devvami 1.1.2 → 1.3.0

package/src/formatters/charts.js

@@ -0,0 +1,205 @@
+import chalk from 'chalk'
+
+/** @import { ChartSeries } from '../types.js' */
+
+// Colour palette for multi-series charts (cycles if more than 8 series)
+const PALETTE = [
+  chalk.cyan,
+  chalk.yellow,
+  chalk.green,
+  chalk.magenta,
+  chalk.blue,
+  chalk.red,
+  chalk.white,
+  chalk.gray,
+]
+
+/**
+ * Get the terminal width, falling back to 80 columns.
+ * @returns {number}
+ */
+function terminalWidth() {
+  return process.stdout.columns ?? 80
+}
+
+/**
+ * Scale a value to a bar width in characters.
+ * @param {number} value
+ * @param {number} max
+ * @param {number} maxWidth
+ * @returns {number}
+ */
+function scaleBar(value, max, maxWidth) {
+  if (max === 0) return 0
+  return Math.round((value / max) * maxWidth)
+}
+
+/**
+ * Render a single-series or stacked ASCII bar chart.
+ *
+ * Each series contributes a coloured segment to each bar. With a single series
+ * the bars are monochrome cyan. Labels on the x-axis are sampled to avoid
+ * overlap at ~10-column intervals.
+ *
+ * @param {ChartSeries[]} series - One or more data series
+ * @param {{ title?: string, width?: number }} [options]
+ * @returns {string}
+ */
+export function barChart(series, options = {}) {
+  if (!series.length) return '(no data)'
+
+  const width = options.width ?? Math.min(terminalWidth() - 2, 120)
+  const labelColWidth = 12 // space reserved for y-axis labels ($xx.xx)
+  const chartWidth = Math.max(width - labelColWidth - 2, 10)
+
+  // Combine all series into per-label totals for scaling
+  const allLabels = series[0]?.labels ?? []
+  const totals = allLabels.map((_, i) =>
+    series.reduce((sum, s) => sum + (s.values[i] ?? 0), 0),
+  )
+  const maxTotal = Math.max(...totals, 0)
+
+  const lines = []
+
+  if (options.title) {
+    lines.push(chalk.bold(options.title))
+    lines.push('─'.repeat(width))
+  }
+
+  // Bar rows: one per time label
+  const BAR_HEIGHT = 8
+
+  // Build chart column by column (one char per day)
+  // We render it as a 2D grid: rows = height levels, cols = days
+  const grid = Array.from({ length: BAR_HEIGHT }, () => Array(allLabels.length).fill(' '))
+
+  for (let col = 0; col < allLabels.length; col++) {
+    const total = totals[col]
+    const barLen = scaleBar(total, maxTotal, BAR_HEIGHT)
+
+    // Determine colour per series for stacked effect (simplified: colour by dominant series)
+    let dominantIdx = 0
+    let dominantVal = 0
+    for (let si = 0; si < series.length; si++) {
+      if ((series[si].values[col] ?? 0) > dominantVal) {
+        dominantVal = series[si].values[col] ?? 0
+        dominantIdx = si
+      }
+    }
+    const colour = PALETTE[dominantIdx % PALETTE.length]
+
+    for (let row = 0; row < barLen; row++) {
+      grid[BAR_HEIGHT - 1 - row][col] = colour('█')
+    }
+  }
+
+  // Render grid rows with y-axis labels on the leftmost and rightmost rows
+  for (let row = 0; row < BAR_HEIGHT; row++) {
+    let yLabel = '            '
+    if (row === 0) {
+      yLabel = `$${maxTotal.toFixed(2)}`.padStart(labelColWidth)
+    } else if (row === BAR_HEIGHT - 1) {
+      yLabel = '$0.00'.padStart(labelColWidth)
+    }
+
+    // Sample columns to fit chartWidth (one char per label, spaced if needed)
+    const step = Math.max(1, Math.ceil(allLabels.length / chartWidth))
+    const rowStr = grid[row].filter((_, i) => i % step === 0).join('')
+    lines.push(`${yLabel} ${rowStr}`)
+  }
+
+  // X-axis date labels (sample every ~10 positions)
+  const step = Math.max(1, Math.ceil(allLabels.length / Math.floor(chartWidth / 10)))
+  const xLabels = allLabels
+    .filter((_, i) => i % step === 0)
+    .map((l) => l.slice(5)) // "MM-DD"
+  lines.push(' '.repeat(labelColWidth + 1) + xLabels.join('         '))
+
+  // Legend for multi-series
+  if (series.length > 1) {
+    lines.push('')
+    lines.push(chalk.dim('Legend:'))
+    for (let i = 0; i < series.length; i++) {
+      const colour = PALETTE[i % PALETTE.length]
+      lines.push(`  ${colour('█')}  ${series[i].name}`)
+    }
+  }
+
+  return lines.join('\n')
+}
+
+/**
+ * Render an ASCII line chart. Each series is drawn as a distinct coloured line.
+ * Values are plotted on a fixed-height canvas using half-block characters.
+ *
+ * @param {ChartSeries[]} series - One or more data series
+ * @param {{ title?: string, width?: number }} [options]
+ * @returns {string}
+ */
+export function lineChart(series, options = {}) {
+  if (!series.length) return '(no data)'
+
+  const width = options.width ?? Math.min(terminalWidth() - 2, 120)
+  const labelColWidth = 12
+  const chartWidth = Math.max(width - labelColWidth - 2, 10)
+  const chartHeight = 10
+
+  const allLabels = series[0]?.labels ?? []
+  const allValues = series.flatMap((s) => s.values)
+  const maxVal = Math.max(...allValues, 0)
+
+  const lines = []
+
+  if (options.title) {
+    lines.push(chalk.bold(options.title))
+    lines.push('─'.repeat(width))
+  }
+
+  // Build a 2D canvas: rows = chartHeight, cols = chartWidth
+  const canvas = Array.from({ length: chartHeight }, () =>
+    Array(chartWidth).fill(' '),
+  )
+
+  const step = Math.max(1, Math.ceil(allLabels.length / chartWidth))
+
+  for (let si = 0; si < series.length; si++) {
+    const colour = PALETTE[si % PALETTE.length]
+    const sampledValues = series[si].values.filter((_, i) => i % step === 0)
+
+    for (let col = 0; col < Math.min(sampledValues.length, chartWidth); col++) {
+      const val = sampledValues[col] ?? 0
+      const row = maxVal === 0 ? chartHeight - 1 : chartHeight - 1 - Math.round((val / maxVal) * (chartHeight - 1))
+      canvas[Math.max(0, Math.min(row, chartHeight - 1))][col] = colour('●')
+    }
+  }
+
+  // Render rows with y-axis labels
+  for (let row = 0; row < chartHeight; row++) {
+    let yLabel = '            '
+    if (row === 0) {
+      yLabel = `$${maxVal.toFixed(2)}`.padStart(labelColWidth)
+    } else if (row === chartHeight - 1) {
+      yLabel = '$0.00'.padStart(labelColWidth)
+    }
+    lines.push(`${yLabel} ${canvas[row].join('')}`)
+  }
+
+  // X-axis date labels
+  const xStep = Math.max(1, Math.ceil(allLabels.length / Math.floor(chartWidth / 10)))
+  const xLabels = allLabels
+    .filter((_, i) => i % xStep === 0)
+    .map((l) => l.slice(5))
+  lines.push(' '.repeat(labelColWidth + 1) + xLabels.join('         '))
+
+  // Legend
+  if (series.length > 0) {
+    lines.push('')
+    lines.push(chalk.dim('Legend:'))
+    for (let i = 0; i < series.length; i++) {
+      const colour = PALETTE[i % PALETTE.length]
+      lines.push(`  ${colour('●')}  ${series[i].name}`)
+    }
+  }
+
+  return lines.join('\n')
+}

package/src/formatters/cost.js

@@ -1,4 +1,4 @@
-/** @import { AWSCostEntry } from '../types.js' */
+/** @import { AWSCostEntry, CostGroupMode } from '../types.js' */
 
 /**
  * Format a USD amount as currency string.
@@ -31,21 +31,34 @@ export function formatTrend(current, previous) {
   return `${sign}${pct.toFixed(1)}%`
 }
 
+/**
+ * Derive the display row label for a cost entry based on the grouping mode.
+ * @param {AWSCostEntry} entry
+ * @param {CostGroupMode} groupBy
+ * @returns {string}
+ */
+export function rowLabel(entry, groupBy) {
+  if (groupBy === 'tag') return entry.tagValue ?? entry.serviceName
+  if (groupBy === 'both') return `${entry.serviceName} / ${entry.tagValue ?? '(untagged)'}`
+  return entry.serviceName
+}
+
 /**
  * Format cost entries as a printable table string.
  * @param {AWSCostEntry[]} entries
- * @param {string} serviceName
+ * @param {string} label - Display label for the header
+ * @param {CostGroupMode} [groupBy] - Grouping mode (default: 'service')
  * @returns {string}
  */
-export function formatCostTable(entries, serviceName) {
+export function formatCostTable(entries, label, groupBy = 'service') {
   const total = calculateTotal(entries)
   const rows = entries
     .sort((a, b) => b.amount - a.amount)
-    .map((e) => `  ${e.serviceName.padEnd(40)} ${formatCurrency(e.amount)}`)
+    .map((e) => `  ${rowLabel(e, groupBy).padEnd(40)} ${formatCurrency(e.amount)}`)
     .join('\n')
   const divider = '─'.repeat(50)
   return [
-    `Costs for: ${serviceName}`,
+    `Costs for: ${label}`,
     divider,
     rows,
     divider,

package/src/formatters/security.js

@@ -0,0 +1,119 @@
+import chalk from 'chalk'
+import { deriveOverallStatus } from '../services/security.js'
+
+/** @import { SetupSession, SecurityToolStatus, PlatformInfo } from '../types.js' */
+
+/**
+ * Format the educational introduction about credential security.
+ * @returns {string}
+ */
+export function formatEducationalIntro() {
+  const border = chalk.dim('─'.repeat(60))
+  const lines = [
+    border,
+    chalk.bold.yellow('  Why credential security matters'),
+    border,
+    '',
+    chalk.white('  Storing secrets in plaintext (shell history, .env files,'),
+    chalk.white('  ~/.aws/credentials) is the leading cause of supply chain'),
+    chalk.white('  attacks. One leaked key can compromise your entire org.'),
+    '',
+    chalk.bold('  What this setup installs:'),
+    '',
+    chalk.cyan('  aws-vault') + chalk.white('   — stores AWS credentials in an encrypted vault'),
+    chalk.cyan('             ') + chalk.white('  (macOS Keychain, pass on Linux).'),
+    chalk.cyan('  pass     ') + chalk.white('   — GPG-encrypted password store (Linux/WSL2).'),
+    chalk.cyan('  GCM      ') + chalk.white('   — Git Credential Manager: no more PATs in files.'),
+    chalk.cyan('  Keychain ') + chalk.white('   — macOS Keychain as Git credential helper.'),
+    '',
+    chalk.dim('  References: https://aws.github.io/aws-vault  |  https://www.passwordstore.org'),
+    border,
+  ]
+  return lines.join('\n')
+}
+
+/**
+ * Format a step header line for the setup flow.
+ * @param {{ id: string, label: string, type: string }} step
+ * @returns {string}
+ */
+export function formatStepHeader(step) {
+  const typeColor = {
+    check: chalk.blue,
+    install: chalk.yellow,
+    configure: chalk.cyan,
+    verify: chalk.green,
+  }
+  const colorFn = typeColor[step.type] ?? chalk.white
+  return `  ${colorFn(`[${step.type}]`)}  ${step.label}`
+}
+
+/**
+ * Format the completion summary table for a setup session.
+ * @param {SetupSession} session
+ * @param {PlatformInfo} platformInfo
+ * @returns {string}
+ */
+export function formatSecuritySummary(session, platformInfo) {
+  const border = chalk.dim('─'.repeat(60))
+  const lines = [
+    '',
+    border,
+    chalk.bold('  Security Setup — Summary'),
+    border,
+    '',
+    chalk.bold(`  Platform: ${chalk.cyan(platformInfo.platform)}`),
+    chalk.bold(`  Selection: ${chalk.cyan(session.selection)}`),
+    '',
+  ]
+
+  // Build a per-step result table
+  for (const step of session.steps) {
+    const result = session.results.get(step.id)
+    const status = result?.status ?? 'pending'
+    let badge
+    if (status === 'success') badge = chalk.green('✔')
+    else if (status === 'skipped') badge = chalk.dim('─')
+    else if (status === 'failed') badge = chalk.red('✗')
+    else badge = chalk.gray('○')
+
+    const label = chalk.white(step.label.padEnd(45))
+    const msg = result?.message ? chalk.gray(`  ${result.message}`) : ''
+    lines.push(`  ${badge}  ${label}${msg}`)
+
+    if (status === 'failed' && result?.hint) {
+      lines.push(chalk.dim(`       → ${result.hint}`))
+      if (result.hintUrl) lines.push(chalk.dim(`         ${result.hintUrl}`))
+    }
+  }
+
+  lines.push('')
+
+  // Overall status
+  const successful = [...session.results.values()].filter((r) => r.status === 'success').length
+  const failed = [...session.results.values()].filter((r) => r.status === 'failed').length
+  const skipped = [...session.results.values()].filter((r) => r.status === 'skipped').length
+
+  lines.push(
+    `  ${chalk.green(`${successful} succeeded`)}  ${chalk.dim(`${skipped} skipped`)}  ${failed > 0 ? chalk.red(`${failed} failed`) : chalk.dim('0 failed')}`,
+  )
+
+  if (failed === 0) {
+    lines.push('')
+    lines.push(chalk.bold.green('  All done! Restart your terminal to apply shell profile changes.'))
+    lines.push(chalk.dim('  Then run: dvmi auth login'))
+  } else {
+    lines.push('')
+    lines.push(chalk.bold.red('  Setup incomplete — see failure hints above.'))
+  }
+
+  lines.push(border)
+  return lines.join('\n')
+}
+
+/**
+ * Derive an overall status label from tool statuses (re-exported for convenience).
+ * @param {SecurityToolStatus[]} tools
+ * @returns {'success'|'partial'|'not-configured'}
+ */
+export { deriveOverallStatus }

package/src/help.js

@@ -58,14 +58,17 @@ const CATEGORIES = [
   {
     title: 'Tasks (ClickUp)',
     cmds: [
-      { id: 'tasks:list',  hint: '[--status] [--search]' },
-      { id: 'tasks:today', hint: '' },
+      { id: 'tasks:list',     hint: '[--status] [--search]' },
+      { id: 'tasks:today',    hint: '' },
+      { id: 'tasks:assigned', hint: '[--status] [--search]' },
     ],
   },
   {
     title: 'Cloud & Costi',
     cmds: [
-      { id: 'costs:get', hint: '[--period] [--profile]' },
+      { id: 'costs:get',   hint: '[SERVICE] [--period] [--group-by] [--tag-key]' },
+      { id: 'costs:trend', hint: '[--group-by] [--tag-key] [--line]' },
+      { id: 'logs',        hint: '[--group] [--filter] [--since] [--limit] [--region]' },
     ],
   },
   {
@@ -78,6 +81,12 @@ const CATEGORIES = [
       { id: 'prompts:run',            hint: '[PATH] [--tool]' },
     ],
   },
+  {
+    title: 'Sicurezza & Credenziali',
+    cmds: [
+      { id: 'security:setup', hint: '[--json]' },
+    ],
+  },
   {
     title: 'Setup & Ambiente',
     cmds: [
@@ -85,28 +94,12 @@ const CATEGORIES = [
       { id: 'doctor',     hint: '' },
       { id: 'auth:login', hint: '' },
       { id: 'whoami',     hint: '' },
+      { id: 'welcome',    hint: '' },
       { id: 'upgrade',    hint: '' },
     ],
   },
 ]
 
-// ─── Example commands shown at bottom of root help ──────────────────────────
-const EXAMPLES = [
-   { cmd: 'dvmi prompts list',                                    note: 'Sfoglia prompt AI dal tuo repository' },
-   { cmd: 'dvmi prompts list --filter refactor',                  note: 'Filtra prompt per parola chiave' },
-   { cmd: 'dvmi prompts download coding/refactor-prompt.md',      note: 'Scarica un prompt localmente' },
-   { cmd: 'dvmi prompts browse skills --query refactor',          note: 'Cerca skill su skills.sh' },
-   { cmd: 'dvmi prompts browse awesome --category agents',        note: 'Sfoglia awesome-copilot agents' },
-   { cmd: 'dvmi prompts run coding/refactor-prompt.md --tool opencode', note: 'Esegui un prompt con opencode' },
-   { cmd: 'dvmi docs read',                                       note: 'Leggi il README del repo corrente' },
-   { cmd: 'dvmi docs search "authentication"',                    note: 'Cerca nei docs del repo corrente' },
-   { cmd: 'dvmi repo list --search "api"',                        note: 'Filtra repository per nome' },
-   { cmd: 'dvmi pr status',                                       note: 'PR aperte e review in attesa' },
-   { cmd: 'dvmi pipeline status',                                 note: 'Ultimi workflow CI/CD' },
-   { cmd: 'dvmi tasks list --search "bug"',                       note: 'Cerca task ClickUp' },
-   { cmd: 'dvmi costs get --json',                                note: 'Costi AWS in formato JSON' },
- ]
-
 // ─── Help class ─────────────────────────────────────────────────────────────
 
 /**
@@ -156,14 +149,41 @@ export default class CustomHelp extends Help {
 
   // ─── Private helpers ──────────────────────────────────────────────────────
 
-  /**
-   * Build the full categorized root help layout.
-   * @returns {string}
-   */
+   /**
+    * Build the full categorized root help layout.
+    * @returns {string}
+    */
   #buildRootLayout() {
     /** @type {Map<string, import('@oclif/core').Command.Cached>} */
     const cmdMap = new Map(this.config.commands.map((c) => [c.id, c]))
 
+    /** @type {Array<{cmd: string, note: string}>} */
+    const EXAMPLES = [
+      { cmd: 'dvmi prompts list',                                     note: 'Sfoglia prompt AI dal tuo repository' },
+      { cmd: 'dvmi prompts list --filter refactor',                   note: 'Filtra prompt per parola chiave' },
+      { cmd: 'dvmi prompts download coding/refactor-prompt.md',       note: 'Scarica un prompt localmente' },
+      { cmd: 'dvmi prompts browse skills --query refactor',           note: 'Cerca skill su skills.sh' },
+      { cmd: 'dvmi prompts browse awesome --category agents',         note: 'Sfoglia awesome-copilot agents' },
+      { cmd: 'dvmi prompts run coding/refactor-prompt.md --tool opencode', note: 'Esegui un prompt con opencode' },
+      { cmd: 'dvmi docs read',                                        note: 'Leggi il README del repo corrente' },
+      { cmd: 'dvmi docs search "authentication"',                     note: 'Cerca nei docs del repo corrente' },
+      { cmd: 'dvmi repo list --search "api"',                         note: 'Filtra repository per nome' },
+      { cmd: 'dvmi pr status',                                        note: 'PR aperte e review in attesa' },
+      { cmd: 'dvmi pipeline status',                                  note: 'Ultimi workflow CI/CD' },
+      { cmd: 'dvmi tasks list --search "bug"',                        note: 'Cerca task ClickUp' },
+      { cmd: 'dvmi tasks today',                                      note: 'Task in lavorazione oggi' },
+      { cmd: 'dvmi costs get --period mtd',                           note: 'Costi AWS mese corrente per servizio' },
+      { cmd: 'dvmi costs get --group-by tag --tag-key env',           note: 'Costi raggruppati per tag env' },
+      { cmd: 'dvmi costs trend --line',                               note: 'Trend costi 2 mesi (grafico lineare)' },
+      { cmd: 'dvmi costs get --json',                                 note: 'Costi AWS in formato JSON' },
+      { cmd: 'dvmi logs',                                             note: 'Sfoglia log CloudWatch in modo interattivo' },
+      { cmd: 'dvmi logs --group /aws/lambda/my-fn --since 24h',       note: 'Log Lambda ultimi 24h' },
+      { cmd: 'dvmi logs --group /aws/lambda/my-fn --filter "ERROR"',  note: 'Filtra eventi ERROR su un log group' },
+      { cmd: 'dvmi security setup --json',                            note: 'Controlla lo stato degli strumenti di sicurezza' },
+      { cmd: 'dvmi security setup',                                   note: 'Wizard interattivo: installa aws-vault e GCM' },
+      { cmd: 'dvmi welcome',                                          note: 'Dashboard missione dvmi con intro animata' },
+    ]
+
     const lines = []
 
      // ── Usage ──────────────────────────────────────────────────────────────

package/src/services/aws-costs.js

@@ -1,6 +1,6 @@
 import { CostExplorerClient, GetCostAndUsageCommand } from '@aws-sdk/client-cost-explorer'
 
-/** @import { AWSCostEntry } from '../types.js' */
+/** @import { AWSCostEntry, CostGroupMode, CostTrendSeries } from '../types.js' */
 
 /**
  * Get the date range for a cost period.
@@ -28,14 +28,62 @@ function getPeriodDates(period) {
   return { start: fmt(start), end: fmt(now) }
 }
 
+/**
+ * Get the rolling 2-month date range for trend queries.
+ * @returns {{ start: string, end: string }}
+ */
+export function getTwoMonthPeriod() {
+  const now = new Date()
+  const fmt = (d) => d.toISOString().split('T')[0]
+  const start = new Date(now.getFullYear(), now.getMonth() - 2, 1)
+  return { start: fmt(start), end: fmt(now) }
+}
+
+/**
+ * Strip the "tagkey$" prefix from an AWS tag group key response.
+ * AWS returns tag values as "<tagKey>$<value>" — strip the prefix.
+ * An empty stripped value is displayed as "(untagged)".
+ * @param {string} rawKey - Raw key from AWS response (e.g. "env$prod" or "env$")
+ * @returns {string}
+ */
+function stripTagPrefix(rawKey) {
+  const dollarIdx = rawKey.indexOf('$')
+  if (dollarIdx === -1) return rawKey
+  const stripped = rawKey.slice(dollarIdx + 1)
+  return stripped === '' ? '(untagged)' : stripped
+}
+
+/**
+ * Build the GroupBy array for Cost Explorer based on the grouping mode.
+ * AWS limits GroupBy to max 2 entries.
+ * @param {CostGroupMode} groupBy
+ * @param {string} [tagKey]
+ * @returns {Array<{Type: string, Key: string}>}
+ */
+function buildGroupBy(groupBy, tagKey) {
+  if (groupBy === 'service') {
+    return [{ Type: 'DIMENSION', Key: 'SERVICE' }]
+  }
+  if (groupBy === 'tag') {
+    return [{ Type: 'TAG', Key: tagKey ?? '' }]
+  }
+  // both
+  return [
+    { Type: 'DIMENSION', Key: 'SERVICE' },
+    { Type: 'TAG', Key: tagKey ?? '' },
+  ]
+}
+
 /**
  * Query AWS Cost Explorer for costs filtered by project tags.
  * @param {string} serviceName - Tag value for filtering
  * @param {Record<string, string>} tags - Project tags (key-value pairs)
  * @param {'last-month'|'last-week'|'mtd'} [period]
+ * @param {CostGroupMode} [groupBy]
+ * @param {string} [tagKey]
  * @returns {Promise<{ entries: AWSCostEntry[], period: { start: string, end: string } }>}
  */
-export async function getServiceCosts(serviceName, tags, period = 'last-month') {
+export async function getServiceCosts(serviceName, tags, period = 'last-month', groupBy = 'service', tagKey) {
   // Cost Explorer always uses us-east-1
   const client = new CostExplorerClient({ region: 'us-east-1' })
   const { start, end } = getPeriodDates(period)
@@ -56,7 +104,7 @@ export async function getServiceCosts(serviceName, tags, period = 'last-month')
     Granularity: 'MONTHLY',
     Metrics: ['UnblendedCost'],
     Filter: filter,
-    GroupBy: [{ Type: 'DIMENSION', Key: 'SERVICE' }],
+    GroupBy: buildGroupBy(groupBy, tagKey),
   })
 
   const result = await client.send(command)
@@ -66,15 +114,91 @@ export async function getServiceCosts(serviceName, tags, period = 'last-month')
     for (const group of timeResult.Groups ?? []) {
       const amount = Number(group.Metrics?.UnblendedCost?.Amount ?? 0)
       if (amount > 0) {
-        entries.push({
-          serviceName: group.Keys?.[0] ?? 'Unknown',
+        const keys = group.Keys ?? []
+        /** @type {AWSCostEntry} */
+        const entry = {
+          serviceName: groupBy === 'tag' ? stripTagPrefix(keys[0] ?? '') : (keys[0] ?? 'Unknown'),
           amount,
           unit: group.Metrics?.UnblendedCost?.Unit ?? 'USD',
           period: { start, end },
-        })
+        }
+        if (groupBy === 'both') {
+          entry.tagValue = stripTagPrefix(keys[1] ?? '')
+        } else if (groupBy === 'tag') {
+          entry.tagValue = entry.serviceName
+        }
+        entries.push(entry)
       }
     }
   }
 
   return { entries, period: { start, end } }
 }
+
+/**
+ * Query AWS Cost Explorer for daily costs over the last 2 months, grouped by the given mode.
+ * Handles NextPageToken pagination internally.
+ * @param {CostGroupMode} groupBy
+ * @param {string} [tagKey]
+ * @returns {Promise<CostTrendSeries[]>}
+ */
+export async function getTrendCosts(groupBy = 'service', tagKey) {
+  const client = new CostExplorerClient({ region: 'us-east-1' })
+  const { start, end } = getTwoMonthPeriod()
+
+  /** @type {Map<string, Map<string, number>>} seriesName → date → amount */
+  const seriesMap = new Map()
+
+  let nextPageToken = undefined
+  do {
+    const command = new GetCostAndUsageCommand({
+      TimePeriod: { Start: start, End: end },
+      Granularity: 'DAILY',
+      Metrics: ['UnblendedCost'],
+      GroupBy: buildGroupBy(groupBy, tagKey),
+      ...(nextPageToken ? { NextPageToken: nextPageToken } : {}),
+    })
+
+    const result = await client.send(command)
+    nextPageToken = result.NextPageToken
+
+    for (const timeResult of result.ResultsByTime ?? []) {
+      const date = timeResult.TimePeriod?.Start ?? ''
+      for (const group of timeResult.Groups ?? []) {
+        const amount = Number(group.Metrics?.UnblendedCost?.Amount ?? 0)
+        const keys = group.Keys ?? []
+
+        let seriesName
+        if (groupBy === 'service') {
+          seriesName = keys[0] ?? 'Unknown'
+        } else if (groupBy === 'tag') {
+          seriesName = stripTagPrefix(keys[0] ?? '')
+        } else {
+          // both: "ServiceName / tagValue"
+          const svc = keys[0] ?? 'Unknown'
+          const tag = stripTagPrefix(keys[1] ?? '')
+          seriesName = `${svc} / ${tag}`
+        }
+
+        if (!seriesMap.has(seriesName)) {
+          seriesMap.set(seriesName, new Map())
+        }
+        const dateMap = seriesMap.get(seriesName)
+        dateMap.set(date, (dateMap.get(date) ?? 0) + amount)
+      }
+    }
+  } while (nextPageToken)
+
+  /** @type {CostTrendSeries[]} */
+  const series = []
+  for (const [name, dateMap] of seriesMap) {
+    const points = Array.from(dateMap.entries())
+      .sort(([a], [b]) => a.localeCompare(b))
+      .map(([date, amount]) => ({ date, amount }))
+    if (points.some((p) => p.amount > 0)) {
+      series.push({ name, points })
+    }
+  }
+
+  return series
+}