@jadenrazo/cloudcost-mcp 1.0.1 → 1.2.0

package/dist/{chunk-6O2Y6MKU.js → chunk-CGMU4ETN.js}

@@ -8,10 +8,11 @@ import {
   getGcpSqlPricing,
   getGcpStoragePricing,
   getInstanceMap,
+  getPricingMetadata,
   getRegionMappings,
   getRegionPriceMultipliers,
   getStorageMap
-} from "./chunk-MNFT5YKN.js";
+} from "./chunk-LWTVE7UY.js";
 
 // src/config.ts
 import { readFileSync, existsSync } from "fs";
@@ -39,9 +40,39 @@ var DEFAULT_CONFIG = {
   },
   budget: {
     warn_percentage: 80
+  },
+  guardrail: {
+    warn_ratio: 0.8
   }
 };
 
+// src/logger.ts
+var LEVEL_ORDER = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3
+};
+var currentLevel = "info";
+function setLogLevel(level) {
+  currentLevel = level;
+}
+function shouldLog(level) {
+  return LEVEL_ORDER[level] >= LEVEL_ORDER[currentLevel];
+}
+function log(level, message, data) {
+  if (!shouldLog(level)) return;
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  const entry = data ? `[${timestamp}] ${level.toUpperCase()}: ${message} ${JSON.stringify(data)}` : `[${timestamp}] ${level.toUpperCase()}: ${message}`;
+  process.stderr.write(entry + "\n");
+}
+var logger = {
+  debug: (msg, data) => log("debug", msg, data),
+  info: (msg, data) => log("info", msg, data),
+  warn: (msg, data) => log("warn", msg, data),
+  error: (msg, data) => log("error", msg, data)
+};
+
 // src/config.ts
 function getConfigDir() {
   return join(homedir(), ".cloudcost");
@@ -51,7 +82,11 @@ function loadFileConfig() {
   if (!existsSync(configPath)) return {};
   try {
     return JSON.parse(readFileSync(configPath, "utf-8"));
-  } catch {
+  } catch (err) {
+    logger.warn("Ignoring malformed config file; using defaults", {
+      path: configPath,
+      error: err instanceof Error ? err.message : String(err)
+    });
     return {};
   }
 }
@@ -101,6 +136,23 @@ function loadEnvConfig() {
       ...warnPct !== void 0 && !isNaN(warnPct) && { warn_percentage: warnPct }
     };
   }
+  if (env.CLOUDCOST_GUARDRAIL_MAX_MONTHLY || env.CLOUDCOST_GUARDRAIL_MAX_PER_RESOURCE || env.CLOUDCOST_GUARDRAIL_WARN_RATIO) {
+    const parsePositive = (raw) => {
+      if (!raw) return void 0;
+      const v = parseFloat(raw);
+      return Number.isFinite(v) && v > 0 ? v : void 0;
+    };
+    const maxMonthly = parsePositive(env.CLOUDCOST_GUARDRAIL_MAX_MONTHLY);
+    const maxPerResource = parsePositive(env.CLOUDCOST_GUARDRAIL_MAX_PER_RESOURCE);
+    const warnRatioRaw = env.CLOUDCOST_GUARDRAIL_WARN_RATIO ? parseFloat(env.CLOUDCOST_GUARDRAIL_WARN_RATIO) : NaN;
+    const warnRatio = Number.isFinite(warnRatioRaw) && warnRatioRaw > 0 && warnRatioRaw <= 1 ? warnRatioRaw : void 0;
+    config.guardrail = {
+      ...DEFAULT_CONFIG.guardrail,
+      ...maxMonthly !== void 0 && { max_monthly: maxMonthly },
+      ...maxPerResource !== void 0 && { max_per_resource: maxPerResource },
+      ...warnRatio !== void 0 && { warn_ratio: warnRatio }
+    };
+  }
   return config;
 }
 function loadConfig() {
@@ -133,43 +185,94 @@ function loadConfig() {
       ...DEFAULT_CONFIG.budget,
       ...fileConfig.budget,
       ...envConfig.budget
+    },
+    guardrail: {
+      ...DEFAULT_CONFIG.guardrail,
+      ...fileConfig.guardrail,
+      ...envConfig.guardrail
     }
   };
 }
 
-// src/pricing/cache.ts
-import Database from "better-sqlite3";
-import { mkdirSync } from "fs";
-import { dirname } from "path";
-
-// src/logger.ts
-var LEVEL_ORDER = {
-  debug: 0,
-  info: 1,
-  warn: 2,
-  error: 3
+// src/currency.ts
+var SUPPORTED_CURRENCIES = [
+  "USD",
+  "EUR",
+  "GBP",
+  "JPY",
+  "CAD",
+  "AUD",
+  "INR",
+  "BRL"
+];
+var EXCHANGE_RATES_AS_OF = "2026-03";
+var EXCHANGE_RATES = {
+  USD: 1,
+  EUR: 0.92,
+  GBP: 0.79,
+  JPY: 149.5,
+  CAD: 1.36,
+  AUD: 1.53,
+  INR: 83.1,
+  BRL: 4.97
 };
-var currentLevel = "info";
-function setLogLevel(level) {
-  currentLevel = level;
+function convertCurrency(amountUsd, targetCurrency) {
+  const rate = EXCHANGE_RATES[targetCurrency];
+  if (rate === void 0 || rate === 1) {
+    return amountUsd;
+  }
+  return amountUsd * rate;
 }
-function shouldLog(level) {
-  return LEVEL_ORDER[level] >= LEVEL_ORDER[currentLevel];
+function getExchangeRateInfo(currency) {
+  return {
+    rate: EXCHANGE_RATES[currency] ?? 1,
+    rate_as_of: EXCHANGE_RATES_AS_OF
+  };
 }
-function log(level, message, data) {
-  if (!shouldLog(level)) return;
-  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  const entry = data ? `[${timestamp}] ${level.toUpperCase()}: ${message} ${JSON.stringify(data)}` : `[${timestamp}] ${level.toUpperCase()}: ${message}`;
-  process.stderr.write(entry + "\n");
+function convertLineItem(item, currency) {
+  return {
+    ...item,
+    unit_price: convertCurrency(item.unit_price, currency),
+    monthly_cost: convertCurrency(item.monthly_cost, currency)
+  };
+}
+function convertCostEstimate(estimate, currency) {
+  return {
+    ...estimate,
+    monthly_cost: convertCurrency(estimate.monthly_cost, currency),
+    yearly_cost: convertCurrency(estimate.yearly_cost, currency),
+    currency,
+    breakdown: estimate.breakdown.map((item) => convertLineItem(item, currency))
+  };
+}
+function convertBreakdownCurrency(breakdown, currency) {
+  const original_usd = {
+    total_monthly: breakdown.total_monthly,
+    total_yearly: breakdown.total_yearly
+  };
+  const convertedByService = {};
+  for (const [service, amount] of Object.entries(breakdown.by_service)) {
+    convertedByService[service] = convertCurrency(amount, currency);
+  }
+  return {
+    ...breakdown,
+    total_monthly: convertCurrency(breakdown.total_monthly, currency),
+    total_yearly: convertCurrency(breakdown.total_yearly, currency),
+    currency,
+    by_service: convertedByService,
+    by_resource: breakdown.by_resource.map((est) => convertCostEstimate(est, currency)),
+    ...breakdown.estimated_egress_monthly !== void 0 && {
+      estimated_egress_monthly: convertCurrency(breakdown.estimated_egress_monthly, currency)
+    },
+    original_usd,
+    exchange_rate: getExchangeRateInfo(currency)
+  };
 }
-var logger = {
-  debug: (msg, data) => log("debug", msg, data),
-  info: (msg, data) => log("info", msg, data),
-  warn: (msg, data) => log("warn", msg, data),
-  error: (msg, data) => log("error", msg, data)
-};
 
 // src/pricing/cache.ts
+import Database from "better-sqlite3";
+import { mkdirSync } from "fs";
+import { dirname } from "path";
 var SCHEMA = `
   CREATE TABLE IF NOT EXISTS pricing_cache (
     key        TEXT PRIMARY KEY,
@@ -525,6 +628,15 @@ var PricingCache = class {
   }
 };
 
+// src/pricing/effective-date.ts
+function resolveEffectiveDate(effectiveDate) {
+  if (effectiveDate) {
+    const t = new Date(effectiveDate);
+    if (!Number.isNaN(t.getTime())) return t.toISOString();
+  }
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+
 // src/pricing/aws/aws-normalizer.ts
 function extractUsdPrice(priceDimensions) {
   for (const dim of Object.values(priceDimensions)) {
@@ -562,94 +674,131 @@ function extractFromTerms(onDemandTerms, defaultUnit) {
   }
   return { price: 0, unit: defaultUnit };
 }
-function resolveEffectiveDate(effectiveDate) {
-  if (effectiveDate) {
-    const t = new Date(effectiveDate);
-    if (!Number.isNaN(t.getTime())) return t.toISOString();
-  }
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
-function normalizeAwsCompute(rawProduct, rawPrice, region, effectiveDate) {
-  const attrs = rawProduct?.attributes ?? {};
+function normalize(rawPrice, region, effectiveDate, spec) {
   const terms = rawPrice?.terms?.OnDemand ?? {};
-  const { price, unit } = extractFromTerms(terms, "Hrs");
+  const { price, unit } = extractFromTerms(terms, spec.defaultUnit);
   return {
     provider: "aws",
-    service: "ec2",
-    resource_type: attrs.instanceType ?? "unknown",
+    service: spec.service,
+    resource_type: spec.resourceType,
     region,
     unit,
     price_per_unit: price,
     currency: "USD",
+    description: spec.description,
+    attributes: {
+      ...spec.attributes,
+      pricing_source: "live"
+    },
+    effective_date: resolveEffectiveDate(effectiveDate)
+  };
+}
+function normalizeAwsCompute(rawProduct, rawPrice, region, effectiveDate) {
+  const attrs = rawProduct?.attributes ?? {};
+  return normalize(rawPrice, region, effectiveDate, {
+    service: "ec2",
+    defaultUnit: "Hrs",
+    resourceType: attrs.instanceType ?? "unknown",
     description: attrs.instanceType ? `AWS EC2 ${attrs.instanceType} (${attrs.operatingSystem ?? "Linux"})` : void 0,
     attributes: {
       instance_type: attrs.instanceType ?? "",
       vcpu: attrs.vcpu ?? "",
       memory: attrs.memory ?? "",
       operating_system: attrs.operatingSystem ?? "Linux",
-      tenancy: attrs.tenancy ?? "Shared",
-      pricing_source: "live"
-    },
-    effective_date: resolveEffectiveDate(effectiveDate)
-  };
+      tenancy: attrs.tenancy ?? "Shared"
+    }
+  });
 }
 function normalizeAwsDatabase(rawProduct, rawPrice, region, effectiveDate) {
   const attrs = rawProduct?.attributes ?? {};
-  const terms = rawPrice?.terms?.OnDemand ?? {};
-  const { price, unit } = extractFromTerms(terms, "Hrs");
-  return {
-    provider: "aws",
+  return normalize(rawPrice, region, effectiveDate, {
     service: "rds",
-    resource_type: attrs.instanceType ?? "unknown",
-    region,
-    unit,
-    price_per_unit: price,
-    currency: "USD",
+    defaultUnit: "Hrs",
+    resourceType: attrs.instanceType ?? "unknown",
     description: attrs.instanceType ? `AWS RDS ${attrs.instanceType} (${attrs.databaseEngine ?? "MySQL"})` : void 0,
     attributes: {
       instance_type: attrs.instanceType ?? "",
       database_engine: attrs.databaseEngine ?? "",
       deployment_option: attrs.deploymentOption ?? "Single-AZ",
       vcpu: attrs.vcpu ?? "",
-      memory: attrs.memory ?? "",
-      pricing_source: "live"
-    },
-    effective_date: resolveEffectiveDate(effectiveDate)
-  };
+      memory: attrs.memory ?? ""
+    }
+  });
 }
 function normalizeAwsStorage(rawProduct, rawPrice, region, effectiveDate) {
   const attrs = rawProduct?.attributes ?? {};
-  const terms = rawPrice?.terms?.OnDemand ?? {};
-  const { price, unit } = extractFromTerms(terms, "GB-Mo");
   const volumeType = attrs.volumeApiName ?? attrs.volumeType ?? "gp3";
-  return {
-    provider: "aws",
+  return normalize(rawPrice, region, effectiveDate, {
     service: "ebs",
-    resource_type: volumeType,
-    region,
-    unit,
-    price_per_unit: price,
-    currency: "USD",
+    defaultUnit: "GB-Mo",
+    resourceType: volumeType,
     description: `AWS EBS ${volumeType} volume`,
     attributes: {
       volume_type: volumeType,
       max_iops: attrs.maxIopsvolume ?? "",
-      max_throughput: attrs.maxThroughputvolume ?? "",
-      pricing_source: "live"
-    },
-    effective_date: resolveEffectiveDate(effectiveDate)
-  };
+      max_throughput: attrs.maxThroughputvolume ?? ""
+    }
+  });
 }
 
 // src/pricing/fetch-utils.ts
+var DEFAULT_MAX_RESPONSE_BYTES = 100 * 1024 * 1024;
+var DEFAULT_TIMEOUT_MS = 6e4;
+function assertUrlAllowed(url, options) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`fetchWithRetry: invalid URL`);
+  }
+  const requireHttps = options.requireHttps ?? true;
+  if (requireHttps && parsed.protocol !== "https:") {
+    throw new Error(`fetchWithRetry: rejected non-https URL (scheme=${parsed.protocol})`);
+  }
+  if (options.allowedHosts && options.allowedHosts.length > 0) {
+    if (!options.allowedHosts.includes(parsed.host)) {
+      throw new Error(`fetchWithRetry: host ${parsed.host} not in allowlist`);
+    }
+  }
+  return parsed;
+}
+function capResponseBody(res, maxBytes) {
+  if (!res.body) return res;
+  if (!Number.isFinite(maxBytes)) return res;
+  let seen = 0;
+  const limiter = new TransformStream({
+    transform(chunk, controller) {
+      seen += chunk.byteLength;
+      if (seen > maxBytes) {
+        controller.error(new Error(`fetchWithRetry: response body exceeded ${maxBytes} bytes`));
+        return;
+      }
+      controller.enqueue(chunk);
+    }
+  });
+  const limited = res.body.pipeThrough(limiter);
+  return new Response(limited, {
+    status: res.status,
+    statusText: res.statusText,
+    headers: res.headers
+  });
+}
+function withDefaultSignal(init, timeoutMs) {
+  if (init?.signal) return init;
+  return { ...init ?? {}, signal: AbortSignal.timeout(timeoutMs) };
+}
 async function fetchWithRetry(url, init, options = {}) {
   const maxRetries = options.maxRetries ?? 3;
   const baseDelay = options.baseDelay ?? 1e3;
   const maxDelay = options.maxDelay ?? 1e4;
+  const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+  const defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+  assertUrlAllowed(url, options);
+  const safeInit = withDefaultSignal(init, defaultTimeoutMs);
   let lastError;
   for (let attempt = 0; attempt <= maxRetries; attempt++) {
     try {
-      const res = await fetch(url, init);
+      const res = await fetch(url, safeInit);
       if (res.status === 429 || res.status >= 500 && res.status < 600) {
         if (attempt < maxRetries) {
           const delay = Math.min(baseDelay * Math.pow(2, attempt), maxDelay);
@@ -663,7 +812,7 @@ async function fetchWithRetry(url, init, options = {}) {
           continue;
         }
       }
-      return res;
+      return capResponseBody(res, maxResponseBytes);
     } catch (err) {
       lastError = err;
       if (attempt < maxRetries) {
@@ -684,7 +833,8 @@ async function fetchWithRetry(url, init, options = {}) {
       }
     }
   }
-  throw lastError ?? new Error(`fetchWithRetry: all ${maxRetries} retries failed for ${url}`);
+  if (lastError instanceof Error) throw lastError;
+  throw new Error(`fetchWithRetry: all ${maxRetries} retries failed for ${url}`);
 }
 function sleep(ms) {
   if (process.env.NODE_ENV === "test" || process.env.VITEST) {
@@ -1022,6 +1172,24 @@ var NAT_PER_GB = 0.045;
 var EKS_HOURLY = 0.1;
 var CACHE_TTL = 86400;
 var BULK_PRICING_BASE = "https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws";
+var AWS_PRICING_HOST = "pricing.us-east-1.amazonaws.com";
+var AWS_REGION_RE = /^[a-z]{2}(?:-(?:gov|iso|isob))?-[a-z]+-\d+$/;
+var AWS_PRICING_SERVICES = /* @__PURE__ */ new Set([
+  "AmazonEC2",
+  "AmazonRDS",
+  "AmazonElastiCache",
+  "AmazonRedshift"
+]);
+function assertValidAwsRegion(region) {
+  if (typeof region !== "string" || !AWS_REGION_RE.test(region)) {
+    throw new Error(`invalid AWS region: ${JSON.stringify(region).slice(0, 64)}`);
+  }
+}
+function assertValidAwsPricingService(service) {
+  if (typeof service !== "string" || !AWS_PRICING_SERVICES.has(service)) {
+    throw new Error(`invalid AWS pricing service: ${JSON.stringify(service).slice(0, 64)}`);
+  }
+}
 var SIZE_ORDER = [
   "nano",
   "micro",
@@ -1038,11 +1206,12 @@ var SIZE_ORDER = [
   "32xlarge",
   "48xlarge"
 ];
-function regionMultiplier(region) {
-  const multipliers = getRegionPriceMultipliers();
-  const mult = multipliers.aws[region.toLowerCase()];
+
+// src/pricing/region-multiplier.ts
+function regionMultiplier(provider, region) {
+  const mult = getRegionPriceMultipliers()[provider][region.toLowerCase()];
   if (mult === void 0) {
-    logger.warn("region-multiplier: unknown AWS region, defaulting to 1.0x", { region });
+    logger.warn("region-multiplier: unknown region, defaulting to 1.0x", { provider, region });
     return 1;
   }
   return mult;
@@ -1051,13 +1220,16 @@ function regionMultiplier(region) {
 // src/pricing/aws/bulk-loader.ts
 var AwsBulkLoader = class {
   cache;
+  /** Cache TTL for pricing writes (seconds); from config.cache.ttl_seconds. */
+  ttlSeconds;
   /**
    * Deduplicates concurrent streaming CSV fetches for the same region.
    * Keyed by region; value is the in-flight Promise<boolean>.
    */
   ec2CsvFetchInProgress = /* @__PURE__ */ new Map();
-  constructor(cache) {
+  constructor(cache, ttlSeconds = CACHE_TTL) {
     this.cache = cache;
+    this.ttlSeconds = ttlSeconds;
   }
   // -------------------------------------------------------------------------
   // Public API
@@ -1084,7 +1256,7 @@ var AwsBulkLoader = class {
       if (bulk) {
         const result = this.extractEc2Price(bulk, instanceType, region, os);
         if (result) {
-          this.cache.set(cacheKey, result, "aws", "ec2", region, CACHE_TTL);
+          this.cache.set(cacheKey, result, "aws", "ec2", region, this.ttlSeconds);
           return result;
         }
       }
@@ -1106,7 +1278,7 @@ var AwsBulkLoader = class {
       if (bulk) {
         const result = this.extractRdsPrice(bulk, instanceClass, region, engine);
         if (result) {
-          this.cache.set(cacheKey, result, "aws", "rds", region, CACHE_TTL);
+          this.cache.set(cacheKey, result, "aws", "rds", region, this.ttlSeconds);
           return result;
         }
       }
@@ -1128,7 +1300,7 @@ var AwsBulkLoader = class {
       if (bulk) {
         const result = this.extractEbsPrice(bulk, volumeType, region);
         if (result) {
-          this.cache.set(cacheKey, result, "aws", "ebs", region, CACHE_TTL);
+          this.cache.set(cacheKey, result, "aws", "ebs", region, this.ttlSeconds);
           return result;
         }
       }
@@ -1141,9 +1313,9 @@ var AwsBulkLoader = class {
     }
     return this.fallbackStoragePrice(volumeType, region, cacheKey);
   }
-  async getLoadBalancerPrice(region) {
-    const multiplier = regionMultiplier(region);
-    return {
+  getLoadBalancerPrice(region) {
+    const multiplier = regionMultiplier("aws", region);
+    return Promise.resolve({
       provider: "aws",
       service: "elb",
       resource_type: "alb",
@@ -1157,11 +1329,11 @@ var AwsBulkLoader = class {
         pricing_model: "fixed_plus_lcu"
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
-  async getNatGatewayPrice(region) {
-    const multiplier = regionMultiplier(region);
-    return {
+  getNatGatewayPrice(region) {
+    const multiplier = regionMultiplier("aws", region);
+    return Promise.resolve({
       provider: "aws",
       service: "vpc",
       resource_type: "nat-gateway",
@@ -1174,11 +1346,11 @@ var AwsBulkLoader = class {
         per_gb_price: String(NAT_PER_GB * multiplier)
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
-  async getKubernetesPrice(region) {
-    const multiplier = regionMultiplier(region);
-    return {
+  getKubernetesPrice(region) {
+    const multiplier = regionMultiplier("aws", region);
+    return Promise.resolve({
       provider: "aws",
       service: "eks",
       resource_type: "cluster",
@@ -1189,7 +1361,7 @@ var AwsBulkLoader = class {
       description: "AWS EKS control plane (per cluster/hour)",
       attributes: {},
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
   // -------------------------------------------------------------------------
   // Internal helpers – EC2 CSV streaming
@@ -1219,7 +1391,8 @@ var AwsBulkLoader = class {
     return promise;
   }
   async _doFetchAndCacheEc2CsvPrices(region) {
-    const url = `${BULK_PRICING_BASE}/AmazonEC2/current/${region}/index.csv`;
+    assertValidAwsRegion(region);
+    const url = `${BULK_PRICING_BASE}/AmazonEC2/current/${encodeURIComponent(region)}/index.csv`;
     logger.debug("Streaming AWS EC2 CSV pricing", { url, region });
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), 12e4);
@@ -1230,7 +1403,11 @@ var AwsBulkLoader = class {
         {
           maxRetries: 1,
           baseDelay: 500,
-          maxDelay: 2e3
+          maxDelay: 2e3,
+          allowedHosts: [AWS_PRICING_HOST],
+          // AWS EC2 CSVs run ~267 MiB today; allow headroom for growth while
+          // still hard-bounding at 512 MiB to prevent adversarial OOM.
+          maxResponseBytes: 512 * 1024 * 1024
         }
       );
       if (!res.ok) {
@@ -1351,7 +1528,7 @@ var AwsBulkLoader = class {
             },
             effective_date: effectiveDate
           };
-          this.cache.set(csvCacheKey, normalized, "aws", "ec2", region, CACHE_TTL);
+          this.cache.set(csvCacheKey, normalized, "aws", "ec2", region, this.ttlSeconds);
           cachedCount++;
         }
       }
@@ -1388,7 +1565,7 @@ var AwsBulkLoader = class {
               "aws",
               "ec2",
               region,
-              CACHE_TTL
+              this.ttlSeconds
             );
             cachedCount++;
           }
@@ -1420,14 +1597,19 @@ var AwsBulkLoader = class {
   // Internal helpers – live API fetch
   // -------------------------------------------------------------------------
   async fetchBulkPricing(service, region) {
-    const url = `${BULK_PRICING_BASE}/${service}/current/${region}/index.json`;
+    assertValidAwsPricingService(service);
+    assertValidAwsRegion(region);
+    const url = `${BULK_PRICING_BASE}/${encodeURIComponent(service)}/current/${encodeURIComponent(region)}/index.json`;
     logger.debug("Fetching AWS bulk pricing", { url });
     const res = await fetchWithRetryAndCircuitBreaker(
       url,
       {
         signal: AbortSignal.timeout(3e4)
       },
-      { maxRetries: 0 }
+      {
+        maxRetries: 0,
+        allowedHosts: [AWS_PRICING_HOST]
+      }
     );
     if (!res.ok) {
       throw new Error(`HTTP ${res.status} from ${url}`);
@@ -1513,7 +1695,7 @@ var AwsBulkLoader = class {
       logger.warn("No fallback price found for EC2 instance type", { instanceType });
       return null;
     }
-    const multiplier = regionMultiplier(region);
+    const multiplier = regionMultiplier("aws", region);
     const result = {
       provider: "aws",
       service: "ec2",
@@ -1531,7 +1713,7 @@ var AwsBulkLoader = class {
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
     };
-    this.cache.set(cacheKey, result, "aws", "ec2", region, CACHE_TTL);
+    this.cache.set(cacheKey, result, "aws", "ec2", region, this.ttlSeconds);
     return result;
   }
   fallbackDatabasePrice(instanceClass, region, engine, cacheKey) {
@@ -1540,7 +1722,7 @@ var AwsBulkLoader = class {
       logger.warn("No fallback price found for RDS instance class", { instanceClass });
       return null;
     }
-    const multiplier = regionMultiplier(region);
+    const multiplier = regionMultiplier("aws", region);
     const result = {
       provider: "aws",
       service: "rds",
@@ -1558,7 +1740,7 @@ var AwsBulkLoader = class {
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
     };
-    this.cache.set(cacheKey, result, "aws", "rds", region, CACHE_TTL);
+    this.cache.set(cacheKey, result, "aws", "rds", region, this.ttlSeconds);
     return result;
   }
   fallbackStoragePrice(volumeType, region, cacheKey) {
@@ -1567,7 +1749,7 @@ var AwsBulkLoader = class {
       logger.warn("No fallback price found for EBS volume type", { volumeType });
       return null;
     }
-    const multiplier = regionMultiplier(region);
+    const multiplier = regionMultiplier("aws", region);
     const result = {
       provider: "aws",
       service: "ebs",
@@ -1583,7 +1765,7 @@ var AwsBulkLoader = class {
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
     };
-    this.cache.set(cacheKey, result, "aws", "ebs", region, CACHE_TTL);
+    this.cache.set(cacheKey, result, "aws", "ebs", region, this.ttlSeconds);
     return result;
   }
 };
@@ -1593,10 +1775,13 @@ var SPOT_ADVISOR_URL = "https://website.spot.ec2.aws.a2z.com/spot.json";
 var SPOT_ADVISOR_CACHE_KEY = "aws/spot-advisor/v1";
 var AwsSpotClient = class {
   cache;
+  /** Cache TTL for pricing writes (seconds); from config.cache.ttl_seconds. */
+  ttlSeconds;
   /** In-flight fetch deduplication. */
   inflight = null;
-  constructor(cache) {
+  constructor(cache, ttlSeconds = CACHE_TTL) {
     this.cache = cache;
+    this.ttlSeconds = ttlSeconds;
   }
   /**
    * Get the spot discount factor (0–1) for an instance type in a region.
@@ -1660,7 +1845,7 @@ var AwsSpotClient = class {
         logger.debug("AWS Spot Advisor response missing spot_advisor key");
         return null;
       }
-      this.cache.set(SPOT_ADVISOR_CACHE_KEY, doc, "aws", "spot-advisor", "global", CACHE_TTL);
+      this.cache.set(SPOT_ADVISOR_CACHE_KEY, doc, "aws", "spot-advisor", "global", this.ttlSeconds);
       return doc;
     } catch (err) {
       logger.debug("AWS Spot Advisor fetch failed", {
@@ -1710,8 +1895,11 @@ function extractRiRatesFromBulk(bulk, instanceType, os = "Linux") {
 }
 var AwsReservedClient = class {
   cache;
-  constructor(cache) {
+  /** Cache TTL for pricing writes (seconds); from config.cache.ttl_seconds. */
+  ttlSeconds;
+  constructor(cache, ttlSeconds = CACHE_TTL) {
     this.cache = cache;
+    this.ttlSeconds = ttlSeconds;
   }
   async getRiRates(service, instanceType, region, os = "Linux") {
     if (service === "AmazonEC2") {
@@ -1727,13 +1915,18 @@ var AwsReservedClient = class {
     const cacheKey = `aws/ri/${service.toLowerCase()}/${region.toLowerCase()}/${instanceType.toLowerCase()}/${os.toLowerCase()}`;
     const cached = this.cache.get(cacheKey);
     if (cached && Array.isArray(cached.rates)) return cached.rates;
-    const url = `${BULK_PRICING_BASE}/${service}/current/${region}/index.json`;
+    assertValidAwsPricingService(service);
+    assertValidAwsRegion(region);
+    const url = `${BULK_PRICING_BASE}/${encodeURIComponent(service)}/current/${encodeURIComponent(region)}/index.json`;
     logger.debug("Fetching AWS bulk pricing for RI rates", { url });
     try {
       const res = await fetchWithRetryAndCircuitBreaker(
         url,
         { signal: AbortSignal.timeout(6e4) },
-        { maxRetries: 0 }
+        {
+          maxRetries: 0,
+          allowedHosts: [AWS_PRICING_HOST]
+        }
       );
       if (!res.ok) {
         logger.debug("AWS RI bulk fetch non-OK", { status: res.status });
@@ -1747,7 +1940,7 @@ var AwsReservedClient = class {
         unit: "none",
         rates
       };
-      this.cache.set(cacheKey, entry, "aws", "ri", region, CACHE_TTL);
+      this.cache.set(cacheKey, entry, "aws", "ri", region, this.ttlSeconds);
       return rates;
     } catch (err) {
       logger.debug("AWS RI bulk fetch failed, will use static fallback", {
@@ -1809,67 +2002,48 @@ function normalizePayment(purchase) {
 }
 
 // src/pricing/azure/azure-normalizer.ts
-function normalizeAzureCompute(item) {
+function normalize2(item, spec) {
   return {
     provider: "azure",
-    service: "virtual-machines",
+    service: spec.service,
     resource_type: item.skuName ?? item.armSkuName ?? "unknown",
     region: item.armRegionName ?? item.location ?? "",
-    unit: item.unitOfMeasure ?? "1 Hour",
+    unit: item.unitOfMeasure ?? spec.defaultUnit,
     price_per_unit: item.retailPrice ?? item.unitPrice ?? 0,
     currency: item.currencyCode ?? "USD",
-    tier: item.tierMinimumUnits !== void 0 ? String(item.tierMinimumUnits) : void 0,
+    tier: spec.includeTier && item.tierMinimumUnits !== void 0 ? String(item.tierMinimumUnits) : void 0,
     description: item.productName ?? void 0,
     attributes: {
       sku_name: item.skuName ?? "",
-      arm_sku_name: item.armSkuName ?? "",
-      service_name: item.serviceName ?? "Virtual Machines",
+      ...spec.extraAttributes?.(item),
+      service_name: item.serviceName ?? spec.defaultServiceName ?? "",
       product_name: item.productName ?? "",
       meter_name: item.meterName ?? "",
       pricing_source: "live"
     },
-    effective_date: item.effectiveStartDate ?? (/* @__PURE__ */ new Date()).toISOString()
+    effective_date: resolveEffectiveDate(item.effectiveStartDate)
   };
 }
+function normalizeAzureCompute(item) {
+  return normalize2(item, {
+    service: "virtual-machines",
+    defaultUnit: "1 Hour",
+    includeTier: true,
+    defaultServiceName: "Virtual Machines",
+    extraAttributes: (i) => ({ arm_sku_name: i.armSkuName ?? "" })
+  });
+}
 function normalizeAzureDatabase(item) {
-  return {
-    provider: "azure",
+  return normalize2(item, {
     service: "azure-database",
-    resource_type: item.skuName ?? item.armSkuName ?? "unknown",
-    region: item.armRegionName ?? item.location ?? "",
-    unit: item.unitOfMeasure ?? "1 Hour",
-    price_per_unit: item.retailPrice ?? item.unitPrice ?? 0,
-    currency: item.currencyCode ?? "USD",
-    description: item.productName ?? void 0,
-    attributes: {
-      sku_name: item.skuName ?? "",
-      service_name: item.serviceName ?? "",
-      product_name: item.productName ?? "",
-      meter_name: item.meterName ?? "",
-      pricing_source: "live"
-    },
-    effective_date: item.effectiveStartDate ?? (/* @__PURE__ */ new Date()).toISOString()
-  };
+    defaultUnit: "1 Hour"
+  });
 }
 function normalizeAzureStorage(item) {
-  return {
-    provider: "azure",
+  return normalize2(item, {
     service: "managed-disks",
-    resource_type: item.skuName ?? item.armSkuName ?? "unknown",
-    region: item.armRegionName ?? item.location ?? "",
-    unit: item.unitOfMeasure ?? "1 GiB/Month",
-    price_per_unit: item.retailPrice ?? item.unitPrice ?? 0,
-    currency: item.currencyCode ?? "USD",
-    description: item.productName ?? void 0,
-    attributes: {
-      sku_name: item.skuName ?? "",
-      service_name: item.serviceName ?? "",
-      product_name: item.productName ?? "",
-      meter_name: item.meterName ?? "",
-      pricing_source: "live"
-    },
-    effective_date: item.effectiveStartDate ?? (/* @__PURE__ */ new Date()).toISOString()
-  };
+    defaultUnit: "1 GiB/Month"
+  });
 }
 
 // src/pricing/azure/arm-regions.ts
@@ -2081,21 +2255,15 @@ var NAT_PER_GB2 = 0.045;
 var AKS_HOURLY = 0.1;
 var CACHE_TTL2 = 86400;
 var RETAIL_API_BASE = "https://prices.azure.com/api/retail/prices";
-function regionMultiplier2(region) {
-  const multipliers = getRegionPriceMultipliers();
-  const mult = multipliers.azure[region.toLowerCase()];
-  if (mult === void 0) {
-    logger.warn("region-multiplier: unknown Azure region, defaulting to 1.0x", { region });
-    return 1;
-  }
-  return mult;
-}
 
 // src/pricing/azure/retail-client.ts
 var AzureRetailClient = class {
   cache;
-  constructor(cache) {
+  /** Cache TTL for pricing writes (seconds); from config.cache.ttl_seconds. */
+  ttlSeconds;
+  constructor(cache, ttlSeconds = CACHE_TTL2) {
     this.cache = cache;
+    this.ttlSeconds = ttlSeconds;
   }
   // -------------------------------------------------------------------------
   // Public API
@@ -2111,7 +2279,7 @@ var AzureRetailClient = class {
       const match = this.pickVmItem(items, vmSize, os);
       if (match) {
         const result = normalizeAzureCompute(match);
-        this.cache.set(cacheKey, result, "azure", "vm", region, CACHE_TTL2);
+        this.cache.set(cacheKey, result, "azure", "vm", region, this.ttlSeconds);
         return result;
       }
     } catch (err) {
@@ -2132,7 +2300,7 @@ var AzureRetailClient = class {
       const serviceName = `Azure Database for ${engine}`;
       const result = await this.queryDatabasePrice(tier, armRegion, serviceName);
       if (result) {
-        this.cache.set(cacheKey, result, "azure", "db", region, CACHE_TTL2);
+        this.cache.set(cacheKey, result, "azure", "db", region, this.ttlSeconds);
         return result;
       }
       logger.warn("Azure Retail API returned no matching DB pricing", {
@@ -2214,7 +2382,7 @@ var AzureRetailClient = class {
       if (items.length > 0) {
         items.sort((a, b) => (a.skuId ?? "").localeCompare(b.skuId ?? ""));
         const result = normalizeAzureStorage(items[0]);
-        this.cache.set(cacheKey, result, "azure", "storage", region, CACHE_TTL2);
+        this.cache.set(cacheKey, result, "azure", "storage", region, this.ttlSeconds);
         return result;
       }
       logger.warn("Azure Retail API returned no matching storage pricing", {
@@ -2230,9 +2398,9 @@ var AzureRetailClient = class {
     }
     return this.fallbackStoragePrice(diskType, region, cacheKey);
   }
-  async getLoadBalancerPrice(region) {
-    const multiplier = regionMultiplier2(region);
-    return {
+  getLoadBalancerPrice(region) {
+    const multiplier = regionMultiplier("azure", region);
+    return Promise.resolve({
       provider: "azure",
       service: "load-balancer",
       resource_type: "standard",
@@ -2246,11 +2414,11 @@ var AzureRetailClient = class {
         pricing_model: "fixed_plus_rules"
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
-  async getNatGatewayPrice(region) {
-    const multiplier = regionMultiplier2(region);
-    return {
+  getNatGatewayPrice(region) {
+    const multiplier = regionMultiplier("azure", region);
+    return Promise.resolve({
       provider: "azure",
       service: "nat-gateway",
       resource_type: "nat-gateway",
@@ -2263,11 +2431,11 @@ var AzureRetailClient = class {
         per_gb_price: String(NAT_PER_GB2 * multiplier)
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
-  async getKubernetesPrice(region) {
-    const multiplier = regionMultiplier2(region);
-    return {
+  getKubernetesPrice(region) {
+    const multiplier = regionMultiplier("azure", region);
+    return Promise.resolve({
       provider: "azure",
       service: "aks",
       resource_type: "cluster",
@@ -2278,7 +2446,7 @@ var AzureRetailClient = class {
       description: "Azure Kubernetes Service (uptime SLA tier, per cluster/hour)",
       attributes: {},
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
   /**
    * Fetch the live Spot VM price for a given VM size/region/OS from the Azure
@@ -2310,7 +2478,7 @@ var AzureRetailClient = class {
         const result = normalizeAzureCompute(spotItems[0]);
         result.attributes.pricing_source = "live";
         result.attributes.purchase_option = "spot";
-        this.cache.set(cacheKey, result, "azure", "vm-spot", region, CACHE_TTL2);
+        this.cache.set(cacheKey, result, "azure", "vm-spot", region, this.ttlSeconds);
         return result;
       }
     } catch (err) {
@@ -2351,7 +2519,7 @@ var AzureRetailClient = class {
         result.attributes.pricing_source = "live";
         result.attributes.purchase_option = "reservation";
         result.attributes.reservation_term = termLabel;
-        this.cache.set(cacheKey, result, "azure", "vm-ri", region, CACHE_TTL2);
+        this.cache.set(cacheKey, result, "azure", "vm-ri", region, this.ttlSeconds);
         return result;
       }
     } catch (err) {
@@ -2432,16 +2600,20 @@ var AzureRetailClient = class {
   pickVmItem(items, vmSize, os) {
     if (items.length === 0) return null;
     const sorted = [...items].sort((a, b) => (a.skuId ?? "").localeCompare(b.skuId ?? ""));
-    const vmLower = vmSize.toLowerCase();
+    const skuFragment = vmSize.toLowerCase().replace(/^standard_/, "").replace(/_/g, " ");
     const isWindows = os.toLowerCase().includes("windows");
-    for (const item of sorted) {
+    const onDemand = sorted.filter((item) => {
+      const meterLower = (item.meterName ?? "").toLowerCase();
+      return !meterLower.includes("low priority") && !meterLower.includes("spot");
+    });
+    for (const item of onDemand) {
       const skuLower = (item.skuName ?? "").toLowerCase();
-      const hasWindows = skuLower.includes("windows");
-      if (skuLower.includes(vmLower) && (isWindows && hasWindows || !isWindows && !hasWindows)) {
+      const hasWindows = skuLower.includes("windows") || (item.productName ?? "").toLowerCase().includes("windows");
+      if (skuLower.includes(skuFragment) && (isWindows && hasWindows || !isWindows && !hasWindows)) {
         return item;
       }
     }
-    return sorted[0];
+    return onDemand[0] ?? sorted[0];
   }
   // -------------------------------------------------------------------------
   // Internal helpers – size interpolation
@@ -2481,7 +2653,7 @@ var AzureRetailClient = class {
       logger.warn("No fallback price found for Azure VM size", { vmSize });
       return null;
     }
-    const multiplier = regionMultiplier2(region);
+    const multiplier = regionMultiplier("azure", region);
     const result = {
       provider: "azure",
       service: "virtual-machines",
@@ -2498,7 +2670,7 @@ var AzureRetailClient = class {
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
     };
-    this.cache.set(cacheKey, result, "azure", "vm", region, CACHE_TTL2);
+    this.cache.set(cacheKey, result, "azure", "vm", region, this.ttlSeconds);
     return result;
   }
   fallbackDatabasePrice(tier, region, engine, cacheKey) {
@@ -2508,7 +2680,7 @@ var AzureRetailClient = class {
       logger.warn("No fallback price found for Azure DB tier", { tier });
       return null;
     }
-    const multiplier = regionMultiplier2(region);
+    const multiplier = regionMultiplier("azure", region);
     const result = {
       provider: "azure",
       service: "azure-database",
@@ -2525,7 +2697,7 @@ var AzureRetailClient = class {
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
     };
-    this.cache.set(cacheKey, result, "azure", "db", region, CACHE_TTL2);
+    this.cache.set(cacheKey, result, "azure", "db", region, this.ttlSeconds);
     return result;
   }
   fallbackStoragePrice(diskType, region, cacheKey) {
@@ -2535,7 +2707,7 @@ var AzureRetailClient = class {
       logger.warn("No fallback price found for Azure disk type", { diskType });
       return null;
     }
-    const multiplier = regionMultiplier2(region);
+    const multiplier = regionMultiplier("azure", region);
     const result = {
       provider: "azure",
       service: "managed-disks",
@@ -2551,7 +2723,7 @@ var AzureRetailClient = class {
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
     };
-    this.cache.set(cacheKey, result, "azure", "storage", region, CACHE_TTL2);
+    this.cache.set(cacheKey, result, "azure", "storage", region, this.ttlSeconds);
     return result;
   }
 };
@@ -2569,73 +2741,59 @@ function parseAzureVmSeries(vmName) {
 }
 
 // src/pricing/gcp/gcp-normalizer.ts
-function normalizeGcpCompute(machineType, hourlyPrice, region) {
+function normalize3(resourceType, pricePerUnit, region, spec, opts) {
   return {
     provider: "gcp",
-    service: "compute-engine",
-    resource_type: machineType,
+    service: spec.service,
+    resource_type: resourceType,
     region,
-    unit: "h",
-    price_per_unit: hourlyPrice,
+    unit: spec.unit,
+    price_per_unit: pricePerUnit,
     currency: "USD",
-    description: `GCP Compute Engine ${machineType}`,
+    description: `${spec.descriptionPrefix} ${resourceType}`,
     attributes: {
-      machine_type: machineType,
-      pricing_source: "bundled"
+      [spec.attrKey]: resourceType,
+      ...opts.skuId !== void 0 ? { sku_id: opts.skuId } : {},
+      pricing_source: opts.source
     },
-    effective_date: (/* @__PURE__ */ new Date()).toISOString()
+    effective_date: resolveEffectiveDate(opts.effectiveDate)
   };
 }
+var COMPUTE_SPEC = {
+  service: "compute-engine",
+  unit: "h",
+  descriptionPrefix: "GCP Compute Engine",
+  attrKey: "machine_type"
+};
+var DATABASE_SPEC = {
+  service: "cloud-sql",
+  unit: "h",
+  descriptionPrefix: "GCP Cloud SQL",
+  attrKey: "tier"
+};
+var STORAGE_SPEC = {
+  service: "cloud-storage",
+  unit: "GiBy.mo",
+  descriptionPrefix: "GCP Cloud Storage",
+  attrKey: "storage_class"
+};
+var DISK_SPEC = {
+  service: "persistent-disk",
+  unit: "GiBy.mo",
+  descriptionPrefix: "GCP Persistent Disk",
+  attrKey: "disk_type"
+};
+function normalizeGcpCompute(machineType, hourlyPrice, region) {
+  return normalize3(machineType, hourlyPrice, region, COMPUTE_SPEC, { source: "bundled" });
+}
 function normalizeGcpDatabase(tier, hourlyPrice, region) {
-  return {
-    provider: "gcp",
-    service: "cloud-sql",
-    resource_type: tier,
-    region,
-    unit: "h",
-    price_per_unit: hourlyPrice,
-    currency: "USD",
-    description: `GCP Cloud SQL ${tier}`,
-    attributes: {
-      tier,
-      pricing_source: "bundled"
-    },
-    effective_date: (/* @__PURE__ */ new Date()).toISOString()
-  };
+  return normalize3(tier, hourlyPrice, region, DATABASE_SPEC, { source: "bundled" });
 }
 function normalizeGcpStorage(storageClass, pricePerGb, region) {
-  return {
-    provider: "gcp",
-    service: "cloud-storage",
-    resource_type: storageClass,
-    region,
-    unit: "GiBy.mo",
-    price_per_unit: pricePerGb,
-    currency: "USD",
-    description: `GCP Cloud Storage ${storageClass}`,
-    attributes: {
-      storage_class: storageClass,
-      pricing_source: "bundled"
-    },
-    effective_date: (/* @__PURE__ */ new Date()).toISOString()
-  };
+  return normalize3(storageClass, pricePerGb, region, STORAGE_SPEC, { source: "bundled" });
 }
 function normalizeGcpDisk(diskType, pricePerGb, region) {
-  return {
-    provider: "gcp",
-    service: "persistent-disk",
-    resource_type: diskType,
-    region,
-    unit: "GiBy.mo",
-    price_per_unit: pricePerGb,
-    currency: "USD",
-    description: `GCP Persistent Disk ${diskType}`,
-    attributes: {
-      disk_type: diskType,
-      pricing_source: "bundled"
-    },
-    effective_date: (/* @__PURE__ */ new Date()).toISOString()
-  };
+  return normalize3(diskType, pricePerGb, region, DISK_SPEC, { source: "bundled" });
 }
 
 // src/pricing/gcp/bundled-loader.ts
@@ -2645,20 +2803,11 @@ var NAT_HOURLY3 = 0.044;
 var NAT_PER_GB3 = 0.045;
 var GKE_STANDARD_HOURLY = 0.1;
 var GKE_AUTOPILOT_VCPU_HOURLY = 0.0445;
-function regionMultiplier3(region) {
-  const multipliers = getRegionPriceMultipliers();
-  const mult = multipliers.gcp[region.toLowerCase()];
-  if (mult === void 0) {
-    logger.warn("region-multiplier: unknown GCP region, defaulting to 1.0x", { region });
-    return 1;
-  }
-  return mult;
-}
 var GcpBundledLoader = class {
   // -------------------------------------------------------------------------
   // Public API
   // -------------------------------------------------------------------------
-  async getComputePrice(machineType, region) {
+  getComputePrice(machineType, region) {
     try {
       const pricing = getGcpComputePricing();
       const regionPrices = pricing[region];
@@ -2667,7 +2816,7 @@ var GcpBundledLoader = class {
           region,
           machineType
         });
-        return null;
+        return Promise.resolve(null);
       }
       const price = regionPrices[machineType];
       if (price === void 0) {
@@ -2675,19 +2824,19 @@ var GcpBundledLoader = class {
           region,
           machineType
         });
-        return null;
+        return Promise.resolve(null);
       }
-      return normalizeGcpCompute(machineType, price, region);
+      return Promise.resolve(normalizeGcpCompute(machineType, price, region));
     } catch (err) {
       logger.error("GCP compute pricing load error", {
         machineType,
         region,
         err: err instanceof Error ? err.message : String(err)
       });
-      return null;
+      return Promise.resolve(null);
     }
   }
-  async getDatabasePrice(tier, region) {
+  getDatabasePrice(tier, region) {
     try {
       const pricing = getGcpSqlPricing();
       const regionPrices = pricing[region];
@@ -2696,7 +2845,7 @@ var GcpBundledLoader = class {
           region,
           tier
         });
-        return null;
+        return Promise.resolve(null);
       }
       const price = regionPrices[tier];
       if (price === void 0 || tier === "storage_per_gb" || tier === "ha_multiplier") {
@@ -2704,19 +2853,19 @@ var GcpBundledLoader = class {
           region,
           tier
         });
-        return null;
+        return Promise.resolve(null);
       }
-      return normalizeGcpDatabase(tier, price, region);
+      return Promise.resolve(normalizeGcpDatabase(tier, price, region));
     } catch (err) {
       logger.error("GCP SQL pricing load error", {
         tier,
         region,
         err: err instanceof Error ? err.message : String(err)
       });
-      return null;
+      return Promise.resolve(null);
     }
   }
-  async getStoragePrice(storageClass, region) {
+  getStoragePrice(storageClass, region) {
     try {
       const pricing = getGcpStoragePricing();
       const regionPrices = pricing[region];
@@ -2725,7 +2874,7 @@ var GcpBundledLoader = class {
           region,
           storageClass
         });
-        return null;
+        return Promise.resolve(null);
       }
       const classKey = storageClass.toUpperCase();
       const price = regionPrices[classKey];
@@ -2734,19 +2883,19 @@ var GcpBundledLoader = class {
           region,
           storageClass
         });
-        return null;
+        return Promise.resolve(null);
       }
-      return normalizeGcpStorage(storageClass.toUpperCase(), price, region);
+      return Promise.resolve(normalizeGcpStorage(storageClass.toUpperCase(), price, region));
     } catch (err) {
       logger.error("GCP Storage pricing load error", {
         storageClass,
         region,
         err: err instanceof Error ? err.message : String(err)
       });
-      return null;
+      return Promise.resolve(null);
     }
   }
-  async getDiskPrice(diskType, region) {
+  getDiskPrice(diskType, region) {
     try {
       const pricing = getGcpDiskPricing();
       const regionPrices = pricing[region];
@@ -2755,7 +2904,7 @@ var GcpBundledLoader = class {
           region,
           diskType
         });
-        return null;
+        return Promise.resolve(null);
       }
       const diskKey = diskType;
       const price = regionPrices[diskKey];
@@ -2764,21 +2913,21 @@ var GcpBundledLoader = class {
           region,
           diskType
         });
-        return null;
+        return Promise.resolve(null);
       }
-      return normalizeGcpDisk(diskType, price, region);
+      return Promise.resolve(normalizeGcpDisk(diskType, price, region));
     } catch (err) {
       logger.error("GCP Disk pricing load error", {
         diskType,
         region,
         err: err instanceof Error ? err.message : String(err)
       });
-      return null;
+      return Promise.resolve(null);
     }
   }
-  async getLoadBalancerPrice(region) {
-    const multiplier = regionMultiplier3(region);
-    return {
+  getLoadBalancerPrice(region) {
+    const multiplier = regionMultiplier("gcp", region);
+    return Promise.resolve({
       provider: "gcp",
       service: "cloud-load-balancing",
       resource_type: "forwarding-rule",
@@ -2791,11 +2940,11 @@ var GcpBundledLoader = class {
         per_gb_price: String(LB_PER_GB * multiplier)
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
-  async getNatGatewayPrice(region) {
-    const multiplier = regionMultiplier3(region);
-    return {
+  getNatGatewayPrice(region) {
+    const multiplier = regionMultiplier("gcp", region);
+    return Promise.resolve({
       provider: "gcp",
       service: "cloud-nat",
       resource_type: "nat-gateway",
@@ -2808,12 +2957,12 @@ var GcpBundledLoader = class {
         per_gb_price: String(NAT_PER_GB3 * multiplier)
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
-  async getKubernetesPrice(region, mode = "standard") {
-    const multiplier = regionMultiplier3(region);
+  getKubernetesPrice(region, mode = "standard") {
+    const multiplier = regionMultiplier("gcp", region);
     const baseHourly = mode === "autopilot" ? GKE_AUTOPILOT_VCPU_HOURLY : GKE_STANDARD_HOURLY;
-    return {
+    return Promise.resolve({
       provider: "gcp",
       service: "gke",
       resource_type: "cluster",
@@ -2830,7 +2979,7 @@ var GcpBundledLoader = class {
         }
       },
       effective_date: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    });
   }
 };
 
@@ -2869,8 +3018,11 @@ function skuCoversRegion(sku, region) {
 }
 var CloudBillingClient = class {
   cache;
-  constructor(cache) {
+  /** Cache TTL for pricing writes (seconds); from config.cache.ttl_seconds. */
+  ttlSeconds;
+  constructor(cache, ttlSeconds = CACHE_TTL3) {
     this.cache = cache;
+    this.ttlSeconds = ttlSeconds;
   }
   // -------------------------------------------------------------------------
   // Public fetch methods
@@ -2888,7 +3040,7 @@ var CloudBillingClient = class {
       const family = this.machineFamily(machineType);
       const result = this.extractComputePrice(skus, machineType, family, region);
       if (result) {
-        this.cache.set(cacheKey, result, "gcp", "compute", region, CACHE_TTL3);
+        this.cache.set(cacheKey, result, "gcp", "compute", region, this.ttlSeconds);
         return result;
       }
     } catch (err) {
@@ -2911,7 +3063,7 @@ var CloudBillingClient = class {
       const skus = await this.fetchSkus(SERVICE_IDS.CLOUD_SQL, region);
       const result = this.extractDatabasePrice(skus, tier, region);
       if (result) {
-        this.cache.set(cacheKey, result, "gcp", "cloud-sql", region, CACHE_TTL3);
+        this.cache.set(cacheKey, result, "gcp", "cloud-sql", region, this.ttlSeconds);
         return result;
       }
     } catch (err) {
@@ -2935,7 +3087,7 @@ var CloudBillingClient = class {
       const skus = await this.fetchSkus(SERVICE_IDS.CLOUD_STORAGE, region);
       const result = this.extractStoragePrice(skus, storageClass, region);
       if (result) {
-        this.cache.set(cacheKey, result, "gcp", "cloud-storage", region, CACHE_TTL3);
+        this.cache.set(cacheKey, result, "gcp", "cloud-storage", region, this.ttlSeconds);
         return result;
       }
     } catch (err) {
@@ -2964,7 +3116,7 @@ var CloudBillingClient = class {
       const skus = await this.fetchSkus(SERVICE_IDS.COMPUTE, region);
       const result = this.extractGpuPrice(skus, accelerator, region);
       if (result) {
-        this.cache.set(cacheKey, result, "gcp", "compute-gpu", region, CACHE_TTL3);
+        this.cache.set(cacheKey, result, "gcp", "compute-gpu", region, this.ttlSeconds);
         return result;
       }
     } catch (err) {
@@ -3046,7 +3198,7 @@ var CloudBillingClient = class {
       if (result.term1yr === null && result.term3yr === null) {
         return null;
       }
-      this.cache.set(cacheKey, result, "gcp", "compute-cud", region, CACHE_TTL3);
+      this.cache.set(cacheKey, result, "gcp", "compute-cud", region, this.ttlSeconds);
       return result;
     } catch (err) {
       logger.warn("GCP Cloud Billing CUD fetch failed", {
@@ -3071,7 +3223,7 @@ var CloudBillingClient = class {
       const skus = await this.fetchSkus(SERVICE_IDS.GKE, region);
       const result = this.extractAutopilotPodRates(skus, region);
       if (result) {
-        this.cache.set(cacheKey, result, "gcp", "gke-autopilot", region, CACHE_TTL3);
+        this.cache.set(cacheKey, result, "gcp", "gke-autopilot", region, this.ttlSeconds);
         return result;
       }
     } catch (err) {
@@ -3350,14 +3502,15 @@ var CloudBillingClient = class {
 };
 
 // src/pricing/pricing-engine.ts
+var DEFAULT_CACHE_TTL_SECONDS = 86400;
 var AwsProvider = class {
   loader;
   spotClient;
   reservedClient;
-  constructor(cache) {
-    this.loader = new AwsBulkLoader(cache);
-    this.spotClient = new AwsSpotClient(cache);
-    this.reservedClient = new AwsReservedClient(cache);
+  constructor(cache, ttlSeconds) {
+    this.loader = new AwsBulkLoader(cache, ttlSeconds);
+    this.spotClient = new AwsSpotClient(cache, ttlSeconds);
+    this.reservedClient = new AwsReservedClient(cache, ttlSeconds);
   }
   getSpotFactor(instanceType, region, os) {
     return this.spotClient.getSpotFactor(
@@ -3390,8 +3543,8 @@ var AwsProvider = class {
 };
 var AzureProvider = class {
   client;
-  constructor(cache) {
-    this.client = new AzureRetailClient(cache);
+  constructor(cache, ttlSeconds) {
+    this.client = new AzureRetailClient(cache, ttlSeconds);
   }
   getComputePrice(instanceType, region, os) {
     return this.client.getComputePrice(instanceType, region, os);
@@ -3433,9 +3586,9 @@ var AzureProvider = class {
 var GcpProvider = class {
   loader;
   liveClient;
-  constructor(cache) {
+  constructor(cache, ttlSeconds) {
     this.loader = new GcpBundledLoader();
-    this.liveClient = new CloudBillingClient(cache);
+    this.liveClient = new CloudBillingClient(cache, ttlSeconds);
   }
   async getComputePrice(instanceType, region, _os) {
     try {
@@ -3489,12 +3642,51 @@ var GcpProvider = class {
     return this.loader.getKubernetesPrice(region, mode === "autopilot" ? "autopilot" : "standard");
   }
 };
+var SERVICE_ALIAS_LOOKUPS = (() => {
+  const groups = [
+    [
+      ["compute", "ec2", "vm", "instance", "virtual-machines"],
+      (p, resourceType, region, attributes) => p.getComputePrice(resourceType, region, attributes.os)
+    ],
+    [
+      ["database", "rds", "sql", "db", "cloud-sql", "azure-database"],
+      (p, resourceType, region, attributes) => p.getDatabasePrice(resourceType, region, attributes.engine)
+    ],
+    [
+      ["storage", "ebs", "disk", "gcs", "managed-disks", "persistent-disk", "cloud-storage"],
+      (p, resourceType, region, attributes) => {
+        const sizeGb = attributes.size_gb ? parseFloat(attributes.size_gb) : void 0;
+        return p.getStoragePrice(resourceType, region, sizeGb);
+      }
+    ],
+    [
+      ["lb", "load-balancer", "alb", "nlb", "elb", "cloud-load-balancing"],
+      (p, resourceType, region) => p.getLoadBalancerPrice(resourceType, region)
+    ],
+    [
+      ["nat", "nat-gateway", "cloud-nat"],
+      (p, _resourceType, region) => p.getNatGatewayPrice(region)
+    ],
+    [
+      ["k8s", "kubernetes", "eks", "aks", "gke"],
+      (p, _resourceType, region, attributes) => p.getKubernetesPrice(region, attributes.mode)
+    ]
+  ];
+  const map = /* @__PURE__ */ new Map();
+  for (const [aliases, lookup] of groups) {
+    for (const alias of aliases) map.set(alias, lookup);
+  }
+  return map;
+})();
 var PricingEngine = class {
   providers = /* @__PURE__ */ new Map();
-  constructor(cache, _config) {
-    this.providers.set("aws", new AwsProvider(cache));
-    this.providers.set("azure", new AzureProvider(cache));
-    this.providers.set("gcp", new GcpProvider(cache));
+  config;
+  constructor(cache, config) {
+    this.config = config;
+    const ttlSeconds = config?.cache?.ttl_seconds ?? DEFAULT_CACHE_TTL_SECONDS;
+    this.providers.set("aws", new AwsProvider(cache, ttlSeconds));
+    this.providers.set("azure", new AzureProvider(cache, ttlSeconds));
+    this.providers.set("gcp", new GcpProvider(cache, ttlSeconds));
   }
   /**
    * Return the PricingProvider for a specific cloud provider.
@@ -3529,24 +3721,9 @@ var PricingEngine = class {
       resourceType,
       region
     });
-    if (svc === "compute" || svc === "ec2" || svc === "vm" || svc === "instance" || svc === "virtual-machines") {
-      return p.getComputePrice(resourceType, region, attributes.os);
-    }
-    if (svc === "database" || svc === "rds" || svc === "sql" || svc === "db" || svc === "cloud-sql" || svc === "azure-database") {
-      return p.getDatabasePrice(resourceType, region, attributes.engine);
-    }
-    if (svc === "storage" || svc === "ebs" || svc === "disk" || svc === "gcs" || svc === "managed-disks" || svc === "persistent-disk" || svc === "cloud-storage") {
-      const sizeGb = attributes.size_gb ? parseFloat(attributes.size_gb) : void 0;
-      return p.getStoragePrice(resourceType, region, sizeGb);
-    }
-    if (svc === "lb" || svc === "load-balancer" || svc === "alb" || svc === "nlb" || svc === "elb" || svc === "cloud-load-balancing") {
-      return p.getLoadBalancerPrice(resourceType, region);
-    }
-    if (svc === "nat" || svc === "nat-gateway" || svc === "cloud-nat") {
-      return p.getNatGatewayPrice(region);
-    }
-    if (svc === "k8s" || svc === "kubernetes" || svc === "eks" || svc === "aks" || svc === "gke") {
-      return p.getKubernetesPrice(region, attributes.mode);
+    const lookup = SERVICE_ALIAS_LOOKUPS.get(svc);
+    if (lookup) {
+      return lookup(p, resourceType, region, attributes);
     }
     logger.warn("PricingEngine: unrecognised service", { service, provider });
     return null;
@@ -3554,10 +3731,10 @@ var PricingEngine = class {
 };
 
 // src/tools/analyze-terraform.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 
 // src/parsers/index.ts
-import { dirname as dirname2 } from "path";
+import { dirname as dirname2, isAbsolute, normalize as normalize4, sep as sep2 } from "path";
 
 // src/parsers/hcl-parser.ts
 import { parse } from "@cdktf/hcl2json";
@@ -3595,6 +3772,39 @@ async function parseHclToJson(hclContent, filename = "main.tf") {
   }
 }
 
+// src/parsers/extractors/helpers.ts
+function firstBlock(block, key) {
+  const nested = block[key];
+  if (Array.isArray(nested) && nested.length > 0) {
+    return nested[0];
+  }
+  return {};
+}
+function coerceToString(v) {
+  if (typeof v === "string") return v;
+  if (typeof v === "number" || typeof v === "boolean" || typeof v === "bigint" || typeof v === "symbol" || typeof v === "function" || typeof v === "undefined") {
+    return String(v);
+  }
+  return JSON.stringify(v);
+}
+function str(v) {
+  return typeof v === "string" && v ? v : void 0;
+}
+function num(v) {
+  if (typeof v === "number") return v;
+  if (typeof v === "string") {
+    const n = Number(v);
+    return isNaN(n) ? void 0 : n;
+  }
+  return void 0;
+}
+function bool(v) {
+  if (typeof v === "boolean") return v;
+  if (v === "true") return true;
+  if (v === "false") return false;
+  return void 0;
+}
+
 // src/parsers/variable-resolver.ts
 function resolveVariables(hclJson, tfvarsContent) {
   const defaults = extractVariableDefaults(hclJson);
@@ -3673,7 +3883,8 @@ function substituteInString(str2, variables) {
   return str2.replace(VAR_INLINE_RE, (_match, varName) => {
     if (varName in variables) {
       const v = variables[varName];
-      return v === null ? "" : String(v);
+      if (v === null || v === void 0) return "";
+      return coerceToString(v);
     }
     return _match;
   });
@@ -3696,32 +3907,6 @@ function detectProvider(resourceType) {
   );
 }
 
-// src/parsers/extractors/helpers.ts
-function firstBlock(block, key) {
-  const nested = block[key];
-  if (Array.isArray(nested) && nested.length > 0) {
-    return nested[0];
-  }
-  return {};
-}
-function str(v) {
-  return typeof v === "string" && v ? v : void 0;
-}
-function num(v) {
-  if (typeof v === "number") return v;
-  if (typeof v === "string") {
-    const n = Number(v);
-    return isNaN(n) ? void 0 : n;
-  }
-  return void 0;
-}
-function bool(v) {
-  if (typeof v === "boolean") return v;
-  if (v === "true") return true;
-  if (v === "false") return false;
-  return void 0;
-}
-
 // src/parsers/extractors/aws-extractor.ts
 var awsExtractors = {
   aws_instance(block) {
@@ -4307,7 +4492,7 @@ function extractTags(block) {
   const result = {};
   for (const [k, v] of Object.entries(tags)) {
     if (typeof v === "string") result[k] = v;
-    else if (v !== null && v !== void 0) result[k] = String(v);
+    else if (v !== null && v !== void 0) result[k] = coerceToString(v);
   }
   return result;
 }
@@ -4447,10 +4632,20 @@ function isWithin(child, parent) {
 // src/parsers/safe-json.ts
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function safeJsonParse(text) {
-  return JSON.parse(text, (key, value) => {
-    if (FORBIDDEN_KEYS.has(key)) return void 0;
+  let droppedKeys = 0;
+  const parsed = JSON.parse(text, (key, value) => {
+    if (FORBIDDEN_KEYS.has(key)) {
+      droppedKeys++;
+      return void 0;
+    }
     return value;
   });
+  if (droppedKeys > 0) {
+    logger.warn("safeJsonParse: dropped prototype-pollution keys from payload", {
+      droppedKeys
+    });
+  }
+  return parsed;
 }
 
 // src/parsers/module-resolver.ts
@@ -4461,7 +4656,11 @@ function readTfFiles(dirPath) {
   let entries;
   try {
     entries = readdirSync(dirPath);
-  } catch {
+  } catch (err) {
+    logger.warn("Cannot list module directory; skipping", {
+      dirPath: sanitizeForMessage(dirPath),
+      error: sanitizeForMessage(err instanceof Error ? err.message : String(err), 512)
+    });
     return [];
   }
   const files = [];
@@ -4471,7 +4670,11 @@ function readTfFiles(dirPath) {
     try {
       const content = readFileSync2(fullPath, "utf-8");
       files.push({ path: fullPath, content });
-    } catch {
+    } catch (err) {
+      logger.warn("Cannot read module file; skipping", {
+        path: sanitizeForMessage(fullPath),
+        error: sanitizeForMessage(err instanceof Error ? err.message : String(err), 512)
+      });
     }
   }
   return files;
@@ -4782,7 +4985,7 @@ function extractAttributes(cfnType, props) {
       return {
         instance_type: asString(props.DBInstanceClass),
         engine: asString(props.Engine),
-        storage_size_gb: asNumber(props.AllocatedStorage),
+        storage_size_gb: num(props.AllocatedStorage),
         multi_az: asBoolean(props.MultiAZ)
       };
     case "AWS::S3::Bucket":
@@ -4790,8 +4993,8 @@ function extractAttributes(cfnType, props) {
     case "AWS::EBS::Volume":
       return {
         storage_type: asString(props.VolumeType),
-        storage_size_gb: asNumber(props.Size),
-        iops: asNumber(props.Iops)
+        storage_size_gb: num(props.Size),
+        iops: num(props.Iops)
       };
     case "AWS::ElasticLoadBalancingV2::LoadBalancer":
       return {
@@ -4803,16 +5006,16 @@ function extractAttributes(cfnType, props) {
       return {};
     case "AWS::Lambda::Function":
       return {
-        memory_size: asNumber(props.MemorySize),
-        timeout: asNumber(props.Timeout)
+        memory_size: num(props.MemorySize),
+        timeout: num(props.Timeout)
       };
     case "AWS::DynamoDB::Table":
       return {
         billing_mode: asString(props.BillingMode) ?? "PROVISIONED",
-        read_capacity: asNumber(
+        read_capacity: num(
           props.ProvisionedThroughput?.ReadCapacityUnits
         ),
-        write_capacity: asNumber(
+        write_capacity: num(
           props.ProvisionedThroughput?.WriteCapacityUnits
         )
       };
@@ -4827,7 +5030,7 @@ function extractAttributes(cfnType, props) {
     case "AWS::ElastiCache::CacheCluster":
       return {
         instance_type: asString(props.CacheNodeType),
-        node_count: asNumber(props.NumCacheNodes),
+        node_count: num(props.NumCacheNodes),
         engine: asString(props.Engine)
       };
     case "AWS::CloudFront::Distribution":
@@ -4842,7 +5045,8 @@ function extractTags2(props) {
   if (Array.isArray(rawTags)) {
     for (const tag of rawTags) {
       if (tag && typeof tag === "object" && "Key" in tag && "Value" in tag) {
-        tags[String(tag.Key)] = String(tag.Value);
+        const { Key, Value } = tag;
+        tags[coerceToString(Key)] = coerceToString(Value);
       }
     }
   }
@@ -4851,14 +5055,6 @@ function extractTags2(props) {
 function asString(value) {
   return typeof value === "string" ? value : void 0;
 }
-function asNumber(value) {
-  if (typeof value === "number") return value;
-  if (typeof value === "string") {
-    const n = Number(value);
-    return Number.isNaN(n) ? void 0 : n;
-  }
-  return void 0;
-}
 function asBoolean(value) {
   if (typeof value === "boolean") return value;
   if (value === "true") return true;
@@ -4878,11 +5074,11 @@ var CloudFormationParser = class {
       return false;
     });
   }
-  async parse(files, options) {
+  parse(files, options) {
     const warnings = [];
     const file = files.find((f) => this.extensions.some((ext) => f.path.endsWith(ext)));
     if (!file) {
-      return emptyInventory(warnings);
+      return Promise.resolve(emptyInventory(warnings));
     }
     let template;
     try {
@@ -4891,11 +5087,11 @@ var CloudFormationParser = class {
       const msg = err instanceof Error ? err.message : String(err);
       warnings.push(`Failed to parse CloudFormation template ${file.path}: ${msg}`);
       logger.warn("CloudFormation parse error", { path: file.path, error: msg });
-      return emptyInventory(warnings);
+      return Promise.resolve(emptyInventory(warnings));
     }
     if (!template || typeof template !== "object" || !template.Resources) {
       warnings.push(`Invalid CloudFormation template: missing Resources section in ${file.path}`);
-      return emptyInventory(warnings);
+      return Promise.resolve(emptyInventory(warnings));
     }
     const resolvedParams = resolveParameters(
       template.Parameters ?? {},
@@ -4928,7 +5124,7 @@ var CloudFormationParser = class {
       region,
       warningCount: warnings.length
     });
-    return inventory;
+    return Promise.resolve(inventory);
   }
 };
 function emptyInventory(warnings) {
@@ -5034,14 +5230,14 @@ function extractAttributes2(armTypeLower, props, resource, parameters) {
       const diskProps = props;
       return {
         sku: resource.sku?.name,
-        storage_size_gb: asNumber2(diskProps.diskSizeGB)
+        storage_size_gb: num(diskProps.diskSizeGB)
       };
     }
     case "microsoft.dbforpostgresql/flexibleservers": {
       const storage = props.storage;
       return {
         sku: resource.sku?.name,
-        storage_size_gb: asNumber2(storage?.storageSizeGB)
+        storage_size_gb: num(storage?.storageSizeGB)
       };
     }
     case "microsoft.dbformysql/flexibleservers":
@@ -5065,7 +5261,7 @@ function extractAttributes2(armTypeLower, props, resource, parameters) {
       const pools = props.agentPoolProfiles;
       const firstPool = pools?.[0];
       return {
-        node_count: asNumber2(firstPool?.count),
+        node_count: num(firstPool?.count),
         vm_size: typeof firstPool?.vmSize === "string" ? firstPool.vmSize : void 0
       };
     }
@@ -5099,14 +5295,6 @@ function extractAttributes2(armTypeLower, props, resource, parameters) {
       return {};
   }
 }
-function asNumber2(value) {
-  if (typeof value === "number") return value;
-  if (typeof value === "string") {
-    const n = Number(value);
-    return Number.isNaN(n) ? void 0 : n;
-  }
-  return void 0;
-}
 
 // src/parsers/bicep/arm-parser.ts
 var ArmParser = class {
@@ -5118,11 +5306,11 @@ var ArmParser = class {
       return f.content.includes("schema.management.azure.com") || f.content.includes("Microsoft.") && f.content.includes("apiVersion");
     });
   }
-  async parse(files, options) {
+  parse(files, options) {
     const warnings = [];
     const file = files.find((f) => f.path.endsWith(".json"));
     if (!file) {
-      return emptyInventory2(warnings);
+      return Promise.resolve(emptyInventory2(warnings));
     }
     let template;
     try {
@@ -5131,11 +5319,11 @@ var ArmParser = class {
       const msg = err instanceof Error ? err.message : String(err);
       warnings.push(`Failed to parse ARM template ${file.path}: ${msg}`);
       logger.warn("ARM template parse error", { path: file.path, error: msg });
-      return emptyInventory2(warnings);
+      return Promise.resolve(emptyInventory2(warnings));
     }
     if (!template || typeof template !== "object" || !Array.isArray(template.resources)) {
       warnings.push(`Invalid ARM template: missing resources array in ${file.path}`);
-      return emptyInventory2(warnings);
+      return Promise.resolve(emptyInventory2(warnings));
     }
     const resolvedParams = resolveParameters2(
       template.parameters ?? {},
@@ -5168,7 +5356,7 @@ var ArmParser = class {
       region,
       warningCount: warnings.length
     });
-    return inventory;
+    return Promise.resolve(inventory);
   }
 };
 function emptyInventory2(warnings) {
@@ -5318,7 +5506,7 @@ function extractAttributes3(pulumiType, props) {
       return {
         instance_type: asString2(props.instanceClass),
         engine: asString2(props.engine),
-        storage_size_gb: asNumber3(props.allocatedStorage),
+        storage_size_gb: num(props.allocatedStorage),
         multi_az: asBoolean2(props.multiAz)
       };
     case "aws:s3/bucket:Bucket":
@@ -5326,8 +5514,8 @@ function extractAttributes3(pulumiType, props) {
     case "aws:ebs/volume:Volume":
       return {
         storage_type: asString2(props.type),
-        storage_size_gb: asNumber3(props.size),
-        iops: asNumber3(props.iops)
+        storage_size_gb: num(props.size),
+        iops: num(props.iops)
       };
     case "aws:lb/loadBalancer:LoadBalancer":
       return {
@@ -5339,14 +5527,14 @@ function extractAttributes3(pulumiType, props) {
       return {};
     case "aws:lambda/function:Function":
       return {
-        memory_size: asNumber3(props.memorySize),
-        timeout: asNumber3(props.timeout)
+        memory_size: num(props.memorySize),
+        timeout: num(props.timeout)
       };
     case "aws:dynamodb/table:Table":
       return {
         billing_mode: asString2(props.billingMode) ?? "PROVISIONED",
-        read_capacity: asNumber3(props.readCapacity),
-        write_capacity: asNumber3(props.writeCapacity)
+        read_capacity: num(props.readCapacity),
+        write_capacity: num(props.writeCapacity)
       };
     case "aws:route53/zone:Zone":
       return {};
@@ -5392,12 +5580,12 @@ function extractAttributes3(pulumiType, props) {
       };
     case "gcp:container:Cluster":
       return {
-        node_count: asNumber3(props.initialNodeCount)
+        node_count: num(props.initialNodeCount)
       };
     case "gcp:cloudfunctions:Function":
       return {
-        memory_size: asNumber3(props.availableMemoryMb),
-        timeout: asNumber3(props.timeout)
+        memory_size: num(props.availableMemoryMb),
+        timeout: num(props.timeout)
       };
     case "gcp:dns:ManagedZone":
       return {};
@@ -5420,14 +5608,6 @@ function extractTags3(props) {
 function asString2(value) {
   return typeof value === "string" ? value : void 0;
 }
-function asNumber3(value) {
-  if (typeof value === "number") return value;
-  if (typeof value === "string") {
-    const n = Number(value);
-    return Number.isNaN(n) ? void 0 : n;
-  }
-  return void 0;
-}
 function asBoolean2(value) {
   if (typeof value === "boolean") return value;
   if (value === "true") return true;
@@ -5450,7 +5630,7 @@ var PulumiParser = class {
       }
     });
   }
-  async parse(files, _options) {
+  parse(files, _options) {
     const warnings = [];
     const file = files.find((f) => {
       try {
@@ -5462,7 +5642,7 @@ var PulumiParser = class {
       }
     });
     if (!file) {
-      return emptyInventory3(warnings);
+      return Promise.resolve(emptyInventory3(warnings));
     }
     let stackExport;
     try {
@@ -5471,11 +5651,11 @@ var PulumiParser = class {
       const msg = err instanceof Error ? err.message : String(err);
       warnings.push(`Failed to parse Pulumi stack export ${file.path}: ${msg}`);
       logger.warn("Pulumi parse error", { path: file.path, error: msg });
-      return emptyInventory3(warnings);
+      return Promise.resolve(emptyInventory3(warnings));
     }
     if (!stackExport?.deployment?.resources || !Array.isArray(stackExport.deployment.resources)) {
       warnings.push(`Invalid Pulumi stack export: missing deployment.resources in ${file.path}`);
-      return emptyInventory3(warnings);
+      return Promise.resolve(emptyInventory3(warnings));
     }
     const resources = [];
     for (const pulumiRes of stackExport.deployment.resources) {
@@ -5509,7 +5689,7 @@ var PulumiParser = class {
       region: dominantRegion,
       warningCount: warnings.length
     });
-    return inventory;
+    return Promise.resolve(inventory);
   }
 };
 function emptyInventory3(warnings) {
@@ -5606,7 +5786,7 @@ async function parseTerraform(files, tfvarsContent, basePath, resolveModulesEnab
       parse_warnings: warnings
     };
   }
-  const combined = mergeHclJsons2(parsedJsons.map((p) => p.json));
+  const combined = mergeHclJsons(parsedJsons.map((p) => p.json));
   const variables = resolveVariables(combined, tfvarsContent);
   const providers = ["aws", "azure", "gcp"];
   const defaultRegions = {};
@@ -5625,7 +5805,7 @@ async function parseTerraform(files, tfvarsContent, basePath, resolveModulesEnab
     }
   }
   if (resolveModulesEnabled) {
-    const moduleBasePath = basePath ?? (parsedJsons.length > 0 ? dirname2(parsedJsons[0].path) : process.cwd());
+    const moduleBasePath = basePath ?? (parsedJsons.length > 0 ? deriveModuleBasePath(parsedJsons[0].path) : process.cwd());
     try {
       const moduleResources = await resolveModules(combined, moduleBasePath, variables, warnings);
       allResources.push(...moduleResources);
@@ -5658,46 +5838,19 @@ async function parseTerraform(files, tfvarsContent, basePath, resolveModulesEnab
   });
   return inventory;
 }
-function mergeHclJsons2(jsons) {
-  const merged = {};
-  for (const json of jsons) {
-    for (const [key, value] of Object.entries(json)) {
-      if (!(key in merged)) {
-        merged[key] = deepClone(value);
-        continue;
-      }
-      const existing = merged[key];
-      if (value !== null && typeof value === "object" && !Array.isArray(value) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-        merged[key] = mergeObjects2(
-          existing,
-          value
-        );
-      } else if (Array.isArray(existing) && Array.isArray(value)) {
-        merged[key] = [...existing, ...value];
-      } else {
-        merged[key] = deepClone(value);
-      }
-    }
+function deriveModuleBasePath(filePath) {
+  const normalized = normalize4(filePath);
+  const isWindowsDrive = /^[A-Za-z]:/.test(normalized);
+  const isWindowsUnc = normalized.startsWith("\\\\") || normalized.startsWith("//");
+  if (isAbsolute(normalized) || isWindowsDrive || isWindowsUnc) {
+    return process.cwd();
   }
-  return merged;
-}
-function mergeObjects2(a, b) {
-  const result = { ...a };
-  for (const [key, bVal] of Object.entries(b)) {
-    const aVal = result[key];
-    if (aVal !== null && typeof aVal === "object" && !Array.isArray(aVal) && bVal !== null && typeof bVal === "object" && !Array.isArray(bVal)) {
-      result[key] = mergeObjects2(aVal, bVal);
-    } else if (Array.isArray(aVal) && Array.isArray(bVal)) {
-      result[key] = [...aVal, ...bVal];
-    } else {
-      result[key] = deepClone(bVal);
-    }
+  const dir = dirname2(normalized);
+  const escapesUpward = dir === ".." || dir.startsWith(`..${sep2}`) || dir.startsWith("../");
+  if (escapesUpward) {
+    return process.cwd();
   }
-  return result;
-}
-function deepClone(value) {
-  if (value === null || typeof value !== "object") return value;
-  return structuredClone(value);
+  return dir;
 }
 
 // src/parsers/dependency-graph.ts
@@ -5828,6 +5981,9 @@ function generateMermaidDiagram(graph) {
   return lines.join("\n");
 }
 
+// src/schemas/fragments.ts
+import { z as z2 } from "zod";
+
 // src/schemas/bounded.ts
 import { z } from "zod";
 var MAX_FILE_PATH_LEN = 1024;
@@ -5836,23 +5992,43 @@ var MAX_TFVARS_BYTES = 1 * 1024 * 1024;
 var MAX_PLAN_JSON_BYTES = 20 * 1024 * 1024;
 var MAX_STATE_JSON_BYTES = 20 * 1024 * 1024;
 var MAX_SHORT_STRING_LEN = 256;
+var MAX_TOTAL_FILE_BYTES = 50 * 1024 * 1024;
 var filePathSchema = z.string().max(MAX_FILE_PATH_LEN, `File path exceeds ${MAX_FILE_PATH_LEN} characters`);
 var fileContentSchema = z.string().max(MAX_FILE_CONTENT_BYTES, `File content exceeds ${MAX_FILE_CONTENT_BYTES} bytes`);
 var tfvarsSchema = z.string().max(MAX_TFVARS_BYTES, `tfvars content exceeds ${MAX_TFVARS_BYTES} bytes`);
 var planJsonSchema = z.string().max(MAX_PLAN_JSON_BYTES, `plan JSON exceeds ${MAX_PLAN_JSON_BYTES} bytes`);
 var stateJsonSchema = z.string().max(MAX_STATE_JSON_BYTES, `state JSON exceeds ${MAX_STATE_JSON_BYTES} bytes`);
 var shortStringSchema = z.string().max(MAX_SHORT_STRING_LEN, `value exceeds ${MAX_SHORT_STRING_LEN} characters`);
+function assertTotalFileBytesWithin(files, ctx) {
+  let total = 0;
+  for (const f of files) {
+    total += f.content.length;
+    if (total > MAX_TOTAL_FILE_BYTES) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: `aggregate file content exceeds ${MAX_TOTAL_FILE_BYTES} bytes`,
+        path: ["files"]
+      });
+      return;
+    }
+  }
+}
+
+// src/schemas/fragments.ts
+var providerEnum = z2.enum(["aws", "azure", "gcp"]);
+var iacFileEntrySchema = z2.object({
+  path: filePathSchema.describe("File path"),
+  content: fileContentSchema.describe("File content")
+});
+var iacFilesSchema = z2.array(iacFileEntrySchema).max(2e3, "files array exceeds 2000 entries").superRefine(assertTotalFileBytesWithin);
+var tfvarsField = tfvarsSchema.optional().describe("Contents of terraform.tfvars file");
+var currencyField = z2.enum(SUPPORTED_CURRENCIES).optional().default("USD").describe("Output currency for cost estimates. Defaults to USD.");
 
 // src/tools/analyze-terraform.ts
-var analyzeTerraformSchema = z2.object({
-  files: z2.array(
-    z2.object({
-      path: filePathSchema.describe("File path"),
-      content: fileContentSchema.describe("File content (HCL)")
-    })
-  ).max(2e3, "files array exceeds 2000 entries").describe("Terraform files to analyze"),
-  tfvars: tfvarsSchema.optional().describe("Contents of terraform.tfvars file"),
-  include_dependencies: z2.boolean().optional().default(false).describe(
+var analyzeTerraformSchema = z3.object({
+  files: iacFilesSchema.describe("Terraform files to analyze"),
+  tfvars: tfvarsField,
+  include_dependencies: z3.boolean().optional().default(false).describe(
     "When true, parse resource references and depends_on blocks to build a dependency graph and Mermaid diagram"
   )
 });
@@ -5904,7 +6080,7 @@ async function analyzeTerraform(params) {
 }
 
 // src/tools/estimate-cost.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 
 // src/mapping/region-mapper.ts
 var DEFAULT_REGIONS = {
@@ -5933,6 +6109,27 @@ function mapRegion(region, sourceProvider, targetProvider) {
   return mapped;
 }
 
+// src/calculator/estimate-factory.ts
+function round2(n) {
+  return Math.round(n * 100) / 100;
+}
+function makeCostEstimate(input) {
+  return {
+    resource_id: input.resource.id,
+    resource_type: input.resource.type,
+    resource_name: input.resource.name,
+    provider: input.provider,
+    region: input.region,
+    monthly_cost: round2(input.monthlyCost),
+    yearly_cost: round2(input.monthlyCost * 12),
+    currency: input.currency ?? "USD",
+    breakdown: input.breakdown,
+    confidence: input.confidence,
+    notes: input.notes,
+    pricing_source: input.pricingSource
+  };
+}
+
 // src/mapping/instance-mapper.ts
 function directionKey(source, target) {
   if (source === target) return null;
@@ -6114,7 +6311,7 @@ async function calculateComputeCost(resource, targetProvider, targetRegion, pric
       `No instance mapping found for ${sourceInstanceType} (${resource.provider} -> ${targetProvider})`
     );
   } else {
-    const { getInstanceMap: getInstanceMap2 } = await import("./loader-UWVEXYMR.js");
+    const { getInstanceMap: getInstanceMap2 } = await import("./loader-CMBV7346.js");
     const im = getInstanceMap2();
     const dirKey = `${resource.provider}_to_${targetProvider}`;
     const directMap = im[dirKey];
@@ -6128,11 +6325,7 @@ async function calculateComputeCost(resource, targetProvider, targetRegion, pric
     }
   }
   const effectiveInstance = mappedInstance ?? sourceInstanceType;
-  const computePrice = effectiveInstance ? await pricingEngine.getProvider(targetProvider).getComputePrice(
-    effectiveInstance,
-    targetRegion,
-    resource.attributes.os
-  ) : null;
+  const computePrice = effectiveInstance ? await pricingEngine.getProvider(targetProvider).getComputePrice(effectiveInstance, targetRegion, resource.attributes.os) : null;
   let computeMonthlyCost = 0;
   let pricingSource = "fallback";
   if (computePrice) {
@@ -6253,20 +6446,16 @@ async function calculateComputeCost(resource, targetProvider, targetRegion, pric
     }
   }
   const totalMonthly = computeMonthlyCost + storageMonthlyCost;
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence,
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 
 // src/calculator/database.ts
@@ -6369,20 +6558,16 @@ async function calculateDatabaseCost(resource, targetProvider, targetRegion, pri
     }
   }
   const totalMonthly = instanceMonthlyCost + storageMonthlyCost;
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: mappedInstance ? "high" : "low",
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 
 // src/calculator/storage.ts
@@ -6461,20 +6646,16 @@ async function calculateStorageCost(resource, targetProvider, targetRegion, pric
       targetRegion
     });
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: storagePrice ? "high" : "low",
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 
 // src/calculator/network.ts
@@ -6524,20 +6705,16 @@ async function calculateNatGatewayCost(resource, targetProvider, targetRegion, p
   } else {
     notes.push(`No pricing data found for ${resource.type} in ${targetRegion}`);
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: natPrice ? "medium" : "low",
     notes,
-    pricing_source: natPricingSource
-  };
+    pricingSource: natPricingSource
+  });
 }
 async function calculateLoadBalancerCost(resource, targetProvider, targetRegion, pricingEngine, monthlyHours = 730) {
   const notes = [];
@@ -6569,20 +6746,16 @@ async function calculateLoadBalancerCost(resource, targetProvider, targetRegion,
   } else {
     notes.push(`No pricing data found for ${resource.type} in ${targetRegion}`);
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: lbPrice ? "medium" : "low",
     notes,
-    pricing_source: lbPricingSource
-  };
+    pricingSource: lbPricingSource
+  });
 }
 
 // src/calculator/kubernetes.ts
@@ -6653,20 +6826,16 @@ async function calculateKubernetesCost(resource, targetProvider, targetRegion, p
       );
     }
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: k8sPrice ? "medium" : "low",
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 
 // src/calculator/serverless.ts
@@ -6721,20 +6890,16 @@ function calculateLambdaCost(resource, targetProvider, targetRegion) {
   }
   const totalMonthly = requestCost + computeCost;
   void timeoutSec;
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 var DYNAMO_ON_DEMAND_WRITE_PER_MILLION = 1.25;
 var DYNAMO_ON_DEMAND_READ_PER_MILLION = 0.25;
@@ -6804,20 +6969,16 @@ function calculateDynamoDbCost(resource, targetProvider, targetRegion) {
     monthly_cost: storageCost
   });
   totalMonthly += storageCost;
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 var SQS_STANDARD_PER_MILLION = 0.4;
 var SQS_FIFO_PER_MILLION = 0.5;
@@ -6842,20 +7003,16 @@ function calculateSqsCost(resource, targetProvider, targetRegion) {
     );
   }
   notes.push(`SQS ${queueType} queue pricing at $${pricePerMillion}/million requests`);
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/cache.ts
@@ -6912,20 +7069,16 @@ function calculateElastiCacheCost(resource, targetProvider, targetRegion) {
   } else {
     notes.push(`No pricing data found for ElastiCache node type ${nodeType}; cost reported as $0`);
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: basePrice !== void 0 ? "medium" : "low",
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 var AZURE_REDIS_PRICES = {
   // Basic (single node, no SLA)
@@ -6978,20 +7131,16 @@ function calculateAzureRedisCacheCost(resource, targetProvider, targetRegion) {
       `No pricing found for Azure Redis Cache ${sku} ${capacityStr.toUpperCase()}; cost reported as $0`
     );
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hourlyPrice !== void 0 ? "medium" : "low",
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 var GCP_REDIS_PRICES = {
   basic: 0.049,
@@ -7015,20 +7164,16 @@ function calculateGcpRedisCost(resource, targetProvider, targetRegion) {
   notes.push(
     `GCP Memorystore Redis: ${normalizedTier} tier, ${memorySizeGb}GB \u2014 $${pricePerGbHour}/GB/hr`
   );
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 var CLOUDFRONT_DATA_FIRST_10TB_PER_GB = 0.085;
 var DEFAULT_CLOUDFRONT_TRANSFER_GB = 100;
@@ -7068,20 +7213,16 @@ function calculateCloudFrontCost(resource, targetProvider, targetRegion) {
   notes.push(
     `CloudFront ${priceClass} \u2014 HTTPS request charges excluded (runtime traffic data required)`
   );
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/paas.ts
@@ -7148,20 +7289,16 @@ function calculateAppServicePlanCost(resource, targetProvider, targetRegion) {
       `No pricing found for App Service Plan SKU "${skuName || skuSize || skuTier}"; cost reported as $0`
     );
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hourlyPrice !== void 0 ? "medium" : "low",
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 var COSMOS_SERVERLESS_PER_MILLION_RU = 0.25;
 var COSMOS_PROVISIONED_PER_100_RU_PER_HR = 8e-3;
@@ -7219,20 +7356,16 @@ function calculateCosmosDbCost(resource, targetProvider, targetRegion) {
     });
     totalMonthly += storageCost;
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: pricingSource
-  };
+    pricingSource
+  });
 }
 var AZURE_FUNC_PER_MILLION_EXECUTIONS = 0.2;
 var AZURE_FUNC_GB_SECOND_PRICE = 16e-6;
@@ -7269,20 +7402,16 @@ function calculateAzureFunctionCost(resource, targetProvider, targetRegion) {
     );
   }
   notes.push("Azure Function App on Consumption plan (dedicated plan not priced separately)");
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 var CLOUD_RUN_VCPU_PER_SECOND = 24e-6;
 var CLOUD_RUN_MEMORY_GIB_PER_SECOND = 25e-7;
@@ -7355,20 +7484,16 @@ function calculateCloudRunCost(resource, targetProvider, targetRegion) {
     );
   }
   notes.push(`Cloud Run: ${vcpus} vCPU, ${memoryGib.toFixed(2)}GiB memory`);
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 var BIGQUERY_QUERY_PER_TB = 5;
 var BIGQUERY_STORAGE_PER_GB = 0.02;
@@ -7401,24 +7526,20 @@ function calculateBigQueryCost(resource, targetProvider, targetRegion) {
       `Default assumption: ${DEFAULT_BIGQUERY_QUERY_TB}TB queries/month \u2014 provide monthly_query_tb attribute for accuracy`
     );
   }
-  if (resource.attributes.location) {
+  if (typeof resource.attributes.location === "string" && resource.attributes.location) {
     notes.push(`BigQuery location: ${resource.attributes.location}`);
   }
   notes.push("BigQuery on-demand pricing; flat-rate/reservations not included");
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 var GCF_PER_MILLION_INVOCATIONS = 0.4;
 var GCF_GB_SECOND_PRICE = 25e-7;
@@ -7454,114 +7575,38 @@ function calculateGcpFunctionCost(resource, targetProvider, targetRegion) {
       `Default assumption: ${DEFAULT_GCF_INVOCATIONS.toLocaleString()} invocations/month, ${DEFAULT_GCF_DURATION_MS}ms avg, ${DEFAULT_GCF_MEMORY_MB}MB memory`
     );
   }
-  if (resource.attributes.runtime) {
+  if (typeof resource.attributes.runtime === "string" && resource.attributes.runtime) {
     notes.push(`Cloud Function runtime: ${resource.attributes.runtime}`);
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/data-transfer.ts
 var DEFAULT_EGRESS_GB = 100;
-var AWS_EGRESS_PER_GB = 0.09;
-var AZURE_EGRESS_PER_GB = 0.087;
-var GCP_EGRESS_PER_GB = 0.085;
-var AWS_REGION_MULTIPLIERS = {
-  "us-east-1": 1,
-  "us-east-2": 1,
-  "us-west-1": 1,
-  "us-west-2": 1,
-  "eu-west-1": 1,
-  "eu-west-2": 1,
-  "eu-central-1": 1,
-  "ap-southeast-1": 1.11,
-  // $0.10/GB
-  "ap-southeast-2": 1.11,
-  "ap-northeast-1": 1.11,
-  "ap-northeast-2": 1.11,
-  "ap-south-1": 1.11,
-  "sa-east-1": 1.31,
-  // $0.118/GB
-  "ca-central-1": 1,
-  "eu-north-1": 1,
-  "me-south-1": 1.11,
-  "af-south-1": 1.16
-  // $0.1046/GB
-};
-var AZURE_REGION_MULTIPLIERS = {
-  eastus: 1,
-  eastus2: 1,
-  westus: 1,
-  westus2: 1,
-  westus3: 1,
-  centralus: 1,
-  northeurope: 1,
-  westeurope: 1,
-  uksouth: 1,
-  ukwest: 1,
-  germanywestcentral: 1,
-  francecentral: 1,
-  eastasia: 1.16,
-  // Zone 2 rate
-  southeastasia: 1.16,
-  japaneast: 1.16,
-  koreacentral: 1.16,
-  australiaeast: 1.24,
-  // Zone 3 rate
-  brazilsouth: 1.31,
-  southafricanorth: 1.31
-};
-var GCP_REGION_MULTIPLIERS = {
-  "us-central1": 1,
-  "us-east1": 1,
-  "us-east4": 1,
-  "us-west1": 1,
-  "us-west2": 1,
-  "us-west3": 1,
-  "us-west4": 1,
-  "europe-west1": 1,
-  "europe-west2": 1,
-  "europe-west3": 1,
-  "europe-west4": 1,
-  "europe-west6": 1,
-  "europe-north1": 1,
-  "northamerica-northeast1": 1,
-  "southamerica-east1": 1.59,
-  // $0.135/GB
-  "asia-east1": 1.41,
-  // $0.12/GB (APAC)
-  "asia-east2": 1.41,
-  "asia-northeast1": 1.41,
-  "asia-northeast2": 1.41,
-  "asia-northeast3": 1.41,
-  "asia-south1": 1.41,
-  "asia-southeast1": 1.41,
-  "asia-southeast2": 1.41,
-  "australia-southeast1": 1.41,
-  "australia-southeast2": 1.41
+var EGRESS_PRICING = {
+  aws: {
+    ratePerGb: 0.09,
+    note: "Data transfer costs cover internet egress only; intra-region and inter-AZ traffic charges are excluded from this estimate"
+  },
+  azure: {
+    ratePerGb: 0.087,
+    note: "Data transfer costs cover internet egress only; intra-region traffic is free on Azure and excluded from this estimate"
+  },
+  gcp: {
+    ratePerGb: 0.085,
+    note: "Data transfer costs cover internet egress only; intra-region and Google network traffic charges are excluded from this estimate"
+  }
 };
-function awsRegionMultiplier(region) {
-  return AWS_REGION_MULTIPLIERS[region.toLowerCase()] ?? 1;
-}
-function azureRegionMultiplier(region) {
-  return AZURE_REGION_MULTIPLIERS[region.toLowerCase()] ?? 1;
-}
-function gcpRegionMultiplier(region) {
-  return GCP_REGION_MULTIPLIERS[region.toLowerCase()] ?? 1;
-}
-async function calculateAwsDataTransferCost(resource, targetRegion) {
+function calculateEgressCost(resource, provider, targetRegion) {
   const notes = [];
   const breakdown = [];
   const egressGb = resource.attributes.monthly_egress_gb ?? DEFAULT_EGRESS_GB;
@@ -7570,8 +7615,8 @@ async function calculateAwsDataTransferCost(resource, targetRegion) {
       `Data transfer cost estimated at ${egressGb} GB/month egress; actual costs depend on traffic volume and destination`
     );
   }
-  const multiplier = awsRegionMultiplier(targetRegion);
-  const ratePerGb = AWS_EGRESS_PER_GB * multiplier;
+  const pricing = EGRESS_PRICING[provider];
+  const ratePerGb = pricing.ratePerGb * regionMultiplier(provider, targetRegion);
   const totalMonthly = ratePerGb * egressGb;
   breakdown.push({
     description: `Internet egress (${egressGb} GB/month, estimated)`,
@@ -7580,97 +7625,26 @@ async function calculateAwsDataTransferCost(resource, targetRegion) {
     unit_price: ratePerGb,
     monthly_cost: totalMonthly
   });
-  notes.push(
-    "Data transfer costs cover internet egress only; intra-region and inter-AZ traffic charges are excluded from this estimate"
-  );
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
-    provider: "aws",
+  notes.push(pricing.note);
+  return makeCostEstimate({
+    resource,
+    provider,
     region: targetRegion,
-    monthly_cost: Math.round(totalMonthly * 100) / 100,
-    yearly_cost: Math.round(totalMonthly * 12 * 100) / 100,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "low",
     notes,
-    pricing_source: "fallback"
-  };
-}
-async function calculateAzureDataTransferCost(resource, targetRegion) {
-  const notes = [];
-  const breakdown = [];
-  const egressGb = resource.attributes.monthly_egress_gb ?? DEFAULT_EGRESS_GB;
-  if (!resource.attributes.monthly_egress_gb || resource.attributes.monthly_egress_gb <= 0) {
-    notes.push(
-      `Data transfer cost estimated at ${egressGb} GB/month egress; actual costs depend on traffic volume and destination`
-    );
-  }
-  const multiplier = azureRegionMultiplier(targetRegion);
-  const ratePerGb = AZURE_EGRESS_PER_GB * multiplier;
-  const totalMonthly = ratePerGb * egressGb;
-  breakdown.push({
-    description: `Internet egress (${egressGb} GB/month, estimated)`,
-    unit: "GB",
-    quantity: egressGb,
-    unit_price: ratePerGb,
-    monthly_cost: totalMonthly
+    pricingSource: "fallback"
   });
-  notes.push(
-    "Data transfer costs cover internet egress only; intra-region traffic is free on Azure and excluded from this estimate"
-  );
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
-    provider: "azure",
-    region: targetRegion,
-    monthly_cost: Math.round(totalMonthly * 100) / 100,
-    yearly_cost: Math.round(totalMonthly * 12 * 100) / 100,
-    currency: "USD",
-    breakdown,
-    confidence: "low",
-    notes,
-    pricing_source: "fallback"
-  };
 }
-async function calculateGcpDataTransferCost(resource, targetRegion) {
-  const notes = [];
-  const breakdown = [];
-  const egressGb = resource.attributes.monthly_egress_gb ?? DEFAULT_EGRESS_GB;
-  if (!resource.attributes.monthly_egress_gb || resource.attributes.monthly_egress_gb <= 0) {
-    notes.push(
-      `Data transfer cost estimated at ${egressGb} GB/month egress; actual costs depend on traffic volume and destination`
-    );
-  }
-  const multiplier = gcpRegionMultiplier(targetRegion);
-  const ratePerGb = GCP_EGRESS_PER_GB * multiplier;
-  const totalMonthly = ratePerGb * egressGb;
-  breakdown.push({
-    description: `Internet egress (${egressGb} GB/month, estimated)`,
-    unit: "GB",
-    quantity: egressGb,
-    unit_price: ratePerGb,
-    monthly_cost: totalMonthly
-  });
-  notes.push(
-    "Data transfer costs cover internet egress only; intra-region and Google network traffic charges are excluded from this estimate"
-  );
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
-    provider: "gcp",
-    region: targetRegion,
-    monthly_cost: Math.round(totalMonthly * 100) / 100,
-    yearly_cost: Math.round(totalMonthly * 12 * 100) / 100,
-    currency: "USD",
-    breakdown,
-    confidence: "low",
-    notes,
-    pricing_source: "fallback"
-  };
+function calculateAwsDataTransferCost(resource, targetRegion) {
+  return calculateEgressCost(resource, "aws", targetRegion);
+}
+function calculateAzureDataTransferCost(resource, targetRegion) {
+  return calculateEgressCost(resource, "azure", targetRegion);
+}
+function calculateGcpDataTransferCost(resource, targetRegion) {
+  return calculateEgressCost(resource, "gcp", targetRegion);
 }
 
 // src/calculator/container-registry.ts
@@ -7721,20 +7695,16 @@ function calculateContainerRegistryCost(resource, targetProvider, targetRegion)
     monthly_cost: storageCost
   });
   const totalMonthly = storageCost;
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hasExplicitStorage ? "high" : "medium",
     notes,
-    pricing_source: "bundled"
-  };
+    pricingSource: "bundled"
+  });
 }
 
 // src/calculator/secrets.ts
@@ -7829,20 +7799,16 @@ function calculateSecretsCost(resource, targetProvider, targetRegion) {
     });
     totalMonthly += accessOpFee;
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hasExplicitSecretCount ? "high" : "medium",
     notes,
-    pricing_source: "bundled"
-  };
+    pricingSource: "bundled"
+  });
 }
 
 // src/calculator/dns.ts
@@ -7896,20 +7862,16 @@ function calculateDnsCost(resource, targetProvider, targetRegion) {
     monthly_cost: queryCost
   });
   const totalMonthly = zonePrice + queryCost;
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hasExplicitQueries ? "high" : "medium",
     notes,
-    pricing_source: "bundled"
-  };
+    pricingSource: "bundled"
+  });
 }
 
 // src/calculator/api-gateway.ts
@@ -8030,20 +7992,16 @@ function calculateApiGatewayCost(resource, targetProvider, targetRegion) {
       );
     }
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hasExplicitRequests ? "high" : "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/waf.ts
@@ -8157,20 +8115,16 @@ function calculateWafCost(resource, targetProvider, targetRegion) {
     totalMonthly += requestCost;
     notes.push("GCP equivalent: Cloud Armor security policy");
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hasExplicitRules && hasExplicitRequests ? "high" : "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/search.ts
@@ -8265,20 +8219,16 @@ function calculateSearchCost(resource, targetProvider, targetRegion) {
       "GCP has no direct managed OpenSearch service; estimate based on comparable compute cost"
     );
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: targetProvider === "aws" ? "medium" : "low",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/messaging.ts
@@ -8411,20 +8361,16 @@ function calculateMessagingCost(resource, targetProvider, targetRegion) {
       );
     }
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hasExplicitMessages ? "high" : "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 function calculateMqBrokerCost(resource, targetProvider, targetRegion) {
   const notes = [];
@@ -8461,20 +8407,16 @@ function calculateMqBrokerCost(resource, targetProvider, targetRegion) {
     unit_price: AWS_MQ_STORAGE_PER_GB,
     monthly_cost: storageCost
   });
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: hourlyPrice !== void 0 ? "medium" : "low",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 function calculateEventHubCost(resource, targetProvider, targetRegion) {
   const notes = [];
@@ -8494,20 +8436,16 @@ function calculateEventHubCost(resource, targetProvider, targetRegion) {
   notes.push(
     `Azure Event Hubs: ${sku} tier, ${capacity} ${unitLabel}(s) \u2014 $${hourlyPrice}/${unitLabel}/hr`
   );
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 function calculatePubSubSubscriptionCost(resource, targetProvider, targetRegion) {
   const notes = [];
@@ -8530,20 +8468,16 @@ function calculatePubSubSubscriptionCost(resource, targetProvider, targetRegion)
   notes.push(
     `GCP Pub/Sub subscription: $${GCP_PUBSUB_SUBSCRIPTION_PER_MILLION_OPS}/million ack operations`
   );
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: opsCost,
-    yearly_cost: opsCost * 12,
-    currency: "USD",
+    monthlyCost: opsCost,
     breakdown,
     confidence: hasExplicitMessages ? "high" : "medium",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/ml-ai.ts
@@ -8661,20 +8595,16 @@ function calculateMlAiCost(resource, targetProvider, targetRegion) {
       "Azure ML endpoint pricing not yet supported \u2014 consider Azure Machine Learning compute instance costs"
     );
   }
-  return {
-    resource_id: resource.id,
-    resource_type: resource.type,
-    resource_name: resource.name,
+  return makeCostEstimate({
+    resource,
     provider: targetProvider,
     region: targetRegion,
-    monthly_cost: totalMonthly,
-    yearly_cost: totalMonthly * 12,
-    currency: "USD",
+    monthlyCost: totalMonthly,
     breakdown,
     confidence: "low",
     notes,
-    pricing_source: "fallback"
-  };
+    pricingSource: "fallback"
+  });
 }
 
 // src/calculator/cost-engine.ts
@@ -8971,20 +8901,16 @@ var CostEngine = class {
       return calculatePubSubSubscriptionCost(resource, targetProvider, targetRegion);
     }
     logger.warn("CostEngine: unsupported resource type", { type, targetProvider });
-    return {
-      resource_id: resource.id,
-      resource_type: type,
-      resource_name: resource.name,
+    return makeCostEstimate({
+      resource,
       provider: targetProvider,
       region: targetRegion,
-      monthly_cost: 0,
-      yearly_cost: 0,
-      currency: "USD",
+      monthlyCost: 0,
       breakdown: [],
       confidence: "low",
       notes: [`Resource type "${type}" is not yet supported by the cost engine`],
-      pricing_source: "fallback"
-    };
+      pricingSource: "fallback"
+    });
   }
   /**
    * Calculates costs for all resources and aggregates them into a CostBreakdown.
@@ -9050,7 +8976,7 @@ var CostEngine = class {
             name: `data-transfer-${estimate.provider}-${estimate.region}`,
             provider: estimate.provider,
             region: estimate.region,
-            attributes: { monthly_egress_gb: 100 },
+            attributes: { monthly_egress_gb: DEFAULT_EGRESS_GB },
             tags: {},
             source_file: "synthetic"
           }
@@ -9078,6 +9004,12 @@ var CostEngine = class {
       }
     }
     const totalMonthly = estimates.reduce((sum, e) => sum + e.monthly_cost, 0);
+    const estimatedEgressMonthly = estimates.filter((e) => DATA_TRANSFER_TYPES.has(e.resource_type)).reduce((sum, e) => sum + e.monthly_cost, 0);
+    if (estimatedEgressMonthly > 0) {
+      warnings.push(
+        `total_monthly includes a synthetic estimate of ${DEFAULT_EGRESS_GB} GB/month internet egress ($${(Math.round(estimatedEgressMonthly * 100) / 100).toFixed(2)}/mo, USD) \u2014 see estimated_egress_monthly. Set CLOUDCOST_INCLUDE_DATA_TRANSFER=false to exclude it.`
+      );
+    }
     const budgetWarnings = this.evaluateBudget(totalMonthly, estimates);
     return {
       provider: targetProvider,
@@ -9091,6 +9023,9 @@ var CostEngine = class {
       by_resource: estimates,
       generated_at: (/* @__PURE__ */ new Date()).toISOString(),
       warnings,
+      ...estimatedEgressMonthly > 0 && {
+        estimated_egress_monthly: Math.round(estimatedEgressMonthly * 100) / 100
+      },
       ...budgetWarnings.length > 0 && { budget_warnings: budgetWarnings }
     };
   }
@@ -9135,84 +9070,15 @@ var CostEngine = class {
   }
 };
 
-// src/currency.ts
-var SUPPORTED_CURRENCIES = [
-  "USD",
-  "EUR",
-  "GBP",
-  "JPY",
-  "CAD",
-  "AUD",
-  "INR",
-  "BRL"
-];
-var EXCHANGE_RATES = {
-  USD: 1,
-  EUR: 0.92,
-  GBP: 0.79,
-  JPY: 149.5,
-  CAD: 1.36,
-  AUD: 1.53,
-  INR: 83.1,
-  BRL: 4.97
-};
-function convertCurrency(amountUsd, targetCurrency) {
-  const rate = EXCHANGE_RATES[targetCurrency];
-  if (rate === void 0 || rate === 1) {
-    return amountUsd;
-  }
-  return amountUsd * rate;
-}
-function convertLineItem(item, currency) {
-  return {
-    ...item,
-    unit_price: convertCurrency(item.unit_price, currency),
-    monthly_cost: convertCurrency(item.monthly_cost, currency)
-  };
-}
-function convertCostEstimate(estimate, currency) {
-  return {
-    ...estimate,
-    monthly_cost: convertCurrency(estimate.monthly_cost, currency),
-    yearly_cost: convertCurrency(estimate.yearly_cost, currency),
-    currency,
-    breakdown: estimate.breakdown.map((item) => convertLineItem(item, currency))
-  };
-}
-function convertBreakdownCurrency(breakdown, currency) {
-  const original_usd = {
-    total_monthly: breakdown.total_monthly,
-    total_yearly: breakdown.total_yearly
-  };
-  const convertedByService = {};
-  for (const [service, amount] of Object.entries(breakdown.by_service)) {
-    convertedByService[service] = convertCurrency(amount, currency);
-  }
-  return {
-    ...breakdown,
-    total_monthly: convertCurrency(breakdown.total_monthly, currency),
-    total_yearly: convertCurrency(breakdown.total_yearly, currency),
-    currency,
-    by_service: convertedByService,
-    by_resource: breakdown.by_resource.map((est) => convertCostEstimate(est, currency)),
-    original_usd
-  };
-}
-
 // src/tools/estimate-cost.ts
-var estimateCostSchema = z3.object({
-  files: z3.array(
-    z3.object({
-      path: filePathSchema.describe("File path"),
-      content: fileContentSchema.describe("File content (HCL)")
-    })
-  ).max(2e3, "files array exceeds 2000 entries"),
-  tfvars: tfvarsSchema.optional().describe("Contents of terraform.tfvars file"),
-  provider: z3.enum(["aws", "azure", "gcp"]).describe("Target cloud provider to estimate costs for"),
-  region: z3.string().optional().describe(
+var estimateCostSchema = z4.object({
+  files: iacFilesSchema,
+  tfvars: tfvarsField,
+  provider: providerEnum.describe("Target cloud provider to estimate costs for"),
+  region: shortStringSchema.optional().describe(
     "Target region for pricing lookup. Defaults to the source region mapped to the target provider."
   ),
-  currency: z3.enum(SUPPORTED_CURRENCIES).optional().default("USD").describe("Output currency for cost estimates. Defaults to USD.")
+  currency: currencyField
 });
 async function estimateCost(params, pricingEngine, config) {
   const inventory = await parseTerraform(params.files, params.tfvars);
@@ -9249,12 +9115,13 @@ async function estimateCost(params, pricingEngine, config) {
   return {
     ...convertedRest,
     by_resource: byResource,
-    warnings: allWarnings
+    warnings: allWarnings,
+    pricing_metadata: getPricingMetadata(targetProvider)
   };
 }
 
 // src/tools/compare-providers.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 
 // src/calculator/reserved.ts
 var DISCOUNT_RATES = {
@@ -9802,15 +9669,23 @@ function generateJsonReport(comparison, resources, monthlyHours = 730, parseWarn
   return JSON.stringify(output);
 }
 
-// src/reporting/csv-report.ts
-var PROVIDERS = ["aws", "azure", "gcp"];
+// src/reporting/csv-escape.ts
 function csvEscape(value) {
-  const str2 = String(value);
-  if (str2.includes(",") || str2.includes("\n") || str2.includes('"')) {
-    return `"${str2.replace(/"/g, '""')}"`;
+  if (typeof value === "number") {
+    return Number.isFinite(value) ? String(value) : "";
+  }
+  let str2 = String(value);
+  if (/^[=+\-@\t\r]/.test(str2)) {
+    str2 = "'" + str2;
+  }
+  if (/["\n\r,]/.test(str2)) {
+    str2 = `"${str2.replace(/"/g, '""')}"`;
   }
   return str2;
 }
+
+// src/reporting/csv-report.ts
+var PROVIDERS = ["aws", "azure", "gcp"];
 function generateCsvReport(comparison, resources, options = {}) {
   const lines = [];
   const tagKey = options.group_by === "tag" ? options.group_by_tag_key : void 0;
@@ -9971,15 +9846,8 @@ function billingPeriodEnd() {
   const now = /* @__PURE__ */ new Date();
   return new Date(now.getFullYear(), now.getMonth() + 1, 1).toISOString().split("T")[0];
 }
-function csvEscape2(value) {
-  const str2 = String(value);
-  if (str2.includes(",") || str2.includes("\n") || str2.includes('"')) {
-    return `"${str2.replace(/"/g, '""')}"`;
-  }
-  return str2;
-}
 function buildRow(values) {
-  return values.map(csvEscape2).join(",");
+  return values.map(csvEscape).join(",");
 }
 function generateFocusReport(comparison, resources) {
   const lines = [];
@@ -10046,17 +9914,12 @@ function generateFocusReport(comparison, resources) {
 }
 
 // src/tools/compare-providers.ts
-var compareProvidersSchema = z4.object({
-  files: z4.array(
-    z4.object({
-      path: filePathSchema.describe("File path"),
-      content: fileContentSchema.describe("File content (HCL)")
-    })
-  ).max(2e3, "files array exceeds 2000 entries"),
-  tfvars: tfvarsSchema.optional().describe("Contents of terraform.tfvars file"),
-  format: z4.enum(["markdown", "json", "csv", "focus"]).default("markdown").describe("Output report format"),
-  providers: z4.array(z4.enum(["aws", "azure", "gcp"])).default(["aws", "azure", "gcp"]).describe("Cloud providers to include in the comparison"),
-  currency: z4.enum(SUPPORTED_CURRENCIES).optional().default("USD").describe("Output currency for cost estimates. Defaults to USD.")
+var compareProvidersSchema = z5.object({
+  files: iacFilesSchema,
+  tfvars: tfvarsField,
+  format: z5.enum(["markdown", "json", "csv", "focus"]).default("markdown").describe("Output report format"),
+  providers: z5.array(providerEnum).default(["aws", "azure", "gcp"]).describe("Cloud providers to include in the comparison"),
+  currency: currencyField
 });
 async function compareProviders(params, pricingEngine, config) {
   const inventory = await parseTerraform(params.files, params.tfvars);
@@ -10112,11 +9975,13 @@ async function compareProviders(params, pricingEngine, config) {
       break;
   }
   const dedupedWarnings = [.../* @__PURE__ */ new Set([...parseWarnings, ...allWarnings])];
+  const pricingMetadata = Object.fromEntries(providerList.map((p) => [p, getPricingMetadata(p)]));
   if (params.format === "json") {
     return {
       report,
       format: params.format,
-      warnings: dedupedWarnings
+      warnings: dedupedWarnings,
+      pricing_metadata: pricingMetadata
     };
   }
   const comparisonSummary = {
@@ -10133,21 +9998,17 @@ async function compareProviders(params, pricingEngine, config) {
     report,
     format: params.format,
     comparison: comparisonSummary,
-    warnings: dedupedWarnings
+    warnings: dedupedWarnings,
+    pricing_metadata: pricingMetadata
   };
 }
 
 // src/tools/optimize-cost.ts
-import { z as z5 } from "zod";
-var optimizeCostSchema = z5.object({
-  files: z5.array(
-    z5.object({
-      path: filePathSchema.describe("File path"),
-      content: fileContentSchema.describe("File content (HCL)")
-    })
-  ).max(2e3, "files array exceeds 2000 entries"),
-  tfvars: tfvarsSchema.optional().describe("Contents of terraform.tfvars file"),
-  providers: z5.array(z5.enum(["aws", "azure", "gcp"])).default(["aws", "azure", "gcp"]).describe("Providers to calculate costs against for cross-provider recommendations")
+import { z as z6 } from "zod";
+var optimizeCostSchema = z6.object({
+  files: iacFilesSchema,
+  tfvars: tfvarsField,
+  providers: z6.array(providerEnum).default(["aws", "azure", "gcp"]).describe("Providers to calculate costs against for cross-provider recommendations")
 });
 async function optimizeCost(params, pricingEngine, config) {
   const inventory = await parseTerraform(params.files, params.tfvars);
@@ -10183,28 +10044,23 @@ async function optimizeCost(params, pricingEngine, config) {
 }
 
 // src/tools/what-if.ts
-import { z as z6 } from "zod";
-var whatIfSchema = z6.object({
-  files: z6.array(
-    z6.object({
-      path: filePathSchema.describe("File path"),
-      content: fileContentSchema.describe("File content (HCL)")
-    })
-  ).max(2e3, "files array exceeds 2000 entries").describe("Terraform HCL files to analyse"),
-  changes: z6.array(
-    z6.object({
+import { z as z7 } from "zod";
+var whatIfSchema = z7.object({
+  files: iacFilesSchema.describe("Terraform HCL files to analyse"),
+  changes: z7.array(
+    z7.object({
       resource_id: shortStringSchema.describe(
         "The resource ID to modify (e.g. aws_instance.web)"
       ),
       attribute: shortStringSchema.describe(
         "The attribute name to change (e.g. instance_type, storage_size_gb)"
       ),
-      new_value: z6.union([shortStringSchema, z6.number()]).describe("The new value for the attribute")
+      new_value: z7.union([shortStringSchema, z7.number()]).describe("The new value for the attribute")
     })
   ).max(200, "changes array exceeds 200 entries").describe("List of attribute changes to simulate"),
-  provider: z6.enum(["aws", "azure", "gcp"]).optional().describe("Target cloud provider. Defaults to auto-detecting from the files"),
-  region: z6.string().optional().describe("Target region for pricing. Defaults to the region detected from provider blocks"),
-  tfvars: z6.string().optional().describe("Contents of a terraform.tfvars file for variable resolution")
+  provider: providerEnum.optional().describe("Target cloud provider. Defaults to auto-detecting from the files"),
+  region: shortStringSchema.optional().describe("Target region for pricing. Defaults to the region detected from provider blocks"),
+  tfvars: tfvarsSchema.optional().describe("Contents of a terraform.tfvars file for variable resolution")
 });
 function cloneResources(resources) {
   return JSON.parse(JSON.stringify(resources));
@@ -10300,30 +10156,34 @@ async function whatIf(params, pricingEngine, config) {
 }
 
 export {
-  loadConfig,
   setLogLevel,
   logger,
+  loadConfig,
+  SUPPORTED_CURRENCIES,
+  convertCurrency,
+  getExchangeRateInfo,
+  convertBreakdownCurrency,
   PricingCache,
   PricingEngine,
   sanitizeForMessage,
+  coerceToString,
   str,
   num,
   bool,
   safeJsonParse,
   parseTerraform,
-  filePathSchema,
-  fileContentSchema,
-  tfvarsSchema,
   planJsonSchema,
   stateJsonSchema,
+  shortStringSchema,
+  providerEnum,
+  iacFilesSchema,
+  tfvarsField,
+  currencyField,
   analyzeTerraformSchema,
   analyzeTerraform,
   mapRegion,
   mapInstance,
   CostEngine,
-  SUPPORTED_CURRENCIES,
-  convertCurrency,
-  convertBreakdownCurrency,
   estimateCostSchema,
   estimateCost,
   compareProvidersSchema,
@@ -10333,4 +10193,4 @@ export {
   whatIfSchema,
   whatIf
 };
-//# sourceMappingURL=chunk-6O2Y6MKU.js.map
+//# sourceMappingURL=chunk-CGMU4ETN.js.map