@pagopa/dx-savemoney 0.5.0 → 0.6.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/dx-savemoney",
-  "version": "0.5.0",
+  "version": "0.6.2",
   "type": "module",
   "description": "Azure resource analyzer for finding unused or cost-inefficient resources.",
   "repository": {
@@ -38,25 +38,18 @@
     "@logtape/logtape": "^1.3.11",
     "cli-table3": "^0.6.5",
     "js-yaml": "^4.3.0",
-    "p-limit": "^7.3.0",
+    "p-limit": "^7.3.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@tsconfig/node24": "24.0.4",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^22.20.0",
-    "@vitest/coverage-v8": "^4.1.9",
-    "eslint": "^10.6.0",
-    "prettier": "3.8.3",
+    "@types/node": "^22.20.1",
+    "@vitest/coverage-v8": "^4.1.10",
+    "eslint": "^10.8.0",
+    "prettier": "3.9.6",
     "typescript": "~5.9.3",
-    "vitest": "^4.1.9",
-    "@pagopa/eslint-config": "^6.2.0"
-  },
-  "scripts": {
-    "build": "rm -rf dist && tsc",
-    "dev": "tsc --watch",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
-    "test:coverage": "vitest run --coverage"
+    "vitest": "^4.1.10",
+    "@pagopa/eslint-config": "^6.2.2"
   }
 }

package/src/azure/__tests__/azqr.test.ts

@@ -0,0 +1,238 @@
+/**
+ * Tests for the AZQR ingestion module.
+ *
+ * Cover the behaviours CES-2192 requires:
+ * 1. `parseAzqrReport` validates the JSON shape (accept valid, reject invalid).
+ * 2. `isAzqrReportMasked` detects AZQR's default subscription-ID masking.
+ * 3. `classifyAzqrRow` / `azqrImpactedToFindings` promote billable waste as
+ *    `cost`, orphaned free resources as `cleanup` candidates, and drop
+ *    security / reliability / best-practice noise.
+ * 4. Impact → severity mapping and inventory enrichment.
+ */
+
+import { describe, expect, it } from "vitest";
+
+import {
+  type AzqrImpactedRow,
+  azqrImpactedToFindings,
+  classifyAzqrRow,
+  isAzqrReportMasked,
+  parseAzqrReport,
+} from "../azqr.js";
+
+const REAL_SUB = "ec285037-c673-4f58-b594-d7c480da4e8b";
+const MASKED_SUB = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxx0da4e8b";
+
+function impactedRow(
+  overrides: Partial<AzqrImpactedRow> = {},
+): AzqrImpactedRow {
+  return {
+    category: "Security",
+    impact: "Medium",
+    recommendation: "Some best practice",
+    resourceId: resourceId(
+      REAL_SUB,
+      "microsoft.network/networksecuritygroups",
+      "nsg",
+    ),
+    resourceType: "microsoft.network/networksecuritygroups",
+    source: "APRL",
+    ...overrides,
+  };
+}
+
+/** An orphaned (AOR) resource row of the given type. */
+function orphanRow(
+  resourceType: string,
+  overrides: Partial<AzqrImpactedRow> = {},
+): AzqrImpactedRow {
+  return impactedRow({
+    category: "Governance",
+    resourceId: resourceId(REAL_SUB, resourceType, "res"),
+    resourceType,
+    source: "AOR",
+    ...overrides,
+  });
+}
+
+function resourceId(sub: string, type: string, name: string): string {
+  return `/subscriptions/${sub}/resourcegroups/rg/providers/${type}/${name}`;
+}
+
+describe("parseAzqrReport", () => {
+  it("accepts a valid report and defaults missing arrays", () => {
+    const report = parseAzqrReport({ impacted: [impactedRow()] });
+    expect(report.impacted).toHaveLength(1);
+    expect(report.inventory).toEqual([]);
+  });
+
+  it("strips unknown top-level sections", () => {
+    const report = parseAzqrReport({
+      advisor: [{ anything: true }],
+      impacted: [],
+      recommendations: [{ foo: "bar" }],
+    });
+    expect(report.impacted).toEqual([]);
+  });
+
+  it("throws with a cause when an impacted row misses required fields", () => {
+    expect(() => parseAzqrReport({ impacted: [{ impact: "High" }] })).toThrow(
+      /Invalid AZQR report/,
+    );
+  });
+});
+
+describe("isAzqrReportMasked", () => {
+  it("detects masked subscription IDs in resource IDs", () => {
+    const report = parseAzqrReport({
+      impacted: [
+        impactedRow({
+          resourceId: resourceId(
+            MASKED_SUB,
+            "microsoft.network/publicipaddresses",
+            "pip",
+          ),
+        }),
+      ],
+    });
+    expect(isAzqrReportMasked(report)).toBe(true);
+  });
+
+  it("returns false when IDs carry the real subscription GUID", () => {
+    const report = parseAzqrReport({ impacted: [impactedRow()] });
+    expect(isAzqrReportMasked(report)).toBe(false);
+  });
+});
+
+describe("classifyAzqrRow", () => {
+  it("classifies rows AZQR categorises as Cost as cost", () => {
+    expect(classifyAzqrRow(impactedRow({ category: "Cost" }))).toBe("cost");
+  });
+
+  it("classifies orphaned billable resources as cost", () => {
+    expect(
+      classifyAzqrRow(
+        orphanRow("microsoft.network/publicipaddresses", {
+          recommendation: "Public IPs not attached to any resource",
+        }),
+      ),
+    ).toBe("cost");
+  });
+
+  it("classifies orphaned free resources (NSG, subnet, …) as cleanup", () => {
+    expect(
+      classifyAzqrRow(
+        orphanRow("microsoft.network/networksecuritygroups", {
+          recommendation:
+            "Network Security Groups not attached to any network interface or subnet",
+        }),
+      ),
+    ).toBe("cleanup");
+  });
+
+  it("drops non-orphan security / reliability best-practice rows", () => {
+    expect(
+      classifyAzqrRow(
+        impactedRow({
+          category: "Security",
+          recommendation: "Enable diagnostic settings",
+          resourceType: "microsoft.web/serverfarms",
+        }),
+      ),
+    ).toBeNull();
+  });
+
+  it("does not promote orphan-sounding text unless the AOR source tags it", () => {
+    expect(
+      classifyAzqrRow(
+        impactedRow({
+          category: "Governance",
+          recommendation: "Public IPs not attached to any resource",
+          resourceType: "microsoft.network/publicipaddresses",
+          source: "APRL",
+        }),
+      ),
+    ).toBeNull();
+  });
+});
+
+describe("azqrImpactedToFindings", () => {
+  it("maps billable orphans to cost findings and drops non-orphan noise", () => {
+    const report = parseAzqrReport({
+      impacted: [
+        orphanRow("microsoft.web/serverfarms", {
+          impact: "High",
+          recommendation: "App Service plans without hosting Apps",
+          recommendationId: "app-service-empty",
+          resourceId: resourceId(REAL_SUB, "microsoft.web/serverfarms", "asp"),
+        }),
+        impactedRow(), // non-orphan APRL noise → dropped
+      ],
+    });
+
+    const findings = azqrImpactedToFindings(report);
+
+    expect(findings).toHaveLength(1);
+    expect(findings[0]).toMatchObject({
+      category: "cost",
+      code: "azqr.app-service-empty",
+      severity: "high",
+      source: "azqr",
+    });
+    expect(findings[0].estimatedMonthlySavings).toBeUndefined();
+    expect(findings[0].recommendedAction).toContain("Review the resource");
+  });
+
+  it("maps orphaned free resources to low-severity cleanup candidates", () => {
+    const report = parseAzqrReport({
+      impacted: [
+        orphanRow("microsoft.network/virtualnetworks", {
+          impact: "Medium",
+          recommendation: "Subnets without Connected Devices or Delegation",
+          recommendationId: "empty-subnet",
+        }),
+      ],
+    });
+
+    const [finding] = azqrImpactedToFindings(report);
+    expect(finding).toMatchObject({
+      category: "operationalExcellence",
+      code: "azqr.empty-subnet",
+      severity: "low",
+      source: "azqr",
+    });
+    expect(finding.recommendedAction).toContain("no direct cost");
+  });
+
+  it("enriches the reason with inventory SKU / location when available", () => {
+    const id = resourceId(REAL_SUB, "microsoft.network/natgateways", "nat");
+    const report = parseAzqrReport({
+      impacted: [
+        orphanRow("microsoft.network/natgateways", {
+          recommendation: "NAT Gateways not attached to any subnet",
+          resourceId: id,
+        }),
+      ],
+      inventory: [
+        { location: "italynorth", resourceId: id, skuName: "Standard" },
+      ],
+    });
+
+    const [finding] = azqrImpactedToFindings(report);
+    expect(finding.reason).toContain("Standard");
+    expect(finding.reason).toContain("italynorth");
+  });
+
+  it("defaults severity to low for unknown impact on cost rows", () => {
+    const report = parseAzqrReport({
+      impacted: [
+        impactedRow({
+          category: "Cost",
+          impact: undefined,
+          resourceType: "microsoft.compute/disks",
+        }),
+      ],
+    });
+    expect(azqrImpactedToFindings(report)[0].severity).toBe("low");
+  });
+});

package/src/azure/__tests__/config.test.ts

@@ -48,6 +48,7 @@ describe("loadConfig", () => {
     expect(result.preferredLocation).toBe("italynorth");
     expect(result.sources).toEqual(["advisor", "custom"]);
     expect(result.timespanDays).toBe(30);
+    expect(result.azqrReportPath).toBeUndefined();
   });
 
   it("applies sources defaults when loading from the environment", async () => {
@@ -90,6 +91,7 @@ describe("loadConfig", () => {
     expect(result.preferredLocation).toBe("westeurope");
     expect(result.sources).toEqual(["custom"]);
     expect(result.timespanDays).toBe(60);
+    expect(result.azqrReportPath).toBe("./azqr_action_plan.json");
 
     expect(result.thresholds?.vm.cpuPercent).toBe(5);
     expect(result.thresholds?.vm.networkInBytesPerDay).toBe(10485760);

package/src/azure/__tests__/fixtures/full-override.yaml

@@ -3,6 +3,7 @@ azure:
     - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
     - yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy
   preferredLocation: westeurope
+  azqrReportPath: ./azqr_action_plan.json
   sources:
     - custom
   timespanDays: 60

package/src/azure/analyzer.ts

@@ -50,6 +50,11 @@ import {
   createDefaultSubscriptionAnalyzers,
   type SubscriptionAnalyzer,
 } from "./analyzers/index.js";
+import {
+  azqrImpactedToFindings,
+  isAzqrReportMasked,
+  loadAzqrReport,
+} from "./azqr.js";
 import { PricingClient, PricingService } from "./pricing/index.js";
 import { matchesTags, type MetricsCache } from "./utils.js";
 
@@ -173,6 +178,12 @@ export async function analyzeAzureResources(
     }
   }
 
+  // Ingest an AZQR (`azqr scan --json`) report when provided, merging its
+  // FinOps-relevant `impacted` rows into the aggregated reports as findings.
+  if (config.azqrReportPath) {
+    await ingestAzqrReport(config.azqrReportPath, allReports, logger);
+  }
+
   // Sort to make the output more readable:
   //  - Subscription-scoped findings (Reserved Instances, savings plans, ...)
   //    sink to the bottom: they aggregate many recommendations into a single
@@ -433,6 +444,42 @@ function hasTagFilter(filterTags: Map<string, string> | undefined): boolean {
   return Boolean(filterTags && filterTags.size > 0);
 }
 
+/**
+ * Loads an AZQR report, filters it down to FinOps opportunities and merges the
+ * resulting findings into the aggregated reports. Runs once per invocation
+ * (the report is subscription-agnostic), building a global index from every
+ * report collected during the live scan so AZQR findings attach to their
+ * resource when present or create a stub otherwise.
+ *
+ * When the report is still masked, findings cannot match live resource IDs, so
+ * a warning advises re-running AZQR with `--mask=false`.
+ */
+async function ingestAzqrReport(
+  azqrReportPath: string,
+  reports: AzureDetailedResourceReport[],
+  logger: ReturnType<typeof getLogger>,
+): Promise<void> {
+  const report = await loadAzqrReport(azqrReportPath);
+  if (isAzqrReportMasked(report)) {
+    logger.warn(
+      "AZQR report has masked subscription IDs: findings may not match live" +
+        " resources and can appear as separate stub entries. Re-run with" +
+        " `azqr scan --mask=false` for accurate merging.",
+    );
+  }
+
+  const findings = azqrImpactedToFindings(report);
+  const reportsById = new Map<string, AzureDetailedResourceReport>(
+    reports.map((r) => [(r.resource.id ?? "").toLowerCase(), r]),
+  );
+  for (const finding of findings) {
+    mergeFinding(finding, reports, reportsById);
+  }
+  logger.info(
+    `AZQR: merged ${findings.length} finding(s) from ${azqrReportPath}`,
+  );
+}
+
 function isResourceScopedFinding(resourceId: string): boolean {
   return /\/providers\//i.test(resourceId);
 }

package/src/azure/analyzers/advisor.ts

@@ -111,8 +111,7 @@ export function createAdvisorAnalyzer(clientFactory?: {
         if (rec.category?.toLowerCase() !== "cost") continue;
         const rawResourceId = rec.resourceMetadata?.resourceId;
         const props = rec.extendedProperties as
-          | Record<string, string>
-          | undefined;
+          Record<string, string> | undefined;
         const savings = parseSavings(props);
         if (rawResourceId && /\/providers\//i.test(rawResourceId)) {
           resourceFindings.push(

package/src/azure/azqr.ts

@@ -0,0 +1,270 @@
+/**
+ * AZQR report ingestion.
+ *
+ * Parses an AZQR (`azqr scan --json`) report and turns its `impacted`
+ * resources into the unified `Finding` model (`source: "azqr"`), keeping only
+ * the rows that carry FinOps signal so the SaveMoney output is not flooded with
+ * security / reliability / high-availability best-practice noise. Promoted rows
+ * fall into two classes (see {@link classifyAzqrRow}):
+ *
+ * - **cost** (`category: "cost"`): billable waste — rows AZQR categorises as
+ *   `Cost`, or orphaned resources whose type actually incurs cost (public IPs,
+ *   NAT gateways, application gateways, …).
+ * - **cleanup** (`category: "operationalExcellence"`): orphaned *free* resources
+ *   (empty subnets, unattached NSGs, orphan API connections, …). They carry no
+ *   direct cost but are cleanup candidates worth investigating.
+ *
+ * Orphans are detected via AZQR's `AOR` (Azure Orphan Resources) check source
+ * rather than fragile recommendation-text matching.
+ *
+ * The AZQR CLI masks subscription IDs by default (e.g.
+ * `/subscriptions/xxxxxxxx-…/`). Masked IDs do not match the real resource IDs
+ * produced by a live scan, so masked findings cannot be merged onto their
+ * resources — {@link isAzqrReportMasked} lets the orchestrator warn and advise
+ * re-running with `azqr scan --mask=false`.
+ *
+ * Scope note (CES-2192 / Fase 1): only `impacted` rows are ingested, enriched
+ * with `inventory` metadata when available. AZQR `advisor` rows are ignored to
+ * avoid duplicating SaveMoney's own Azure Advisor cost query.
+ */
+
+import { readFile } from "node:fs/promises";
+import { z } from "zod";
+
+import type { CostRisk } from "../types.js";
+
+import { type Finding } from "../finding.js";
+
+/** A single `impacted` row from an AZQR JSON report (fields we consume). */
+const azqrImpactedRowSchema = z.object({
+  category: z.string().optional(),
+  impact: z.string().optional(),
+  learn: z.string().optional(),
+  recommendation: z.string(),
+  recommendationId: z.string().optional(),
+  resourceGroup: z.string().optional(),
+  resourceId: z.string(),
+  resourceName: z.string().optional(),
+  resourceType: z.string().optional(),
+  source: z.string().optional(),
+  subscriptionId: z.string().optional(),
+  subscriptionName: z.string().optional(),
+});
+
+/** A single `inventory` row from an AZQR JSON report (used for enrichment). */
+const azqrInventoryRowSchema = z.object({
+  location: z.string().optional(),
+  resourceId: z.string(),
+  resourceName: z.string().optional(),
+  resourceType: z.string().optional(),
+  skuName: z.string().optional(),
+  skuTier: z.string().optional(),
+  subscriptionId: z.string().optional(),
+});
+
+/**
+ * Lenient top-level schema. AZQR reports carry many sections we do not use
+ * (`advisor`, `defender`, `recommendations`, …); unknown keys are stripped and
+ * missing arrays default to empty so a partial/older report still parses.
+ */
+const azqrReportSchema = z.object({
+  impacted: z.array(azqrImpactedRowSchema).default([]),
+  inventory: z.array(azqrInventoryRowSchema).default([]),
+});
+
+export type AzqrImpactedRow = z.infer<typeof azqrImpactedRowSchema>;
+export type AzqrInventoryRow = z.infer<typeof azqrInventoryRowSchema>;
+export type AzqrReport = z.infer<typeof azqrReportSchema>;
+
+/**
+ * Azure resource types whose orphaned/unassociated instances actually incur
+ * cost. AZQR's `AOR` (Azure Orphan Resources) check mixes these billable
+ * resources with free config-hygiene ones (NSGs, subnets, orphan API
+ * connections, private endpoints, …): the former are classified as `cost`
+ * opportunities, the latter as `cleanup` candidates.
+ */
+const BILLABLE_ORPHAN_RESOURCE_TYPES: ReadonlySet<string> = new Set([
+  "microsoft.compute/disks",
+  "microsoft.compute/snapshots",
+  "microsoft.network/applicationgateways",
+  "microsoft.network/ddosprotectionplans",
+  "microsoft.network/frontdoorwebapplicationfirewallpolicies",
+  "microsoft.network/loadbalancers",
+  "microsoft.network/natgateways",
+  "microsoft.network/publicipaddresses",
+  "microsoft.network/virtualnetworkgateways",
+  "microsoft.sql/servers/elasticpools",
+  "microsoft.web/serverfarms",
+]);
+
+/**
+ * AZQR's check source for orphaned resources (the Azure Orphan Resources
+ * project). Every `impacted` row tagged with it is a provisioned-but-unused
+ * resource, so it is a reliable, text-independent orphan marker.
+ */
+const ORPHAN_CHECK_SOURCE = "aor";
+
+/** AZQR masks subscription GUID segments with runs of `x`. */
+const MASK_MARKER = "xxxxxxxx";
+
+/** How a promoted AZQR row is classified for reporting. */
+export type AzqrOpportunityKind = "cleanup" | "cost";
+
+const COST_REMEDIATION =
+  "Review the resource and remove or right-size it if it is no longer needed to stop incurring cost.";
+
+const CLEANUP_REMEDIATION =
+  "Orphaned resource with no direct cost. Verify it is unused, then remove it to reduce clutter and management overhead.";
+
+/**
+ * Converts the promoted `impacted` rows of an AZQR report into findings.
+ * AZQR carries no monetary estimate, so `estimatedMonthlySavings` is left
+ * unset. Billable rows render as `cost` opportunities (keeping AZQR's impact as
+ * severity); orphaned free resources render as low-severity
+ * `operationalExcellence` cleanup candidates. All carry an `[azqr]` badge.
+ */
+export function azqrImpactedToFindings(report: AzqrReport): Finding[] {
+  const inventoryById = new Map(
+    report.inventory.map((row) => [row.resourceId.toLowerCase(), row]),
+  );
+  const findings: Finding[] = [];
+  for (const row of report.impacted) {
+    const kind = classifyAzqrRow(row);
+    if (kind === null) continue;
+    const inventory = inventoryById.get(row.resourceId.toLowerCase());
+    const cleanup = kind === "cleanup";
+    const remediation = cleanup ? CLEANUP_REMEDIATION : COST_REMEDIATION;
+    findings.push({
+      category: cleanup ? "operationalExcellence" : "cost",
+      code: row.recommendationId
+        ? `azqr.${row.recommendationId}`
+        : "azqr.impacted",
+      reason: buildReason(row, inventory),
+      recommendedAction: row.learn
+        ? `${remediation} Learn more: ${row.learn}`
+        : remediation,
+      resourceId: row.resourceId,
+      severity: cleanup ? "low" : mapAzqrImpact(row.impact),
+      source: "azqr",
+    });
+  }
+  return findings;
+}
+
+/**
+ * Classifies an `impacted` row for FinOps reporting, or returns `null` to drop
+ * it as noise.
+ *
+ * - `"cost"` — AZQR categorises the row as a cost item, or it is an orphaned
+ *   resource of a billable type (real savings potential).
+ * - `"cleanup"` — an orphaned resource of a *free* type (empty subnets,
+ *   unattached NSGs, orphan API connections, …): no direct cost, but a cleanup
+ *   candidate worth investigating.
+ * - `null` — everything else (security, reliability, high-availability and
+ *   other best-practice rows) is treated as noise and dropped.
+ *
+ * Orphans are identified by AZQR's `AOR` check source, not by matching the
+ * recommendation text.
+ */
+export function classifyAzqrRow(
+  row: AzqrImpactedRow,
+): AzqrOpportunityKind | null {
+  if ((row.category ?? "").toLowerCase().includes("cost")) {
+    return "cost";
+  }
+  if ((row.source ?? "").toLowerCase() !== ORPHAN_CHECK_SOURCE) {
+    return null;
+  }
+  const resourceType = (row.resourceType ?? "").toLowerCase();
+  return BILLABLE_ORPHAN_RESOURCE_TYPES.has(resourceType) ? "cost" : "cleanup";
+}
+
+/**
+ * Detects whether the report still carries AZQR's default subscription-ID
+ * masking. Masked resource IDs cannot be matched against a live scan, so the
+ * caller should advise re-running with `azqr scan --mask=false`.
+ */
+export function isAzqrReportMasked(report: AzqrReport): boolean {
+  return report.impacted.some(
+    (row) =>
+      row.resourceId.includes(MASK_MARKER) ||
+      (row.subscriptionId?.includes(MASK_MARKER) ?? false),
+  );
+}
+
+/**
+ * Reads and parses an AZQR JSON report from disk.
+ *
+ * @throws Error when the file cannot be read or is not valid AZQR JSON; the
+ *         underlying failure is preserved as `cause`.
+ */
+export async function loadAzqrReport(filePath: string): Promise<AzqrReport> {
+  let content: string;
+  try {
+    content = await readFile(filePath, "utf8");
+  } catch (error) {
+    throw new Error(`Cannot read AZQR report at "${filePath}"`, {
+      cause: error,
+    });
+  }
+
+  let json: unknown;
+  try {
+    json = JSON.parse(content);
+  } catch (error) {
+    throw new Error(`AZQR report at "${filePath}" is not valid JSON`, {
+      cause: error,
+    });
+  }
+
+  return parseAzqrReport(json);
+}
+
+/**
+ * Validates and parses an unknown value as an AZQR report.
+ *
+ * @throws Error (with the zod issue as `cause`) when the shape is invalid.
+ */
+export function parseAzqrReport(raw: unknown): AzqrReport {
+  const result = azqrReportSchema.safeParse(raw);
+  if (!result.success) {
+    throw new Error(`Invalid AZQR report: ${result.error.message}`, {
+      cause: result.error,
+    });
+  }
+  return result.data;
+}
+
+/**
+ * Builds the finding reason from the AZQR recommendation, appending SKU / tier
+ * / location context from the matching `inventory` row when available.
+ */
+function buildReason(
+  row: AzqrImpactedRow,
+  inventory: AzqrInventoryRow | undefined,
+): string {
+  const base = row.recommendation.trim();
+  const sentence = base.endsWith(".") ? base : `${base}.`;
+  const context: string[] = [];
+  if (inventory?.skuName) context.push(inventory.skuName);
+  if (inventory?.skuTier && inventory.skuTier !== inventory.skuName) {
+    context.push(inventory.skuTier);
+  }
+  if (inventory?.location) context.push(inventory.location);
+  return context.length > 0 ? `${sentence} (${context.join(", ")})` : sentence;
+}
+
+/**
+ * Maps AZQR/APRL `impact` (`High` | `Medium` | `Low`) onto the SaveMoney
+ * `CostRisk` scale, defaulting to `low` for unknown values.
+ */
+function mapAzqrImpact(impact: string | undefined): CostRisk {
+  switch (impact?.toLowerCase()) {
+    case "high":
+      return "high";
+    case "medium":
+      return "medium";
+    default:
+      return "low";
+  }
+}

package/src/azure/config.ts

@@ -42,6 +42,7 @@ export async function loadAzureConfig(
       const rawYaml = yaml.load(raw);
       const parsed = ConfigSchema.parse(rawYaml);
       return {
+        azqrReportPath: parsed.azure.azqrReportPath,
         concurrency: parsed.azure.concurrency,
         preferredLocation: parsed.azure.preferredLocation,
         sources: parsed.azure.sources,

package/src/azure/pricing/__tests__/schema.test.ts

@@ -0,0 +1,30 @@
+/**
+ * Tests for the Retail Prices API zod schemas, focused on the API's real
+ * (and easy to overlook) quirks rather than the happy path already covered
+ * indirectly by client.test.ts.
+ */
+
+import { describe, expect, it } from "vitest";
+
+import { PriceItemSchema } from "../schema.js";
+
+describe("PriceItemSchema", () => {
+  it("accepts empty strings for optional metadata fields", () => {
+    // The Retail Prices API returns "" (not the field omitted) for meters
+    // that don't have a given attribute, e.g. `armSkuName` on
+    // Bandwidth/Support meters. Resolvers already treat "" and `undefined`
+    // the same way (`?.toLowerCase() ?? ""`), so the schema must tolerate it.
+    const item = {
+      armSkuName: "",
+      currencyCode: "EUR",
+      retailPrice: 1,
+      type: "Consumption",
+      unitOfMeasure: "1 Hour",
+      unitPrice: 1,
+    };
+
+    const result = PriceItemSchema.parse(item);
+
+    expect(result.armSkuName).toBe("");
+  });
+});