@meyicloud/meyi-cost-server 1.4.1 → 1.6.0

package/src/services/cost-analyser.service.js

@@ -0,0 +1,158 @@
+import {
+  DescribeTasksCommand,
+  ECSClient,
+  RunTaskCommand,
+  StopTaskCommand,
+} from "@aws-sdk/client-ecs";
+import { GetObjectCommand, S3Client } from "@aws-sdk/client-s3";
+import { truthy } from "../lib/cost-utils.js";
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const list = (value) => String(value || "").split(",").map((item) => item.trim()).filter(Boolean);
+
+function required(value, name) {
+  const text = String(value || "").trim();
+  if (!text) throw Object.assign(new Error(`${name} is required for external cost analysis`), { name: "CostAnalyserConfigError", statusCode: 503 });
+  return text;
+}
+
+function environment(values) {
+  return Object.entries(values).filter(([, value]) => value !== undefined && value !== null && value !== "").map(([name, value]) => ({ name, value: String(value) }));
+}
+
+async function bodyText(body) {
+  if (!body) return "";
+  if (typeof body.transformToString === "function") return body.transformToString();
+  const chunks = [];
+  for await (const chunk of body) chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+export class CostAnalyserService {
+  constructor({ contextService, athenaContextService, logger = console, env = process.env, ecsClient = null, s3Client = null } = {}) {
+    this.contextService = contextService;
+    this.athenaContextService = athenaContextService;
+    this.logger = logger;
+    this.enabled = truthy(env.COST_AI_ENABLED);
+    this.region = String(env.COST_AI_ANALYSER_REGION || env.AWS_REGION || env.AWS_DEFAULT_REGION || "us-east-1");
+    this.cluster = String(env.COST_AI_ANALYSER_CLUSTER || "").trim();
+    this.taskDefinition = String(env.COST_AI_ANALYSER_TASK_DEFINITION || "").trim();
+    this.containerName = String(env.COST_AI_ANALYSER_CONTAINER_NAME || "cost-ai-analyser").trim();
+    this.subnets = list(env.COST_AI_ANALYSER_SUBNETS);
+    this.securityGroups = list(env.COST_AI_ANALYSER_SECURITY_GROUPS);
+    this.assignPublicIp = truthy(env.COST_AI_ANALYSER_ASSIGN_PUBLIC_IP) ? "ENABLED" : "DISABLED";
+    this.reportBucket = String(env.COST_AI_ANALYSER_REPORT_BUCKET || "").trim();
+    this.targetRegions = String(env.COST_AI_ANALYSER_TARGET_REGIONS || env.AWS_REGION || "us-east-1").trim();
+    this.bedrockRegion = String(env.COST_AI_ANALYSER_BEDROCK_REGION || "").trim();
+    this.bedrockModelId = String(env.COST_AI_ANALYSER_BEDROCK_MODEL_ID || "").trim();
+    this.topServices = String(env.COST_AI_ANALYSER_TOP_N_SERVICES || "10").trim();
+    this.pollMs = Math.max(Number(env.COST_AI_ANALYSER_POLL_INTERVAL_MS || 15_000), 2_000);
+    this.timeoutMs = Math.max(Number(env.COST_AI_ANALYSER_TIMEOUT_MS || 45 * 60_000), 60_000);
+    this.ecs = ecsClient || new ECSClient({ region: this.region });
+    this.s3 = s3Client || new S3Client({ region: this.region });
+  }
+
+  status() {
+    const configured = Boolean(this.cluster && this.taskDefinition && this.subnets.length && this.securityGroups.length && this.reportBucket && this.bedrockModelId);
+    return {
+      enabled: this.enabled && configured,
+      provider: "meyi-cost-ai-analyser",
+      modelId: configured ? this.bedrockModelId : null,
+      region: configured ? this.bedrockRegion : null,
+      source: "ecs-task",
+    };
+  }
+
+  validate() {
+    if (!this.enabled) throw Object.assign(new Error("AI cost analysis is not enabled for this deployment"), { name: "CostAiDisabledError", statusCode: 503 });
+    required(this.cluster, "COST_AI_ANALYSER_CLUSTER");
+    required(this.taskDefinition, "COST_AI_ANALYSER_TASK_DEFINITION");
+    if (!this.subnets.length) required("", "COST_AI_ANALYSER_SUBNETS");
+    if (!this.securityGroups.length) required("", "COST_AI_ANALYSER_SECURITY_GROUPS");
+    required(this.reportBucket, "COST_AI_ANALYSER_REPORT_BUCKET");
+    required(this.bedrockModelId, "COST_AI_ANALYSER_BEDROCK_MODEL_ID");
+  }
+
+  async readJson(key) {
+    const response = await this.s3.send(new GetObjectCommand({ Bucket: this.reportBucket, Key: key }));
+    return JSON.parse(await bodyText(response.Body));
+  }
+
+  async execute({ tenantId, reportId, range, frequency, onStarted = null }) {
+    this.validate();
+    const customer = await this.contextService.resolve({ headers: {}, user: { tenant_id: tenantId, tenantId } });
+    const athena = this.athenaContextService.resolve(customer).config;
+    if (!athena.enabled) throw Object.assign(new Error("CUR discovery has not produced a queryable Athena table for this tenant"), { name: "CurDataNotReadyError", statusCode: 503 });
+    const targetRoleArn = required(customer.meta?.payerRoleArn, "customer TARGET_ROLE_ARN");
+    const targetAccountId = required(customer.meta?.managementAccountId || customer.accounts?.[0]?.id, "customer management account ID");
+    const prefix = `tenants/${tenantId}/reports/${reportId}`;
+    const values = {
+      REPORT_JOB_ID: reportId,
+      REPORT_TENANT_ID: tenantId,
+      REPORT_KEY_PREFIX: prefix,
+      REPORT_START_DATE: range.Start,
+      REPORT_END_DATE: range.End,
+      REPORT_FREQUENCY: frequency,
+      REPORT_BUCKET: this.reportBucket,
+      REPORT_BUCKET_REGION: this.region,
+      TARGET_ACCOUNT_ID: targetAccountId,
+      TARGET_ROLE_ARN: targetRoleArn,
+      TARGET_ROLE_EXTERNAL_ID: customer.meta?.externalId,
+      TARGET_REGIONS: this.targetRegions,
+      COST_CUR_DATABASE: athena.database,
+      COST_CUR_TABLE: athena.table,
+      COST_CUR_WORKGROUP: athena.workgroup,
+      COST_CUR_OUTPUT_LOCATION: athena.outputLocation,
+      COST_CUR_REGION: athena.region,
+      COST_CUR_TENANT_COLUMN: athena.tenantColumn,
+      COST_CUR_TENANT_PARTITION: athena.tenantPartition || tenantId,
+      BEDROCK_REGION: this.bedrockRegion,
+      BEDROCK_MODEL_ID: this.bedrockModelId,
+      TOP_N_SERVICES: this.topServices,
+    };
+    const launched = await this.ecs.send(new RunTaskCommand({
+      cluster: this.cluster,
+      taskDefinition: this.taskDefinition,
+      launchType: "FARGATE",
+      count: 1,
+      enableExecuteCommand: false,
+      networkConfiguration: { awsvpcConfiguration: { subnets: this.subnets, securityGroups: this.securityGroups, assignPublicIp: this.assignPublicIp } },
+      overrides: { containerOverrides: [{ name: this.containerName, environment: environment(values) }] },
+      startedBy: `meyi-cost-${reportId}`.slice(0, 36),
+    }));
+    if (launched.failures?.length || !launched.tasks?.[0]?.taskArn) {
+      const reason = launched.failures?.map((item) => item.reason || item.detail).filter(Boolean).join("; ") || "ECS did not return a task ARN";
+      throw Object.assign(new Error(`Unable to start cost analyser: ${reason}`), { name: "CostAnalyserLaunchError", statusCode: 502 });
+    }
+    const taskArn = launched.tasks[0].taskArn;
+    await onStarted?.(taskArn);
+    const deadline = Date.now() + this.timeoutMs;
+    while (Date.now() < deadline) {
+      const response = await this.ecs.send(new DescribeTasksCommand({ cluster: this.cluster, tasks: [taskArn] }));
+      const task = response.tasks?.[0];
+      if (task?.lastStatus === "STOPPED") {
+        const container = task.containers?.find((item) => item.name === this.containerName) || task.containers?.[0];
+        let status;
+        try { status = await this.readJson(`${prefix}/status.json`); } catch { status = null; }
+        if (Number(container?.exitCode ?? 1) !== 0 || status?.status !== "COMPLETED") {
+          throw Object.assign(new Error(status?.error || container?.reason || task.stoppedReason || "Cost analyser task failed"), { name: "CostAnalyserTaskError", statusCode: 502, taskArn });
+        }
+        return {
+          taskArn,
+          artifactBucket: this.reportBucket,
+          markdownKey: status.markdownKey || `${prefix}/report.md`,
+          pdfKey: status.pdfKey || `${prefix}/report.pdf`,
+          markdownSize: Number(status.markdownSize || 0),
+          pdfSize: Number(status.pdfSize || 0),
+          modelId: this.bedrockModelId,
+          dataSource: "AWS CUR",
+          facts: { currentTotal: Number(status.summary?.totalMonthlyCost || 0), currency: "USD" },
+          summary: status.summary || {},
+        };
+      }
+      await sleep(this.pollMs);
+    }
+    await this.ecs.send(new StopTaskCommand({ cluster: this.cluster, task: taskArn, reason: "Meyi cost analysis timeout" }));
+    throw Object.assign(new Error("Cost analyser task timed out"), { name: "CostAnalyserTimeoutError", statusCode: 504, taskArn });
+  }
+}

package/src/services/cost-analysis-report.service.js

@@ -0,0 +1,68 @@
+import { nextScheduleRun, reportRange, validateSchedule } from "../lib/cost-analysis-schedule.js";
+
+function scheduleDto(row) {
+  if (!row) return { enabled: false, frequency: "weekly", time: "09:00", timezone: "UTC", dayOfWeek: 1, dayOfMonth: 1, nextRunAt: null, lastRunAt: null };
+  return { enabled: row.enabled, frequency: row.frequency, time: String(row.time_of_day).slice(0, 5), timezone: row.timezone, dayOfWeek: row.day_of_week, dayOfMonth: row.day_of_month, nextRunAt: row.next_run_at, lastRunAt: row.last_run_at };
+}
+
+function reportDto(row) {
+  return {
+    id: row.id, frequency: row.schedule_frequency, scheduledFor: row.scheduled_for,
+    period: { Start: String(row.period_start).slice(0, 10), End: String(row.period_end).slice(0, 10) },
+    status: row.status, attempts: Number(row.attempt_count || 0), modelId: row.model_id,
+    dataSource: row.data_source, facts: row.facts || null, ...(row.result || {}),
+    pdfReady: row.status === "COMPLETED" && Boolean(row.pdf_key || row.pdf_data || Number(row.pdf_size || 0) > 0),
+    pdfSize: Number(row.pdf_size || 0), error: row.error, startedAt: row.started_at,
+    completedAt: row.completed_at, createdAt: row.created_at,
+  };
+}
+
+export class CostAnalysisReportService {
+  constructor({ contextService, repository, artifactService }) {
+    this.contextService = contextService;
+    this.repository = repository;
+    this.artifactService = artifactService;
+  }
+
+  tenant(req) { return this.contextService.tenantId(req); }
+
+  async getSchedule(req) { return scheduleDto(await this.repository.getSchedule(this.tenant(req))); }
+
+  async saveSchedule(req, input) {
+    if (String(req.user?.role || "").toLowerCase() !== "admin") throw Object.assign(new Error("Administrator access is required to change the AI report schedule"), { statusCode: 403 });
+    const schedule = validateSchedule(input);
+    const nextRunAt = schedule.enabled ? nextScheduleRun(schedule) : null;
+    return scheduleDto(await this.repository.saveSchedule(this.tenant(req), schedule, nextRunAt));
+  }
+
+  async list(req, limit) { return (await this.repository.list(this.tenant(req), limit)).map(reportDto); }
+
+  async latest(req) {
+    const reports = await this.list(req, 1);
+    return reports[0] || null;
+  }
+
+  async get(req, id) {
+    const row = await this.repository.find(this.tenant(req), id);
+    if (!row) throw Object.assign(new Error("AI cost report was not found"), { statusCode: 404 });
+    return reportDto(row);
+  }
+
+  async pdf(req, id) {
+    const row = await this.repository.find(this.tenant(req), id, true);
+    if (!row) throw Object.assign(new Error("AI cost report was not found"), { statusCode: 404 });
+    if (row.status !== "COMPLETED") throw Object.assign(new Error("The PDF is not ready"), { statusCode: 409 });
+    const data = row.pdf_key ? await this.artifactService.get(row.artifact_bucket, row.pdf_key) : row.pdf_data ? Buffer.from(row.pdf_data) : null;
+    if (!data?.length) throw Object.assign(new Error("The PDF artifact is unavailable"), { statusCode: 409 });
+    return { data, filename: `meyi-cost-analysis-${String(row.period_start).slice(0, 10)}-${id.slice(0, 8)}.pdf` };
+  }
+
+  async markdown(req, id) {
+    const row = await this.repository.find(this.tenant(req), id, true);
+    if (!row) throw Object.assign(new Error("AI cost report was not found"), { statusCode: 404 });
+    if (row.status !== "COMPLETED" || !row.markdown_key) throw Object.assign(new Error("The Markdown report is not ready"), { statusCode: 409 });
+    const data = await this.artifactService.get(row.artifact_bucket, row.markdown_key);
+    if (!data?.length) throw Object.assign(new Error("The Markdown artifact is unavailable"), { statusCode: 409 });
+    return { data, filename: `meyi-cost-analysis-${String(row.period_start).slice(0, 10)}-${id.slice(0, 8)}.md` };
+  }
+}

package/src/services/cost-report-artifact.service.js

@@ -0,0 +1,22 @@
+import { GetObjectCommand, S3Client } from "@aws-sdk/client-s3";
+
+async function bytes(body) {
+  if (!body) return Buffer.alloc(0);
+  if (typeof body.transformToByteArray === "function") return Buffer.from(await body.transformToByteArray());
+  const chunks = [];
+  for await (const chunk of body) chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks);
+}
+
+export class CostReportArtifactService {
+  constructor({ client = null, region = process.env.COST_AI_ANALYSER_REGION || process.env.AWS_REGION } = {}) {
+    this.client = client || new S3Client({ region });
+  }
+
+  async get(bucket, key) {
+    if (!bucket || !key) return null;
+    const response = await this.client.send(new GetObjectCommand({ Bucket: bucket, Key: key }));
+    return bytes(response.Body);
+  }
+}
+

package/src/workers/cost-analysis-report.worker.js

@@ -0,0 +1,67 @@
+import { nextScheduleRun, reportRange } from "../lib/cost-analysis-schedule.js";
+export class CostAnalysisReportWorker {
+  constructor({ repository, analyserService, logger = console, env = process.env }) {
+    this.repository = repository;
+    this.analyserService = analyserService;
+    this.logger = logger;
+    this.enabled = String(env.COST_AI_ENABLED || "").toLowerCase() === "true";
+    this.pollMs = Math.max(Number(env.COST_AI_REPORT_POLL_INTERVAL_MS || 60_000), 10_000);
+    this.leaseMs = Math.max(Number(env.COST_AI_REPORT_LEASE_MS || 30 * 60_000), 60_000);
+    this.batchSize = Math.min(Math.max(Number(env.COST_AI_REPORT_BATCH_SIZE || 5), 1), 25);
+    this.running = false;
+    this.timer = null;
+    this.initialTimer = null;
+  }
+
+  async run(schedule) {
+    const normalized = { ...schedule, time: String(schedule.time_of_day).slice(0, 5), dayOfWeek: schedule.day_of_week, dayOfMonth: schedule.day_of_month };
+    const range = reportRange(normalized, schedule.scheduled_for);
+    const report = await this.repository.createReport(schedule, range);
+    const nextRunAt = nextScheduleRun(normalized, new Date());
+    if (!report) return this.repository.setNextRun(schedule.tenant_id, nextRunAt, false, schedule.next_run_at);
+    const claimed = await this.repository.markRunning(report.id);
+    if (!claimed) return this.repository.setNextRun(schedule.tenant_id, nextRunAt, false, schedule.next_run_at);
+    try {
+      const result = await this.analyserService.execute({
+        tenantId: schedule.tenant_id,
+        reportId: report.id,
+        range,
+        frequency: schedule.frequency,
+        onStarted: (taskArn) => this.repository.setTaskArn(report.id, taskArn),
+      });
+      await this.repository.completeExternal(report.id, result);
+      await this.repository.setNextRun(schedule.tenant_id, nextRunAt, true, schedule.next_run_at);
+    } catch (error) {
+      await this.repository.fail(report.id, error);
+      await this.repository.setNextRun(schedule.tenant_id, nextRunAt, true, schedule.next_run_at);
+      this.logger.error?.("[Cost AI Reports] Scheduled analysis failed", { tenantId: schedule.tenant_id, reportId: report.id, message: error.message });
+    }
+  }
+
+  async tick() {
+    if (!this.enabled || this.running) return;
+    this.running = true;
+    try {
+      const schedules = await this.repository.claimDue(this.batchSize, this.leaseMs);
+      for (const schedule of schedules) await this.run(schedule);
+    } catch (error) {
+      this.logger.error?.("[Cost AI Reports] Scheduler tick failed", error);
+    } finally { this.running = false; }
+  }
+
+  start() {
+    if (!this.enabled || this.timer) return;
+    this.initialTimer = setTimeout(() => void this.tick(), 2_000);
+    this.initialTimer.unref?.();
+    this.timer = setInterval(() => void this.tick(), this.pollMs);
+    this.timer.unref?.();
+    this.logger.log?.(`[Cost AI Reports] Scheduler started; poll=${Math.round(this.pollMs / 1000)}s`);
+  }
+
+  stop() {
+    if (this.initialTimer) clearTimeout(this.initialTimer);
+    if (this.timer) clearInterval(this.timer);
+    this.initialTimer = null;
+    this.timer = null;
+  }
+}

package/src/lib/cost-analysis.js

@@ -1,116 +0,0 @@
-import { createHash } from "node:crypto";
-import { round } from "./cost-utils.js";
-
-const text = (value, max = 1200) => String(value || "").trim().slice(0, max);
-const severity = (value) => ["low", "medium", "high"].includes(value) ? value : "medium";
-
-function median(values) {
-  const sorted = values.filter(Number.isFinite).sort((a, b) => a - b);
-  if (!sorted.length) return null;
-  const middle = Math.floor(sorted.length / 2);
-  return sorted.length % 2 ? sorted[middle] : (sorted[middle - 1] + sorted[middle]) / 2;
-}
-
-function deltaRows(current = [], previous = [], limit = 8) {
-  const before = new Map(previous.map((item) => [item.label, Number(item.amount || 0)]));
-  return current.slice(0, limit).map((item) => {
-    const currentAmount = Number(item.amount || 0);
-    const previousAmount = before.get(item.label) || 0;
-    return {
-      label: text(item.label, 160),
-      current: round(currentAmount),
-      previous: round(previousAmount),
-      change: round(currentAmount - previousAmount),
-      changePercentage: previousAmount > 0 ? round((currentAmount - previousAmount) / previousAmount * 100) : null,
-      sharePercentage: Number.isFinite(Number(item.percentage)) ? round(Number(item.percentage)) : null,
-    };
-  }).sort((a, b) => Math.abs(b.change) - Math.abs(a.change));
-}
-
-export function buildCostFacts({ current, previous }) {
-  const currentTotal = round(current.totalCost || 0);
-  const previousTotal = round(previous.totalCost || 0);
-  const change = round(currentTotal - previousTotal);
-  const changePercentage = previousTotal > 0 ? round(change / previousTotal * 100) : null;
-  const historicalTotals = (current.trends || [])
-    .filter((item) => String(item.month || "") < String(current.period?.Start || ""))
-    .map((item) => Number(item.amount || 0))
-    .filter((value) => value > 0);
-  const baseline = median(historicalTotals);
-  const currentVsBaseline = baseline && baseline > 0 ? round((currentTotal - baseline) / baseline * 100) : null;
-  const serviceChanges = deltaRows(current.topServices, previous.topServices);
-  const accountChanges = deltaRows(current.topAccounts, previous.topAccounts, 6);
-  const topServiceShare = Number(current.topServices?.[0]?.percentage || 0);
-  const calculatedSignals = [];
-
-  if (changePercentage != null && Math.abs(changePercentage) >= 10) {
-    calculatedSignals.push({
-      severity: Math.abs(changePercentage) >= 25 ? "high" : "medium",
-      kind: "period_change",
-      message: `Spend ${changePercentage > 0 ? "increased" : "decreased"} ${Math.abs(changePercentage)}% compared with the preceding period.`,
-    });
-  }
-  if (currentVsBaseline != null && currentVsBaseline >= 25 && historicalTotals.length >= 3) {
-    calculatedSignals.push({ severity: "high", kind: "baseline_anomaly", message: `Spend is ${currentVsBaseline}% above the historical monthly median.` });
-  }
-  if (topServiceShare >= 50) {
-    calculatedSignals.push({ severity: "medium", kind: "service_concentration", message: `${text(current.topServices[0]?.label, 160)} represents ${round(topServiceShare)}% of spend.` });
-  }
-
-  return {
-    period: current.period,
-    comparisonPeriod: previous.period,
-    currency: current.currency || "USD",
-    dataSource: current.dataSource,
-    currentTotal,
-    previousTotal,
-    change,
-    changePercentage,
-    activeAccounts: Number(current.activeAccounts || 0),
-    activeResources: current.activeResources == null ? null : Number(current.activeResources),
-    historyMonths: historicalTotals.length,
-    historicalMonthlyMedian: baseline == null ? null : round(baseline),
-    currentVsBaselinePercentage: currentVsBaseline,
-    serviceChanges,
-    accountChanges,
-    topRegions: (current.topRegions || []).slice(0, 6).map((item) => ({ label: text(item.label, 160), amount: round(item.amount || 0), sharePercentage: round(item.percentage || 0) })),
-    calculatedSignals,
-    limitations: historicalTotals.length < 3 ? ["Fewer than three non-zero monthly data points are available, so anomaly confidence is limited."] : [],
-  };
-}
-
-export function redactFactsForModel(facts) {
-  return {
-    ...facts,
-    accountChanges: facts.accountChanges.map((item, index) => ({ ...item, label: `Account ${index + 1}` })),
-  };
-}
-
-export function analysisFingerprint(facts, modelId) {
-  return createHash("sha256").update(JSON.stringify({ facts, modelId })).digest("hex");
-}
-
-export function parseAnalysisResponse(value) {
-  const raw = String(value || "").trim().replace(/^```(?:json)?\s*/i, "").replace(/\s*```$/, "");
-  const start = raw.indexOf("{");
-  const end = raw.lastIndexOf("}");
-  if (start < 0 || end <= start) throw new Error("The AI response did not contain a JSON object");
-  const parsed = JSON.parse(raw.slice(start, end + 1));
-  const summary = text(parsed.summary, 3000);
-  const findings = Array.isArray(parsed.findings) ? parsed.findings.slice(0, 6).map((item) => ({
-    severity: severity(item?.severity),
-    title: text(item?.title, 160),
-    explanation: text(item?.explanation, 1000),
-    evidence: text(item?.evidence, 500),
-    estimatedImpact: Number.isFinite(Number(item?.estimatedImpact)) ? round(Number(item.estimatedImpact)) : null,
-  })).filter((item) => item.title && item.explanation) : [];
-  const recommendations = Array.isArray(parsed.recommendations) ? parsed.recommendations.slice(0, 6).map((item) => ({
-    priority: Math.min(Math.max(Number(item?.priority) || 2, 1), 3),
-    title: text(item?.title, 160),
-    action: text(item?.action, 800),
-    rationale: text(item?.rationale, 600),
-  })).filter((item) => item.title && item.action) : [];
-  const limitations = Array.isArray(parsed.limitations) ? parsed.limitations.slice(0, 5).map((item) => text(item, 400)).filter(Boolean) : [];
-  if (!summary || !findings.length || !recommendations.length) throw new Error("The AI response was missing required analysis fields");
-  return { summary, findings, recommendations, limitations };
-}

package/src/lib/llm-provider.js

@@ -1,239 +0,0 @@
-import { BedrockRuntimeClient, ConverseCommand } from "@aws-sdk/client-bedrock-runtime";
-
-/**
- * One calling convention over the LLM providers the Cost plugin supports.
- *
- * Bedrock authenticates with SigV4 and is subject to account-level model
- * access; the direct Anthropic and OpenAI providers authenticate with an API
- * key and are not. That difference is the whole reason this abstraction exists
- * - a deployment blocked on Bedrock model access can still run analysis
- * against a key.
- *
- * Every provider takes the same call shape and returns { text }. Nothing above
- * this file knows which one answered.
- */
-
-export const PROVIDER_BEDROCK = "bedrock";
-export const PROVIDER_ANTHROPIC = "anthropic";
-export const PROVIDER_OPENAI = "openai";
-
-const ANTHROPIC_VERSION = "2023-06-01";
-const DEFAULT_TIMEOUT_MS = 120_000;
-
-/**
- * Provider names arrive from a database row that a human filled in through a
- * dropdown ("AWS Bedrock", "Anthropic", "OpenAI"), so normalise loosely rather
- * than demanding an exact token.
- */
-export function normalizeProviderName(value) {
-  const name = String(value || "").trim().toLowerCase();
-  if (!name) return PROVIDER_BEDROCK;
-  if (name.includes("bedrock")) return PROVIDER_BEDROCK;
-  if (name.includes("anthropic") || name.includes("claude")) return PROVIDER_ANTHROPIC;
-  if (name.includes("openai") || name.includes("gpt")) return PROVIDER_OPENAI;
-  return name;
-}
-
-function providerError(message, { name = "CostAiProviderError", statusCode = 502, cause } = {}) {
-  const error = new Error(message);
-  error.name = name;
-  error.statusCode = statusCode;
-  if (cause) error.cause = cause;
-  return error;
-}
-
-/**
- * Read an HTTP error body without letting a provider's error text leak a key
- * back to the caller. Bodies are truncated: some providers echo request context.
- */
-async function readErrorBody(response) {
-  try {
-    const text = await response.text();
-    return String(text || "").slice(0, 500);
-  } catch {
-    return "";
-  }
-}
-
-async function postJson(url, { headers, body, timeoutMs }) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    return await fetch(url, {
-      method: "POST",
-      headers: { "content-type": "application/json", ...headers },
-      body: JSON.stringify(body),
-      signal: controller.signal,
-    });
-  } catch (error) {
-    if (error.name === "AbortError") {
-      throw providerError(`The model did not respond within ${Math.round(timeoutMs / 1000)}s`, { name: "CostAiTimeoutError", statusCode: 504 });
-    }
-    throw providerError(`Could not reach the model endpoint: ${error.message}`, { cause: error });
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-/**
- * Shared by both Bedrock auth modes: Converse wire shape in, plain text out.
- *
- * Undefined sampling parameters are omitted rather than sent as null. Claude
- * Haiku 4.5 and Sonnet 4.5 reject a request that carries both temperature and
- * topP - "cannot both be specified for this model" - so the caller sends one.
- */
-function converseRequestBody({ system, messages, maxTokens, temperature, topP }) {
-  const inferenceConfig = { maxTokens };
-  if (temperature !== undefined && temperature !== null) inferenceConfig.temperature = temperature;
-  if (topP !== undefined && topP !== null) inferenceConfig.topP = topP;
-  return {
-    system: [{ text: system }],
-    messages: messages.map((message) => ({ role: message.role, content: [{ text: message.text }] })),
-    inferenceConfig,
-  };
-}
-
-function converseResponseText(payload) {
-  return (payload?.output?.message?.content || []).map((item) => item.text || "").join("\n");
-}
-
-/**
- * Bedrock with an API key (the ABSK... long-term or short-term keys issued in
- * the Bedrock console). These are bearer tokens, not SigV4 credentials, so the
- * AWS SDK cannot use them without the process-wide AWS_BEARER_TOKEN_BEDROCK
- * variable - unusable here, because the token is per tenant and this process
- * serves many. Calling the Converse REST endpoint directly keeps it per request.
- *
- * Authentication only. Model entitlement is still granted per AWS account, so a
- * key cannot reach a model the account has not been approved for.
- */
-function createBedrockBearerProvider({ modelId, region, apiKey, timeoutMs }) {
-  if (!region) throw providerError("Bedrock with an API key requires a region", { name: "CostAiConfigError", statusCode: 400 });
-  const endpoint = `https://bedrock-runtime.${region}.amazonaws.com/model/${encodeURIComponent(modelId)}/converse`;
-  return {
-    provider: PROVIDER_BEDROCK,
-    modelId,
-    region,
-    authMode: "api-key",
-    async converse(request) {
-      const response = await postJson(endpoint, {
-        headers: { authorization: `Bearer ${apiKey}` },
-        timeoutMs,
-        body: converseRequestBody(request),
-      });
-      if (!response.ok) {
-        // 404 here is Bedrock's shape for "account not entitled to this model",
-        // not a missing endpoint. Pass the message through so the UI can show it.
-        throw providerError(`Bedrock returned ${response.status}: ${await readErrorBody(response)}`, {
-          statusCode: response.status === 429 ? 429 : 502,
-        });
-      }
-      return { text: converseResponseText(await response.json()) };
-    },
-  };
-}
-
-/**
- * Bedrock with SigV4. The original behaviour: the ambient credential chain (the
- * ECS task role) unless explicit access keys are supplied, which is how a
- * customer points the plugin at their own account.
- */
-function createBedrockProvider({ modelId, region, apiKey, accessKeyId, secretAccessKey, sessionToken, client, timeoutMs }) {
-  // An injected client is a test seam and must win, so check it before the key.
-  if (!client && apiKey) return createBedrockBearerProvider({ modelId, region, apiKey, timeoutMs });
-  const credentials = accessKeyId && secretAccessKey
-    ? { accessKeyId, secretAccessKey, ...(sessionToken ? { sessionToken } : {}) }
-    : undefined;
-  const runtime = client || new BedrockRuntimeClient({ region, ...(credentials ? { credentials } : {}) });
-  return {
-    provider: PROVIDER_BEDROCK,
-    modelId,
-    region,
-    authMode: credentials ? "access-keys" : "ambient",
-    async converse(request) {
-      const response = await runtime.send(new ConverseCommand({ modelId, ...converseRequestBody(request) }));
-      return { text: converseResponseText(response) };
-    },
-  };
-}
-
-function createAnthropicProvider({ modelId, apiKey, baseUrl, timeoutMs }) {
-  if (!apiKey) throw providerError("The Anthropic provider requires an API key", { name: "CostAiConfigError", statusCode: 400 });
-  const endpoint = `${String(baseUrl || "https://api.anthropic.com").replace(/\/+$/, "")}/v1/messages`;
-  return {
-    provider: PROVIDER_ANTHROPIC,
-    modelId,
-    region: null,
-    async converse({ system, messages, maxTokens, temperature, topP }) {
-      const response = await postJson(endpoint, {
-        headers: { "x-api-key": apiKey, "anthropic-version": ANTHROPIC_VERSION },
-        timeoutMs,
-        body: {
-          model: modelId,
-          max_tokens: maxTokens,
-          ...(temperature === undefined || temperature === null ? {} : { temperature }),
-          ...(topP === undefined || topP === null ? {} : { top_p: topP }),
-          system,
-          messages: messages.map((message) => ({ role: message.role, content: message.text })),
-        },
-      });
-      if (!response.ok) {
-        throw providerError(`Anthropic API returned ${response.status}: ${await readErrorBody(response)}`, { statusCode: response.status === 429 ? 429 : 502 });
-      }
-      const payload = await response.json();
-      return { text: (payload.content || []).map((item) => item.text || "").join("\n") };
-    },
-  };
-}
-
-function createOpenAiProvider({ modelId, apiKey, baseUrl, timeoutMs }) {
-  if (!apiKey) throw providerError("The OpenAI provider requires an API key", { name: "CostAiConfigError", statusCode: 400 });
-  const endpoint = `${String(baseUrl || "https://api.openai.com").replace(/\/+$/, "")}/v1/chat/completions`;
-  return {
-    provider: PROVIDER_OPENAI,
-    modelId,
-    region: null,
-    async converse({ system, messages, maxTokens, temperature, topP }) {
-      const response = await postJson(endpoint, {
-        headers: { authorization: `Bearer ${apiKey}` },
-        timeoutMs,
-        body: {
-          model: modelId,
-          max_completion_tokens: maxTokens,
-          ...(temperature === undefined || temperature === null ? {} : { temperature }),
-          ...(topP === undefined || topP === null ? {} : { top_p: topP }),
-          messages: [
-            { role: "system", content: system },
-            ...messages.map((message) => ({ role: message.role, content: message.text })),
-          ],
-        },
-      });
-      if (!response.ok) {
-        throw providerError(`OpenAI API returned ${response.status}: ${await readErrorBody(response)}`, { statusCode: response.status === 429 ? 429 : 502 });
-      }
-      const payload = await response.json();
-      return { text: (payload.choices || []).map((choice) => choice.message?.content || "").join("\n") };
-    },
-  };
-}
-
-/**
- * @param {object} config
- * @param {string} config.provider    bedrock | anthropic | openai (loose match)
- * @param {string} config.modelId
- * @param {string} [config.apiKey]    required for anthropic and openai
- * @param {string} [config.region]    bedrock only
- * @param {string} [config.accessKeyId]      bedrock only; omit for ambient creds
- * @param {string} [config.secretAccessKey]  bedrock only
- * @param {string} [config.baseUrl]   overrides the provider endpoint
- * @param {object} [config.client]    inject a Bedrock client, for tests
- */
-export function createLlmProvider(config = {}) {
-  const provider = normalizeProviderName(config.provider);
-  const timeoutMs = Math.max(Number(config.timeoutMs || DEFAULT_TIMEOUT_MS), 1_000);
-  if (!config.modelId) throw providerError("A model id is required", { name: "CostAiConfigError", statusCode: 400 });
-  if (provider === PROVIDER_BEDROCK) return createBedrockProvider({ ...config, timeoutMs });
-  if (provider === PROVIDER_ANTHROPIC) return createAnthropicProvider({ ...config, timeoutMs });
-  if (provider === PROVIDER_OPENAI) return createOpenAiProvider({ ...config, timeoutMs });
-  throw providerError(`Unsupported AI provider "${config.provider}"`, { name: "CostAiConfigError", statusCode: 400 });
-}