@pagopa/dx-savemoney 0.6.4 → 0.6.5

package/dist/azure/finding-code.js

@@ -0,0 +1,127 @@
+/**
+ * Stable per-sentence identity for custom (live-scan) analyzer findings.
+ *
+ * `Finding.recommendationId` powers cross-source dedup, but custom analyzer
+ * sentences were deliberately excluded from it: every sentence produced by
+ * `findingsFromAnalysisResult` shared the generic `code: "custom.unknown"`
+ * and had no stable identifier, so two different sentences could never be
+ * told apart safely.
+ *
+ * This module closes that gap for the sentences whose wording is known ahead
+ * of time: each per-resource analyzer in `azure/resources/` builds its
+ * `reason` string from a fixed set of templates (e.g. "Disk is unattached.",
+ * "VM is deallocated."). This module recognises those templates by a
+ * case-insensitive prefix match on the (already sentence-split) `reason` and
+ * assigns both `code` and `recommendationId` to a stable `custom.<id>` value,
+ * following the same convention as `advisor.<recommendationTypeId>` /
+ * `azqr.<recommendationId>`. That is what lets `foldDuplicateFinding`
+ * (`finding-dedup.ts`) — whose matching is already identity-based and
+ * source-agnostic — collapse two custom findings that describe the same
+ * problem on the same resource.
+ *
+ * A handful of sentences are worded identically by more than one resource
+ * type (e.g. App Service Plan and Container App both emit "Very low CPU usage
+ * (…)."). Those intentionally share one generic code: dedup only ever
+ * compares findings within the same `resourceId`, and a resource can't be two
+ * types at once, so the shared code cannot cause a false merge across
+ * unrelated resources.
+ *
+ * Sentences that don't match any known template are left untouched — they
+ * keep `code: "custom.unknown"` and no `recommendationId`, exactly like
+ * before, so genuinely unrecognised text is never merged on a guess.
+ */
+import { DETAIL_LOOKUP_FAILURE_PREFIX, MISSING_TAGS_REASON, NO_ANALYZER_REASON, UNPREFERRED_LOCATION_REASON, } from "./finding-category.js";
+/** Shared prefix for every stable custom finding id, mirroring `advisor.<id>` / `azqr.<id>`. */
+const CODE_PREFIX = "custom.";
+/**
+ * Ordered `(normalized reason prefix, code suffix)` pairs. Evaluated
+ * top-to-bottom; the first match wins. Prefixes are matched against the
+ * trimmed, lower-cased `reason`, so the dynamic suffixes analyzers append
+ * (percentages, byte counts, durations, …) never break the match.
+ */
+const REASON_CODES = [
+    // Generic — emitted by (almost) every per-resource analyzer.
+    ["resource id is missing.", "missing-resource-id"],
+    [DETAIL_LOOKUP_FAILURE_PREFIX, "lookup-failed"],
+    [MISSING_TAGS_REASON.toLowerCase(), "missing-tags"],
+    [NO_ANALYZER_REASON.toLowerCase(), "no-analyzer"],
+    [UNPREFERRED_LOCATION_REASON.toLowerCase(), "unpreferred-location"],
+    // Managed Disk (azure/resources/disk.ts)
+    ["disk is unattached.", "disk.unattached"],
+    // Network Interface (azure/resources/nic.ts)
+    ["nic not attached to any vm or private endpoint.", "nic.unattached"],
+    ["no public ip assigned.", "nic.no-public-ip"],
+    // Private Endpoint (azure/resources/private-endpoint.ts)
+    [
+        "private endpoint has no private link service connections configured.",
+        "private-endpoint.no-connections",
+    ],
+    [
+        "private endpoint has rejected or disconnected connections.",
+        "private-endpoint.rejected-connection",
+    ],
+    [
+        "private endpoint has no network interfaces attached.",
+        "private-endpoint.no-nics",
+    ],
+    [
+        "private endpoint is not associated with a subnet.",
+        "private-endpoint.no-subnet",
+    ],
+    // Container App (azure/resources/container-app.ts)
+    ["container app is not running.", "container-app.not-running"],
+    ["container app has 0 replicas configured.", "container-app.zero-replicas"],
+    // App Service Plan (azure/resources/app-service.ts)
+    ["app service plan has no apps deployed.", "app-service.no-apps"],
+    [
+        "premium tier with low resource utilization.",
+        "app-service.premium-underutilized",
+    ],
+    // Public IP (azure/resources/public-ip.ts)
+    ["public ip not associated with any resource.", "public-ip.unassociated"],
+    ["static ip not in use.", "public-ip.static-unused"],
+    // Storage Account (azure/resources/storage.ts)
+    ["very low transaction count (", "storage.low-transactions"],
+    // Virtual Machine (azure/resources/vm.ts) — worded distinctly ("Low ...",
+    // no "Very") from the shared "Very low ..." family below.
+    ["vm is deallocated.", "vm.deallocated"],
+    ["vm is stopped.", "vm.stopped"],
+    ["low cpu usage (avg", "vm.low-cpu-usage"],
+    ["low network traffic (", "vm.low-network-traffic"],
+    // Static Web App (azure/resources/static-web-app.ts)
+    ["no traffic data available in", "static-site.no-traffic-data"],
+    ["very low site traffic (", "static-site.low-traffic"],
+    ["very low data transfer (", "static-site.low-data-transfer"],
+    // Shared across resource types whose analyzers phrase the same signal with
+    // identical text — see module doc. App Service Plan + Container App for
+    // CPU/memory; Container App + Public IP for network traffic.
+    ["very low cpu usage (", "low-cpu-usage"],
+    ["very low memory usage (", "low-memory-usage"],
+    ["very low network traffic (", "low-network-traffic"],
+];
+/**
+ * Assigns a stable `code`/`recommendationId` to every custom finding whose
+ * `reason` matches a known sentence template, so equivalent sentences about
+ * the same resource collapse via `foldDuplicateFinding` instead of appearing
+ * as separate rows.
+ *
+ * Leaves untouched: non-`"custom"` findings, and findings that already carry
+ * a `recommendationId` (nothing to add) or whose `reason` matches no known
+ * template (stays `"custom.unknown"`, ungrouped — the same fallback behaviour
+ * as before this module existed).
+ */
+export function assignCustomFindingCodes(findings) {
+    return findings.map((finding) => {
+        if (finding.source !== "custom" || finding.recommendationId) {
+            return finding;
+        }
+        const code = stableCodeFor(finding.reason);
+        return code ? { ...finding, code, recommendationId: code } : finding;
+    });
+}
+function stableCodeFor(reason) {
+    const normalized = reason.trim().toLowerCase();
+    const match = REASON_CODES.find(([prefix]) => normalized.startsWith(prefix));
+    return match ? `${CODE_PREFIX}${match[1]}` : undefined;
+}
+//# sourceMappingURL=finding-code.js.map

package/dist/azure/finding-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-code.js","sourceRoot":"","sources":["../../src/azure/finding-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,gGAAgG;AAChG,MAAM,WAAW,GAAG,SAAS,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,YAAY,GAA2C;IAC3D,6DAA6D;IAC7D,CAAC,yBAAyB,EAAE,qBAAqB,CAAC;IAClD,CAAC,4BAA4B,EAAE,eAAe,CAAC;IAC/C,CAAC,mBAAmB,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC;IACnD,CAAC,kBAAkB,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC;IACjD,CAAC,2BAA2B,CAAC,WAAW,EAAE,EAAE,sBAAsB,CAAC;IAEnE,yCAAyC;IACzC,CAAC,qBAAqB,EAAE,iBAAiB,CAAC;IAE1C,6CAA6C;IAC7C,CAAC,iDAAiD,EAAE,gBAAgB,CAAC;IACrE,CAAC,wBAAwB,EAAE,kBAAkB,CAAC;IAE9C,yDAAyD;IACzD;QACE,sEAAsE;QACtE,iCAAiC;KAClC;IACD;QACE,4DAA4D;QAC5D,sCAAsC;KACvC;IACD;QACE,sDAAsD;QACtD,0BAA0B;KAC3B;IACD;QACE,mDAAmD;QACnD,4BAA4B;KAC7B;IAED,mDAAmD;IACnD,CAAC,+BAA+B,EAAE,2BAA2B,CAAC;IAC9D,CAAC,0CAA0C,EAAE,6BAA6B,CAAC;IAE3E,oDAAoD;IACpD,CAAC,wCAAwC,EAAE,qBAAqB,CAAC;IACjE;QACE,6CAA6C;QAC7C,mCAAmC;KACpC;IAED,2CAA2C;IAC3C,CAAC,6CAA6C,EAAE,wBAAwB,CAAC;IACzE,CAAC,uBAAuB,EAAE,yBAAyB,CAAC;IAEpD,+CAA+C;IAC/C,CAAC,8BAA8B,EAAE,0BAA0B,CAAC;IAE5D,0EAA0E;IAC1E,0DAA0D;IAC1D,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;IACxC,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAChC,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;IAC1C,CAAC,uBAAuB,EAAE,wBAAwB,CAAC;IAEnD,qDAAqD;IACrD,CAAC,8BAA8B,EAAE,6BAA6B,CAAC;IAC/D,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;IACtD,CAAC,0BAA0B,EAAE,+BAA+B,CAAC;IAE7D,2EAA2E;IAC3E,wEAAwE;IACxE,6DAA6D;IAC7D,CAAC,sBAAsB,EAAE,eAAe,CAAC;IACzC,CAAC,yBAAyB,EAAE,kBAAkB,CAAC;IAC/C,CAAC,4BAA4B,EAAE,qBAAqB,CAAC;CACtD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAmB;IAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC5D,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC"}

package/dist/azure/finding-dedup.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Cross-source deduplication of findings.
+ *
+ * SaveMoney observes the same subscription through three lenses: the custom
+ * live-scan analyzers, Azure Advisor, and an optional AZQR report. They
+ * overlap — an unattached disk is waste no matter who reports it — so the
+ * same resource could otherwise appear several times in the output, once per
+ * source. This also folds duplicate sentences emitted by the custom analyzers
+ * themselves (e.g. the same resource triggering the same "Very low CPU usage"
+ * template twice), since the matching below is source-agnostic.
+ *
+ * Findings are unified on the `resourceId + recommendationId` key. Sources
+ * normalise `recommendationId` onto a shared vocabulary whenever one exists:
+ * orphaned resources use {@link orphanRecommendationId} regardless of who
+ * detected them, which is what lets an AZQR `AOR` row collapse onto the
+ * Advisor or custom finding for the same resource. Custom analyzer sentences
+ * with a known template get a stable `custom.<id>` identity from
+ * `finding-code.ts`; sentences with no known template keep
+ * `code: "custom.unknown"` and no `recommendationId`, so they are never
+ * collapsed on guesswork. The surviving finding is the one carrying the
+ * monetary estimate (only Advisor and the pricing-enriched custom analyzers
+ * have one — AZQR reports no amounts at all), annotated with the
+ * corroborating source so the extra provenance is not lost.
+ */
+import type { Finding } from "../finding.js";
+import type { AzureDetailedResourceReport } from "./types.js";
+/**
+ * Folds `incoming` into an existing finding of `report` when both describe the
+ * same problem, so the resource is reported once instead of once per source.
+ *
+ * The surviving finding keeps the highest severity and the only available
+ * monetary estimate, and records the corroborating source both in its own
+ * reason and in the legacy per-resource `analysis` summary, so the `lint`,
+ * `json` and `table` formats all keep the provenance.
+ *
+ * @returns `true` when the finding was folded and must not be appended.
+ */
+export declare function foldDuplicateFinding(incoming: Finding, report: AzureDetailedResourceReport): boolean;
+/**
+ * Builds the canonical identity of an orphaned resource of the given type,
+ * e.g. `orphan.microsoft.compute/disks`.
+ */
+export declare function orphanRecommendationId(resourceType: string): string;
+//# sourceMappingURL=finding-dedup.d.ts.map

package/dist/azure/finding-dedup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-dedup.d.ts","sourceRoot":"","sources":["../../src/azure/finding-dedup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAiB,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAa9D;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,2BAA2B,GAClC,OAAO,CA0BT;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEnE"}

package/dist/azure/finding-dedup.js

@@ -0,0 +1,132 @@
+/**
+ * Cross-source deduplication of findings.
+ *
+ * SaveMoney observes the same subscription through three lenses: the custom
+ * live-scan analyzers, Azure Advisor, and an optional AZQR report. They
+ * overlap — an unattached disk is waste no matter who reports it — so the
+ * same resource could otherwise appear several times in the output, once per
+ * source. This also folds duplicate sentences emitted by the custom analyzers
+ * themselves (e.g. the same resource triggering the same "Very low CPU usage"
+ * template twice), since the matching below is source-agnostic.
+ *
+ * Findings are unified on the `resourceId + recommendationId` key. Sources
+ * normalise `recommendationId` onto a shared vocabulary whenever one exists:
+ * orphaned resources use {@link orphanRecommendationId} regardless of who
+ * detected them, which is what lets an AZQR `AOR` row collapse onto the
+ * Advisor or custom finding for the same resource. Custom analyzer sentences
+ * with a known template get a stable `custom.<id>` identity from
+ * `finding-code.ts`; sentences with no known template keep
+ * `code: "custom.unknown"` and no `recommendationId`, so they are never
+ * collapsed on guesswork. The surviving finding is the one carrying the
+ * monetary estimate (only Advisor and the pricing-enriched custom analyzers
+ * have one — AZQR reports no amounts at all), annotated with the
+ * corroborating source so the extra provenance is not lost.
+ */
+import { maxCostRisk } from "../types.js";
+/** Sources that observe the live subscription, as opposed to a static report. */
+const LIVE_SOURCES = new Set(["advisor", "custom"]);
+/**
+ * Canonical identity prefix for "this resource is provisioned but unused".
+ * Shared by every source so orphan findings deduplicate across them.
+ */
+const ORPHAN_RECOMMENDATION_PREFIX = "orphan.";
+/**
+ * Folds `incoming` into an existing finding of `report` when both describe the
+ * same problem, so the resource is reported once instead of once per source.
+ *
+ * The surviving finding keeps the highest severity and the only available
+ * monetary estimate, and records the corroborating source both in its own
+ * reason and in the legacy per-resource `analysis` summary, so the `lint`,
+ * `json` and `table` formats all keep the provenance.
+ *
+ * @returns `true` when the finding was folded and must not be appended.
+ */
+export function foldDuplicateFinding(incoming, report) {
+    const findings = report.findings;
+    if (!findings) {
+        return false;
+    }
+    const surviving = findDuplicateFinding(incoming, findings);
+    if (!surviving) {
+        return false;
+    }
+    const note = corroborationNote(surviving, incoming);
+    findings[findings.indexOf(surviving)] = {
+        ...surviving,
+        estimatedMonthlySavings: surviving.estimatedMonthlySavings ?? incoming.estimatedMonthlySavings,
+        reason: note ? `${surviving.reason.trimEnd()} ${note}` : surviving.reason,
+        recommendationId: surviving.recommendationId ?? incoming.recommendationId,
+        severity: maxCostRisk(surviving.severity, incoming.severity),
+    };
+    report.analysis = {
+        ...report.analysis,
+        costRisk: maxCostRisk(report.analysis.costRisk, incoming.severity),
+        reason: note
+            ? `${report.analysis.reason.trimEnd()} ${note}`.trim()
+            : report.analysis.reason,
+    };
+    return true;
+}
+/**
+ * Builds the canonical identity of an orphaned resource of the given type,
+ * e.g. `orphan.microsoft.compute/disks`.
+ */
+export function orphanRecommendationId(resourceType) {
+    return `${ORPHAN_RECOMMENDATION_PREFIX}${resourceType.toLowerCase()}`;
+}
+/**
+ * Short sentence appended to the surviving finding so the reader still sees
+ * that a second source flagged the same resource. Omitted for same-source
+ * duplicates, where there is no extra provenance to record, and when the same
+ * note is already there — repeated rows must corroborate, not accumulate.
+ */
+function corroborationNote(surviving, incoming) {
+    if (surviving.source === incoming.source) {
+        return undefined;
+    }
+    const note = isOrphanRecommendation(incoming.recommendationId)
+        ? `Also flagged by ${incoming.source} as an orphaned resource.`
+        : `Also flagged by ${incoming.source}.`;
+    return surviving.reason.includes(note) ? undefined : note;
+}
+/**
+ * Returns the already-collected finding that covers the same problem as
+ * `incoming`, or `undefined` when the incoming finding is genuinely new.
+ *
+ * Two findings describe the same problem when either:
+ *
+ * 1. they share the exact canonical identity (`recommendationId`) on the same
+ *    resource — a true duplicate, e.g. the same AZQR row ingested twice; or
+ * 2. `incoming` reports the resource as orphaned and a live source already
+ *    reported billable waste on it with no stronger identity of its own (e.g.
+ *    a sentence-level custom finding with no `recommendationId`). An orphaned
+ *    resource has a single cost problem — it exists — so the live finding,
+ *    which can carry a monetary estimate, supersedes the static one. A live
+ *    finding that already carries its own distinct `recommendationId` (e.g.
+ *    an Advisor right-sizing recommendation) is a different problem and is
+ *    never absorbed this way.
+ *
+ * Findings without a `recommendationId` never match: sentences whose text
+ * matches no known template (still `code: "custom.unknown"`, see
+ * `finding-code.ts`) must not be collapsed on guesswork.
+ */
+function findDuplicateFinding(incoming, existing) {
+    const identity = incoming.recommendationId?.toLowerCase();
+    if (!identity) {
+        return undefined;
+    }
+    const sameIdentity = existing.find((candidate) => candidate.recommendationId?.toLowerCase() === identity);
+    if (sameIdentity) {
+        return sameIdentity;
+    }
+    if (!isOrphanRecommendation(incoming.recommendationId)) {
+        return undefined;
+    }
+    return existing.find((candidate) => candidate.category === "cost" &&
+        LIVE_SOURCES.has(candidate.source) &&
+        !candidate.recommendationId);
+}
+function isOrphanRecommendation(recommendationId) {
+    return (recommendationId ?? "").startsWith(ORPHAN_RECOMMENDATION_PREFIX);
+}
+//# sourceMappingURL=finding-dedup.js.map

package/dist/azure/finding-dedup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-dedup.js","sourceRoot":"","sources":["../../src/azure/finding-dedup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,iFAAiF;AACjF,MAAM,YAAY,GAA+B,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhF;;;GAGG;AACH,MAAM,4BAA4B,GAAG,SAAS,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAiB,EACjB,MAAmC;IAEnC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpD,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG;QACtC,GAAG,SAAS;QACZ,uBAAuB,EACrB,SAAS,CAAC,uBAAuB,IAAI,QAAQ,CAAC,uBAAuB;QACvE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM;QACzE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB;QACzE,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC;KAC7D,CAAC;IACF,MAAM,CAAC,QAAQ,GAAG;QAChB,GAAG,MAAM,CAAC,QAAQ;QAClB,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAClE,MAAM,EAAE,IAAI;YACV,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE;YACtD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM;KAC3B,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,OAAO,GAAG,4BAA4B,GAAG,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,SAAkB,EAClB,QAAiB;IAEjB,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC5D,CAAC,CAAC,mBAAmB,QAAQ,CAAC,MAAM,2BAA2B;QAC/D,CAAC,CAAC,mBAAmB,QAAQ,CAAC,MAAM,GAAG,CAAC;IAC1C,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,oBAAoB,CAC3B,QAAiB,EACjB,QAA4B;IAE5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,gBAAgB,EAAE,WAAW,EAAE,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAChC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,WAAW,EAAE,KAAK,QAAQ,CACtE,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,QAAQ,KAAK,MAAM;QAC7B,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC;QAClC,CAAC,SAAS,CAAC,gBAAgB,CAC9B,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,gBAAoC;IAClE,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;AAC3E,CAAC"}

package/dist/finding.d.ts

@@ -14,7 +14,8 @@ import type { CostRisk } from "./types.js";
  * A single, atomic observation about a resource.
  *
  * One resource can produce multiple findings (e.g. "no tags" + "low CPU").
- * Findings are designed to be deduplicated by `(resourceId, source, code)`.
+ * Findings are deduplicated on `(resourceId, recommendationId)` — see
+ * {@link Finding.recommendationId}.
  */
 export type Finding = {
     /**
@@ -25,8 +26,8 @@ export type Finding = {
     /**
      * Stable machine-readable identifier for the kind of finding, e.g.
      * `vm.deallocated`, `disk.unattached`, `advisor.right-size-vm`.
-     * Used for deduplication and grouping. Free-form for now to keep the
-     * adapter from existing analyzers cheap; can be tightened later.
+     * Free-form and source-specific: use `recommendationId` for
+     * deduplication across sources.
      */
     code: string;
     /**
@@ -40,6 +41,19 @@ export type Finding = {
      * legacy `AnalysisResult.reason` field.
      */
     reason: string;
+    /**
+     * Canonical, source-independent identity of the underlying problem.
+     * Together with `resourceId` it forms the deduplication key, so the same
+     * waste reported by different sources collapses into a single finding
+     * (see `azure/finding-dedup.ts`).
+     *
+     * Producers normalise it whenever a shared vocabulary exists — orphaned
+     * resources use `orphan.<resourceType>` regardless of the source that
+     * detected them — and fall back to their native recommendation ID
+     * otherwise. Left unset when the source has no stable identifier: such
+     * findings are never deduplicated.
+     */
+    recommendationId?: string;
     /**
      * Optional, machine-friendly hint about how to remediate. For Advisor
      * this typically maps to `shortDescription.solution`.
@@ -84,10 +98,8 @@ export type Money = {
 /**
  * Aggregate view: one resource with the list of findings emitted for it.
  *
- * This is the type future report generators should consume. The current
- * report layer still works on `AzureDetailedResourceReport`; a helper
- * (`legacyReportFromResourceReport`) bridges the two until the report
- * layer is migrated.
+ * This is the type future report generators should consume; the current
+ * report layer still works on `AzureDetailedResourceReport`.
  */
 export type ResourceReport<TResource = unknown> = {
     findings: Finding[];

package/dist/finding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../src/finding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,MAAM,OAAO,GAAG;IACpB;;;OAGG;IACH,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,KAAK,CAAC;IAChC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,EAAE,QAAQ,CAAC;IACnB;;OAEG;IACH,MAAM,EAAE,aAAa,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,eAAe,GACzB,MAAM,GAAG,uBAAuB,GAAG,aAAa,GAAG,aAAa,GAAG,UAAU,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,KAAK,GAAG;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,CAAC,SAAS,GAAG,OAAO,IAAI;IAChD,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,QAAQ,EAAE,SAAS,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB,GAAG,OAAO,EAAE,CAqBZ"}
+{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../src/finding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GAAG;IACpB;;;OAGG;IACH,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,KAAK,CAAC;IAChC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,EAAE,QAAQ,CAAC;IACnB;;OAEG;IACH,MAAM,EAAE,aAAa,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,eAAe,GACzB,MAAM,GAAG,uBAAuB,GAAG,aAAa,GAAG,aAAa,GAAG,UAAU,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,KAAK,GAAG;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,CAAC,SAAS,GAAG,OAAO,IAAI;IAChD,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,QAAQ,EAAE,SAAS,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB,GAAG,OAAO,EAAE,CAqBZ"}

package/dist/finding.js.map

@@ -1 +1 @@
-{"version":3,"file":"finding.js","sourceRoot":"","sources":["../src/finding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA6FH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAM1C;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC;IACvE,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,kEAAkE;IAClE,8DAA8D;IAC9D,qBAAqB;IACrB,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,QAAQ,EAAE,MAAe;QACzB,IAAI,EAAE,IAAI,IAAI,gBAAgB;QAC9B,MAAM,EAAE,QAAQ;QAChB,UAAU;QACV,QAAQ;QACR,MAAM;KACP,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,MAAc;IAC9C,OAAO,MAAM;SACV,KAAK,CAAC,WAAW,CAAC;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC"}
+{"version":3,"file":"finding.js","sourceRoot":"","sources":["../src/finding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAyGH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAM1C;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC;IACvE,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,kEAAkE;IAClE,8DAA8D;IAC9D,qBAAqB;IACrB,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,QAAQ,EAAE,MAAe;QACzB,IAAI,EAAE,IAAI,IAAI,gBAAgB;QAC9B,MAAM,EAAE,QAAQ;QAChB,UAAU;QACV,QAAQ;QACR,MAAM;KACP,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,MAAc;IAC9C,OAAO,MAAM;SACV,KAAK,CAAC,WAAW,CAAC;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/types.d.ts

@@ -22,6 +22,8 @@ export type BaseConfig = {
     timespanDays: number;
 };
 export type CostRisk = "high" | "low" | "medium";
+/** Cost risk ordering, from the most to the least severe. */
+export declare const COST_RISK_ORDER: Record<CostRisk, number>;
 /**
  * Configurable thresholds used during resource analysis.
  * Derived from `ThresholdsSchema` — the schema is the single source of truth.
@@ -57,6 +59,12 @@ export declare const DEFAULT_THRESHOLDS: {
         networkInBytesPerDay: number;
     };
 };
+/**
+ * Returns the more severe of two cost risks. Used whenever two observations
+ * about the same resource (or the same problem seen by two sources) are
+ * combined, so severity never degrades silently.
+ */
+export declare function maxCostRisk(a: CostRisk, b: CostRisk): CostRisk;
 /**
  * Merges analysis results, preserving existing reasons and combining suspectedUnused flags.
  */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAI1C,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,KAAK,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEjD;;;GAGG;AACH,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;CAA6B,CAAC;AAE7D;;GAEG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,cAAc,EAC1B,cAAc,EAAE,cAAc,GAC7B,cAAc,CAUhB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAI1C,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,KAAK,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEjD,6DAA6D;AAC7D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAIpD,CAAC;AAEF;;;GAGG;AACH,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;CAA6B,CAAC;AAE7D;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAE9D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,cAAc,EAC1B,cAAc,EAAE,cAAc,GAC7B,cAAc,CAUhB"}

package/dist/types.js

@@ -2,11 +2,25 @@
  * Common types shared across all cloud providers
  */
 import { ThresholdsSchema } from "./schema.js";
+/** Cost risk ordering, from the most to the least severe. */
+export const COST_RISK_ORDER = {
+    high: 0,
+    low: 2,
+    medium: 1,
+};
 /**
  * Default threshold values — produced by parsing an empty object through
  * `ThresholdsSchema`, which applies all schema-defined defaults.
  */
 export const DEFAULT_THRESHOLDS = ThresholdsSchema.parse({});
+/**
+ * Returns the more severe of two cost risks. Used whenever two observations
+ * about the same resource (or the same problem seen by two sources) are
+ * combined, so severity never degrades silently.
+ */
+export function maxCostRisk(a, b) {
+    return COST_RISK_ORDER[a] <= COST_RISK_ORDER[b] ? a : b;
+}
 /**
  * Merges analysis results, preserving existing reasons and combining suspectedUnused flags.
  */

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AA+B/C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAE7D;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,UAA0B,EAC1B,cAA8B;IAE9B,OAAO;QACL,QAAQ,EAAE,cAAc,CAAC,QAAQ;QACjC,uBAAuB,EACrB,cAAc,CAAC,uBAAuB;YACtC,UAAU,CAAC,uBAAuB;QACpC,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM;QACjD,eAAe,EACb,UAAU,CAAC,eAAe,IAAI,cAAc,CAAC,eAAe;KAC/D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAyB/C,6DAA6D;AAC7D,MAAM,CAAC,MAAM,eAAe,GAA6B;IACvD,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;CACV,CAAC;AAQF;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,CAAW,EAAE,CAAW;IAClD,OAAO,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,UAA0B,EAC1B,cAA8B;IAE9B,OAAO;QACL,QAAQ,EAAE,cAAc,CAAC,QAAQ;QACjC,uBAAuB,EACrB,cAAc,CAAC,uBAAuB;YACtC,UAAU,CAAC,uBAAuB;QACpC,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM;QACjD,eAAe,EACb,UAAU,CAAC,eAAe,IAAI,cAAc,CAAC,eAAe;KAC/D,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/dx-savemoney",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "type": "module",
   "description": "Azure resource analyzer for finding unused or cost-inefficient resources.",
   "repository": {

package/src/azure/__tests__/azqr.test.ts

@@ -1,7 +1,7 @@
 /**
  * Tests for the AZQR ingestion module.
  *
- * Cover the behaviours CES-2192 requires:
+ * Cover:
  * 1. `parseAzqrReport` validates the JSON shape (accept valid, reject invalid).
  * 2. `isAzqrReportMasked` detects AZQR's default subscription-ID masking.
  * 3. `classifyAzqrRow` / `azqrImpactedToFindings` promote billable waste as
@@ -235,4 +235,48 @@ describe("azqrImpactedToFindings", () => {
     });
     expect(azqrImpactedToFindings(report)[0].severity).toBe("low");
   });
+
+  it("gives orphaned resources the shared cross-source recommendation id", () => {
+    const report = parseAzqrReport({
+      impacted: [
+        orphanRow("Microsoft.Compute/disks", {
+          recommendation: "Managed Disks not attached",
+          recommendationId: "orphan-disk",
+        }),
+      ],
+    });
+
+    expect(azqrImpactedToFindings(report)[0].recommendationId).toBe(
+      "orphan.microsoft.compute/disks",
+    );
+  });
+
+  it("namespaces the native recommendation id of non-orphan rows", () => {
+    const report = parseAzqrReport({
+      impacted: [
+        impactedRow({
+          category: "Cost",
+          recommendationId: "aprl-1234",
+          resourceType: "microsoft.compute/disks",
+        }),
+      ],
+    });
+
+    expect(azqrImpactedToFindings(report)[0].recommendationId).toBe(
+      "azqr.aprl-1234",
+    );
+  });
+
+  it("leaves the recommendation id unset when the row carries none", () => {
+    const report = parseAzqrReport({
+      impacted: [
+        impactedRow({
+          category: "Cost",
+          resourceType: "microsoft.compute/disks",
+        }),
+      ],
+    });
+
+    expect(azqrImpactedToFindings(report)[0].recommendationId).toBeUndefined();
+  });
 });

package/src/azure/__tests__/finding-category.test.ts

@@ -0,0 +1,68 @@
+/**
+ * Unit tests for the categorisation of custom analyzer reasons.
+ *
+ * The per-resource analyzers describe governance observations and billable
+ * waste in the same `reason` string, so the classifier is what keeps the
+ * `cost` category meaning "money is being wasted".
+ */
+
+import { describe, expect, it } from "vitest";
+
+import type { Finding } from "../../finding.js";
+
+import {
+  categorizeCustomFindings,
+  MISSING_TAGS_REASON,
+  NO_ANALYZER_REASON,
+  unpreferredLocationReason,
+} from "../finding-category.js";
+
+const RESOURCE_ID =
+  "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/disks/disk1";
+
+function categorize(reason: string): Finding["category"] {
+  const [finding] = categorizeCustomFindings([customFinding(reason)]);
+  return finding.category;
+}
+
+function customFinding(reason: string): Finding {
+  return {
+    category: "cost",
+    code: "custom.unknown",
+    reason,
+    resourceId: RESOURCE_ID,
+    severity: "low",
+    source: "custom",
+  };
+}
+
+describe("categorizeCustomFindings", () => {
+  it.each([
+    MISSING_TAGS_REASON,
+    NO_ANALYZER_REASON,
+    unpreferredLocationReason("italynorth"),
+    "Could not retrieve detailed NIC information.",
+  ])("reports %j as operational excellence, not cost", (reason) => {
+    expect(categorize(reason)).toBe("operationalExcellence");
+  });
+
+  it.each([
+    "Disk is unattached.",
+    "VM is deallocated.",
+    "Public IP is not associated with any resource.",
+  ])("keeps %j as a cost finding", (reason) => {
+    expect(categorize(reason)).toBe("cost");
+  });
+
+  it("preserves every other field of the finding", () => {
+    const finding: Finding = {
+      ...customFinding(MISSING_TAGS_REASON),
+      recommendedAction: "Add the required tags.",
+      severity: "medium",
+    };
+
+    expect(categorizeCustomFindings([finding])).toEqual([
+      { ...finding, category: "operationalExcellence" },
+    ]);
+  });
+});