@meyicloud/meyi-cost-server 1.5.0 → 1.7.0

package/AGENTS.md

@@ -3,7 +3,7 @@
 ## Scope
 
 This package is a tenant-aware Express plugin for AWS cost overview, reports,
-budgets, alert dismissals, Cost Explorer, and optional CUR/Athena data. It is
+budgets, alert dismissals, and mandatory CUR/Athena data. It is
 designed to be mounted inside a host backend; it does not own login, tenant
 onboarding, or the host plugin registry.
 
@@ -20,7 +20,7 @@ insight-cost-server/
 |   |-- routes/               # Express paths and common error handling
 |   |-- models/               # Immutable customer, SaaS CUR, and status models
 |   |-- repositories/         # Tenant-scoped onboarding persistence reads
-|   |-- services/             # Cost Explorer, SaaS Athena, context, budgets
+|   |-- services/             # CUR/Athena, external analyser, context, budgets
 |   |-- schema/               # Plugin-owned database tables and installation
 |   |-- lib/                  # Stateless date, cost, and filter helpers
 |   `-- plugin.js             # Dependency composition and lifecycle
@@ -35,23 +35,13 @@ Keep HTTP concerns in routes/controllers, AWS and database behavior in services,
 schema creation in `schema`, and pure calculations in `lib`. `index.js` and
 `cur.js` must remain thin compatibility entry points.
 
-## AI provider abstraction
+## External cost analyser
 
-`src/lib/llm-provider.js` is the only place that knows which vendor answers.
-`createLlmProvider({ provider, modelId, apiKey, region, ... })` returns an
-object with a single `converse({ system, messages, maxTokens, temperature,
-topP })` method resolving to `{ text }`. Bedrock, Anthropic and OpenAI are
-supported; `normalizeProviderName` matches loosely so UI labels like
-"AWS Bedrock" resolve correctly.
-
-`CostAnalysisService.resolveProvider(tenantId)` picks between a host-supplied
-`providerResolver` and the `COST_AI_*` environment defaults. Two rules matter:
-the analysis fingerprint is computed from the **effective** model so switching
-provider cannot serve a cached answer from the previous one, and a resolver
-failure degrades to the environment rather than failing the request.
-
-When adding a provider, add it here and to `test/llm-provider.test.js`; no
-other file should need to change.
+The backend package never calls an LLM directly. `CostAnalysisReportWorker`
+claims due tenant schedules and delegates execution to `CostAnalyserService`,
+which starts one tenant-scoped `meyi-cost-ai-analyser` Fargate task. The task
+writes canonical Markdown and derived PDF artifacts to private S3. Keep ECS
+task overrides tenant-scoped and never log the customer role external ID.
 
 ## Request and data flow
 
@@ -62,21 +52,17 @@ flowchart LR
   Enabled --> Router[/api/v1/cost router]
   Router --> Controller[Cost controller]
   Controller --> Customer[Customer AWS context service]
-  Customer -->|Customer role| CE[AWS Cost Explorer]
-  Controller --> Source{Configured source}
-  Source -->|CUR| SaaS[SaaS Athena context service]
+  Controller --> SaaS[SaaS Athena context service]
   SaaS --> Athena[Central tenant CUR partition]
-  Source -->|auto fallback| CE
-  Controller --> Budget[Budget and dismissal services]
-  Budget --> DB[(Tenant-scoped PostgreSQL)]
-  Athena --> Controller
-  CE --> Controller
+  Athena --> Scheduler[Scheduled report worker]
+  Scheduler --> ECS[Cost analyser Fargate task]
+  ECS --> Artifacts[Private Markdown and PDF S3 objects]
 ```
 
 The plugin currently owns these route groups under `${apiBaseUri}/cost`:
 
 - `GET /accounts`, `/data-status`, `/overview`, `/filter-options`, `/reports`, `/tags`
-- `GET`/`PUT /analysis/schedule`, `GET /analysis/reports`, and tenant-scoped PDF downloads
+- `GET`/`PUT /analysis/schedule`, `GET /analysis/reports`, and tenant-scoped Markdown/PDF downloads
 - `GET /budgets` and `POST /budgets`
 - `DELETE /budgets/:id`
 - `GET /budget-alert-dismissals` and `POST /budget-alert-dismissals`

package/README.md

@@ -32,7 +32,7 @@ and AWS onboarding. The plugin owns cost routes and its budget-related tables.
 - User-, tenant-, month-, and status-scoped budget-alert dismissals
 - Tenant-configurable daily, weekly, and monthly AI report schedules
 - PostgreSQL-backed background report jobs with failure history
-- Server-generated PDF reports available through tenant-scoped downloads
+- Analyser-generated Markdown and PDF reports available through tenant-scoped downloads
 
 Budgets are application rules stored in PostgreSQL; they are not AWS Budgets
 resources. The consuming application evaluates them against current cost and
@@ -97,7 +97,7 @@ For a local package installation test:
 
 ```bash
 npm pack
-npm install /path/to/meyicloud-meyi-cost-server-1.5.0.tgz
+npm install /path/to/meyicloud-meyi-cost-server-1.6.0.tgz
 ```
 
 ## Publish to npm
@@ -258,12 +258,12 @@ SaaS Athena resources.
 
 ### AI analysis variables
 
-AI analysis is optional and invokes Amazon Bedrock from the backend runtime.
-Only aggregated cost facts are sent to the model; tenant IDs, AWS credentials,
-resource IDs, and raw CUR rows are excluded. AI reports are generated by a
-background worker, not by a browser request. Daily reports cover the previous
-complete day, weekly reports cover the previous seven complete days, and
-monthly reports cover the previous calendar month in the configured timezone.
+AI reports are generated by a separate `meyi-cost-ai-analyser` Fargate task.
+The backend only schedules jobs, launches and monitors the task, and serves
+tenant-scoped artifacts. It does not invoke Bedrock or generate PDFs itself.
+Daily reports cover the previous complete day, weekly reports cover the
+previous seven complete days, and monthly reports cover the previous calendar
+month in the configured timezone.
 
 The authenticated report API is:
 
@@ -274,6 +274,7 @@ The authenticated report API is:
 | `GET` | `/analysis/reports` | List tenant report history without PDF bytes. |
 | `GET` | `/analysis/reports/:id` | Read one tenant report. |
 | `GET` | `/analysis/reports/:id/pdf` | Download a completed report PDF. |
+| `GET` | `/analysis/reports/:id/markdown` | Download the canonical Markdown report. |
 
 Schedule and report rows live in `cost_ai_report_schedules` and
 `cost_ai_reports`. The worker atomically claims due schedules with a lease, so
@@ -281,56 +282,29 @@ a restarted task can resume future work without relying on in-memory timers.
 
 | Variable | Default | Required | Purpose |
 | --- | --- | --- | --- |
-| `COST_AI_ENABLED` | `false` | No | Enables the AI analysis endpoints and Bedrock client. |
-| `COST_AI_REGION` | `AWS_REGION` or `us-east-1` | When enabled | Region used by the Bedrock Runtime client. |
-| `COST_AI_MODEL_ID` | Global Claude Sonnet inference profile | When enabled | Bedrock model or inference-profile ID. |
-| `COST_AI_MAX_TOKENS` | `4000` | No | Maximum response tokens, clamped from 600 to 8000. |
-| `COST_AI_CACHE_TTL_MS` | `21600000` | No | Tenant analysis cache duration; defaults to six hours. |
-| `COST_AI_HOURLY_LIMIT` | `6` | No | Maximum non-cached generations per tenant per hour. |
-| `COST_AI_TIMEOUT_MS` | `120000` | No | Per-request timeout for key-based providers; Bedrock uses the SDK default. |
+| `COST_AI_ENABLED` | `false` | No | Enables the schedule worker and external analyser integration. |
+| `COST_AI_ANALYSER_REGION` | `AWS_REGION` | When enabled | ECS and report-bucket region. |
+| `COST_AI_ANALYSER_CLUSTER` | Empty | When enabled | ECS cluster ARN or name. |
+| `COST_AI_ANALYSER_TASK_DEFINITION` | Empty | When enabled | Fargate task definition ARN. |
+| `COST_AI_ANALYSER_CONTAINER_NAME` | `cost-ai-analyser` | No | Container override target. |
+| `COST_AI_ANALYSER_SUBNETS` | Empty | When enabled | Comma-separated private subnet IDs. |
+| `COST_AI_ANALYSER_SECURITY_GROUPS` | Empty | When enabled | Comma-separated task security groups. |
+| `COST_AI_ANALYSER_REPORT_BUCKET` | Empty | When enabled | Private S3 Markdown/PDF artifact bucket. |
+| `COST_AI_ANALYSER_PROVIDER_SECRET_PREFIX` | Empty | When enabled | Prefix for temporary Secrets Manager entries containing each tenant's active Meyi Connect AI provider configuration. |
+| `COST_AI_ANALYSER_TARGET_REGIONS` | `AWS_REGION` | No | Customer regions inspected for resource detail. |
+| `COST_AI_ANALYSER_TOP_N_SERVICES` | `10` | No | Maximum high-cost service agents run per report. |
+| `COST_AI_ANALYSER_POLL_INTERVAL_MS` | `15000` | No | ECS task status polling interval. |
+| `COST_AI_ANALYSER_TIMEOUT_MS` | `2700000` | No | Maximum external task duration. |
 | `COST_AI_REPORT_POLL_INTERVAL_MS` | `60000` | No | How often the background worker claims due schedules; minimum 10 seconds. |
-| `COST_AI_REPORT_LEASE_MS` | `1800000` | No | Claim lease used to recover from an interrupted worker. |
+| `COST_AI_REPORT_LEASE_MS` | `3600000` | No | Claim lease used to recover from an interrupted worker. |
 | `COST_AI_REPORT_BATCH_SIZE` | `5` | No | Maximum schedules claimed by one worker tick; clamped from 1 to 25. |
 
-### Choosing a provider
-
-The `COST_AI_*` variables above configure the deployment default, which is
-Bedrock. A host application can additionally supply `providerResolver` to
-`createInsightCost` to select a provider per tenant:
-
-```js
-createInsightCost({
-  app, db,
-  providerResolver: async (tenantId) => ({
-    provider: "anthropic",        // bedrock | anthropic | openai
-    modelId: "claude-sonnet-4-5",
-    apiKey: "...",                // required for anthropic and openai
-    region: "ap-south-2",         // bedrock only
-    accessKeyId: "...",           // bedrock only; omit to use ambient credentials
-    secretAccessKey: "...",
-  }),
-})
-```
-
-Returning `null` falls back to the environment configuration, so a host that
-does not pass a resolver behaves exactly as before. A resolver that throws is
-logged and also falls back, so a credential-store outage degrades the feature
-rather than failing the request.
-
-Why this exists: Bedrock authenticates with SigV4 and is subject to
-account-level Anthropic model access. The key-based providers are not, so a
-deployment blocked on Bedrock model access can still run analysis. It also
-lets a customer bring their own model account.
-
-`GET /analysis/status` reports the provider that would serve the caller's
-tenant, including a `source` of `tenant-configuration` or `environment`.
-**Host applications are responsible for encrypting stored credentials.**
-
-The runtime role needs `bedrock:InvokeModel` for the selected model or
-inference profile. Analysis results are stored in the tenant-scoped
-`cost_ai_analyses` table and scheduled PDF jobs are stored in
-`cost_ai_reports`. Model or permission failures mark only that scheduled report
-as failed and do not change CUR, standard reports, onboarding, or budgets.
+`GET /analysis/status` reports `meyi-cost-ai-analyser` with an `ecs-task`
+source. The analyser uses the shared ECS task role for Athena, S3, Bedrock, and
+cross-account role assumption. New reports store task and private artifact
+references in `cost_ai_reports`; existing database-backed PDF rows remain
+downloadable for compatibility. Model or task failures mark only that report as
+failed and do not change CUR, standard reports, or onboarding.
 
 ### CUR/Athena variables
 

package/index.js

@@ -1,2 +1 @@
 export { createInsightCost, createInsightCost as default } from "./src/plugin.js";
-export { createLlmProvider, normalizeProviderName, PROVIDER_BEDROCK, PROVIDER_ANTHROPIC, PROVIDER_OPENAI } from "./src/lib/llm-provider.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meyicloud/meyi-cost-server",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "Tenant-aware AWS CUR and Athena cost plugin server for MeyiConnect",
   "type": "module",
   "main": "./index.js",
@@ -19,15 +19,15 @@
   ],
   "dependencies": {
     "@aws-sdk/client-athena": "^3.850.0",
-    "@aws-sdk/client-bedrock-runtime": "^3.850.0",
+    "@aws-sdk/client-ecs": "^3.850.0",
     "@aws-sdk/client-glue": "^3.850.0",
     "@aws-sdk/client-s3": "^3.850.0",
+    "@aws-sdk/client-secrets-manager": "^3.850.0",
     "@aws-sdk/client-sts": "^3.850.0",
     "@aws-sdk/credential-providers": "^3.850.0",
     "drizzle-orm": "^0.44.7",
     "express": "^4.21.1",
-    "luxon": "^3.7.2",
-    "pdfkit": "^0.17.2"
+    "luxon": "^3.7.2"
   },
   "peerDependencies": {
     "pg": ">=8"

package/src/controllers/cost-analysis.controller.js

@@ -12,7 +12,7 @@ export class CostAnalysisController {
 
   async latest(req, res, next) {
     try {
-      return res.json({ analysis: await this.service.latest(req) });
+      return res.json({ analysis: await this.reportService.latest(req) });
     } catch (error) { return next(error); }
   }
 
@@ -45,4 +45,14 @@ export class CostAnalysisController {
       return res.send(report.data);
     } catch (error) { return next(error); }
   }
+
+  async downloadMarkdown(req, res, next) {
+    try {
+      const report = await this.reportService.markdown(req, req.params.id);
+      res.setHeader("Content-Type", "text/markdown; charset=utf-8");
+      res.setHeader("Content-Disposition", `attachment; filename="${report.filename}"`);
+      res.setHeader("Content-Length", report.data.length);
+      return res.send(report.data);
+    } catch (error) { return next(error); }
+  }
 }

package/src/plugin.js

@@ -11,13 +11,11 @@ import { BudgetController } from "./controllers/budget.controller.js";
 import { CostAnalysisController } from "./controllers/cost-analysis.controller.js";
 import { createCostRouter } from "./routes/index.js";
 import { installCostBudgetSchema } from "./schema/cost-budget.schema.js";
-import { installCostAnalysisSchema } from "./schema/cost-analysis.schema.js";
 import { installCostAnalysisReportSchema } from "./schema/cost-analysis-report.schema.js";
-import { CostAnalysisRepository } from "./repositories/cost-analysis.repository.js";
 import { CostAnalysisReportRepository } from "./repositories/cost-analysis-report.repository.js";
-import { CostAnalysisDataService } from "./services/cost-analysis-data.service.js";
-import { CostAnalysisService } from "./services/cost-analysis.service.js";
+import { CostAnalyserService } from "./services/cost-analyser.service.js";
 import { CostAnalysisReportService } from "./services/cost-analysis-report.service.js";
+import { CostReportArtifactService } from "./services/cost-report-artifact.service.js";
 import { CostAnalysisReportWorker } from "./workers/cost-analysis-report.worker.js";
 import { installCurDiscoverySchema } from "./cur-discovery/schema.js";
 import { CurDiscoveryRepository } from "./cur-discovery/cur-discovery.repository.js";
@@ -35,7 +33,6 @@ export function createInsightCost({ app, db, apiBaseUri = "/api/v1", logger = co
   const contextService = new CustomerAwsContextService({ repository: onboardingRepository, defaultTenant });
   const budgetRepository = new BudgetRepository({ db, qSchema });
   const budgetAlertRepository = new BudgetAlertRepository({ db, qSchema });
-  const costAnalysisRepository = new CostAnalysisRepository({ db, qSchema });
   const costAnalysisReportRepository = new CostAnalysisReportRepository({ db, qSchema });
   const budgetService = new BudgetService({ repository: budgetRepository });
   const budgetAlertService = new BudgetAlertService({ repository: budgetAlertRepository });
@@ -54,20 +51,17 @@ export function createInsightCost({ app, db, apiBaseUri = "/api/v1", logger = co
   const discoveryWorker = new CurDiscoveryWorker({ repository: discoveryRepository, service: discoveryService, logger });
   const costController = new CostController({ contextService, curProvider, discoveryRepository, logger });
   const budgetController = new BudgetController({ contextService, budgetService, budgetAlertService });
-  const costAnalysisDataService = new CostAnalysisDataService({ curProvider });
-  // providerResolver lets the host supply per-tenant LLM credentials (the AI
-  // Providers screen). Null keeps the environment-only behaviour.
-  const costAnalysisService = new CostAnalysisService({ contextService, dataService: costAnalysisDataService, repository: costAnalysisRepository, logger, providerResolver });
-  const costAnalysisReportService = new CostAnalysisReportService({ contextService, repository: costAnalysisReportRepository, analysisService: costAnalysisService });
-  const costAnalysisReportWorker = new CostAnalysisReportWorker({ repository: costAnalysisReportRepository, analysisService: costAnalysisService, logger });
-  const costAnalysisController = new CostAnalysisController({ service: costAnalysisService, reportService: costAnalysisReportService });
+  const costAnalyserService = new CostAnalyserService({ contextService, athenaContextService, providerResolver, logger });
+  const artifactService = new CostReportArtifactService();
+  const costAnalysisReportService = new CostAnalysisReportService({ contextService, repository: costAnalysisReportRepository, artifactService });
+  const costAnalysisReportWorker = new CostAnalysisReportWorker({ repository: costAnalysisReportRepository, analyserService: costAnalyserService, logger });
+  const costAnalysisController = new CostAnalysisController({ service: costAnalyserService, reportService: costAnalysisReportService });
   const router = createCostRouter({ costController, budgetController, costAnalysisController }, logger);
   let mounted = false;
 
   return {
     async install() {
       await installCostBudgetSchema(db, qSchema);
-      await installCostAnalysisSchema(db, qSchema);
       await installCostAnalysisReportSchema(db, qSchema);
       await installCurDiscoverySchema(db, qSchema);
       logger.log?.("[Cost] Database migration verified");

package/src/repositories/aws-onboarding.repository.js

@@ -24,9 +24,10 @@ export class AwsOnboardingRepository {
 
     const connection = rows(await this.db.execute(sql`
       SELECT
-        connection_id,
-        role_arn,
-        external_id
+        connection_id,
+        role_arn,
+        external_id,
+        management_account_id
       FROM ${sql.raw(this.connectionsTable)}
       WHERE tenant_id::text = ${tenant}
         AND status = 'CONNECTED'
@@ -72,7 +73,8 @@ export class AwsOnboardingRepository {
         status: item.status,
       })),
       meta: {
-        payerRoleArn: connection.role_arn,
+        payerRoleArn: connection.role_arn,
+        managementAccountId: connection.management_account_id,
         externalId: connection.external_id,
         connectionId: connection.connection_id,
         curExportArn: curConfig.export_arn,

package/src/repositories/cost-analysis-report.repository.js

@@ -71,6 +71,23 @@ export class CostAnalysisReportRepository {
     return rows(await this.db.execute(sql`UPDATE ${sql.raw(this.reports)} SET status = 'RUNNING', attempt_count = attempt_count + 1, started_at = now(), error = NULL, updated_at = now() WHERE id = ${id} AND status = 'PENDING' RETURNING *`))[0] || null;
   }
 
+  async setTaskArn(id, taskArn) {
+    await this.db.execute(sql`UPDATE ${sql.raw(this.reports)} SET ecs_task_arn = ${taskArn}, updated_at = now() WHERE id = ${id}`);
+  }
+
+  async completeExternal(id, result) {
+    await this.db.execute(sql`
+      UPDATE ${sql.raw(this.reports)} SET status = 'COMPLETED', ecs_task_arn = ${result.taskArn},
+        model_id = ${result.modelId}, provider_name = ${result.provider}, provider_source = ${result.source},
+        data_source = ${result.dataSource}, facts = ${JSON.stringify(result.facts || {})}::jsonb,
+        result = ${JSON.stringify(result.summary || {})}::jsonb, artifact_bucket = ${result.artifactBucket},
+        markdown_key = ${result.markdownKey}, markdown_size = ${Number(result.markdownSize || 0)},
+        pdf_key = ${result.pdfKey}, pdf_size = ${Number(result.pdfSize || 0)}, pdf_data = NULL,
+        completed_at = now(), updated_at = now()
+      WHERE id = ${id}
+    `);
+  }
+
   async complete(id, analysis, pdf) {
     await this.db.execute(sql`
       UPDATE ${sql.raw(this.reports)} SET status = 'COMPLETED', model_id = ${analysis.modelId}, data_source = ${analysis.dataSource || null},
@@ -82,13 +99,14 @@ export class CostAnalysisReportRepository {
   }
 
   async fail(id, error) {
-    await this.db.execute(sql`UPDATE ${sql.raw(this.reports)} SET status = 'FAILED', error = ${String(error?.message || error).slice(0, 2000)}, completed_at = now(), updated_at = now() WHERE id = ${id}`);
+    await this.db.execute(sql`UPDATE ${sql.raw(this.reports)} SET status = 'FAILED', ecs_task_arn = COALESCE(${error?.taskArn || null}, ecs_task_arn), error = ${String(error?.message || error).slice(0, 2000)}, completed_at = now(), updated_at = now() WHERE id = ${id}`);
   }
 
   async list(tenantId, limit = 100) {
     return rows(await this.db.execute(sql`
       SELECT id, schedule_frequency, scheduled_for, period_start, period_end, status,
-             attempt_count, model_id, data_source, facts, result, pdf_size, error,
+             attempt_count, model_id, provider_name, provider_source, data_source, facts, result, artifact_bucket,
+             markdown_key, markdown_size, pdf_key, pdf_size, error,
              started_at, completed_at, created_at
       FROM ${sql.raw(this.reports)} WHERE tenant_id = ${tenantId}
       ORDER BY scheduled_for DESC LIMIT ${Math.min(Math.max(Number(limit) || 100, 1), 250)}
@@ -101,7 +119,8 @@ export class CostAnalysisReportRepository {
     }
     return rows(await this.db.execute(sql`
       SELECT id, schedule_frequency, scheduled_for, period_start, period_end, status,
-             attempt_count, model_id, data_source, facts, result, pdf_size, error,
+             attempt_count, model_id, provider_name, provider_source, data_source, facts, result, artifact_bucket,
+             markdown_key, markdown_size, pdf_key, pdf_size, error,
              started_at, completed_at, created_at
       FROM ${sql.raw(this.reports)} WHERE tenant_id = ${tenantId} AND id = ${id} LIMIT 1
     `))[0] || null;

package/src/routes/index.js

@@ -16,6 +16,7 @@ export function createCostRouter({ costController, budgetController, costAnalysi
   router.get("/analysis/reports", costAnalysisController.reports.bind(costAnalysisController));
   router.get("/analysis/reports/:id", costAnalysisController.report.bind(costAnalysisController));
   router.get("/analysis/reports/:id/pdf", costAnalysisController.downloadPdf.bind(costAnalysisController));
+  router.get("/analysis/reports/:id/markdown", costAnalysisController.downloadMarkdown.bind(costAnalysisController));
   router.get("/budgets", budgetController.list.bind(budgetController));
   router.post("/budgets", budgetController.create.bind(budgetController));
   router.delete("/budgets/:id", budgetController.delete.bind(budgetController));

package/src/schema/cost-analysis-report.schema.js

@@ -26,11 +26,18 @@ export async function installCostAnalysisReportSchema(db, qSchema) {
     status text NOT NULL DEFAULT 'PENDING' CHECK (status IN ('PENDING', 'RUNNING', 'COMPLETED', 'FAILED')),
     attempt_count integer NOT NULL DEFAULT 0,
     model_id text,
+    provider_name text,
+    provider_source text,
     data_source text,
     facts jsonb,
     result jsonb,
     pdf_data bytea,
     pdf_size integer,
+    ecs_task_arn text,
+    artifact_bucket text,
+    markdown_key text,
+    markdown_size integer,
+    pdf_key text,
     error text,
     started_at timestamptz,
     completed_at timestamptz,
@@ -40,4 +47,11 @@ export async function installCostAnalysisReportSchema(db, qSchema) {
   )`));
   await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS cost_ai_reports_tenant_created_idx ON ${qSchema}.cost_ai_reports (tenant_id, created_at DESC)`));
   await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS cost_ai_reports_status_idx ON ${qSchema}.cost_ai_reports (status, created_at)`));
+  await db.execute(sql.raw(`ALTER TABLE ${qSchema}.cost_ai_reports ADD COLUMN IF NOT EXISTS ecs_task_arn text`));
+  await db.execute(sql.raw(`ALTER TABLE ${qSchema}.cost_ai_reports ADD COLUMN IF NOT EXISTS artifact_bucket text`));
+  await db.execute(sql.raw(`ALTER TABLE ${qSchema}.cost_ai_reports ADD COLUMN IF NOT EXISTS markdown_key text`));
+  await db.execute(sql.raw(`ALTER TABLE ${qSchema}.cost_ai_reports ADD COLUMN IF NOT EXISTS markdown_size integer`));
+  await db.execute(sql.raw(`ALTER TABLE ${qSchema}.cost_ai_reports ADD COLUMN IF NOT EXISTS pdf_key text`));
+  await db.execute(sql.raw(`ALTER TABLE ${qSchema}.cost_ai_reports ADD COLUMN IF NOT EXISTS provider_name text`));
+  await db.execute(sql.raw(`ALTER TABLE ${qSchema}.cost_ai_reports ADD COLUMN IF NOT EXISTS provider_source text`));
 }