@pagopa/dx-savemoney 0.4.0 → 0.6.1

package/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAE/E,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,wEAAwE;IACxE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACjC,iGAAiG;IACjG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,0BAA0B,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,6EAA6E;IAC7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACjC,iFAAiF;IACjF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,qGAAqG;IACrG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,4BAA4B,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,2GAA2G;IAC3G,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3C,wFAAwF;IACxF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IAC3C,+GAA+G;IAC/G,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,uBAAuB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,sFAAsF;IACtF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,oGAAoG;IACpG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,0BAA0B,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACxC,+EAA+E;IAC/E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,gFAAgF;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,UAAU,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAChE,0BAA0B,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAC1C;IACD,YAAY,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CACpE,4BAA4B,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAC5C;IACD,QAAQ,EAAE,wBAAwB,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5D,wBAAwB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CACxC;IACD,UAAU,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAChE,0BAA0B,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAC1C;IACD,OAAO,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1D,uBAAuB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CACvC;IACD,EAAE,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAChD,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAClC;CACF,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,gFAAgF;AAEhF,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,CAAC;IACN;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;IACnD;;;;OAIG;IACH,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;SACpC,QAAQ,EAAE;SACV,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACjC,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CACF,CAAC,EACD,wEAAwE,CACzE;IACH,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAChC;IACD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACtD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAE/E,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,wEAAwE;IACxE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACjC,iGAAiG;IACjG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,0BAA0B,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,6EAA6E;IAC7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACjC,iFAAiF;IACjF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,qGAAqG;IACrG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,4BAA4B,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,2GAA2G;IAC3G,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3C,wFAAwF;IACxF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IAC3C,+GAA+G;IAC/G,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,uBAAuB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,sFAAsF;IACtF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,oGAAoG;IACpG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,0BAA0B,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACxC,+EAA+E;IAC/E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,gFAAgF;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,UAAU,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAChE,0BAA0B,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAC1C;IACD,YAAY,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CACpE,4BAA4B,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAC5C;IACD,QAAQ,EAAE,wBAAwB,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5D,wBAAwB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CACxC;IACD,UAAU,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAChE,0BAA0B,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAC1C;IACD,OAAO,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1D,uBAAuB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CACvC;IACD,EAAE,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAChD,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAClC;CACF,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,gFAAgF;AAEhF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAU,CAAC;AAElE,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEtD,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,CAAC;IACN;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;IACnD;;;;OAIG;IACH,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC;SAC1B,IAAI,CAAC,iBAAiB,CAAC;SACvB,OAAO,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC;IACpC,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CACF,CAAC,EACD,wEAAwE,CACzE;IACH,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAChC;IACD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACtD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/dx-savemoney",
-  "version": "0.4.0",
+  "version": "0.6.1",
   "type": "module",
   "description": "Azure resource analyzer for finding unused or cost-inefficient resources.",
   "repository": {
@@ -38,19 +38,19 @@
     "@logtape/logtape": "^1.3.11",
     "cli-table3": "^0.6.5",
     "js-yaml": "^4.3.0",
-    "p-limit": "^7.3.0",
+    "p-limit": "^7.3.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@tsconfig/node24": "24.0.4",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^22.20.0",
-    "@vitest/coverage-v8": "^4.1.9",
-    "eslint": "^10.6.0",
-    "prettier": "3.8.3",
+    "@types/node": "^22.20.1",
+    "@vitest/coverage-v8": "^4.1.10",
+    "eslint": "^10.8.0",
+    "prettier": "3.9.6",
     "typescript": "~5.9.3",
-    "vitest": "^4.1.9",
-    "@pagopa/eslint-config": "^6.2.0"
+    "vitest": "^4.1.10",
+    "@pagopa/eslint-config": "^6.2.2"
   },
   "scripts": {
     "build": "rm -rf dist && tsc",

package/src/azure/__tests__/azqr.test.ts

@@ -0,0 +1,238 @@
+/**
+ * Tests for the AZQR ingestion module.
+ *
+ * Cover the behaviours CES-2192 requires:
+ * 1. `parseAzqrReport` validates the JSON shape (accept valid, reject invalid).
+ * 2. `isAzqrReportMasked` detects AZQR's default subscription-ID masking.
+ * 3. `classifyAzqrRow` / `azqrImpactedToFindings` promote billable waste as
+ *    `cost`, orphaned free resources as `cleanup` candidates, and drop
+ *    security / reliability / best-practice noise.
+ * 4. Impact → severity mapping and inventory enrichment.
+ */
+
+import { describe, expect, it } from "vitest";
+
+import {
+  type AzqrImpactedRow,
+  azqrImpactedToFindings,
+  classifyAzqrRow,
+  isAzqrReportMasked,
+  parseAzqrReport,
+} from "../azqr.js";
+
+const REAL_SUB = "ec285037-c673-4f58-b594-d7c480da4e8b";
+const MASKED_SUB = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxx0da4e8b";
+
+function impactedRow(
+  overrides: Partial<AzqrImpactedRow> = {},
+): AzqrImpactedRow {
+  return {
+    category: "Security",
+    impact: "Medium",
+    recommendation: "Some best practice",
+    resourceId: resourceId(
+      REAL_SUB,
+      "microsoft.network/networksecuritygroups",
+      "nsg",
+    ),
+    resourceType: "microsoft.network/networksecuritygroups",
+    source: "APRL",
+    ...overrides,
+  };
+}
+
+/** An orphaned (AOR) resource row of the given type. */
+function orphanRow(
+  resourceType: string,
+  overrides: Partial<AzqrImpactedRow> = {},
+): AzqrImpactedRow {
+  return impactedRow({
+    category: "Governance",
+    resourceId: resourceId(REAL_SUB, resourceType, "res"),
+    resourceType,
+    source: "AOR",
+    ...overrides,
+  });
+}
+
+function resourceId(sub: string, type: string, name: string): string {
+  return `/subscriptions/${sub}/resourcegroups/rg/providers/${type}/${name}`;
+}
+
+describe("parseAzqrReport", () => {
+  it("accepts a valid report and defaults missing arrays", () => {
+    const report = parseAzqrReport({ impacted: [impactedRow()] });
+    expect(report.impacted).toHaveLength(1);
+    expect(report.inventory).toEqual([]);
+  });
+
+  it("strips unknown top-level sections", () => {
+    const report = parseAzqrReport({
+      advisor: [{ anything: true }],
+      impacted: [],
+      recommendations: [{ foo: "bar" }],
+    });
+    expect(report.impacted).toEqual([]);
+  });
+
+  it("throws with a cause when an impacted row misses required fields", () => {
+    expect(() => parseAzqrReport({ impacted: [{ impact: "High" }] })).toThrow(
+      /Invalid AZQR report/,
+    );
+  });
+});
+
+describe("isAzqrReportMasked", () => {
+  it("detects masked subscription IDs in resource IDs", () => {
+    const report = parseAzqrReport({
+      impacted: [
+        impactedRow({
+          resourceId: resourceId(
+            MASKED_SUB,
+            "microsoft.network/publicipaddresses",
+            "pip",
+          ),
+        }),
+      ],
+    });
+    expect(isAzqrReportMasked(report)).toBe(true);
+  });
+
+  it("returns false when IDs carry the real subscription GUID", () => {
+    const report = parseAzqrReport({ impacted: [impactedRow()] });
+    expect(isAzqrReportMasked(report)).toBe(false);
+  });
+});
+
+describe("classifyAzqrRow", () => {
+  it("classifies rows AZQR categorises as Cost as cost", () => {
+    expect(classifyAzqrRow(impactedRow({ category: "Cost" }))).toBe("cost");
+  });
+
+  it("classifies orphaned billable resources as cost", () => {
+    expect(
+      classifyAzqrRow(
+        orphanRow("microsoft.network/publicipaddresses", {
+          recommendation: "Public IPs not attached to any resource",
+        }),
+      ),
+    ).toBe("cost");
+  });
+
+  it("classifies orphaned free resources (NSG, subnet, …) as cleanup", () => {
+    expect(
+      classifyAzqrRow(
+        orphanRow("microsoft.network/networksecuritygroups", {
+          recommendation:
+            "Network Security Groups not attached to any network interface or subnet",
+        }),
+      ),
+    ).toBe("cleanup");
+  });
+
+  it("drops non-orphan security / reliability best-practice rows", () => {
+    expect(
+      classifyAzqrRow(
+        impactedRow({
+          category: "Security",
+          recommendation: "Enable diagnostic settings",
+          resourceType: "microsoft.web/serverfarms",
+        }),
+      ),
+    ).toBeNull();
+  });
+
+  it("does not promote orphan-sounding text unless the AOR source tags it", () => {
+    expect(
+      classifyAzqrRow(
+        impactedRow({
+          category: "Governance",
+          recommendation: "Public IPs not attached to any resource",
+          resourceType: "microsoft.network/publicipaddresses",
+          source: "APRL",
+        }),
+      ),
+    ).toBeNull();
+  });
+});
+
+describe("azqrImpactedToFindings", () => {
+  it("maps billable orphans to cost findings and drops non-orphan noise", () => {
+    const report = parseAzqrReport({
+      impacted: [
+        orphanRow("microsoft.web/serverfarms", {
+          impact: "High",
+          recommendation: "App Service plans without hosting Apps",
+          recommendationId: "app-service-empty",
+          resourceId: resourceId(REAL_SUB, "microsoft.web/serverfarms", "asp"),
+        }),
+        impactedRow(), // non-orphan APRL noise → dropped
+      ],
+    });
+
+    const findings = azqrImpactedToFindings(report);
+
+    expect(findings).toHaveLength(1);
+    expect(findings[0]).toMatchObject({
+      category: "cost",
+      code: "azqr.app-service-empty",
+      severity: "high",
+      source: "azqr",
+    });
+    expect(findings[0].estimatedMonthlySavings).toBeUndefined();
+    expect(findings[0].recommendedAction).toContain("Review the resource");
+  });
+
+  it("maps orphaned free resources to low-severity cleanup candidates", () => {
+    const report = parseAzqrReport({
+      impacted: [
+        orphanRow("microsoft.network/virtualnetworks", {
+          impact: "Medium",
+          recommendation: "Subnets without Connected Devices or Delegation",
+          recommendationId: "empty-subnet",
+        }),
+      ],
+    });
+
+    const [finding] = azqrImpactedToFindings(report);
+    expect(finding).toMatchObject({
+      category: "operationalExcellence",
+      code: "azqr.empty-subnet",
+      severity: "low",
+      source: "azqr",
+    });
+    expect(finding.recommendedAction).toContain("no direct cost");
+  });
+
+  it("enriches the reason with inventory SKU / location when available", () => {
+    const id = resourceId(REAL_SUB, "microsoft.network/natgateways", "nat");
+    const report = parseAzqrReport({
+      impacted: [
+        orphanRow("microsoft.network/natgateways", {
+          recommendation: "NAT Gateways not attached to any subnet",
+          resourceId: id,
+        }),
+      ],
+      inventory: [
+        { location: "italynorth", resourceId: id, skuName: "Standard" },
+      ],
+    });
+
+    const [finding] = azqrImpactedToFindings(report);
+    expect(finding.reason).toContain("Standard");
+    expect(finding.reason).toContain("italynorth");
+  });
+
+  it("defaults severity to low for unknown impact on cost rows", () => {
+    const report = parseAzqrReport({
+      impacted: [
+        impactedRow({
+          category: "Cost",
+          impact: undefined,
+          resourceType: "microsoft.compute/disks",
+        }),
+      ],
+    });
+    expect(azqrImpactedToFindings(report)[0].severity).toBe("low");
+  });
+});

package/src/azure/__tests__/config.test.ts

@@ -8,7 +8,9 @@
 
 import path from "path";
 import { fileURLToPath } from "url";
-import { describe, expect, it } from "vitest";
+import { afterEach, describe, expect, expectTypeOf, it, vi } from "vitest";
+
+import type { AzureConfig, AzureSource } from "../../index.js";
 
 import { loadConfig } from "../../index.js";
 import { ConfigSchema } from "../../schema.js";
@@ -24,6 +26,10 @@ const FIXTURE_PARTIAL = path.resolve(
 const FIXTURE_FULL = path.resolve(__dirname, "fixtures/full-override.yaml");
 
 describe("loadConfig", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
   it("throws when explicit path does not exist", async () => {
     await expect(loadConfig("/nonexistent/config.yaml")).rejects.toThrow(
       "Config file not found",
@@ -33,11 +39,24 @@ describe("loadConfig", () => {
   it("loads subscriptionIds and defaults from a partial YAML file", async () => {
     const result = await loadConfig(FIXTURE_PARTIAL);
 
+    expectTypeOf<AzureConfig["sources"]>().toEqualTypeOf<
+      [AzureSource, ...AzureSource[]]
+    >();
     expect(result.subscriptionIds).toEqual([
       "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
     ]);
     expect(result.preferredLocation).toBe("italynorth");
+    expect(result.sources).toEqual(["advisor", "custom"]);
     expect(result.timespanDays).toBe(30);
+    expect(result.azqrReportPath).toBeUndefined();
+  });
+
+  it("applies sources defaults when loading from the environment", async () => {
+    vi.stubEnv("ARM_SUBSCRIPTION_ID", "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx");
+
+    const result = await loadConfig();
+
+    expect(result.sources).toEqual(["advisor", "custom"]);
   });
 
   it("loads partial threshold overrides and keeps defaults for missing fields", async () => {
@@ -70,7 +89,9 @@ describe("loadConfig", () => {
 
     expect(result.subscriptionIds).toHaveLength(2);
     expect(result.preferredLocation).toBe("westeurope");
+    expect(result.sources).toEqual(["custom"]);
     expect(result.timespanDays).toBe(60);
+    expect(result.azqrReportPath).toBe("./azqr_action_plan.json");
 
     expect(result.thresholds?.vm.cpuPercent).toBe(5);
     expect(result.thresholds?.vm.networkInBytesPerDay).toBe(10485760);
@@ -96,6 +117,17 @@ describe("loadConfig", () => {
     expect(result.thresholds).toHaveProperty("staticSite");
   });
 
+  it("rejects an empty sources list", () => {
+    const result = ConfigSchema.safeParse({
+      azure: {
+        sources: [],
+        subscriptionIds: ["xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"],
+      },
+    });
+
+    expect(result.success).toBe(false);
+  });
+
   it("does not expose pricing settings in YAML config", () => {
     const result = ConfigSchema.safeParse({
       azure: {

package/src/azure/__tests__/fixtures/full-override.yaml

@@ -3,6 +3,9 @@ azure:
     - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
     - yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy
   preferredLocation: westeurope
+  azqrReportPath: ./azqr_action_plan.json
+  sources:
+    - custom
   timespanDays: 60
   thresholds:
     vm:

package/src/azure/analyzer.ts

@@ -32,11 +32,7 @@ import { getLogger } from "@logtape/logtape";
 import pLimit from "p-limit";
 
 import type { Finding } from "../finding.js";
-import type {
-  AzureConfig,
-  AzureDetailedResourceReport,
-  AzureSource,
-} from "./types.js";
+import type { AzureConfig, AzureDetailedResourceReport } from "./types.js";
 
 import { findingsFromAnalysisResult } from "../finding.js";
 import {
@@ -54,11 +50,15 @@ import {
   createDefaultSubscriptionAnalyzers,
   type SubscriptionAnalyzer,
 } from "./analyzers/index.js";
+import {
+  azqrImpactedToFindings,
+  isAzqrReportMasked,
+  loadAzqrReport,
+} from "./azqr.js";
 import { PricingClient, PricingService } from "./pricing/index.js";
 import { matchesTags, type MetricsCache } from "./utils.js";
 
 const DEFAULT_CONCURRENCY = 8;
-const DEFAULT_SOURCES: AzureSource[] = ["advisor", "custom"];
 
 const RISK_ORDER: Record<CostRisk, number> = { high: 0, low: 2, medium: 1 };
 
@@ -86,9 +86,8 @@ export async function analyzeAzureResources(
   const credential = new DefaultAzureCredential();
   const allReports: AzureDetailedResourceReport[] = [];
 
-  const sources = config.sources ?? DEFAULT_SOURCES;
-  const customEnabled = sources.includes("custom");
-  const advisorEnabled = sources.includes("advisor");
+  const customEnabled = config.sources.includes("custom");
+  const advisorEnabled = config.sources.includes("advisor");
 
   const analyzers = createDefaultAnalyzers();
   const subscriptionAnalyzers = advisorEnabled
@@ -179,6 +178,12 @@ export async function analyzeAzureResources(
     }
   }
 
+  // Ingest an AZQR (`azqr scan --json`) report when provided, merging its
+  // FinOps-relevant `impacted` rows into the aggregated reports as findings.
+  if (config.azqrReportPath) {
+    await ingestAzqrReport(config.azqrReportPath, allReports, logger);
+  }
+
   // Sort to make the output more readable:
   //  - Subscription-scoped findings (Reserved Instances, savings plans, ...)
   //    sink to the bottom: they aggregate many recommendations into a single
@@ -439,6 +444,42 @@ function hasTagFilter(filterTags: Map<string, string> | undefined): boolean {
   return Boolean(filterTags && filterTags.size > 0);
 }
 
+/**
+ * Loads an AZQR report, filters it down to FinOps opportunities and merges the
+ * resulting findings into the aggregated reports. Runs once per invocation
+ * (the report is subscription-agnostic), building a global index from every
+ * report collected during the live scan so AZQR findings attach to their
+ * resource when present or create a stub otherwise.
+ *
+ * When the report is still masked, findings cannot match live resource IDs, so
+ * a warning advises re-running AZQR with `--mask=false`.
+ */
+async function ingestAzqrReport(
+  azqrReportPath: string,
+  reports: AzureDetailedResourceReport[],
+  logger: ReturnType<typeof getLogger>,
+): Promise<void> {
+  const report = await loadAzqrReport(azqrReportPath);
+  if (isAzqrReportMasked(report)) {
+    logger.warn(
+      "AZQR report has masked subscription IDs: findings may not match live" +
+        " resources and can appear as separate stub entries. Re-run with" +
+        " `azqr scan --mask=false` for accurate merging.",
+    );
+  }
+
+  const findings = azqrImpactedToFindings(report);
+  const reportsById = new Map<string, AzureDetailedResourceReport>(
+    reports.map((r) => [(r.resource.id ?? "").toLowerCase(), r]),
+  );
+  for (const finding of findings) {
+    mergeFinding(finding, reports, reportsById);
+  }
+  logger.info(
+    `AZQR: merged ${findings.length} finding(s) from ${azqrReportPath}`,
+  );
+}
+
 function isResourceScopedFinding(resourceId: string): boolean {
   return /\/providers\//i.test(resourceId);
 }

package/src/azure/analyzers/advisor.ts

@@ -111,8 +111,7 @@ export function createAdvisorAnalyzer(clientFactory?: {
         if (rec.category?.toLowerCase() !== "cost") continue;
         const rawResourceId = rec.resourceMetadata?.resourceId;
         const props = rec.extendedProperties as
-          | Record<string, string>
-          | undefined;
+          Record<string, string> | undefined;
         const savings = parseSavings(props);
         if (rawResourceId && /\/providers\//i.test(rawResourceId)) {
           resourceFindings.push(