
+      description: `GCP GKE Autopilot pod resources (live: ${vcpuSku.description})`,
+      attributes,
+      effective_date: vcpuSku.pricingInfo?.[0]?.effectiveTime ?? (/* @__PURE__ */ new Date()).toISOString()
     };
   }
 };
 
 // src/pricing/pricing-engine.ts
+var DEFAULT_CACHE_TTL_SECONDS = 86400;
 var AwsProvider = class {
   loader;
-  constructor(cache) {
-    this.loader = new AwsBulkLoader(cache);
+  spotClient;
+  reservedClient;
+  constructor(cache, ttlSeconds) {
+    this.loader = new AwsBulkLoader(cache, ttlSeconds);
+    this.spotClient = new AwsSpotClient(cache, ttlSeconds);
+    this.reservedClient = new AwsReservedClient(cache, ttlSeconds);
+  }
+  getSpotFactor(instanceType, region, os) {
+    return this.spotClient.getSpotFactor(
+      instanceType,
+      region,
+      os === "Windows" ? "Windows" : "Linux"
+    );
+  }
+  getReservedRates(_instanceType, _region, _os) {
+    return Promise.resolve(null);
   }
   getComputePrice(instanceType, region, os) {
     return this.loader.getComputePrice(instanceType, region, os);
@@ -2643,8 +3543,8 @@ var AwsProvider = class {
 };
 var AzureProvider = class {
   client;
-  constructor(cache) {
-    this.client = new AzureRetailClient(cache);
+  constructor(cache, ttlSeconds) {
+    this.client = new AzureRetailClient(cache, ttlSeconds);
   }
   getComputePrice(instanceType, region, os) {
     return this.client.getComputePrice(instanceType, region, os);
@@ -2664,13 +3564,31 @@ var AzureProvider = class {
   getKubernetesPrice(region) {
     return this.client.getKubernetesPrice(region);
   }
+  /**
+   * Azure-specific: fetch live Spot VM pricing from the Retail API. Exposed
+   * on the provider so the compute calculator can prefer live spot rows
+   * over static discount factors. Returns null when the live API has no
+   * matching spot row. Not part of the base `PricingProvider` interface
+   * because AWS/GCP use different spot channels.
+   */
+  getSpotPrice(vmSize, region, os) {
+    return this.client.getSpotPrice(vmSize, region, os);
+  }
+  /**
+   * Azure-specific: fetch the live Reservation VM hourly rate (1yr / 3yr)
+   * from the Retail API. Returns null when no reservation row matches,
+   * signalling callers to fall back to the static DISCOUNT_RATES table.
+   */
+  getReservationHourlyRate(vmSize, region, term) {
+    return this.client.getReservationHourlyRate(vmSize, region, term);
+  }
 };
 var GcpProvider = class {
   loader;
   liveClient;
-  constructor(cache) {
+  constructor(cache, ttlSeconds) {
     this.loader = new GcpBundledLoader();
-    this.liveClient = new CloudBillingClient(cache);
+    this.liveClient = new CloudBillingClient(cache, ttlSeconds);
   }
   async getComputePrice(instanceType, region, _os) {
     try {
@@ -2724,12 +3642,51 @@ var GcpProvider = class {
     return this.loader.getKubernetesPrice(region, mode === "autopilot" ? "autopilot" : "standard");
   }
 };
+var SERVICE_ALIAS_LOOKUPS = (() => {
+  const groups = [
+    [
+      ["compute", "ec2", "vm", "instance", "virtual-machines"],
+      (p, resourceType, region, attributes) => p.getComputePrice(resourceType, region, attributes.os)
+    ],
+    [
+      ["database", "rds", "sql", "db", "cloud-sql", "azure-database"],
+      (p, resourceType, region, attributes) => p.getDatabasePrice(resourceType, region, attributes.engine)
+    ],
+    [
+      ["storage", "ebs", "disk", "gcs", "managed-disks", "persistent-disk", "cloud-storage"],
+      (p, resourceType, region, attributes) => {
+        const sizeGb = attributes.size_gb ? parseFloat(attributes.size_gb) : void 0;
+        return p.getStoragePrice(resourceType, region, sizeGb);
+      }
+    ],
+    [
+      ["lb", "load-balancer", "alb", "nlb", "elb", "cloud-load-balancing"],
+      (p, resourceType, region) => p.getLoadBalancerPrice(resourceType, region)
+    ],
+    [
+      ["nat", "nat-gateway", "cloud-nat"],
+      (p, _resourceType, region) => p.getNatGatewayPrice(region)
+    ],
+    [
+      ["k8s", "kubernetes", "eks", "aks", "gke"],
+      (p, _resourceType, region, attributes) => p.getKubernetesPrice(region, attributes.mode)
+    ]
+  ];
+  const map = /* @__PURE__ */ new Map();
+  for (const [aliases, lookup] of groups) {
+    for (const alias of aliases) map.set(alias, lookup);
+  }
+  return map;
+})();
 var PricingEngine = class {
   providers = /* @__PURE__ */ new Map();
-  constructor(cache, _config) {
-    this.providers.set("aws", new AwsProvider(cache));
-    this.providers.set("azure", new AzureProvider(cache));
-    this.providers.set("gcp", new GcpProvider(cache));
+  config;
+  constructor(cache, config) {
+    this.config = config;
+    const ttlSeconds = config?.cache?.ttl_seconds ?? DEFAULT_CACHE_TTL_SECONDS;
+    this.providers.set("aws", new AwsProvider(cache, ttlSeconds));
+    this.providers.set("azure", new AzureProvider(cache, ttlSeconds));
+    this.providers.set("gcp", new GcpProvider(cache, ttlSeconds));
   }
   /**
    * Return the PricingProvider for a specific cloud provider.
@@ -2764,24 +3721,9 @@ var PricingEngine = class {
       resourceType,
       region
     });
-    if (svc === "compute" || svc === "ec2" || svc === "vm" || svc === "instance" || svc === "virtual-machines") {
-      return p.getComputePrice(resourceType, region, attributes.os);
-    }
-    if (svc === "database" || svc === "rds" || svc === "sql" || svc === "db" || svc === "cloud-sql" || svc === "azure-database") {
-      return p.getDatabasePrice(resourceType, region, attributes.engine);
-    }
-    if (svc === "storage" || svc === "ebs" || svc === "disk" || svc === "gcs" || svc === "managed-disks" || svc === "persistent-disk" || svc === "cloud-storage") {
-      const sizeGb = attributes.size_gb ? parseFloat(attributes.size_gb) : void 0;
-      return p.getStoragePrice(resourceType, region, sizeGb);
-    }
-    if (svc === "lb" || svc === "load-balancer" || svc === "alb" || svc === "nlb" || svc === "elb" || svc === "cloud-load-balancing") {
-      return p.getLoadBalancerPrice(resourceType, region);
-    }
-    if (svc === "nat" || svc === "nat-gateway" || svc === "cloud-nat") {
-      return p.getNatGatewayPrice(region);
-    }
-    if (svc === "k8s" || svc === "kubernetes" || svc === "eks" || svc === "aks" || svc === "gke") {
-      return p.getKubernetesPrice(region, attributes.mode);
+    const lookup = SERVICE_ALIAS_LOOKUPS.get(svc);
+    if (lookup) {
+      return lookup(p, resourceType, region, attributes);
     }
     logger.warn("PricingEngine: unrecognised service", { service, provider });
     return null;
@@ -2789,13 +3731,27 @@ var PricingEngine = class {
 };
 
 // src/tools/analyze-terraform.ts
-import { z } from "zod";
+import { z as z3 } from "zod";
 
 // src/parsers/index.ts
-import { dirname as dirname2 } from "path";
+import { dirname as dirname2, isAbsolute, normalize as normalize4, sep as sep2 } from "path";
 
 // src/parsers/hcl-parser.ts
 import { parse } from "@cdktf/hcl2json";
+
+// src/util/sanitize.ts
+function sanitizeForMessage(input, maxLen = 256) {
+  const s = typeof input === "string" ? input : String(input);
+  const noControl = s.replace(/[\x00-\x1F\x7F]/g, "");
+  const noInvisible = noControl.replace(
+    /[\u200B-\u200F\u202A-\u202E\u2060-\u2064\u2066-\u206F\uFEFF]/g,
+    ""
+  );
+  if (noInvisible.length <= maxLen) return noInvisible;
+  return `${noInvisible.slice(0, maxLen)}\u2026`;
+}
+
+// src/parsers/hcl-parser.ts
 async function parseHclToJson(hclContent, filename = "main.tf") {
   if (!hclContent.trim()) {
     logger.debug("Received empty HCL content, returning empty object", {
@@ -2809,9 +3765,44 @@ async function parseHclToJson(hclContent, filename = "main.tf") {
     return result;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    logger.error("Failed to parse HCL", { filename, error: message });
-    throw new Error(`HCL parse error in "${filename}": ${message}`);
+    const safeFilename = sanitizeForMessage(filename, 256);
+    const safeMessage = sanitizeForMessage(message, 512);
+    logger.error("Failed to parse HCL", { filename: safeFilename, error: safeMessage });
+    throw new Error(`HCL parse error in "${safeFilename}": ${safeMessage}`);
+  }
+}
+
+// src/parsers/extractors/helpers.ts
+function firstBlock(block, key) {
+  const nested = block[key];
+  if (Array.isArray(nested) && nested.length > 0) {
+    return nested[0];
+  }
+  return {};
+}
+function coerceToString(v) {
+  if (typeof v === "string") return v;
+  if (typeof v === "number" || typeof v === "boolean" || typeof v === "bigint" || typeof v === "symbol" || typeof v === "function" || typeof v === "undefined") {
+    return String(v);
+  }
+  return JSON.stringify(v);
+}
+function str(v) {
+  return typeof v === "string" && v ? v : void 0;
+}
+function num(v) {
+  if (typeof v === "number") return v;
+  if (typeof v === "string") {
+    const n = Number(v);
+    return isNaN(n) ? void 0 : n;
   }
+  return void 0;
+}
+function bool(v) {
+  if (typeof v === "boolean") return v;
+  if (v === "true") return true;
+  if (v === "false") return false;
+  return void 0;
 }
 
 // src/parsers/variable-resolver.ts
@@ -2892,7 +3883,8 @@ function substituteInString(str2, variables) {
   return str2.replace(VAR_INLINE_RE, (_match, varName) => {
     if (varName in variables) {
       const v = variables[varName];
-      return v === null ? "" : String(v);
+      if (v === null || v === void 0) return "";
+      return coerceToString(v);
     }
     return _match;
   });
@@ -2915,32 +3907,6 @@ function detectProvider(resourceType) {
   );
 }
 
-// src/parsers/extractors/helpers.ts
-function firstBlock(block, key) {
-  const nested = block[key];
-  if (Array.isArray(nested) && nested.length > 0) {
-    return nested[0];
-  }
-  return {};
-}
-function str(v) {
-  return typeof v === "string" && v ? v : void 0;
-}
-function num(v) {
-  if (typeof v === "number") return v;
-  if (typeof v === "string") {
-    const n = Number(v);
-    return isNaN(n) ? void 0 : n;
-  }
-  return void 0;
-}
-function bool(v) {
-  if (typeof v === "boolean") return v;
-  if (v === "true") return true;
-  if (v === "false") return false;
-  return void 0;
-}
-
 // src/parsers/extractors/aws-extractor.ts
 var awsExtractors = {
   aws_instance(block) {
@@ -3526,7 +4492,7 @@ function extractTags(block) {
   const result = {};
   for (const [k, v] of Object.entries(tags)) {
     if (typeof v === "string") result[k] = v;
-    else if (v !== null && v !== void 0) result[k] = String(v);
+    else if (v !== null && v !== void 0) result[k] = coerceToString(v);
   }
   return result;
 }
@@ -3638,14 +4604,63 @@ function extractResources(hclJson, variables, sourceFile, defaultRegions = {}, w
 
 // src/parsers/module-resolver.ts
 import { readdirSync, readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
-import { join as join2, resolve } from "path";
+import { join as join2, resolve as resolve2 } from "path";
+
+// src/parsers/path-safety.ts
+import { lstatSync, realpathSync } from "fs";
+import { resolve, sep } from "path";
+function resolveWithinBoundary(candidate, basePath, rootBoundary) {
+  const resolved = resolve(basePath, candidate);
+  const boundary = resolve(rootBoundary);
+  if (!isWithin(resolved, boundary)) return null;
+  try {
+    const real = realpathSync(resolved);
+    if (!isWithin(real, boundary)) return null;
+    const stat = lstatSync(resolved);
+    if (stat.isSymbolicLink()) return null;
+    return real;
+  } catch {
+    return resolved;
+  }
+}
+function isWithin(child, parent) {
+  if (child === parent) return true;
+  const parentWithSep = parent.endsWith(sep) ? parent : parent + sep;
+  return child.startsWith(parentWithSep);
+}
+
+// src/parsers/safe-json.ts
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function safeJsonParse(text) {
+  let droppedKeys = 0;
+  const parsed = JSON.parse(text, (key, value) => {
+    if (FORBIDDEN_KEYS.has(key)) {
+      droppedKeys++;
+      return void 0;
+    }
+    return value;
+  });
+  if (droppedKeys > 0) {
+    logger.warn("safeJsonParse: dropped prototype-pollution keys from payload", {
+      droppedKeys
+    });
+  }
+  return parsed;
+}
+
+// src/parsers/module-resolver.ts
 var MAX_MODULE_DEPTH = 10;
+var FORBIDDEN_MERGE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function readTfFiles(dirPath) {
   if (!existsSync2(dirPath)) return [];
   let entries;
   try {
     entries = readdirSync(dirPath);
-  } catch {
+  } catch (err) {
+    logger.warn("Cannot list module directory; skipping", {
+      dirPath: sanitizeForMessage(dirPath),
+      error: sanitizeForMessage(err instanceof Error ? err.message : String(err), 512)
+    });
     return [];
   }
   const files = [];
@@ -3655,7 +4670,11 @@ function readTfFiles(dirPath) {
     try {
       const content = readFileSync2(fullPath, "utf-8");
       files.push({ path: fullPath, content });
-    } catch {
+    } catch (err) {
+      logger.warn("Cannot read module file; skipping", {
+        path: sanitizeForMessage(fullPath),
+        error: sanitizeForMessage(err instanceof Error ? err.message : String(err), 512)
+      });
     }
   }
   return files;
@@ -3664,6 +4683,7 @@ function mergeHclJsons(jsons) {
   const merged = {};
   for (const json of jsons) {
     for (const [key, value] of Object.entries(json)) {
+      if (FORBIDDEN_MERGE_KEYS.has(key)) continue;
       if (!(key in merged)) {
         merged[key] = JSON.parse(JSON.stringify(value));
         continue;
@@ -3684,8 +4704,13 @@ function mergeHclJsons(jsons) {
   return merged;
 }
 function mergeObjects(a, b) {
-  const result = { ...a };
+  const result = {};
+  for (const [key, aVal] of Object.entries(a)) {
+    if (FORBIDDEN_MERGE_KEYS.has(key)) continue;
+    result[key] = aVal;
+  }
   for (const [key, bVal] of Object.entries(b)) {
+    if (FORBIDDEN_MERGE_KEYS.has(key)) continue;
     const aVal = result[key];
     if (aVal !== null && typeof aVal === "object" && !Array.isArray(aVal) && bVal !== null && typeof bVal === "object" && !Array.isArray(bVal)) {
       result[key] = mergeObjects(aVal, bVal);
@@ -3727,10 +4752,10 @@ function prefixResources(resources, moduleName) {
     id: `module.${moduleName}.${r.id}`
   }));
 }
-async function parseModuleDirectory(dirPath, parentVars, moduleInputs, warnings, depth) {
+async function parseModuleDirectory(dirPath, parentVars, moduleInputs, warnings, depth, rootBoundary) {
   if (depth >= MAX_MODULE_DEPTH) {
     warnings.push(
-      `Module nesting depth limit (${MAX_MODULE_DEPTH}) reached at "${dirPath}". Skipping further expansion.`
+      `Module nesting depth limit (${MAX_MODULE_DEPTH}) reached at "${sanitizeForMessage(dirPath)}". Skipping further expansion.`
     );
     return [];
   }
@@ -3745,10 +4770,12 @@ async function parseModuleDirectory(dirPath, parentVars, moduleInputs, warnings,
       parsedJsons.push({ path: file.path, json });
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      warnings.push(`Parse error in module file ${file.path}: ${msg}`);
+      const safePath = sanitizeForMessage(file.path);
+      const safeMsg = sanitizeForMessage(msg, 512);
+      warnings.push(`Parse error in module file ${safePath}: ${safeMsg}`);
       logger.warn("Skipping module file due to parse error", {
-        path: file.path,
-        error: msg
+        path: safePath,
+        error: safeMsg
       });
     }
   }
@@ -3771,86 +4798,117 @@ async function parseModuleDirectory(dirPath, parentVars, moduleInputs, warnings,
       allResources.push(...resources);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      warnings.push(`Extraction error in module file ${path}: ${msg}`);
-      logger.warn("Resource extraction failed in module", { path, error: msg });
-    }
-  }
-  const nestedResources = await resolveModules(combined, dirPath, variables, warnings, depth + 1);
+      const safePath = sanitizeForMessage(path);
+      const safeMsg = sanitizeForMessage(msg, 512);
+      warnings.push(`Extraction error in module file ${safePath}: ${safeMsg}`);
+      logger.warn("Resource extraction failed in module", { path: safePath, error: safeMsg });
+    }
+  }
+  const nestedResources = await resolveModules(
+    combined,
+    dirPath,
+    variables,
+    warnings,
+    depth + 1,
+    rootBoundary
+  );
   allResources.push(...nestedResources);
   return allResources;
 }
-async function resolveModules(hclJson, basePath, variables, warnings, depth = 0) {
+async function resolveModules(hclJson, basePath, variables, warnings, depth = 0, rootBoundary) {
   const moduleBlock = hclJson["module"];
   if (!moduleBlock || typeof moduleBlock !== "object" || Array.isArray(moduleBlock)) {
     return [];
   }
+  const boundary = resolve2(rootBoundary ?? process.cwd());
   const allResources = [];
   for (const [moduleName, moduleDeclaration] of Object.entries(
     moduleBlock
   )) {
+    const safeModuleName = sanitizeForMessage(moduleName, 128);
     const source = getSourceAttr(moduleDeclaration);
     if (!source) {
-      warnings.push(`Module "${moduleName}" has no source attribute and will be skipped.`);
+      warnings.push(`Module "${safeModuleName}" has no source attribute and will be skipped.`);
       continue;
     }
+    const safeSource = sanitizeForMessage(source, 256);
     const isLocal = source.startsWith("./") || source.startsWith("../");
     const isGit = source.startsWith("git::") || source.includes("github.com") || source.includes("bitbucket.org") || source.startsWith("hg::");
     if (isGit) {
       warnings.push(
-        `Module "${moduleName}" uses a git source ("${source}") which is not supported. Skipping.`
+        `Module "${safeModuleName}" uses a git source ("${safeSource}") which is not supported. Skipping.`
       );
-      logger.debug("Skipping git module", { moduleName, source });
+      logger.debug("Skipping git module", { moduleName: safeModuleName, source: safeSource });
       continue;
     }
     const rawInputs = extractModuleInputs(moduleDeclaration);
     const moduleInputs = substituteVariables(rawInputs, variables);
     let moduleDir;
     if (isLocal) {
-      moduleDir = resolve(basePath, source);
+      moduleDir = resolveWithinBoundary(source, basePath, boundary);
+      if (!moduleDir) {
+        warnings.push(
+          `Module "${safeModuleName}" source "${safeSource}" resolves outside the allowed root and was rejected.`
+        );
+        logger.warn("Rejected local module path escaping boundary", {
+          moduleName: safeModuleName,
+          source: safeSource
+        });
+        continue;
+      }
     } else {
-      const terraformModulesDir = join2(basePath, ".terraform", "modules");
-      const candidateDirect = join2(terraformModulesDir, moduleName);
-      if (existsSync2(candidateDirect)) {
+      const terraformModulesDir = resolve2(basePath, ".terraform", "modules");
+      const candidateDirect = resolveWithinBoundary(
+        moduleName,
+        terraformModulesDir,
+        terraformModulesDir
+      );
+      if (candidateDirect && existsSync2(candidateDirect)) {
         moduleDir = candidateDirect;
       } else {
         const modulesJsonPath = join2(terraformModulesDir, "modules.json");
+        let resolvedFromJson = null;
         if (existsSync2(modulesJsonPath)) {
           try {
-            const modulesJson = JSON.parse(readFileSync2(modulesJsonPath, "utf-8"));
+            const rawJson = readFileSync2(modulesJsonPath, "utf-8");
+            const modulesJson = safeJsonParse(rawJson);
             const entry = modulesJson.Modules?.find(
               (m) => m.Key === moduleName || m.Key.startsWith(`${moduleName}.`)
             );
-            if (entry?.Dir) {
-              moduleDir = resolve(basePath, entry.Dir);
-            } else {
-              warnings.push(
-                `Registry module "${moduleName}" (source: "${source}") not found in .terraform/modules/. Run "terraform init" to download modules before estimating costs.`
-              );
-              logger.debug("Registry module not initialised", { moduleName, source });
-              continue;
+            if (entry?.Dir && typeof entry.Dir === "string") {
+              resolvedFromJson = resolveWithinBoundary(entry.Dir, basePath, boundary);
             }
           } catch {
-            warnings.push(
-              `Registry module "${moduleName}" (source: "${source}") not found in .terraform/modules/. Run "terraform init" to download modules before estimating costs.`
-            );
-            continue;
+            resolvedFromJson = null;
           }
+        }
+        if (resolvedFromJson) {
+          moduleDir = resolvedFromJson;
         } else {
           warnings.push(
-            `Registry module "${moduleName}" (source: "${source}") not found in .terraform/modules/. Run "terraform init" to download modules before estimating costs.`
+            `Registry module "${safeModuleName}" (source: "${safeSource}") not found in .terraform/modules/. Run "terraform init" to download modules before estimating costs.`
           );
-          logger.debug("Registry module not initialised", { moduleName, source });
+          logger.debug("Registry module not initialised", {
+            moduleName: safeModuleName,
+            source: safeSource
+          });
           continue;
         }
       }
     }
-    logger.debug("Resolving module", { moduleName, source, moduleDir, depth });
+    logger.debug("Resolving module", {
+      moduleName: safeModuleName,
+      source: safeSource,
+      moduleDir,
+      depth
+    });
     const childResources = await parseModuleDirectory(
       moduleDir,
       variables,
       moduleInputs,
       warnings,
-      depth
+      depth,
+      boundary
     );
     allResources.push(...prefixResources(childResources, moduleName));
   }
@@ -3927,7 +4985,7 @@ function extractAttributes(cfnType, props) {
       return {
         instance_type: asString(props.DBInstanceClass),
         engine: asString(props.Engine),
-        storage_size_gb: asNumber(props.AllocatedStorage),
+        storage_size_gb: num(props.AllocatedStorage),
         multi_az: asBoolean(props.MultiAZ)
       };
     case "AWS::S3::Bucket":
@@ -3935,8 +4993,8 @@ function extractAttributes(cfnType, props) {
     case "AWS::EBS::Volume":
       return {
         storage_type: asString(props.VolumeType),
-        storage_size_gb: asNumber(props.Size),
-        iops: asNumber(props.Iops)
+        storage_size_gb: num(props.Size),
+        iops: num(props.Iops)
       };
     case "AWS::ElasticLoadBalancingV2::LoadBalancer":
       return {
@@ -3948,16 +5006,16 @@ function extractAttributes(cfnType, props) {
       return {};
     case "AWS::Lambda::Function":
       return {
-        memory_size: asNumber(props.MemorySize),
-        timeout: asNumber(props.Timeout)
+        memory_size: num(props.MemorySize),
+        timeout: num(props.Timeout)
       };
     case "AWS::DynamoDB::Table":
       return {
         billing_mode: asString(props.BillingMode) ?? "PROVISIONED",
-        read_capacity: asNumber(
+        read_capacity: num(
           props.ProvisionedThroughput?.ReadCapacityUnits
         ),
-        write_capacity: asNumber(
+        write_capacity: num(
           props.ProvisionedThroughput?.WriteCapacityUnits
         )
       };
@@ -3972,7 +5030,7 @@ function extractAttributes(cfnType, props) {
     case "AWS::ElastiCache::CacheCluster":
       return {
         instance_type: asString(props.CacheNodeType),
-        node_count: asNumber(props.NumCacheNodes),
+        node_count: num(props.NumCacheNodes),
         engine: asString(props.Engine)
       };
     case "AWS::CloudFront::Distribution":
@@ -3987,7 +5045,8 @@ function extractTags2(props) {
   if (Array.isArray(rawTags)) {
     for (const tag of rawTags) {
       if (tag && typeof tag === "object" && "Key" in tag && "Value" in tag) {
-        tags[String(tag.Key)] = String(tag.Value);
+        const { Key, Value } = tag;
+        tags[coerceToString(Key)] = coerceToString(Value);
       }
     }
   }
@@ -3996,14 +5055,6 @@ function extractTags2(props) {
 function asString(value) {
   return typeof value === "string" ? value : void 0;
 }
-function asNumber(value) {
-  if (typeof value === "number") return value;
-  if (typeof value === "string") {
-    const n = Number(value);
-    return Number.isNaN(n) ? void 0 : n;
-  }
-  return void 0;
-}
 function asBoolean(value) {
   if (typeof value === "boolean") return value;
   if (value === "true") return true;
@@ -4023,11 +5074,11 @@ var CloudFormationParser = class {
       return false;
     });
   }
-  async parse(files, options) {
+  parse(files, options) {
     const warnings = [];
     const file = files.find((f) => this.extensions.some((ext) => f.path.endsWith(ext)));
     if (!file) {
-      return emptyInventory(warnings);
+      return Promise.resolve(emptyInventory(warnings));
     }
     let template;
     try {
@@ -4036,11 +5087,11 @@ var CloudFormationParser = class {
       const msg = err instanceof Error ? err.message : String(err);
       warnings.push(`Failed to parse CloudFormation template ${file.path}: ${msg}`);
       logger.warn("CloudFormation parse error", { path: file.path, error: msg });
-      return emptyInventory(warnings);
+      return Promise.resolve(emptyInventory(warnings));
     }
     if (!template || typeof template !== "object" || !template.Resources) {
       warnings.push(`Invalid CloudFormation template: missing Resources section in ${file.path}`);
-      return emptyInventory(warnings);
+      return Promise.resolve(emptyInventory(warnings));
     }
     const resolvedParams = resolveParameters(
       template.Parameters ?? {},
@@ -4073,7 +5124,7 @@ var CloudFormationParser = class {
       region,
       warningCount: warnings.length
     });
-    return inventory;
+    return Promise.resolve(inventory);
   }
 };
 function emptyInventory(warnings) {
@@ -4179,14 +5230,14 @@ function extractAttributes2(armTypeLower, props, resource, parameters) {
       const diskProps = props;
       return {
         sku: resource.sku?.name,
-        storage_size_gb: asNumber2(diskProps.diskSizeGB)
+        storage_size_gb: num(diskProps.diskSizeGB)
       };
     }
     case "microsoft.dbforpostgresql/flexibleservers": {
       const storage = props.storage;
       return {
         sku: resource.sku?.name,
-        storage_size_gb: asNumber2(storage?.storageSizeGB)
+        storage_size_gb: num(storage?.storageSizeGB)
       };
     }
     case "microsoft.dbformysql/flexibleservers":
@@ -4210,7 +5261,7 @@ function extractAttributes2(armTypeLower, props, resource, parameters) {
       const pools = props.agentPoolProfiles;
       const firstPool = pools?.[0];
       return {
-        node_count: asNumber2(firstPool?.count),
+        node_count: num(firstPool?.count),
         vm_size: typeof firstPool?.vmSize === "string" ? firstPool.vmSize : void 0
       };
     }
@@ -4244,14 +5295,6 @@ function extractAttributes2(armTypeLower, props, resource, parameters) {
       return {};
   }
 }
-function asNumber2(value) {
-  if (typeof value === "number") return value;
-  if (typeof value === "string") {
-    const n = Number(value);
-    return Number.isNaN(n) ? void 0 : n;
-  }
-  return void 0;
-}
 
 // src/parsers/bicep/arm-parser.ts
 var ArmParser = class {
@@ -4263,11 +5306,11 @@ var ArmParser = class {
       return f.content.includes("schema.management.azure.com") || f.content.includes("Microsoft.") && f.content.includes("apiVersion");
     });
   }
-  async parse(files, options) {
+  parse(files, options) {
     const warnings = [];
     const file = files.find((f) => f.path.endsWith(".json"));
     if (!file) {
-      return emptyInventory2(warnings);
+      return Promise.resolve(emptyInventory2(warnings));
     }
     let template;
     try {
@@ -4276,11 +5319,11 @@ var ArmParser = class {
       const msg = err instanceof Error ? err.message : String(err);
       warnings.push(`Failed to parse ARM template ${file.path}: ${msg}`);
       logger.warn("ARM template parse error", { path: file.path, error: msg });
-      return emptyInventory2(warnings);
+      return Promise.resolve(emptyInventory2(warnings));
     }
     if (!template || typeof template !== "object" || !Array.isArray(template.resources)) {
       warnings.push(`Invalid ARM template: missing resources array in ${file.path}`);
-      return emptyInventory2(warnings);
+      return Promise.resolve(emptyInventory2(warnings));
     }
     const resolvedParams = resolveParameters2(
       template.parameters ?? {},
@@ -4313,7 +5356,7 @@ var ArmParser = class {
       region,
       warningCount: warnings.length
     });
-    return inventory;
+    return Promise.resolve(inventory);
   }
 };
 function emptyInventory2(warnings) {
@@ -4463,7 +5506,7 @@ function extractAttributes3(pulumiType, props) {
       return {
         instance_type: asString2(props.instanceClass),
         engine: asString2(props.engine),
-        storage_size_gb: asNumber3(props.allocatedStorage),
+        storage_size_gb: num(props.allocatedStorage),
         multi_az: asBoolean2(props.multiAz)
       };
     case "aws:s3/bucket:Bucket":
@@ -4471,8 +5514,8 @@ function extractAttributes3(pulumiType, props) {
     case "aws:ebs/volume:Volume":
       return {
         storage_type: asString2(props.type),
-        storage_size_gb: asNumber3(props.size),
-        iops: asNumber3(props.iops)
+        storage_size_gb: num(props.size),
+        iops: num(props.iops)
       };
     case "aws:lb/loadBalancer:LoadBalancer":
       return {
@@ -4484,14 +5527,14 @@ function extractAttributes3(pulumiType, props) {
       return {};
     case "aws:lambda/function:Function":
       return {
-        memory_size: asNumber3(props.memorySize),
-        timeout: asNumber3(props.timeout)
+        memory_size: num(props.memorySize),
+        timeout: num(props.timeout)
       };
     case "aws:dynamodb/table:Table":
       return {
         billing_mode: asString2(props.billingMode) ?? "PROVISIONED",
-        read_capacity: asNumber3(props.readCapacity),
-        write_capacity: asNumber3(props.writeCapacity)
+        read_capacity: num(props.readCapacity),
+        write_capacity: num(props.writeCapacity)
       };
     case "aws:route53/zone:Zone":
       return {};
@@ -4537,12 +5580,12 @@ function extractAttributes3(pulumiType, props) {
       };
     case "gcp:container:Cluster":
       return {
-        node_count: asNumber3(props.initialNodeCount)
+        node_count: num(props.initialNodeCount)
       };
     case "gcp:cloudfunctions:Function":
       return {
-        memory_size: asNumber3(props.availableMemoryMb),
-        timeout: asNumber3(props.timeout)
+        memory_size: num(props.availableMemoryMb),
+        timeout: num(props.timeout)
       };
     case "gcp:dns:ManagedZone":
       return {};
@@ -4565,14 +5608,6 @@ function extractTags3(props) {
 function asString2(value) {
   return typeof value === "string" ? value : void 0;
 }
-function asNumber3(value) {
-  if (typeof value === "number") return value;
-  if (typeof value === "string") {
-    const n = Number(value);
-    return Number.isNaN(n) ? void 0 : n;
-  }
-  return void 0;
-}
 function asBoolean2(value) {
   if (typeof value === "boolean") return value;
   if (value === "true") return true;
@@ -4595,7 +5630,7 @@ var PulumiParser = class {
       }
     });
   }
-  async parse(files, _options) {
+  parse(files, _options) {
     const warnings = [];
     const file = files.find((f) => {
       try {
@@ -4607,7 +5642,7 @@ var PulumiParser = class {
       }
     });
     if (!file) {
-      return emptyInventory3(warnings);
+      return Promise.resolve(emptyInventory3(warnings));
     }
     let stackExport;
     try {
@@ -4616,11 +5651,11 @@ var PulumiParser = class {
       const msg = err instanceof Error ? err.message : String(err);
       warnings.push(`Failed to parse Pulumi stack export ${file.path}: ${msg}`);
       logger.warn("Pulumi parse error", { path: file.path, error: msg });
-      return emptyInventory3(warnings);
+      return Promise.resolve(emptyInventory3(warnings));
     }
     if (!stackExport?.deployment?.resources || !Array.isArray(stackExport.deployment.resources)) {
       warnings.push(`Invalid Pulumi stack export: missing deployment.resources in ${file.path}`);
-      return emptyInventory3(warnings);
+      return Promise.resolve(emptyInventory3(warnings));
     }
     const resources = [];
     for (const pulumiRes of stackExport.deployment.resources) {
@@ -4654,7 +5689,7 @@ var PulumiParser = class {
       region: dominantRegion,
       warningCount: warnings.length
     });
-    return inventory;
+    return Promise.resolve(inventory);
   }
 };
 function emptyInventory3(warnings) {
@@ -4751,7 +5786,7 @@ async function parseTerraform(files, tfvarsContent, basePath, resolveModulesEnab
       parse_warnings: warnings
     };
   }
-  const combined = mergeHclJsons2(parsedJsons.map((p) => p.json));
+  const combined = mergeHclJsons(parsedJsons.map((p) => p.json));
   const variables = resolveVariables(combined, tfvarsContent);
   const providers = ["aws", "azure", "gcp"];
   const defaultRegions = {};
@@ -4770,7 +5805,7 @@ async function parseTerraform(files, tfvarsContent, basePath, resolveModulesEnab
     }
   }
   if (resolveModulesEnabled) {
-    const moduleBasePath = basePath ?? (parsedJsons.length > 0 ? dirname2(parsedJsons[0].path) : process.cwd());
+    const moduleBasePath = basePath ?? (parsedJsons.length > 0 ? deriveModuleBasePath(parsedJsons[0].path) : process.cwd());
     try {
       const moduleResources = await resolveModules(combined, moduleBasePath, variables, warnings);
       allResources.push(...moduleResources);
@@ -4803,46 +5838,19 @@ async function parseTerraform(files, tfvarsContent, basePath, resolveModulesEnab
   });
   return inventory;
 }
-function mergeHclJsons2(jsons) {
-  const merged = {};
-  for (const json of jsons) {
-    for (const [key, value] of Object.entries(json)) {
-      if (!(key in merged)) {
-        merged[key] = deepClone(value);
-        continue;
-      }
-      const existing = merged[key];
-      if (value !== null && typeof value === "object" && !Array.isArray(value) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-        merged[key] = mergeObjects2(
-          existing,
-          value
-        );
-      } else if (Array.isArray(existing) && Array.isArray(value)) {
-        merged[key] = [...existing, ...value];
-      } else {
-        merged[key] = deepClone(value);
-      }
-    }
+function deriveModuleBasePath(filePath) {
+  const normalized = normalize4(filePath);
+  const isWindowsDrive = /^[A-Za-z]:/.test(normalized);
+  const isWindowsUnc = normalized.startsWith("\\\\") || normalized.startsWith("//");
+  if (isAbsolute(normalized) || isWindowsDrive || isWindowsUnc) {
+    return process.cwd();
   }
-  return merged;
-}
-function mergeObjects2(a, b) {
-  const result = { ...a };
-  for (const [key, bVal] of Object.entries(b)) {
-    const aVal = result[key];
-    if (aVal !== null && typeof aVal === "object" && !Array.isArray(aVal) && bVal !== null && typeof bVal === "object" && !Array.isArray(bVal)) {
-      result[key] = mergeObjects2(aVal, bVal);
-    } else if (Array.isArray(aVal) && Array.isArray(bVal)) {
-      result[key] = [...aVal, ...bVal];
-    } else {
-      result[key] = deepClone(bVal);
-    }
+  const dir = dirname2(normalized);
+  const escapesUpward = dir === ".." || dir.startsWith(`..${sep2}`) || dir.startsWith("../");
+  if (escapesUpward) {
+    return process.cwd();
   }
-  return result;
-}
-function deepClone(value) {
-  if (value === null || typeof value !== "object") return value;
-  return structuredClone(value);
+  return dir;
 }
 
 // src/parsers/dependency-graph.ts
@@ -4973,16 +5981,54 @@ function generateMermaidDiagram(graph) {
   return lines.join("\n");
 }
 
+// src/schemas/fragments.ts
+import { z as z2 } from "zod";
+
+// src/schemas/bounded.ts
+import { z } from "zod";
+var MAX_FILE_PATH_LEN = 1024;
+var MAX_FILE_CONTENT_BYTES = 5 * 1024 * 1024;
+var MAX_TFVARS_BYTES = 1 * 1024 * 1024;
+var MAX_PLAN_JSON_BYTES = 20 * 1024 * 1024;
+var MAX_STATE_JSON_BYTES = 20 * 1024 * 1024;
+var MAX_SHORT_STRING_LEN = 256;
+var MAX_TOTAL_FILE_BYTES = 50 * 1024 * 1024;
+var filePathSchema = z.string().max(MAX_FILE_PATH_LEN, `File path exceeds ${MAX_FILE_PATH_LEN} characters`);
+var fileContentSchema = z.string().max(MAX_FILE_CONTENT_BYTES, `File content exceeds ${MAX_FILE_CONTENT_BYTES} bytes`);
+var tfvarsSchema = z.string().max(MAX_TFVARS_BYTES, `tfvars content exceeds ${MAX_TFVARS_BYTES} bytes`);
+var planJsonSchema = z.string().max(MAX_PLAN_JSON_BYTES, `plan JSON exceeds ${MAX_PLAN_JSON_BYTES} bytes`);
+var stateJsonSchema = z.string().max(MAX_STATE_JSON_BYTES, `state JSON exceeds ${MAX_STATE_JSON_BYTES} bytes`);
+var shortStringSchema = z.string().max(MAX_SHORT_STRING_LEN, `value exceeds ${MAX_SHORT_STRING_LEN} characters`);
+function assertTotalFileBytesWithin(files, ctx) {
+  let total = 0;
+  for (const f of files) {
+    total += f.content.length;
+    if (total > MAX_TOTAL_FILE_BYTES) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: `aggregate file content exceeds ${MAX_TOTAL_FILE_BYTES} bytes`,
+        path: ["files"]
+      });
+      return;
+    }
+  }
+}
+
+// src/schemas/fragments.ts
+var providerEnum = z2.enum(["aws", "azure", "gcp"]);
+var iacFileEntrySchema = z2.object({
+  path: filePathSchema.describe("File path"),
+  content: fileContentSchema.describe("File content")
+});
+var iacFilesSchema = z2.array(iacFileEntrySchema).max(2e3, "files array exceeds 2000 entries").superRefine(assertTotalFileBytesWithin);
+var tfvarsField = tfvarsSchema.optional().describe("Contents of terraform.tfvars file");
+var currencyField = z2.enum(SUPPORTED_CURRENCIES).optional().default("USD").describe("Output currency for cost estimates. Defaults to USD.");
+
 // src/tools/analyze-terraform.ts
-var analyzeTerraformSchema = z.object({
-  files: z.array(
-    z.object({
-      path: z.string().describe("File path"),
-      content: z.string().describe("File content (HCL)")
-    })
-  ).describe("Terraform files to analyze"),
-  tfvars: z.string().optional().describe("Contents of terraform.tfvars file"),
-  include_dependencies: z.boolean().optional().default(false).describe(
+var analyzeTerraformSchema = z3.object({
+  files: iacFilesSchema.describe("Terraform files to analyze"),
+  tfvars: tfvarsField,
+  include_dependencies: z3.boolean().optional().default(false).describe(
     "When true, parse resource references and depends_on blocks to build a dependency graph and Mermaid diagram"
   )
 });
@@ -5034,7 +6080,7 @@ async function analyzeTerraform(params) {
 }
 
 // src/tools/estimate-cost.ts
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
 
 // src/mapping/region-mapper.ts
 var DEFAULT_REGIONS = {
@@ -5063,6 +6109,27 @@ function mapRegion(region, sourceProvider, targetProvider) {
   return mapped;
 }
 
+// src/calculator/estimate-factory.ts
+function round2(n) {
+  return Math.round(n * 100) / 100;
+}
+function makeCostEstimate(input) {
+  return {
+    resource_id: input.resource.id,
+    resource_type: input.resource.type,
+    resource_name: input.resource.name,
+    provider: input.provider,
+    region: input.region,
+    monthly_cost: round2(input.monthlyCost),
+    yearly_cost: round2(input.monthlyCost * 12),
+    currency: input.currency ?? "USD",
+    breakdown: input.breakdown,
+    confidence: input.confidence,
+    notes: input.notes,
+    pricing_source: input.pricingSource
+  };
+}
+
 // src/mapping/instance-mapper.ts
 function directionKey(source, target) {
   if (source === target) return null;
@@ -5244,7 +6311,7 @@ async function calculateComputeCost(resource, targetProvider, targetRegion, pric
       `No instance mapping found for ${sourceInstanceType} (${resource.provider} -> ${targetProvider})`
     );
   } else {
-    const { getInstanceMap: getInstanceMap2 } = await import("./loader-VXYJYDIH.js");
+    const { getInstanceMap: getInstanceMap2 } = await import("./loader-CMBV7346.js");
     const im = getInstanceMap2();
     const dirKey = `${resource.provider}_to_${targetProvider}`;
     const directMap = im[dirKey];
@@ -5258,11 +6325,7 @@ async function calculateComputeCost(resource, targetProvider, targetRegion, pric
     }
   }
   const effectiveInstance = mappedInstance ?? sourceInstanceType;
-  const computePrice = effectiveInstance ? await pricingEngine.getProvider(targetProvider).getComputePrice(
-    effectiveInstance,
-    targetRegion,
-    resource.attributes.os
-  ) : null;
+  const computePrice = effectiveInstance ? await pricingEngine.getProvider(targetProvider).getComputePrice(effectiveInstance, targetRegion, resource.attributes.os) : null;
   let computeMonthlyCost = 0;
   let pricingSource = "fallback";
   if (computePrice) {
@@ -5282,13 +6345,69 @@ async function calculateComputeCost(resource, targetProvider, targetRegion, pric
     }
     let hourlyPrice = computePrice.price_per_unit;
     if (pricingConfig.pricing_model === "spot") {
-      const family = classifyInstanceFamily(effectiveInstance, targetProvider);
-      const providerFactors = SPOT_DISCOUNT_FACTORS[targetProvider] ?? SPOT_DISCOUNT_FACTORS.aws;
-      const factor = providerFactors[family] ?? providerFactors.general ?? 0.35;
-      const savingsPct = Math.round((1 - factor) * 100);
-      hourlyPrice = hourlyPrice * factor;
-      pricingSource = "spot-estimate";
-      notes.push(`Spot pricing applied (${savingsPct}% discount from on-demand)`);
+      let liveSpotApplied = false;
+      if (targetProvider === "azure") {
+        try {
+          const azureProvider = pricingEngine.getProvider("azure");
+          if (typeof azureProvider.getSpotPrice === "function") {
+            const liveSpot = await azureProvider.getSpotPrice(
+              effectiveInstance,
+              targetRegion,
+              resource.attributes.os
+            );
+            if (liveSpot && liveSpot.price_per_unit > 0 && hourlyPrice > 0) {
+              const savingsPct = Math.max(
+                0,
+                Math.round((1 - liveSpot.price_per_unit / hourlyPrice) * 100)
+              );
+              hourlyPrice = liveSpot.price_per_unit;
+              pricingSource = "live";
+              liveSpotApplied = true;
+              notes.push(
+                `Spot pricing applied from live Azure Retail API (${savingsPct}% discount from on-demand)`
+              );
+            }
+          }
+        } catch (err) {
+          logger.debug("Azure live spot lookup failed, using fallback discount factor", {
+            err: err instanceof Error ? err.message : String(err)
+          });
+        }
+      }
+      if (!liveSpotApplied && targetProvider === "aws") {
+        try {
+          const awsProvider = pricingEngine.getProvider("aws");
+          if (typeof awsProvider.getSpotFactor === "function") {
+            const liveFactor = await awsProvider.getSpotFactor(
+              effectiveInstance,
+              targetRegion,
+              resource.attributes.os
+            );
+            if (liveFactor !== null && liveFactor > 0 && liveFactor < 1) {
+              const savingsPct = Math.round((1 - liveFactor) * 100);
+              hourlyPrice = hourlyPrice * liveFactor;
+              pricingSource = "live";
+              liveSpotApplied = true;
+              notes.push(
+                `Spot pricing applied from live AWS Spot Advisor (${savingsPct}% discount from on-demand)`
+              );
+            }
+          }
+        } catch (err) {
+          logger.debug("AWS live spot lookup failed, using fallback discount factor", {
+            err: err instanceof Error ? err.message : String(err)
+          });
+        }
+      }
+      if (!liveSpotApplied) {
+        const family = classifyInstanceFamily(effectiveInstance, targetProvider);
+        const providerFactors = SPOT_DISCOUNT_FACTORS[targetProvider] ?? SPOT_DISCOUNT_FACTORS.aws;
+        const factor = providerFactors[family] ?? providerFactors.general ?? 0.35;
+        const savingsPct = Math.round((1 - factor) * 100);
+        hourlyPrice = hourlyPrice * factor;
+        pricingSource = "spot-estimate";
+        notes.push(`Spot pricing applied (${savingsPct}% discount from on-demand)`);
+      }
     }
     computeMonthlyCost = hourlyPrice * monthlyHours;
     breakdown.push({
@@ -5327,20 +6446,16 @@ async function calculateComputeCost(resource, targetProvider, targetRegion, pric
     }
   }
   const totalMonthly = computeMonthlyCost + storageMonthlyCost;
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence,
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 
 // src/calculator/database.ts
@@ -5443,20 +6558,16 @@ async function calculateDatabaseCost(resource, targetProvider, targetRegion, pri
     }
   }
   const totalMonthly = instanceMonthlyCost + storageMonthlyCost;
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: mappedInstance ? "high" : "low",
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 
 // src/calculator/storage.ts
@@ -5535,20 +6646,16 @@ async function calculateStorageCost(resource, targetProvider, targetRegion, pric
       targetRegion
     });
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: storagePrice ? "high" : "low",
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 
 // src/calculator/network.ts
@@ -5598,20 +6705,16 @@ async function calculateNatGatewayCost(resource, targetProvider, targetRegion, p
   } else {
     notes.push(`No pricing data found for ${resource.type} in ${targetRegion}`);
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: natPrice ? "medium" : "low",
     notes,
-    pricing_source: natPricingSource
-  };
+    pricingSource: natPricingSource
+  });
 }
 async function calculateLoadBalancerCost(resource, targetProvider, targetRegion, pricingEngine, monthlyHours = 730) {
   const notes = [];
@@ -5643,20 +6746,16 @@ async function calculateLoadBalancerCost(resource, targetProvider, targetRegion,
   } else {
     notes.push(`No pricing data found for ${resource.type} in ${targetRegion}`);
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: lbPrice ? "medium" : "low",
     notes,
-    pricing_source: lbPricingSource
-  };
+    pricingSource: lbPricingSource
+  });
 }
 
 // src/calculator/kubernetes.ts
@@ -5727,20 +6826,16 @@ async function calculateKubernetesCost(resource, targetProvider, targetRegion, p
       );
     }
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: k8sPrice ? "medium" : "low",
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 
 // src/calculator/serverless.ts
@@ -5795,20 +6890,16 @@ function calculateLambdaCost(resource, targetProvider, targetRegion) {
   }
   const totalMonthly = requestCost + computeCost;
   void timeoutSec;
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 var DYNAMO_ON_DEMAND_WRITE_PER_MILLION = 1.25;
 var DYNAMO_ON_DEMAND_READ_PER_MILLION = 0.25;
@@ -5878,20 +6969,16 @@ function calculateDynamoDbCost(resource, targetProvider, targetRegion) {
     monthly_cost: storageCost
   });
   totalMonthly += storageCost;
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 var SQS_STANDARD_PER_MILLION = 0.4;
 var SQS_FIFO_PER_MILLION = 0.5;
@@ -5916,20 +7003,16 @@ function calculateSqsCost(resource, targetProvider, targetRegion) {
     );
   }
   notes.push(`SQS ${queueType} queue pricing at $${pricePerMillion}/million requests`);
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/cache.ts
@@ -5986,20 +7069,16 @@ function calculateElastiCacheCost(resource, targetProvider, targetRegion) {
   } else {
     notes.push(`No pricing data found for ElastiCache node type ${nodeType}; cost reported as $0`);
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: basePrice !== void 0 ? "medium" : "low",
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 var AZURE_REDIS_PRICES = {
   // Basic (single node, no SLA)
@@ -6052,20 +7131,16 @@ function calculateAzureRedisCacheCost(resource, targetProvider, targetRegion) {
       `No pricing found for Azure Redis Cache ${sku} ${capacityStr.toUpperCase()}; cost reported as $0`
     );
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hourlyPrice !== void 0 ? "medium" : "low",
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 var GCP_REDIS_PRICES = {
   basic: 0.049,
@@ -6089,20 +7164,16 @@ function calculateGcpRedisCost(resource, targetProvider, targetRegion) {
   notes.push(
     `GCP Memorystore Redis: ${normalizedTier} tier, ${memorySizeGb}GB \u2014 $${pricePerGbHour}/GB/hr`
   );
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 var CLOUDFRONT_DATA_FIRST_10TB_PER_GB = 0.085;
 var DEFAULT_CLOUDFRONT_TRANSFER_GB = 100;
@@ -6142,20 +7213,16 @@ function calculateCloudFrontCost(resource, targetProvider, targetRegion) {
   notes.push(
     `CloudFront ${priceClass} \u2014 HTTPS request charges excluded (runtime traffic data required)`
   );
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/paas.ts
@@ -6222,20 +7289,16 @@ function calculateAppServicePlanCost(resource, targetProvider, targetRegion) {
       `No pricing found for App Service Plan SKU "${skuName || skuSize || skuTier}"; cost reported as $0`
     );
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hourlyPrice !== void 0 ? "medium" : "low",
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 var COSMOS_SERVERLESS_PER_MILLION_RU = 0.25;
 var COSMOS_PROVISIONED_PER_100_RU_PER_HR = 8e-3;
@@ -6293,20 +7356,16 @@ function calculateCosmosDbCost(resource, targetProvider, targetRegion) {
     });
     totalMonthly += storageCost;
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 var AZURE_FUNC_PER_MILLION_EXECUTIONS = 0.2;
 var AZURE_FUNC_GB_SECOND_PRICE = 16e-6;
@@ -6343,20 +7402,16 @@ function calculateAzureFunctionCost(resource, targetProvider, targetRegion) {
     );
   }
   notes.push("Azure Function App on Consumption plan (dedicated plan not priced separately)");
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 var CLOUD_RUN_VCPU_PER_SECOND = 24e-6;
 var CLOUD_RUN_MEMORY_GIB_PER_SECOND = 25e-7;
@@ -6429,20 +7484,16 @@ function calculateCloudRunCost(resource, targetProvider, targetRegion) {
     );
   }
   notes.push(`Cloud Run: ${vcpus} vCPU, ${memoryGib.toFixed(2)}GiB memory`);
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 var BIGQUERY_QUERY_PER_TB = 5;
 var BIGQUERY_STORAGE_PER_GB = 0.02;
@@ -6475,24 +7526,20 @@ function calculateBigQueryCost(resource, targetProvider, targetRegion) {
       `Default assumption: ${DEFAULT_BIGQUERY_QUERY_TB}TB queries/month \u2014 provide monthly_query_tb attribute for accuracy`
     );
   }
-  if (resource.attributes.location) {
+  if (typeof resource.attributes.location === "string" && resource.attributes.location) {
     notes.push(`BigQuery location: ${resource.attributes.location}`);
   }
   notes.push("BigQuery on-demand pricing; flat-rate/reservations not included");
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 var GCF_PER_MILLION_INVOCATIONS = 0.4;
 var GCF_GB_SECOND_PRICE = 25e-7;
@@ -6528,114 +7575,38 @@ function calculateGcpFunctionCost(resource, targetProvider, targetRegion) {
       `Default assumption: ${DEFAULT_GCF_INVOCATIONS.toLocaleString()} invocations/month, ${DEFAULT_GCF_DURATION_MS}ms avg, ${DEFAULT_GCF_MEMORY_MB}MB memory`
     );
   }
-  if (resource.attributes.runtime) {
+  if (typeof resource.attributes.runtime === "string" && resource.attributes.runtime) {
     notes.push(`Cloud Function runtime: ${resource.attributes.runtime}`);
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/data-transfer.ts
 var DEFAULT_EGRESS_GB = 100;
-var AWS_EGRESS_PER_GB = 0.09;
-var AZURE_EGRESS_PER_GB = 0.087;
-var GCP_EGRESS_PER_GB = 0.085;
-var AWS_REGION_MULTIPLIERS = {
-  "us-east-1": 1,
-  "us-east-2": 1,
-  "us-west-1": 1,
-  "us-west-2": 1,
-  "eu-west-1": 1,
-  "eu-west-2": 1,
-  "eu-central-1": 1,
-  "ap-southeast-1": 1.11,
-  // $0.10/GB
-  "ap-southeast-2": 1.11,
-  "ap-northeast-1": 1.11,
-  "ap-northeast-2": 1.11,
-  "ap-south-1": 1.11,
-  "sa-east-1": 1.31,
-  // $0.118/GB
-  "ca-central-1": 1,
-  "eu-north-1": 1,
-  "me-south-1": 1.11,
-  "af-south-1": 1.16
-  // $0.1046/GB
-};
-var AZURE_REGION_MULTIPLIERS = {
-  eastus: 1,
-  eastus2: 1,
-  westus: 1,
-  westus2: 1,
-  westus3: 1,
-  centralus: 1,
-  northeurope: 1,
-  westeurope: 1,
-  uksouth: 1,
-  ukwest: 1,
-  germanywestcentral: 1,
-  francecentral: 1,
-  eastasia: 1.16,
-  // Zone 2 rate
-  southeastasia: 1.16,
-  japaneast: 1.16,
-  koreacentral: 1.16,
-  australiaeast: 1.24,
-  // Zone 3 rate
-  brazilsouth: 1.31,
-  southafricanorth: 1.31
-};
-var GCP_REGION_MULTIPLIERS = {
-  "us-central1": 1,
-  "us-east1": 1,
-  "us-east4": 1,
-  "us-west1": 1,
-  "us-west2": 1,
-  "us-west3": 1,
-  "us-west4": 1,
-  "europe-west1": 1,
-  "europe-west2": 1,
-  "europe-west3": 1,
-  "europe-west4": 1,
-  "europe-west6": 1,
-  "europe-north1": 1,
-  "northamerica-northeast1": 1,
-  "southamerica-east1": 1.59,
-  // $0.135/GB
-  "asia-east1": 1.41,
-  // $0.12/GB (APAC)
-  "asia-east2": 1.41,
-  "asia-northeast1": 1.41,
-  "asia-northeast2": 1.41,
-  "asia-northeast3": 1.41,
-  "asia-south1": 1.41,
-  "asia-southeast1": 1.41,
-  "asia-southeast2": 1.41,
-  "australia-southeast1": 1.41,
-  "australia-southeast2": 1.41
+var EGRESS_PRICING = {
+  aws: {
+    ratePerGb: 0.09,
+    note: "Data transfer costs cover internet egress only; intra-region and inter-AZ traffic charges are excluded from this estimate"
+  },
+  azure: {
+    ratePerGb: 0.087,
+    note: "Data transfer costs cover internet egress only; intra-region traffic is free on Azure and excluded from this estimate"
+  },
+  gcp: {
+    ratePerGb: 0.085,
+    note: "Data transfer costs cover internet egress only; intra-region and Google network traffic charges are excluded from this estimate"
+  }
 };
-function awsRegionMultiplier(region) {
-  return AWS_REGION_MULTIPLIERS[region.toLowerCase()] ?? 1;
-}
-function azureRegionMultiplier(region) {
-  return AZURE_REGION_MULTIPLIERS[region.toLowerCase()] ?? 1;
-}
-function gcpRegionMultiplier(region) {
-  return GCP_REGION_MULTIPLIERS[region.toLowerCase()] ?? 1;
-}
-async function calculateAwsDataTransferCost(resource, targetRegion) {
+function calculateEgressCost(resource, provider, targetRegion) {
   const notes = [];
   const breakdown = [];
   const egressGb = resource.attributes.monthly_egress_gb ?? DEFAULT_EGRESS_GB;
@@ -6644,8 +7615,8 @@ async function calculateAwsDataTransferCost(resource, targetRegion) {
       `Data transfer cost estimated at ${egressGb} GB/month egress; actual costs depend on traffic volume and destination`
     );
   }
-  const multiplier = awsRegionMultiplier(targetRegion);
-  const ratePerGb = AWS_EGRESS_PER_GB * multiplier;
+  const pricing = EGRESS_PRICING[provider];
+  const ratePerGb = pricing.ratePerGb * regionMultiplier(provider, targetRegion);
   const totalMonthly = ratePerGb * egressGb;
   breakdown.push({
     description: `Internet egress (${egressGb} GB/month, estimated)`,
@@ -6654,97 +7625,26 @@ async function calculateAwsDataTransferCost(resource, targetRegion) {
     unit_price: ratePerGb,
     monthly_cost: totalMonthly
   });
-  notes.push(
-    "Data transfer costs cover internet egress only; intra-region and inter-AZ traffic charges are excluded from this estimate"
-  );
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
-    provider: "aws",
+  notes.push(pricing.note);
+  return makeCostEstimate({
+    resource,
+    provider,
     region: targetRegion,
-    monthly_cost: Math.round(totalMonthly * 100) / 100,
-    yearly_cost: Math.round(totalMonthly * 12 * 100) / 100,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "low",
     notes,
-    pricing_source: "fallback"
-  };
-}
-async function calculateAzureDataTransferCost(resource, targetRegion) {
-  const notes = [];
-  const breakdown = [];
-  const egressGb = resource.attributes.monthly_egress_gb ?? DEFAULT_EGRESS_GB;
-  if (!resource.attributes.monthly_egress_gb || resource.attributes.monthly_egress_gb <= 0) {
-    notes.push(
-      `Data transfer cost estimated at ${egressGb} GB/month egress; actual costs depend on traffic volume and destination`
-    );
-  }
-  const multiplier = azureRegionMultiplier(targetRegion);
-  const ratePerGb = AZURE_EGRESS_PER_GB * multiplier;
-  const totalMonthly = ratePerGb * egressGb;
-  breakdown.push({
-    description: `Internet egress (${egressGb} GB/month, estimated)`,
-    unit: "GB",
-    quantity: egressGb,
-    unit_price: ratePerGb,
-    monthly_cost: totalMonthly
+    pricingSource: "fallback"
   });
-  notes.push(
-    "Data transfer costs cover internet egress only; intra-region traffic is free on Azure and excluded from this estimate"
-  );
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
-    provider: "azure",
-    region: targetRegion,
-    monthly_cost: Math.round(totalMonthly * 100) / 100,
-    yearly_cost: Math.round(totalMonthly * 12 * 100) / 100,
-    currency: "USD",
-    breakdown,
-    confidence: "low",
-    notes,
-    pricing_source: "fallback"
-  };
 }
-async function calculateGcpDataTransferCost(resource, targetRegion) {
-  const notes = [];
-  const breakdown = [];
-  const egressGb = resource.attributes.monthly_egress_gb ?? DEFAULT_EGRESS_GB;
-  if (!resource.attributes.monthly_egress_gb || resource.attributes.monthly_egress_gb <= 0) {
-    notes.push(
-      `Data transfer cost estimated at ${egressGb} GB/month egress; actual costs depend on traffic volume and destination`
-    );
-  }
-  const multiplier = gcpRegionMultiplier(targetRegion);
-  const ratePerGb = GCP_EGRESS_PER_GB * multiplier;
-  const totalMonthly = ratePerGb * egressGb;
-  breakdown.push({
-    description: `Internet egress (${egressGb} GB/month, estimated)`,
-    unit: "GB",
-    quantity: egressGb,
-    unit_price: ratePerGb,
-    monthly_cost: totalMonthly
-  });
-  notes.push(
-    "Data transfer costs cover internet egress only; intra-region and Google network traffic charges are excluded from this estimate"
-  );
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
-    provider: "gcp",
-    region: targetRegion,
-    monthly_cost: Math.round(totalMonthly * 100) / 100,
-    yearly_cost: Math.round(totalMonthly * 12 * 100) / 100,
-    currency: "USD",
-    breakdown,
-    confidence: "low",
-    notes,
-    pricing_source: "fallback"
-  };
+function calculateAwsDataTransferCost(resource, targetRegion) {
+  return calculateEgressCost(resource, "aws", targetRegion);
+}
+function calculateAzureDataTransferCost(resource, targetRegion) {
+  return calculateEgressCost(resource, "azure", targetRegion);
+}
+function calculateGcpDataTransferCost(resource, targetRegion) {
+  return calculateEgressCost(resource, "gcp", targetRegion);
 }
 
 // src/calculator/container-registry.ts
@@ -6795,20 +7695,16 @@ function calculateContainerRegistryCost(resource, targetProvider, targetRegion)
     monthly_cost: storageCost
   });
   const totalMonthly = storageCost;
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hasExplicitStorage ? "high" : "medium",
     notes,
-    pricing_source: "bundled"
-  };
+    pricingSource: "bundled"
+  });
 }
 
 // src/calculator/secrets.ts
@@ -6903,20 +7799,16 @@ function calculateSecretsCost(resource, targetProvider, targetRegion) {
     });
     totalMonthly += accessOpFee;
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hasExplicitSecretCount ? "high" : "medium",
     notes,
-    pricing_source: "bundled"
-  };
+    pricingSource: "bundled"
+  });
 }
 
 // src/calculator/dns.ts
@@ -6970,20 +7862,16 @@ function calculateDnsCost(resource, targetProvider, targetRegion) {
     monthly_cost: queryCost
   });
   const totalMonthly = zonePrice + queryCost;
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hasExplicitQueries ? "high" : "medium",
     notes,
-    pricing_source: "bundled"
-  };
+    pricingSource: "bundled"
+  });
 }
 
 // src/calculator/api-gateway.ts
@@ -7104,20 +7992,16 @@ function calculateApiGatewayCost(resource, targetProvider, targetRegion) {
       );
     }
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hasExplicitRequests ? "high" : "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/waf.ts
@@ -7231,20 +8115,16 @@ function calculateWafCost(resource, targetProvider, targetRegion) {
     totalMonthly += requestCost;
     notes.push("GCP equivalent: Cloud Armor security policy");
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hasExplicitRules && hasExplicitRequests ? "high" : "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/search.ts
@@ -7339,20 +8219,16 @@ function calculateSearchCost(resource, targetProvider, targetRegion) {
       "GCP has no direct managed OpenSearch service; estimate based on comparable compute cost"
     );
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: targetProvider === "aws" ? "medium" : "low",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/messaging.ts
@@ -7485,20 +8361,16 @@ function calculateMessagingCost(resource, targetProvider, targetRegion) {
       );
     }
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hasExplicitMessages ? "high" : "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 function calculateMqBrokerCost(resource, targetProvider, targetRegion) {
   const notes = [];
@@ -7535,20 +8407,16 @@ function calculateMqBrokerCost(resource, targetProvider, targetRegion) {
     unit_price: AWS_MQ_STORAGE_PER_GB,
     monthly_cost: storageCost
   });
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hourlyPrice !== void 0 ? "medium" : "low",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 function calculateEventHubCost(resource, targetProvider, targetRegion) {
   const notes = [];
@@ -7568,20 +8436,16 @@ function calculateEventHubCost(resource, targetProvider, targetRegion) {
   notes.push(
     `Azure Event Hubs: ${sku} tier, ${capacity} ${unitLabel}(s) \u2014 $${hourlyPrice}/${unitLabel}/hr`
   );
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 function calculatePubSubSubscriptionCost(resource, targetProvider, targetRegion) {
   const notes = [];
@@ -7604,20 +8468,16 @@ function calculatePubSubSubscriptionCost(resource, targetProvider, targetRegion)
   notes.push(
     `GCP Pub/Sub subscription: $${GCP_PUBSUB_SUBSCRIPTION_PER_MILLION_OPS}/million ack operations`
   );
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: opsCost,
-    yearly_cost: opsCost * 12,
-    currency: "USD",
+    monthlyCost: opsCost,
     breakdown,
     confidence: hasExplicitMessages ? "high" : "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/ml-ai.ts
@@ -7735,20 +8595,16 @@ function calculateMlAiCost(resource, targetProvider, targetRegion) {
       "Azure ML endpoint pricing not yet supported \u2014 consider Azure Machine Learning compute instance costs"
     );
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "low",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/cost-engine.ts
@@ -8045,20 +8901,16 @@ var CostEngine = class {
       return calculatePubSubSubscriptionCost(resource, targetProvider, targetRegion);
     }
     logger.warn("CostEngine: unsupported resource type", { type, targetProvider });
-    return {
-      resource_id: resource.id,
-      resource_type: type,
-      resource_name: resource.name,
+    return makeCostEstimate({
+      resource,
       provider: targetProvider,
       region: targetRegion,
-      monthly_cost: 0,
-      yearly_cost: 0,
-      currency: "USD",
+      monthlyCost: 0,
       breakdown: [],
       confidence: "low",
       notes: [`Resource type "${type}" is not yet supported by the cost engine`],
-      pricing_source: "fallback"
-    };
+      pricingSource: "fallback"
+    });
   }
   /**
    * Calculates costs for all resources and aggregates them into a CostBreakdown.
@@ -8124,7 +8976,7 @@ var CostEngine = class {
             name: `data-transfer-${estimate.provider}-${estimate.region}`,
             provider: estimate.provider,
             region: estimate.region,
-            attributes: { monthly_egress_gb: 100 },
+            attributes: { monthly_egress_gb: DEFAULT_EGRESS_GB },
             tags: {},
             source_file: "synthetic"
           }
@@ -8152,6 +9004,12 @@ var CostEngine = class {
       }
     }
     const totalMonthly = estimates.reduce((sum, e) => sum + e.monthly_cost, 0);
+    const estimatedEgressMonthly = estimates.filter((e) => DATA_TRANSFER_TYPES.has(e.resource_type)).reduce((sum, e) => sum + e.monthly_cost, 0);
+    if (estimatedEgressMonthly > 0) {
+      warnings.push(
+        `total_monthly includes a synthetic estimate of ${DEFAULT_EGRESS_GB} GB/month internet egress ($${(Math.round(estimatedEgressMonthly * 100) / 100).toFixed(2)}/mo, USD) \u2014 see estimated_egress_monthly. Set CLOUDCOST_INCLUDE_DATA_TRANSFER=false to exclude it.`
+      );
+    }
     const budgetWarnings = this.evaluateBudget(totalMonthly, estimates);
     return {
       provider: targetProvider,
@@ -8165,6 +9023,9 @@ var CostEngine = class {
       by_resource: estimates,
       generated_at: (/* @__PURE__ */ new Date()).toISOString(),
       warnings,
+      ...estimatedEgressMonthly > 0 && {
+        estimated_egress_monthly: Math.round(estimatedEgressMonthly * 100) / 100
+      },
       ...budgetWarnings.length > 0 && { budget_warnings: budgetWarnings }
     };
   }
@@ -8209,84 +9070,15 @@ var CostEngine = class {
   }
 };
 
-// src/currency.ts
-var SUPPORTED_CURRENCIES = [
-  "USD",
-  "EUR",
-  "GBP",
-  "JPY",
-  "CAD",
-  "AUD",
-  "INR",
-  "BRL"
-];
-var EXCHANGE_RATES = {
-  USD: 1,
-  EUR: 0.92,
-  GBP: 0.79,
-  JPY: 149.5,
-  CAD: 1.36,
-  AUD: 1.53,
-  INR: 83.1,
-  BRL: 4.97
-};
-function convertCurrency(amountUsd, targetCurrency) {
-  const rate = EXCHANGE_RATES[targetCurrency];
-  if (rate === void 0 || rate === 1) {
-    return amountUsd;
-  }
-  return amountUsd * rate;
-}
-function convertLineItem(item, currency) {
-  return {
-    ...item,
-    unit_price: convertCurrency(item.unit_price, currency),
-    monthly_cost: convertCurrency(item.monthly_cost, currency)
-  };
-}
-function convertCostEstimate(estimate, currency) {
-  return {
-    ...estimate,
-    monthly_cost: convertCurrency(estimate.monthly_cost, currency),
-    yearly_cost: convertCurrency(estimate.yearly_cost, currency),
-    currency,
-    breakdown: estimate.breakdown.map((item) => convertLineItem(item, currency))
-  };
-}
-function convertBreakdownCurrency(breakdown, currency) {
-  const original_usd = {
-    total_monthly: breakdown.total_monthly,
-    total_yearly: breakdown.total_yearly
-  };
-  const convertedByService = {};
-  for (const [service, amount] of Object.entries(breakdown.by_service)) {
-    convertedByService[service] = convertCurrency(amount, currency);
-  }
-  return {
-    ...breakdown,
-    total_monthly: convertCurrency(breakdown.total_monthly, currency),
-    total_yearly: convertCurrency(breakdown.total_yearly, currency),
-    currency,
-    by_service: convertedByService,
-    by_resource: breakdown.by_resource.map((est) => convertCostEstimate(est, currency)),
-    original_usd
-  };
-}
-
 // src/tools/estimate-cost.ts
-var estimateCostSchema = z2.object({
-  files: z2.array(
-    z2.object({
-      path: z2.string().describe("File path"),
-      content: z2.string().describe("File content (HCL)")
-    })
-  ),
-  tfvars: z2.string().optional().describe("Contents of terraform.tfvars file"),
-  provider: z2.enum(["aws", "azure", "gcp"]).describe("Target cloud provider to estimate costs for"),
-  region: z2.string().optional().describe(
+var estimateCostSchema = z4.object({
+  files: iacFilesSchema,
+  tfvars: tfvarsField,
+  provider: providerEnum.describe("Target cloud provider to estimate costs for"),
+  region: shortStringSchema.optional().describe(
     "Target region for pricing lookup. Defaults to the source region mapped to the target provider."
   ),
-  currency: z2.enum(SUPPORTED_CURRENCIES).optional().default("USD").describe("Output currency for cost estimates. Defaults to USD.")
+  currency: currencyField
 });
 async function estimateCost(params, pricingEngine, config) {
   const inventory = await parseTerraform(params.files, params.tfvars);
@@ -8323,12 +9115,13 @@ async function estimateCost(params, pricingEngine, config) {
   return {
     ...convertedRest,
     by_resource: byResource,
-    warnings: allWarnings
+    warnings: allWarnings,
+    pricing_metadata: getPricingMetadata(targetProvider)
   };
 }
 
 // src/tools/compare-providers.ts
-import { z as z3 } from "zod";
+import { z as z5 } from "zod";
 
 // src/calculator/reserved.ts
 var DISCOUNT_RATES = {
@@ -8356,8 +9149,12 @@ var DISCOUNT_RATES = {
     { term: "3yr", payment: "partial_upfront", rate: 0.45 }
   ]
 };
-function calculateReservedPricing(onDemandMonthly, provider) {
-  const rates = DISCOUNT_RATES[provider];
+function calculateReservedPricing(onDemandMonthly, provider, overrides) {
+  const baseRates = DISCOUNT_RATES[provider];
+  const rates = overrides ? baseRates.map((r) => {
+    const override = overrides[r.term];
+    return override !== void 0 ? { ...r, rate: override } : r;
+  }) : baseRates;
   const options = rates.map(({ term, payment, rate }) => {
     const monthly_cost = onDemandMonthly * (1 - rate);
     const monthly_savings = onDemandMonthly - monthly_cost;
@@ -8872,15 +9669,23 @@ function generateJsonReport(comparison, resources, monthlyHours = 730, parseWarn
   return JSON.stringify(output);
 }
 
-// src/reporting/csv-report.ts
-var PROVIDERS = ["aws", "azure", "gcp"];
+// src/reporting/csv-escape.ts
 function csvEscape(value) {
-  const str2 = String(value);
-  if (str2.includes(",") || str2.includes("\n") || str2.includes('"')) {
-    return `"${str2.replace(/"/g, '""')}"`;
+  if (typeof value === "number") {
+    return Number.isFinite(value) ? String(value) : "";
+  }
+  let str2 = String(value);
+  if (/^[=+\-@\t\r]/.test(str2)) {
+    str2 = "'" + str2;
+  }
+  if (/["\n\r,]/.test(str2)) {
+    str2 = `"${str2.replace(/"/g, '""')}"`;
   }
   return str2;
 }
+
+// src/reporting/csv-report.ts
+var PROVIDERS = ["aws", "azure", "gcp"];
 function generateCsvReport(comparison, resources, options = {}) {
   const lines = [];
   const tagKey = options.group_by === "tag" ? options.group_by_tag_key : void 0;
@@ -9041,15 +9846,8 @@ function billingPeriodEnd() {
   const now = /* @__PURE__ */ new Date();
   return new Date(now.getFullYear(), now.getMonth() + 1, 1).toISOString().split("T")[0];
 }
-function csvEscape2(value) {
-  const str2 = String(value);
-  if (str2.includes(",") || str2.includes("\n") || str2.includes('"')) {
-    return `"${str2.replace(/"/g, '""')}"`;
-  }
-  return str2;
-}
 function buildRow(values) {
-  return values.map(csvEscape2).join(",");
+  return values.map(csvEscape).join(",");
 }
 function generateFocusReport(comparison, resources) {
   const lines = [];
@@ -9116,17 +9914,12 @@ function generateFocusReport(comparison, resources) {
 }
 
 // src/tools/compare-providers.ts
-var compareProvidersSchema = z3.object({
-  files: z3.array(
-    z3.object({
-      path: z3.string().describe("File path"),
-      content: z3.string().describe("File content (HCL)")
-    })
-  ),
-  tfvars: z3.string().optional().describe("Contents of terraform.tfvars file"),
-  format: z3.enum(["markdown", "json", "csv", "focus"]).default("markdown").describe("Output report format"),
-  providers: z3.array(z3.enum(["aws", "azure", "gcp"])).default(["aws", "azure", "gcp"]).describe("Cloud providers to include in the comparison"),
-  currency: z3.enum(SUPPORTED_CURRENCIES).optional().default("USD").describe("Output currency for cost estimates. Defaults to USD.")
+var compareProvidersSchema = z5.object({
+  files: iacFilesSchema,
+  tfvars: tfvarsField,
+  format: z5.enum(["markdown", "json", "csv", "focus"]).default("markdown").describe("Output report format"),
+  providers: z5.array(providerEnum).default(["aws", "azure", "gcp"]).describe("Cloud providers to include in the comparison"),
+  currency: currencyField
 });
 async function compareProviders(params, pricingEngine, config) {
   const inventory = await parseTerraform(params.files, params.tfvars);
@@ -9182,11 +9975,13 @@ async function compareProviders(params, pricingEngine, config) {
       break;
   }
   const dedupedWarnings = [.../* @__PURE__ */ new Set([...parseWarnings, ...allWarnings])];
+  const pricingMetadata = Object.fromEntries(providerList.map((p) => [p, getPricingMetadata(p)]));
   if (params.format === "json") {
     return {
       report,
       format: params.format,
-      warnings: dedupedWarnings
+      warnings: dedupedWarnings,
+      pricing_metadata: pricingMetadata
     };
   }
   const comparisonSummary = {
@@ -9203,21 +9998,17 @@ async function compareProviders(params, pricingEngine, config) {
     report,
     format: params.format,
     comparison: comparisonSummary,
-    warnings: dedupedWarnings
+    warnings: dedupedWarnings,
+    pricing_metadata: pricingMetadata
   };
 }
 
 // src/tools/optimize-cost.ts
-import { z as z4 } from "zod";
-var optimizeCostSchema = z4.object({
-  files: z4.array(
-    z4.object({
-      path: z4.string().describe("File path"),
-      content: z4.string().describe("File content (HCL)")
-    })
-  ),
-  tfvars: z4.string().optional().describe("Contents of terraform.tfvars file"),
-  providers: z4.array(z4.enum(["aws", "azure", "gcp"])).default(["aws", "azure", "gcp"]).describe("Providers to calculate costs against for cross-provider recommendations")
+import { z as z6 } from "zod";
+var optimizeCostSchema = z6.object({
+  files: iacFilesSchema,
+  tfvars: tfvarsField,
+  providers: z6.array(providerEnum).default(["aws", "azure", "gcp"]).describe("Providers to calculate costs against for cross-provider recommendations")
 });
 async function optimizeCost(params, pricingEngine, config) {
   const inventory = await parseTerraform(params.files, params.tfvars);
@@ -9253,24 +10044,23 @@ async function optimizeCost(params, pricingEngine, config) {
 }
 
 // src/tools/what-if.ts
-import { z as z5 } from "zod";
-var whatIfSchema = z5.object({
-  files: z5.array(
-    z5.object({
-      path: z5.string().describe("File path"),
-      content: z5.string().describe("File content (HCL)")
-    })
-  ).describe("Terraform HCL files to analyse"),
-  changes: z5.array(
-    z5.object({
-      resource_id: z5.string().describe("The resource ID to modify (e.g. aws_instance.web)"),
-      attribute: z5.string().describe("The attribute name to change (e.g. instance_type, storage_size_gb)"),
-      new_value: z5.union([z5.string(), z5.number()]).describe("The new value for the attribute")
+import { z as z7 } from "zod";
+var whatIfSchema = z7.object({
+  files: iacFilesSchema.describe("Terraform HCL files to analyse"),
+  changes: z7.array(
+    z7.object({
+      resource_id: shortStringSchema.describe(
+        "The resource ID to modify (e.g. aws_instance.web)"
+      ),
+      attribute: shortStringSchema.describe(
+        "The attribute name to change (e.g. instance_type, storage_size_gb)"
+      ),
+      new_value: z7.union([shortStringSchema, z7.number()]).describe("The new value for the attribute")
     })
-  ).describe("List of attribute changes to simulate"),
-  provider: z5.enum(["aws", "azure", "gcp"]).optional().describe("Target cloud provider. Defaults to auto-detecting from the files"),
-  region: z5.string().optional().describe("Target region for pricing. Defaults to the region detected from provider blocks"),
-  tfvars: z5.string().optional().describe("Contents of a terraform.tfvars file for variable resolution")
+  ).max(200, "changes array exceeds 200 entries").describe("List of attribute changes to simulate"),
+  provider: providerEnum.optional().describe("Target cloud provider. Defaults to auto-detecting from the files"),
+  region: shortStringSchema.optional().describe("Target region for pricing. Defaults to the region detected from provider blocks"),
+  tfvars: tfvarsSchema.optional().describe("Contents of a terraform.tfvars file for variable resolution")
 });
 function cloneResources(resources) {
   return JSON.parse(JSON.stringify(resources));
@@ -9366,23 +10156,34 @@ async function whatIf(params, pricingEngine, config) {
 }
 
 export {
-  loadConfig,
   setLogLevel,
   logger,
+  loadConfig,
+  SUPPORTED_CURRENCIES,
+  convertCurrency,
+  getExchangeRateInfo,
+  convertBreakdownCurrency,
   PricingCache,
   PricingEngine,
+  sanitizeForMessage,
+  coerceToString,
   str,
   num,
   bool,
+  safeJsonParse,
   parseTerraform,
+  planJsonSchema,
+  stateJsonSchema,
+  shortStringSchema,
+  providerEnum,
+  iacFilesSchema,
+  tfvarsField,
+  currencyField,
   analyzeTerraformSchema,
   analyzeTerraform,
   mapRegion,
   mapInstance,
   CostEngine,
-  SUPPORTED_CURRENCIES,
-  convertCurrency,
-  convertBreakdownCurrency,
   estimateCostSchema,
   estimateCost,
   compareProvidersSchema,
@@ -9392,4 +10193,4 @@ export {
   whatIfSchema,
   whatIf
 };
-//# sourceMappingURL=chunk-E7KOWAMW.js.map
+//# sourceMappingURL=chunk-CGMU4ETN.js.map