@meyicloud/meyi-cost-server 1.5.0 → 1.6.0

package/src/workers/cost-analysis-report.worker.js

@@ -1,12 +1,9 @@
 import { nextScheduleRun, reportRange } from "../lib/cost-analysis-schedule.js";
-import { createCostAnalysisPdf } from "../services/cost-analysis-pdf.service.js";
-
 export class CostAnalysisReportWorker {
-  constructor({ repository, analysisService, logger = console, env = process.env, pdfGenerator = createCostAnalysisPdf }) {
+  constructor({ repository, analyserService, logger = console, env = process.env }) {
     this.repository = repository;
-    this.analysisService = analysisService;
+    this.analyserService = analyserService;
     this.logger = logger;
-    this.pdfGenerator = pdfGenerator;
     this.enabled = String(env.COST_AI_ENABLED || "").toLowerCase() === "true";
     this.pollMs = Math.max(Number(env.COST_AI_REPORT_POLL_INTERVAL_MS || 60_000), 10_000);
     this.leaseMs = Math.max(Number(env.COST_AI_REPORT_LEASE_MS || 30 * 60_000), 60_000);
@@ -25,10 +22,14 @@ export class CostAnalysisReportWorker {
     const claimed = await this.repository.markRunning(report.id);
     if (!claimed) return this.repository.setNextRun(schedule.tenant_id, nextRunAt, false, schedule.next_run_at);
     try {
-      const req = { body: { force: true }, headers: {}, user: { tenant_id: schedule.tenant_id, tenantId: schedule.tenant_id } };
-      const analysis = await this.analysisService.analyze(req, range);
-      const pdf = await this.pdfGenerator(analysis);
-      await this.repository.complete(report.id, analysis, pdf);
+      const result = await this.analyserService.execute({
+        tenantId: schedule.tenant_id,
+        reportId: report.id,
+        range,
+        frequency: schedule.frequency,
+        onStarted: (taskArn) => this.repository.setTaskArn(report.id, taskArn),
+      });
+      await this.repository.completeExternal(report.id, result);
       await this.repository.setNextRun(schedule.tenant_id, nextRunAt, true, schedule.next_run_at);
     } catch (error) {
       await this.repository.fail(report.id, error);

package/src/lib/cost-analysis.js

@@ -1,116 +0,0 @@
-import { createHash } from "node:crypto";
-import { round } from "./cost-utils.js";
-
-const text = (value, max = 1200) => String(value || "").trim().slice(0, max);
-const severity = (value) => ["low", "medium", "high"].includes(value) ? value : "medium";
-
-function median(values) {
-  const sorted = values.filter(Number.isFinite).sort((a, b) => a - b);
-  if (!sorted.length) return null;
-  const middle = Math.floor(sorted.length / 2);
-  return sorted.length % 2 ? sorted[middle] : (sorted[middle - 1] + sorted[middle]) / 2;
-}
-
-function deltaRows(current = [], previous = [], limit = 8) {
-  const before = new Map(previous.map((item) => [item.label, Number(item.amount || 0)]));
-  return current.slice(0, limit).map((item) => {
-    const currentAmount = Number(item.amount || 0);
-    const previousAmount = before.get(item.label) || 0;
-    return {
-      label: text(item.label, 160),
-      current: round(currentAmount),
-      previous: round(previousAmount),
-      change: round(currentAmount - previousAmount),
-      changePercentage: previousAmount > 0 ? round((currentAmount - previousAmount) / previousAmount * 100) : null,
-      sharePercentage: Number.isFinite(Number(item.percentage)) ? round(Number(item.percentage)) : null,
-    };
-  }).sort((a, b) => Math.abs(b.change) - Math.abs(a.change));
-}
-
-export function buildCostFacts({ current, previous }) {
-  const currentTotal = round(current.totalCost || 0);
-  const previousTotal = round(previous.totalCost || 0);
-  const change = round(currentTotal - previousTotal);
-  const changePercentage = previousTotal > 0 ? round(change / previousTotal * 100) : null;
-  const historicalTotals = (current.trends || [])
-    .filter((item) => String(item.month || "") < String(current.period?.Start || ""))
-    .map((item) => Number(item.amount || 0))
-    .filter((value) => value > 0);
-  const baseline = median(historicalTotals);
-  const currentVsBaseline = baseline && baseline > 0 ? round((currentTotal - baseline) / baseline * 100) : null;
-  const serviceChanges = deltaRows(current.topServices, previous.topServices);
-  const accountChanges = deltaRows(current.topAccounts, previous.topAccounts, 6);
-  const topServiceShare = Number(current.topServices?.[0]?.percentage || 0);
-  const calculatedSignals = [];
-
-  if (changePercentage != null && Math.abs(changePercentage) >= 10) {
-    calculatedSignals.push({
-      severity: Math.abs(changePercentage) >= 25 ? "high" : "medium",
-      kind: "period_change",
-      message: `Spend ${changePercentage > 0 ? "increased" : "decreased"} ${Math.abs(changePercentage)}% compared with the preceding period.`,
-    });
-  }
-  if (currentVsBaseline != null && currentVsBaseline >= 25 && historicalTotals.length >= 3) {
-    calculatedSignals.push({ severity: "high", kind: "baseline_anomaly", message: `Spend is ${currentVsBaseline}% above the historical monthly median.` });
-  }
-  if (topServiceShare >= 50) {
-    calculatedSignals.push({ severity: "medium", kind: "service_concentration", message: `${text(current.topServices[0]?.label, 160)} represents ${round(topServiceShare)}% of spend.` });
-  }
-
-  return {
-    period: current.period,
-    comparisonPeriod: previous.period,
-    currency: current.currency || "USD",
-    dataSource: current.dataSource,
-    currentTotal,
-    previousTotal,
-    change,
-    changePercentage,
-    activeAccounts: Number(current.activeAccounts || 0),
-    activeResources: current.activeResources == null ? null : Number(current.activeResources),
-    historyMonths: historicalTotals.length,
-    historicalMonthlyMedian: baseline == null ? null : round(baseline),
-    currentVsBaselinePercentage: currentVsBaseline,
-    serviceChanges,
-    accountChanges,
-    topRegions: (current.topRegions || []).slice(0, 6).map((item) => ({ label: text(item.label, 160), amount: round(item.amount || 0), sharePercentage: round(item.percentage || 0) })),
-    calculatedSignals,
-    limitations: historicalTotals.length < 3 ? ["Fewer than three non-zero monthly data points are available, so anomaly confidence is limited."] : [],
-  };
-}
-
-export function redactFactsForModel(facts) {
-  return {
-    ...facts,
-    accountChanges: facts.accountChanges.map((item, index) => ({ ...item, label: `Account ${index + 1}` })),
-  };
-}
-
-export function analysisFingerprint(facts, modelId) {
-  return createHash("sha256").update(JSON.stringify({ facts, modelId })).digest("hex");
-}
-
-export function parseAnalysisResponse(value) {
-  const raw = String(value || "").trim().replace(/^```(?:json)?\s*/i, "").replace(/\s*```$/, "");
-  const start = raw.indexOf("{");
-  const end = raw.lastIndexOf("}");
-  if (start < 0 || end <= start) throw new Error("The AI response did not contain a JSON object");
-  const parsed = JSON.parse(raw.slice(start, end + 1));
-  const summary = text(parsed.summary, 3000);
-  const findings = Array.isArray(parsed.findings) ? parsed.findings.slice(0, 6).map((item) => ({
-    severity: severity(item?.severity),
-    title: text(item?.title, 160),
-    explanation: text(item?.explanation, 1000),
-    evidence: text(item?.evidence, 500),
-    estimatedImpact: Number.isFinite(Number(item?.estimatedImpact)) ? round(Number(item.estimatedImpact)) : null,
-  })).filter((item) => item.title && item.explanation) : [];
-  const recommendations = Array.isArray(parsed.recommendations) ? parsed.recommendations.slice(0, 6).map((item) => ({
-    priority: Math.min(Math.max(Number(item?.priority) || 2, 1), 3),
-    title: text(item?.title, 160),
-    action: text(item?.action, 800),
-    rationale: text(item?.rationale, 600),
-  })).filter((item) => item.title && item.action) : [];
-  const limitations = Array.isArray(parsed.limitations) ? parsed.limitations.slice(0, 5).map((item) => text(item, 400)).filter(Boolean) : [];
-  if (!summary || !findings.length || !recommendations.length) throw new Error("The AI response was missing required analysis fields");
-  return { summary, findings, recommendations, limitations };
-}

package/src/lib/llm-provider.js

@@ -1,239 +0,0 @@
-import { BedrockRuntimeClient, ConverseCommand } from "@aws-sdk/client-bedrock-runtime";
-
-/**
- * One calling convention over the LLM providers the Cost plugin supports.
- *
- * Bedrock authenticates with SigV4 and is subject to account-level model
- * access; the direct Anthropic and OpenAI providers authenticate with an API
- * key and are not. That difference is the whole reason this abstraction exists
- * - a deployment blocked on Bedrock model access can still run analysis
- * against a key.
- *
- * Every provider takes the same call shape and returns { text }. Nothing above
- * this file knows which one answered.
- */
-
-export const PROVIDER_BEDROCK = "bedrock";
-export const PROVIDER_ANTHROPIC = "anthropic";
-export const PROVIDER_OPENAI = "openai";
-
-const ANTHROPIC_VERSION = "2023-06-01";
-const DEFAULT_TIMEOUT_MS = 120_000;
-
-/**
- * Provider names arrive from a database row that a human filled in through a
- * dropdown ("AWS Bedrock", "Anthropic", "OpenAI"), so normalise loosely rather
- * than demanding an exact token.
- */
-export function normalizeProviderName(value) {
-  const name = String(value || "").trim().toLowerCase();
-  if (!name) return PROVIDER_BEDROCK;
-  if (name.includes("bedrock")) return PROVIDER_BEDROCK;
-  if (name.includes("anthropic") || name.includes("claude")) return PROVIDER_ANTHROPIC;
-  if (name.includes("openai") || name.includes("gpt")) return PROVIDER_OPENAI;
-  return name;
-}
-
-function providerError(message, { name = "CostAiProviderError", statusCode = 502, cause } = {}) {
-  const error = new Error(message);
-  error.name = name;
-  error.statusCode = statusCode;
-  if (cause) error.cause = cause;
-  return error;
-}
-
-/**
- * Read an HTTP error body without letting a provider's error text leak a key
- * back to the caller. Bodies are truncated: some providers echo request context.
- */
-async function readErrorBody(response) {
-  try {
-    const text = await response.text();
-    return String(text || "").slice(0, 500);
-  } catch {
-    return "";
-  }
-}
-
-async function postJson(url, { headers, body, timeoutMs }) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    return await fetch(url, {
-      method: "POST",
-      headers: { "content-type": "application/json", ...headers },
-      body: JSON.stringify(body),
-      signal: controller.signal,
-    });
-  } catch (error) {
-    if (error.name === "AbortError") {
-      throw providerError(`The model did not respond within ${Math.round(timeoutMs / 1000)}s`, { name: "CostAiTimeoutError", statusCode: 504 });
-    }
-    throw providerError(`Could not reach the model endpoint: ${error.message}`, { cause: error });
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-/**
- * Shared by both Bedrock auth modes: Converse wire shape in, plain text out.
- *
- * Undefined sampling parameters are omitted rather than sent as null. Claude
- * Haiku 4.5 and Sonnet 4.5 reject a request that carries both temperature and
- * topP - "cannot both be specified for this model" - so the caller sends one.
- */
-function converseRequestBody({ system, messages, maxTokens, temperature, topP }) {
-  const inferenceConfig = { maxTokens };
-  if (temperature !== undefined && temperature !== null) inferenceConfig.temperature = temperature;
-  if (topP !== undefined && topP !== null) inferenceConfig.topP = topP;
-  return {
-    system: [{ text: system }],
-    messages: messages.map((message) => ({ role: message.role, content: [{ text: message.text }] })),
-    inferenceConfig,
-  };
-}
-
-function converseResponseText(payload) {
-  return (payload?.output?.message?.content || []).map((item) => item.text || "").join("\n");
-}
-
-/**
- * Bedrock with an API key (the ABSK... long-term or short-term keys issued in
- * the Bedrock console). These are bearer tokens, not SigV4 credentials, so the
- * AWS SDK cannot use them without the process-wide AWS_BEARER_TOKEN_BEDROCK
- * variable - unusable here, because the token is per tenant and this process
- * serves many. Calling the Converse REST endpoint directly keeps it per request.
- *
- * Authentication only. Model entitlement is still granted per AWS account, so a
- * key cannot reach a model the account has not been approved for.
- */
-function createBedrockBearerProvider({ modelId, region, apiKey, timeoutMs }) {
-  if (!region) throw providerError("Bedrock with an API key requires a region", { name: "CostAiConfigError", statusCode: 400 });
-  const endpoint = `https://bedrock-runtime.${region}.amazonaws.com/model/${encodeURIComponent(modelId)}/converse`;
-  return {
-    provider: PROVIDER_BEDROCK,
-    modelId,
-    region,
-    authMode: "api-key",
-    async converse(request) {
-      const response = await postJson(endpoint, {
-        headers: { authorization: `Bearer ${apiKey}` },
-        timeoutMs,
-        body: converseRequestBody(request),
-      });
-      if (!response.ok) {
-        // 404 here is Bedrock's shape for "account not entitled to this model",
-        // not a missing endpoint. Pass the message through so the UI can show it.
-        throw providerError(`Bedrock returned ${response.status}: ${await readErrorBody(response)}`, {
-          statusCode: response.status === 429 ? 429 : 502,
-        });
-      }
-      return { text: converseResponseText(await response.json()) };
-    },
-  };
-}
-
-/**
- * Bedrock with SigV4. The original behaviour: the ambient credential chain (the
- * ECS task role) unless explicit access keys are supplied, which is how a
- * customer points the plugin at their own account.
- */
-function createBedrockProvider({ modelId, region, apiKey, accessKeyId, secretAccessKey, sessionToken, client, timeoutMs }) {
-  // An injected client is a test seam and must win, so check it before the key.
-  if (!client && apiKey) return createBedrockBearerProvider({ modelId, region, apiKey, timeoutMs });
-  const credentials = accessKeyId && secretAccessKey
-    ? { accessKeyId, secretAccessKey, ...(sessionToken ? { sessionToken } : {}) }
-    : undefined;
-  const runtime = client || new BedrockRuntimeClient({ region, ...(credentials ? { credentials } : {}) });
-  return {
-    provider: PROVIDER_BEDROCK,
-    modelId,
-    region,
-    authMode: credentials ? "access-keys" : "ambient",
-    async converse(request) {
-      const response = await runtime.send(new ConverseCommand({ modelId, ...converseRequestBody(request) }));
-      return { text: converseResponseText(response) };
-    },
-  };
-}
-
-function createAnthropicProvider({ modelId, apiKey, baseUrl, timeoutMs }) {
-  if (!apiKey) throw providerError("The Anthropic provider requires an API key", { name: "CostAiConfigError", statusCode: 400 });
-  const endpoint = `${String(baseUrl || "https://api.anthropic.com").replace(/\/+$/, "")}/v1/messages`;
-  return {
-    provider: PROVIDER_ANTHROPIC,
-    modelId,
-    region: null,
-    async converse({ system, messages, maxTokens, temperature, topP }) {
-      const response = await postJson(endpoint, {
-        headers: { "x-api-key": apiKey, "anthropic-version": ANTHROPIC_VERSION },
-        timeoutMs,
-        body: {
-          model: modelId,
-          max_tokens: maxTokens,
-          ...(temperature === undefined || temperature === null ? {} : { temperature }),
-          ...(topP === undefined || topP === null ? {} : { top_p: topP }),
-          system,
-          messages: messages.map((message) => ({ role: message.role, content: message.text })),
-        },
-      });
-      if (!response.ok) {
-        throw providerError(`Anthropic API returned ${response.status}: ${await readErrorBody(response)}`, { statusCode: response.status === 429 ? 429 : 502 });
-      }
-      const payload = await response.json();
-      return { text: (payload.content || []).map((item) => item.text || "").join("\n") };
-    },
-  };
-}
-
-function createOpenAiProvider({ modelId, apiKey, baseUrl, timeoutMs }) {
-  if (!apiKey) throw providerError("The OpenAI provider requires an API key", { name: "CostAiConfigError", statusCode: 400 });
-  const endpoint = `${String(baseUrl || "https://api.openai.com").replace(/\/+$/, "")}/v1/chat/completions`;
-  return {
-    provider: PROVIDER_OPENAI,
-    modelId,
-    region: null,
-    async converse({ system, messages, maxTokens, temperature, topP }) {
-      const response = await postJson(endpoint, {
-        headers: { authorization: `Bearer ${apiKey}` },
-        timeoutMs,
-        body: {
-          model: modelId,
-          max_completion_tokens: maxTokens,
-          ...(temperature === undefined || temperature === null ? {} : { temperature }),
-          ...(topP === undefined || topP === null ? {} : { top_p: topP }),
-          messages: [
-            { role: "system", content: system },
-            ...messages.map((message) => ({ role: message.role, content: message.text })),
-          ],
-        },
-      });
-      if (!response.ok) {
-        throw providerError(`OpenAI API returned ${response.status}: ${await readErrorBody(response)}`, { statusCode: response.status === 429 ? 429 : 502 });
-      }
-      const payload = await response.json();
-      return { text: (payload.choices || []).map((choice) => choice.message?.content || "").join("\n") };
-    },
-  };
-}
-
-/**
- * @param {object} config
- * @param {string} config.provider    bedrock | anthropic | openai (loose match)
- * @param {string} config.modelId
- * @param {string} [config.apiKey]    required for anthropic and openai
- * @param {string} [config.region]    bedrock only
- * @param {string} [config.accessKeyId]      bedrock only; omit for ambient creds
- * @param {string} [config.secretAccessKey]  bedrock only
- * @param {string} [config.baseUrl]   overrides the provider endpoint
- * @param {object} [config.client]    inject a Bedrock client, for tests
- */
-export function createLlmProvider(config = {}) {
-  const provider = normalizeProviderName(config.provider);
-  const timeoutMs = Math.max(Number(config.timeoutMs || DEFAULT_TIMEOUT_MS), 1_000);
-  if (!config.modelId) throw providerError("A model id is required", { name: "CostAiConfigError", statusCode: 400 });
-  if (provider === PROVIDER_BEDROCK) return createBedrockProvider({ ...config, timeoutMs });
-  if (provider === PROVIDER_ANTHROPIC) return createAnthropicProvider({ ...config, timeoutMs });
-  if (provider === PROVIDER_OPENAI) return createOpenAiProvider({ ...config, timeoutMs });
-  throw providerError(`Unsupported AI provider "${config.provider}"`, { name: "CostAiConfigError", statusCode: 400 });
-}

package/src/repositories/cost-analysis.repository.js

@@ -1,50 +0,0 @@
-import { sql } from "drizzle-orm";
-import { rows } from "../lib/cost-utils.js";
-
-export class CostAnalysisRepository {
-  constructor({ db, qSchema }) {
-    this.db = db;
-    this.table = `${qSchema}.cost_ai_analyses`;
-  }
-
-  async findCached(tenantId, fingerprint, maxAgeMs) {
-    const result = rows(await this.db.execute(sql`
-      SELECT * FROM ${sql.raw(this.table)}
-      WHERE tenant_id = ${tenantId} AND input_fingerprint = ${fingerprint}
-        AND created_at >= now() - (${Math.max(maxAgeMs, 0)} * interval '1 millisecond')
-      ORDER BY created_at DESC LIMIT 1
-    `));
-    return result[0] || null;
-  }
-
-  async latest(tenantId) {
-    const result = rows(await this.db.execute(sql`
-      SELECT * FROM ${sql.raw(this.table)}
-      WHERE tenant_id = ${tenantId}
-      ORDER BY created_at DESC LIMIT 1
-    `));
-    return result[0] || null;
-  }
-
-  async countRecent(tenantId, windowMs) {
-    const result = rows(await this.db.execute(sql`
-      SELECT COUNT(*)::integer AS count FROM ${sql.raw(this.table)}
-      WHERE tenant_id = ${tenantId}
-        AND created_at >= now() - (${Math.max(windowMs, 0)} * interval '1 millisecond')
-    `));
-    return Number(result[0]?.count || 0);
-  }
-
-  async save({ id, tenantId, requestedBy, fingerprint, modelId, source, period, facts, result }) {
-    const inserted = rows(await this.db.execute(sql`
-      INSERT INTO ${sql.raw(this.table)}
-        (id, tenant_id, requested_by, input_fingerprint, model_id, data_source,
-         period_start, period_end, facts, result)
-      VALUES
-        (${id}, ${tenantId}, ${requestedBy}, ${fingerprint}, ${modelId}, ${source},
-         ${period.Start}, ${period.End}, ${JSON.stringify(facts)}::jsonb, ${JSON.stringify(result)}::jsonb)
-      RETURNING *
-    `));
-    return inserted[0];
-  }
-}

package/src/schema/cost-analysis.schema.js

@@ -1,7 +0,0 @@
-import { sql } from "drizzle-orm";
-
-export async function installCostAnalysisSchema(db, qSchema) {
-  await db.execute(sql.raw(`CREATE TABLE IF NOT EXISTS ${qSchema}.cost_ai_analyses (id text PRIMARY KEY, tenant_id text NOT NULL, requested_by text, input_fingerprint text NOT NULL, model_id text NOT NULL, data_source text, period_start date NOT NULL, period_end date NOT NULL, facts jsonb NOT NULL, result jsonb NOT NULL, created_at timestamptz NOT NULL DEFAULT now())`));
-  await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS cost_ai_analyses_tenant_created_idx ON ${qSchema}.cost_ai_analyses (tenant_id, created_at DESC)`));
-  await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS cost_ai_analyses_cache_idx ON ${qSchema}.cost_ai_analyses (tenant_id, input_fingerprint, created_at DESC)`));
-}

package/src/services/cost-analysis-data.service.js

@@ -1,39 +0,0 @@
-import { getCurOverview } from "./cur.service.js";
-import { iso } from "../lib/cost-utils.js";
-
-function previousRange(range) {
-  const start = new Date(`${range.Start}T00:00:00Z`);
-  const end = new Date(`${range.End}T00:00:00Z`);
-  const duration = end.getTime() - start.getTime();
-  return { Start: iso(new Date(start.getTime() - duration)), End: range.Start };
-}
-
-function trendRange(range) {
-  const start = new Date(`${range.Start}T00:00:00Z`);
-  start.setUTCMonth(start.getUTCMonth() - 11, 1);
-  return { Start: iso(start), End: range.End };
-}
-
-export class CostAnalysisDataService {
-  constructor({ curProvider }) {
-    this.curProvider = curProvider;
-  }
-
-  async load(context, range) {
-    const prior = previousRange(range);
-    const history = trendRange(range);
-    const [current, previous] = await Promise.all([
-      this.loadPeriod(context, range, history),
-      this.loadPeriod(context, prior, prior),
-    ]);
-    return { current, previous };
-  }
-
-  async loadPeriod(context, range, historyRange) {
-    const { tenant, accounts } = context;
-    const names = new Map(accounts.map((item) => [item.id, item.name]));
-    return this.curProvider.run(context, (client, config) => getCurOverview({
-      client, config, tenant, range, trendRange: historyRange, accountNames: names,
-    }));
-  }
-}

package/src/services/cost-analysis-pdf.service.js

@@ -1,42 +0,0 @@
-import PDFDocument from "pdfkit";
-
-const money = (value, currency = "USD") => new Intl.NumberFormat("en-US", { style: "currency", currency }).format(Number(value || 0));
-
-export function createCostAnalysisPdf(analysis) {
-  return new Promise((resolve, reject) => {
-    const doc = new PDFDocument({ size: "A4", margin: 48, info: { Title: "Meyi Connect AI Cost Analysis", Author: "Meyi Connect" } });
-    const chunks = [];
-    doc.on("data", (chunk) => chunks.push(chunk));
-    doc.on("end", () => resolve(Buffer.concat(chunks)));
-    doc.on("error", reject);
-    const ensure = (height = 80) => { if (doc.y + height > doc.page.height - 48) doc.addPage(); };
-    const inclusiveEnd = new Date(`${analysis.period.End}T00:00:00Z`);
-    inclusiveEnd.setUTCDate(inclusiveEnd.getUTCDate() - 1);
-    doc.font("Helvetica-Bold").fontSize(20).fillColor("#122235").text("AI Cost Analysis");
-    doc.moveDown(0.35).font("Helvetica").fontSize(9).fillColor("#53657a").text(`Generated ${new Date(analysis.generatedAt).toUTCString()} | AWS CUR | ${analysis.period.Start} to ${inclusiveEnd.toISOString().slice(0, 10)}`);
-    doc.moveDown(1).font("Helvetica-Bold").fontSize(12).fillColor("#122235").text("Executive summary");
-    doc.moveDown(0.35).font("Helvetica").fontSize(10).fillColor("#27384a").text(analysis.summary, { lineGap: 3 });
-    doc.moveDown(1).font("Helvetica-Bold").fontSize(12).fillColor("#122235").text("Cost facts");
-    doc.moveDown(0.35).font("Helvetica").fontSize(10).fillColor("#27384a");
-    doc.text(`Period spend: ${money(analysis.facts.currentTotal, analysis.facts.currency)}`);
-    doc.text(`Previous period: ${money(analysis.facts.previousTotal, analysis.facts.currency)}`);
-    doc.text(`Change: ${money(analysis.facts.change, analysis.facts.currency)} (${analysis.facts.changePercentage == null ? "no baseline" : `${analysis.facts.changePercentage}%`})`);
-    doc.moveDown(1).font("Helvetica-Bold").fontSize(12).fillColor("#122235").text("Key findings");
-    for (const finding of analysis.findings || []) {
-      ensure();
-      doc.moveDown(0.5).font("Helvetica-Bold").fontSize(10).fillColor("#122235").text(`${String(finding.severity).toUpperCase()}: ${finding.title}`);
-      doc.font("Helvetica").fillColor("#27384a").text(finding.explanation, { lineGap: 2 });
-      doc.fontSize(9).fillColor("#53657a").text(`Evidence: ${finding.evidence}`);
-    }
-    ensure();
-    doc.moveDown(1).font("Helvetica-Bold").fontSize(12).fillColor("#122235").text("Recommended actions");
-    for (const item of [...(analysis.recommendations || [])].sort((a, b) => a.priority - b.priority)) {
-      ensure();
-      doc.moveDown(0.5).font("Helvetica-Bold").fontSize(10).fillColor("#122235").text(`${item.priority}. ${item.title}`);
-      doc.font("Helvetica").fillColor("#27384a").text(item.action, { lineGap: 2 });
-      doc.fontSize(9).fillColor("#53657a").text(item.rationale);
-    }
-    doc.moveDown(1).font("Helvetica-Oblique").fontSize(8).fillColor("#6b7785").text("AI recommendations are advisory. Review them before changing AWS resources.");
-    doc.end();
-  });
-}