@meyicloud/meyi-cost-server 1.6.0 → 1.7.0

package/AGENTS.md

@@ -3,7 +3,7 @@
 ## Scope
 
 This package is a tenant-aware Express plugin for AWS cost overview, reports,
-budgets, alert dismissals, Cost Explorer, and optional CUR/Athena data. It is
+budgets, alert dismissals, and mandatory CUR/Athena data. It is
 designed to be mounted inside a host backend; it does not own login, tenant
 onboarding, or the host plugin registry.
 
@@ -20,7 +20,7 @@ insight-cost-server/
 |   |-- routes/               # Express paths and common error handling
 |   |-- models/               # Immutable customer, SaaS CUR, and status models
 |   |-- repositories/         # Tenant-scoped onboarding persistence reads
-|   |-- services/             # Cost Explorer, SaaS Athena, context, budgets
+|   |-- services/             # CUR/Athena, external analyser, context, budgets
 |   |-- schema/               # Plugin-owned database tables and installation
 |   |-- lib/                  # Stateless date, cost, and filter helpers
 |   `-- plugin.js             # Dependency composition and lifecycle

package/README.md

@@ -32,7 +32,7 @@ and AWS onboarding. The plugin owns cost routes and its budget-related tables.
 - User-, tenant-, month-, and status-scoped budget-alert dismissals
 - Tenant-configurable daily, weekly, and monthly AI report schedules
 - PostgreSQL-backed background report jobs with failure history
-- Server-generated PDF reports available through tenant-scoped downloads
+- Analyser-generated Markdown and PDF reports available through tenant-scoped downloads
 
 Budgets are application rules stored in PostgreSQL; they are not AWS Budgets
 resources. The consuming application evaluates them against current cost and
@@ -97,7 +97,7 @@ For a local package installation test:
 
 ```bash
 npm pack
-npm install /path/to/meyicloud-meyi-cost-server-1.5.0.tgz
+npm install /path/to/meyicloud-meyi-cost-server-1.6.0.tgz
 ```
 
 ## Publish to npm
@@ -290,8 +290,7 @@ a restarted task can resume future work without relying on in-memory timers.
 | `COST_AI_ANALYSER_SUBNETS` | Empty | When enabled | Comma-separated private subnet IDs. |
 | `COST_AI_ANALYSER_SECURITY_GROUPS` | Empty | When enabled | Comma-separated task security groups. |
 | `COST_AI_ANALYSER_REPORT_BUCKET` | Empty | When enabled | Private S3 Markdown/PDF artifact bucket. |
-| `COST_AI_ANALYSER_BEDROCK_REGION` | Empty | When enabled | Bedrock region passed to the analyser task. |
-| `COST_AI_ANALYSER_BEDROCK_MODEL_ID` | Empty | When enabled | Model passed only to the analyser task. |
+| `COST_AI_ANALYSER_PROVIDER_SECRET_PREFIX` | Empty | When enabled | Prefix for temporary Secrets Manager entries containing each tenant's active Meyi Connect AI provider configuration. |
 | `COST_AI_ANALYSER_TARGET_REGIONS` | `AWS_REGION` | No | Customer regions inspected for resource detail. |
 | `COST_AI_ANALYSER_TOP_N_SERVICES` | `10` | No | Maximum high-cost service agents run per report. |
 | `COST_AI_ANALYSER_POLL_INTERVAL_MS` | `15000` | No | ECS task status polling interval. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meyicloud/meyi-cost-server",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Tenant-aware AWS CUR and Athena cost plugin server for MeyiConnect",
   "type": "module",
   "main": "./index.js",
@@ -22,6 +22,7 @@
     "@aws-sdk/client-ecs": "^3.850.0",
     "@aws-sdk/client-glue": "^3.850.0",
     "@aws-sdk/client-s3": "^3.850.0",
+    "@aws-sdk/client-secrets-manager": "^3.850.0",
     "@aws-sdk/client-sts": "^3.850.0",
     "@aws-sdk/credential-providers": "^3.850.0",
     "drizzle-orm": "^0.44.7",

package/src/plugin.js

@@ -24,7 +24,7 @@ import { CurDiscoveryService } from "./cur-discovery/cur-discovery.service.js";
 import { CurDiscoveryWorker } from "./cur-discovery/cur-discovery.worker.js";
 import { safeSchema } from "./lib/cost-utils.js";
 
-export function createInsightCost({ app, db, apiBaseUri = "/api/v1", logger = console } = {}) {
+export function createInsightCost({ app, db, apiBaseUri = "/api/v1", logger = console, providerResolver = null } = {}) {
   if (!db) throw new Error("db is required");
   const schema = safeSchema(process.env.DB_SCHEMA || "meyiconnect");
   const qSchema = `"${schema}"`;
@@ -51,7 +51,7 @@ export function createInsightCost({ app, db, apiBaseUri = "/api/v1", logger = co
   const discoveryWorker = new CurDiscoveryWorker({ repository: discoveryRepository, service: discoveryService, logger });
   const costController = new CostController({ contextService, curProvider, discoveryRepository, logger });
   const budgetController = new BudgetController({ contextService, budgetService, budgetAlertService });
-  const costAnalyserService = new CostAnalyserService({ contextService, athenaContextService, logger });
+  const costAnalyserService = new CostAnalyserService({ contextService, athenaContextService, providerResolver, logger });
   const artifactService = new CostReportArtifactService();
   const costAnalysisReportService = new CostAnalysisReportService({ contextService, repository: costAnalysisReportRepository, artifactService });
   const costAnalysisReportWorker = new CostAnalysisReportWorker({ repository: costAnalysisReportRepository, analyserService: costAnalyserService, logger });

package/src/repositories/cost-analysis-report.repository.js

@@ -78,7 +78,8 @@ export class CostAnalysisReportRepository {
   async completeExternal(id, result) {
     await this.db.execute(sql`
       UPDATE ${sql.raw(this.reports)} SET status = 'COMPLETED', ecs_task_arn = ${result.taskArn},
-        model_id = ${result.modelId}, data_source = ${result.dataSource}, facts = ${JSON.stringify(result.facts || {})}::jsonb,
+        model_id = ${result.modelId}, provider_name = ${result.provider}, provider_source = ${result.source},
+        data_source = ${result.dataSource}, facts = ${JSON.stringify(result.facts || {})}::jsonb,
         result = ${JSON.stringify(result.summary || {})}::jsonb, artifact_bucket = ${result.artifactBucket},
         markdown_key = ${result.markdownKey}, markdown_size = ${Number(result.markdownSize || 0)},
         pdf_key = ${result.pdfKey}, pdf_size = ${Number(result.pdfSize || 0)}, pdf_data = NULL,
@@ -104,7 +105,7 @@ export class CostAnalysisReportRepository {
   async list(tenantId, limit = 100) {
     return rows(await this.db.execute(sql`
       SELECT id, schedule_frequency, scheduled_for, period_start, period_end, status,
-             attempt_count, model_id, data_source, facts, result, artifact_bucket,
+             attempt_count, model_id, provider_name, provider_source, data_source, facts, result, artifact_bucket,
              markdown_key, markdown_size, pdf_key, pdf_size, error,
              started_at, completed_at, created_at
       FROM ${sql.raw(this.reports)} WHERE tenant_id = ${tenantId}
@@ -118,7 +119,7 @@ export class CostAnalysisReportRepository {
     }
     return rows(await this.db.execute(sql`
       SELECT id, schedule_frequency, scheduled_for, period_start, period_end, status,
-             attempt_count, model_id, data_source, facts, result, artifact_bucket,
+             attempt_count, model_id, provider_name, provider_source, data_source, facts, result, artifact_bucket,
              markdown_key, markdown_size, pdf_key, pdf_size, error,
              started_at, completed_at, created_at
       FROM ${sql.raw(this.reports)} WHERE tenant_id = ${tenantId} AND id = ${id} LIMIT 1

package/src/schema/cost-analysis-report.schema.js

@@ -26,6 +26,8 @@ export async function installCostAnalysisReportSchema(db, qSchema) {
     status text NOT NULL DEFAULT 'PENDING' CHECK (status IN ('PENDING', 'RUNNING', 'COMPLETED', 'FAILED')),
     attempt_count integer NOT NULL DEFAULT 0,
     model_id text,
+    provider_name text,
+    provider_source text,
     data_source text,
     facts jsonb,
     result jsonb,
@@ -50,4 +52,6 @@ export async function installCostAnalysisReportSchema(db, qSchema) {
   await db.execute(sql.raw(`ALTER TABLE ${qSchema}.cost_ai_reports ADD COLUMN IF NOT EXISTS markdown_key text`));
   await db.execute(sql.raw(`ALTER TABLE ${qSchema}.cost_ai_reports ADD COLUMN IF NOT EXISTS markdown_size integer`));
   await db.execute(sql.raw(`ALTER TABLE ${qSchema}.cost_ai_reports ADD COLUMN IF NOT EXISTS pdf_key text`));
+  await db.execute(sql.raw(`ALTER TABLE ${qSchema}.cost_ai_reports ADD COLUMN IF NOT EXISTS provider_name text`));
+  await db.execute(sql.raw(`ALTER TABLE ${qSchema}.cost_ai_reports ADD COLUMN IF NOT EXISTS provider_source text`));
 }

package/src/services/cost-analyser.service.js

@@ -5,11 +5,24 @@ import {
   StopTaskCommand,
 } from "@aws-sdk/client-ecs";
 import { GetObjectCommand, S3Client } from "@aws-sdk/client-s3";
+import {
+  CreateSecretCommand,
+  DeleteSecretCommand,
+  SecretsManagerClient,
+} from "@aws-sdk/client-secrets-manager";
 import { truthy } from "../lib/cost-utils.js";
 
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const list = (value) => String(value || "").split(",").map((item) => item.trim()).filter(Boolean);
 
+function normalizeProvider(value) {
+  const name = String(value || "").trim().toLowerCase();
+  if (name.includes("bedrock")) return "bedrock";
+  if (name.includes("anthropic") || name.includes("claude")) return "anthropic";
+  if (name.includes("openai") || name.includes("gpt")) return "openai";
+  return name;
+}
+
 function required(value, name) {
   const text = String(value || "").trim();
   if (!text) throw Object.assign(new Error(`${name} is required for external cost analysis`), { name: "CostAnalyserConfigError", statusCode: 503 });
@@ -29,9 +42,10 @@ async function bodyText(body) {
 }
 
 export class CostAnalyserService {
-  constructor({ contextService, athenaContextService, logger = console, env = process.env, ecsClient = null, s3Client = null } = {}) {
+  constructor({ contextService, athenaContextService, providerResolver = null, logger = console, env = process.env, ecsClient = null, s3Client = null, secretsClient = null } = {}) {
     this.contextService = contextService;
     this.athenaContextService = athenaContextService;
+    this.providerResolver = providerResolver;
     this.logger = logger;
     this.enabled = truthy(env.COST_AI_ENABLED);
     this.region = String(env.COST_AI_ANALYSER_REGION || env.AWS_REGION || env.AWS_DEFAULT_REGION || "us-east-1");
@@ -43,23 +57,98 @@ export class CostAnalyserService {
     this.assignPublicIp = truthy(env.COST_AI_ANALYSER_ASSIGN_PUBLIC_IP) ? "ENABLED" : "DISABLED";
     this.reportBucket = String(env.COST_AI_ANALYSER_REPORT_BUCKET || "").trim();
     this.targetRegions = String(env.COST_AI_ANALYSER_TARGET_REGIONS || env.AWS_REGION || "us-east-1").trim();
-    this.bedrockRegion = String(env.COST_AI_ANALYSER_BEDROCK_REGION || "").trim();
-    this.bedrockModelId = String(env.COST_AI_ANALYSER_BEDROCK_MODEL_ID || "").trim();
+    this.providerSecretPrefix = String(env.COST_AI_ANALYSER_PROVIDER_SECRET_PREFIX || "").trim().replace(/\/+$/, "");
     this.topServices = String(env.COST_AI_ANALYSER_TOP_N_SERVICES || "10").trim();
     this.pollMs = Math.max(Number(env.COST_AI_ANALYSER_POLL_INTERVAL_MS || 15_000), 2_000);
     this.timeoutMs = Math.max(Number(env.COST_AI_ANALYSER_TIMEOUT_MS || 45 * 60_000), 60_000);
     this.ecs = ecsClient || new ECSClient({ region: this.region });
     this.s3 = s3Client || new S3Client({ region: this.region });
+    this.secrets = secretsClient || new SecretsManagerClient({ region: this.region });
+  }
+
+  infrastructureConfigured() {
+    return Boolean(this.cluster && this.taskDefinition && this.subnets.length && this.securityGroups.length && this.reportBucket && this.providerSecretPrefix);
+  }
+
+  async resolveProvider(tenantId) {
+    if (!this.providerResolver) {
+      throw Object.assign(new Error("Meyi Connect AI provider resolution is not configured"), { name: "CostAiProviderResolverError", statusCode: 503 });
+    }
+    const resolved = await this.providerResolver(tenantId);
+    if (!resolved) {
+      throw Object.assign(new Error("Configure an active AI provider before enabling AI cost reports"), { name: "CostAiProviderNotConfiguredError", statusCode: 409 });
+    }
+    const provider = normalizeProvider(resolved.provider);
+    if (!["bedrock", "anthropic", "openai"].includes(provider)) {
+      throw Object.assign(new Error(`Unsupported AI provider "${resolved.provider}"`), { name: "CostAiProviderConfigError", statusCode: 400 });
+    }
+    const modelId = required(resolved.modelId, "active AI provider model ID");
+    if ((provider === "anthropic" || provider === "openai") && !resolved.apiKey) {
+      throw Object.assign(new Error(`${provider} requires an API key in the active AI provider`), { name: "CostAiProviderConfigError", statusCode: 400 });
+    }
+    if (provider === "bedrock" && !resolved.region) {
+      throw Object.assign(new Error("Bedrock requires an AWS region in the active AI provider"), { name: "CostAiProviderConfigError", statusCode: 400 });
+    }
+    if (Boolean(resolved.accessKeyId) !== Boolean(resolved.secretAccessKey)) {
+      throw Object.assign(new Error("The active Bedrock provider must contain both AWS access-key fields"), { name: "CostAiProviderConfigError", statusCode: 400 });
+    }
+    return { ...resolved, provider, modelId, source: "tenant-configuration" };
   }
 
-  status() {
-    const configured = Boolean(this.cluster && this.taskDefinition && this.subnets.length && this.securityGroups.length && this.reportBucket && this.bedrockModelId);
+  async status(req) {
+    const configured = this.infrastructureConfigured();
+    if (!this.enabled || !configured) {
+      return { enabled: false, providerConfigured: false, provider: null, modelId: null, region: null, source: null, reason: this.enabled ? "ANALYSER_NOT_CONFIGURED" : "COST_AI_DISABLED" };
+    }
+    try {
+      const tenantId = this.contextService.tenantId(req);
+      const provider = await this.resolveProvider(tenantId);
+      return { enabled: true, providerConfigured: true, provider: provider.provider, modelId: provider.modelId, region: provider.region || null, source: provider.source };
+    } catch (error) {
+      if (error.name !== "CostAiProviderNotConfiguredError") throw error;
+      return { enabled: false, providerConfigured: false, provider: null, modelId: null, region: null, source: null, reason: "AI_PROVIDER_REQUIRED" };
+    }
+  }
+
+  async createProviderSecret({ tenantId, reportId, provider }) {
+    const response = await this.secrets.send(new CreateSecretCommand({
+      Name: `${this.providerSecretPrefix}/${reportId}`,
+      Description: "Temporary provider configuration for one Meyi cost-analysis task",
+      SecretString: JSON.stringify({
+        provider: provider.provider,
+        modelId: provider.modelId,
+        apiKey: provider.apiKey,
+        authType: provider.authType,
+        region: provider.region,
+        accessKeyId: provider.accessKeyId,
+        secretAccessKey: provider.secretAccessKey,
+      }),
+      Tags: [
+        { Key: "Application", Value: "meyi-connect" },
+        { Key: "Component", Value: "cost-ai-analyser" },
+        { Key: "TenantId", Value: String(tenantId).slice(0, 256) },
+        { Key: "ReportId", Value: String(reportId).slice(0, 256) },
+      ],
+    }));
+    return required(response.ARN, "temporary AI provider secret ARN");
+  }
+
+  async deleteProviderSecret(secretArn) {
+    if (!secretArn) return;
+    try {
+      await this.secrets.send(new DeleteSecretCommand({ SecretId: secretArn, ForceDeleteWithoutRecovery: true }));
+    } catch (error) {
+      if (error?.name === "ResourceNotFoundException") return;
+      this.logger.error?.("[Cost AI Reports] Failed to delete temporary provider secret", { secretArn, message: error.message });
+    }
+  }
+
+  statusSummary(provider) {
     return {
-      enabled: this.enabled && configured,
-      provider: "meyi-cost-ai-analyser",
-      modelId: configured ? this.bedrockModelId : null,
-      region: configured ? this.bedrockRegion : null,
-      source: "ecs-task",
+      provider: provider.provider,
+      modelId: provider.modelId,
+      region: provider.region || null,
+      source: provider.source,
     };
   }
 
@@ -70,7 +159,7 @@ export class CostAnalyserService {
     if (!this.subnets.length) required("", "COST_AI_ANALYSER_SUBNETS");
     if (!this.securityGroups.length) required("", "COST_AI_ANALYSER_SECURITY_GROUPS");
     required(this.reportBucket, "COST_AI_ANALYSER_REPORT_BUCKET");
-    required(this.bedrockModelId, "COST_AI_ANALYSER_BEDROCK_MODEL_ID");
+    required(this.providerSecretPrefix, "COST_AI_ANALYSER_PROVIDER_SECRET_PREFIX");
   }
 
   async readJson(key) {
@@ -80,79 +169,88 @@ export class CostAnalyserService {
 
   async execute({ tenantId, reportId, range, frequency, onStarted = null }) {
     this.validate();
+    const provider = await this.resolveProvider(tenantId);
     const customer = await this.contextService.resolve({ headers: {}, user: { tenant_id: tenantId, tenantId } });
     const athena = this.athenaContextService.resolve(customer).config;
     if (!athena.enabled) throw Object.assign(new Error("CUR discovery has not produced a queryable Athena table for this tenant"), { name: "CurDataNotReadyError", statusCode: 503 });
     const targetRoleArn = required(customer.meta?.payerRoleArn, "customer TARGET_ROLE_ARN");
     const targetAccountId = required(customer.meta?.managementAccountId || customer.accounts?.[0]?.id, "customer management account ID");
     const prefix = `tenants/${tenantId}/reports/${reportId}`;
-    const values = {
-      REPORT_JOB_ID: reportId,
-      REPORT_TENANT_ID: tenantId,
-      REPORT_KEY_PREFIX: prefix,
-      REPORT_START_DATE: range.Start,
-      REPORT_END_DATE: range.End,
-      REPORT_FREQUENCY: frequency,
-      REPORT_BUCKET: this.reportBucket,
-      REPORT_BUCKET_REGION: this.region,
-      TARGET_ACCOUNT_ID: targetAccountId,
-      TARGET_ROLE_ARN: targetRoleArn,
-      TARGET_ROLE_EXTERNAL_ID: customer.meta?.externalId,
-      TARGET_REGIONS: this.targetRegions,
-      COST_CUR_DATABASE: athena.database,
-      COST_CUR_TABLE: athena.table,
-      COST_CUR_WORKGROUP: athena.workgroup,
-      COST_CUR_OUTPUT_LOCATION: athena.outputLocation,
-      COST_CUR_REGION: athena.region,
-      COST_CUR_TENANT_COLUMN: athena.tenantColumn,
-      COST_CUR_TENANT_PARTITION: athena.tenantPartition || tenantId,
-      BEDROCK_REGION: this.bedrockRegion,
-      BEDROCK_MODEL_ID: this.bedrockModelId,
-      TOP_N_SERVICES: this.topServices,
-    };
-    const launched = await this.ecs.send(new RunTaskCommand({
-      cluster: this.cluster,
-      taskDefinition: this.taskDefinition,
-      launchType: "FARGATE",
-      count: 1,
-      enableExecuteCommand: false,
-      networkConfiguration: { awsvpcConfiguration: { subnets: this.subnets, securityGroups: this.securityGroups, assignPublicIp: this.assignPublicIp } },
-      overrides: { containerOverrides: [{ name: this.containerName, environment: environment(values) }] },
-      startedBy: `meyi-cost-${reportId}`.slice(0, 36),
-    }));
-    if (launched.failures?.length || !launched.tasks?.[0]?.taskArn) {
-      const reason = launched.failures?.map((item) => item.reason || item.detail).filter(Boolean).join("; ") || "ECS did not return a task ARN";
-      throw Object.assign(new Error(`Unable to start cost analyser: ${reason}`), { name: "CostAnalyserLaunchError", statusCode: 502 });
-    }
-    const taskArn = launched.tasks[0].taskArn;
-    await onStarted?.(taskArn);
-    const deadline = Date.now() + this.timeoutMs;
-    while (Date.now() < deadline) {
-      const response = await this.ecs.send(new DescribeTasksCommand({ cluster: this.cluster, tasks: [taskArn] }));
-      const task = response.tasks?.[0];
-      if (task?.lastStatus === "STOPPED") {
-        const container = task.containers?.find((item) => item.name === this.containerName) || task.containers?.[0];
-        let status;
-        try { status = await this.readJson(`${prefix}/status.json`); } catch { status = null; }
-        if (Number(container?.exitCode ?? 1) !== 0 || status?.status !== "COMPLETED") {
-          throw Object.assign(new Error(status?.error || container?.reason || task.stoppedReason || "Cost analyser task failed"), { name: "CostAnalyserTaskError", statusCode: 502, taskArn });
+    let providerSecretArn;
+    try {
+      providerSecretArn = await this.createProviderSecret({ tenantId, reportId, provider });
+      const values = {
+        REPORT_JOB_ID: reportId,
+        REPORT_TENANT_ID: tenantId,
+        REPORT_KEY_PREFIX: prefix,
+        REPORT_START_DATE: range.Start,
+        REPORT_END_DATE: range.End,
+        REPORT_FREQUENCY: frequency,
+        REPORT_BUCKET: this.reportBucket,
+        REPORT_BUCKET_REGION: this.region,
+        TARGET_ACCOUNT_ID: targetAccountId,
+        TARGET_ROLE_ARN: targetRoleArn,
+        TARGET_ROLE_EXTERNAL_ID: customer.meta?.externalId,
+        TARGET_REGIONS: this.targetRegions,
+        COST_CUR_DATABASE: athena.database,
+        COST_CUR_TABLE: athena.table,
+        COST_CUR_WORKGROUP: athena.workgroup,
+        COST_CUR_OUTPUT_LOCATION: athena.outputLocation,
+        COST_CUR_REGION: athena.region,
+        COST_CUR_TENANT_COLUMN: athena.tenantColumn,
+        COST_CUR_TENANT_PARTITION: athena.tenantPartition || tenantId,
+        AI_PROVIDER_SECRET_ARN: providerSecretArn,
+        AI_PROVIDER_SECRET_REGION: this.region,
+        TOP_N_SERVICES: this.topServices,
+      };
+      const launched = await this.ecs.send(new RunTaskCommand({
+        cluster: this.cluster,
+        taskDefinition: this.taskDefinition,
+        launchType: "FARGATE",
+        count: 1,
+        enableExecuteCommand: false,
+        networkConfiguration: { awsvpcConfiguration: { subnets: this.subnets, securityGroups: this.securityGroups, assignPublicIp: this.assignPublicIp } },
+        overrides: { containerOverrides: [{ name: this.containerName, environment: environment(values) }] },
+        startedBy: `meyi-cost-${reportId}`.slice(0, 36),
+      }));
+      if (launched.failures?.length || !launched.tasks?.[0]?.taskArn) {
+        const reason = launched.failures?.map((item) => item.reason || item.detail).filter(Boolean).join("; ") || "ECS did not return a task ARN";
+        throw Object.assign(new Error(`Unable to start cost analyser: ${reason}`), { name: "CostAnalyserLaunchError", statusCode: 502 });
+      }
+      const taskArn = launched.tasks[0].taskArn;
+      await onStarted?.(taskArn);
+      const deadline = Date.now() + this.timeoutMs;
+      while (Date.now() < deadline) {
+        const response = await this.ecs.send(new DescribeTasksCommand({ cluster: this.cluster, tasks: [taskArn] }));
+        const task = response.tasks?.[0];
+        if (task?.lastStatus === "STOPPED") {
+          const container = task.containers?.find((item) => item.name === this.containerName) || task.containers?.[0];
+          let status;
+          try { status = await this.readJson(`${prefix}/status.json`); } catch { status = null; }
+          if (Number(container?.exitCode ?? 1) !== 0 || status?.status !== "COMPLETED") {
+            throw Object.assign(new Error(status?.error || container?.reason || task.stoppedReason || "Cost analyser task failed"), { name: "CostAnalyserTaskError", statusCode: 502, taskArn });
+          }
+          return {
+            taskArn,
+            artifactBucket: this.reportBucket,
+            markdownKey: status.markdownKey || `${prefix}/report.md`,
+            pdfKey: status.pdfKey || `${prefix}/report.pdf`,
+            ticketsKey: status.ticketsKey || `${prefix}/tickets.json`,
+            ticketCount: Number(status.summary?.ticketCount || 0),
+            markdownSize: Number(status.markdownSize || 0),
+            pdfSize: Number(status.pdfSize || 0),
+            ...this.statusSummary(provider),
+            dataSource: "AWS CUR",
+            facts: { currentTotal: Number(status.summary?.totalMonthlyCost || 0), currency: "USD" },
+            summary: status.summary || {},
+          };
         }
-        return {
-          taskArn,
-          artifactBucket: this.reportBucket,
-          markdownKey: status.markdownKey || `${prefix}/report.md`,
-          pdfKey: status.pdfKey || `${prefix}/report.pdf`,
-          markdownSize: Number(status.markdownSize || 0),
-          pdfSize: Number(status.pdfSize || 0),
-          modelId: this.bedrockModelId,
-          dataSource: "AWS CUR",
-          facts: { currentTotal: Number(status.summary?.totalMonthlyCost || 0), currency: "USD" },
-          summary: status.summary || {},
-        };
+        await sleep(this.pollMs);
       }
-      await sleep(this.pollMs);
+      await this.ecs.send(new StopTaskCommand({ cluster: this.cluster, task: taskArn, reason: "Meyi cost analysis timeout" }));
+      throw Object.assign(new Error("Cost analyser task timed out"), { name: "CostAnalyserTimeoutError", statusCode: 504, taskArn });
+    } finally {
+      await this.deleteProviderSecret(providerSecretArn);
     }
-    await this.ecs.send(new StopTaskCommand({ cluster: this.cluster, task: taskArn, reason: "Meyi cost analysis timeout" }));
-    throw Object.assign(new Error("Cost analyser task timed out"), { name: "CostAnalyserTimeoutError", statusCode: 504, taskArn });
   }
 }

package/src/services/cost-analysis-report.service.js

@@ -9,7 +9,8 @@ function reportDto(row) {
   return {
     id: row.id, frequency: row.schedule_frequency, scheduledFor: row.scheduled_for,
     period: { Start: String(row.period_start).slice(0, 10), End: String(row.period_end).slice(0, 10) },
-    status: row.status, attempts: Number(row.attempt_count || 0), modelId: row.model_id,
+    status: row.status, attempts: Number(row.attempt_count || 0), provider: row.provider_name,
+    providerSource: row.provider_source, modelId: row.model_id,
     dataSource: row.data_source, facts: row.facts || null, ...(row.result || {}),
     pdfReady: row.status === "COMPLETED" && Boolean(row.pdf_key || row.pdf_data || Number(row.pdf_size || 0) > 0),
     pdfSize: Number(row.pdf_size || 0), error: row.error, startedAt: row.started_at,