meyi-cost-server 1.0.0

package/src/controllers/budget.controller.js

@@ -0,0 +1,39 @@
+export class BudgetController {
+  constructor({ contextService, budgetService, budgetAlertService }) {
+    this.contextService = contextService;
+    this.budgetService = budgetService;
+    this.budgetAlertService = budgetAlertService;
+  }
+
+  async list(req, res, next) {
+    try { return res.json({ budgets: await this.budgetService.list(this.contextService.tenantId(req)) }); }
+    catch (error) { return next(error); }
+  }
+
+  async create(req, res, next) {
+    try { return res.status(201).json(await this.budgetService.create(this.contextService.tenantId(req), req.body)); }
+    catch (error) {
+      if (error.statusCode === 400) return res.status(400).json({ error: error.message });
+      return next(error);
+    }
+  }
+
+  async delete(req, res, next) {
+    try { await this.budgetService.delete(this.contextService.tenantId(req), req.params.id); return res.status(204).end(); }
+    catch (error) { return next(error); }
+  }
+
+  async listDismissals(req, res, next) {
+    try {
+      const dismissals = await this.budgetAlertService.listDismissals(this.contextService.tenantId(req), req.user?.id, req.query.period);
+      return res.json({ dismissals });
+    } catch (error) { return next(error); }
+  }
+
+  async dismissAlert(req, res, next) {
+    try {
+      const dismissal = await this.budgetAlertService.dismiss(this.contextService.tenantId(req), req.user?.id, req.body);
+      return res.status(201).json(dismissal);
+    } catch (error) { return next(error); }
+  }
+}

package/src/controllers/cost.controller.js

@@ -0,0 +1,261 @@
+import {
+  GetCostAndUsageCommand,
+  GetCostForecastCommand,
+  GetDimensionValuesCommand,
+  GetTagsCommand,
+} from "@aws-sdk/client-cost-explorer";
+import {
+  getCurFilterOptions,
+  getCurOverview,
+  getCurReport,
+  getCurTags,
+} from "../services/cur.service.js";
+import {
+  accountFilter,
+  amount,
+  dateRange,
+  grossCostFilter,
+  iso,
+  listParam,
+  parseGroups,
+  parseRelationships,
+  round,
+} from "../lib/cost-utils.js";
+
+export class CostController {
+  constructor({ contextService, curProvider, explorerService, discoveryRepository = null, logger = console }) {
+    this.contextService = contextService;
+    this.curProvider = curProvider;
+    this.explorerService = explorerService;
+    this.discoveryRepository = discoveryRepository;
+    this.logger = logger;
+  }
+
+  async accounts(req, res, next) {
+    try {
+      const ctx = await this.contextService.resolve(req);
+      const { tenant, accounts, client, queryEnabled, accessMode } = ctx;
+      const names = new Map(accounts.map((item) => [item.id, item.name]));
+      const cur = await this.curProvider.run(ctx, (athena, config) => getCurReport({ client: athena, config, tenant, range: dateRange(req.query), groupBy: "account", accountNames: names }));
+      if (cur) return res.json({ accounts: cur.summary.map((item) => ({ id: item.accountId || item.key, name: item.label, region: "global", status: "active" })), dataSource: cur.dataSource, accessMode: cur.accessMode });
+      if (accounts.length || !queryEnabled) return res.json({ accounts, dataSource: queryEnabled ? "aws-cost-explorer" : "onboarding", accessMode });
+      const response = await client.send(new GetDimensionValuesCommand({ TimePeriod: dateRange(), Dimension: "LINKED_ACCOUNT" }));
+      const discovered = (response.DimensionValues || []).map((item) => ({ id: item.Value, name: item.Attributes?.description || item.Value, region: "global", status: "active" }));
+      return res.json({ accounts: discovered, dataSource: "aws-cost-explorer", accessMode });
+    } catch (error) { return next(error); }
+  }
+
+  async overview(req, res, next) {
+    try {
+      const ctx = await this.contextService.resolve(req);
+      const { tenant, accounts, client, queryEnabled, accessMode } = ctx;
+      const range = dateRange(req.query);
+      const trendMode = String(req.query.period || "monthly").toLowerCase() === "yearly" ? "yearly" : "monthly";
+      const trendStart = trendMode === "monthly" ? new Date(`${range.End}T00:00:00Z`) : new Date(`${range.Start}T00:00:00Z`);
+      if (trendMode === "monthly") trendStart.setUTCMonth(0, 1);
+      const trendRange = { Start: iso(trendStart), End: range.End };
+      const names = new Map(accounts.map((item) => [item.id, item.name]));
+      const cur = await this.curProvider.run(ctx, (athena, config) => getCurOverview({ client: athena, config, tenant, range, trendRange, trendMode, accountNames: names }));
+      if (cur) return res.json(cur);
+      if (!queryEnabled) return res.json({ tenantId: tenant, accounts: [], currency: "USD", totalCost: 0, activeAccounts: 0, trends: [], topServices: [], topAccounts: [], topRegions: [], dataSource: "onboarding", accessMode, message: "No selected AWS accounts or test credentials were found. Complete AWS onboarding or configure the local credential fallback." });
+      const accountIds = accounts.map((item) => item.id);
+      const [trendResponse, netTrendResponse, servicePeriods, accountPeriods, regionPeriods, accountDirectory] = await Promise.all([
+        client.send(new GetCostAndUsageCommand({ TimePeriod: trendRange, Granularity: "MONTHLY", Metrics: ["UnblendedCost"], Filter: grossCostFilter(accountIds) })),
+        client.send(new GetCostAndUsageCommand({ TimePeriod: range, Granularity: "MONTHLY", Metrics: ["UnblendedCost"], Filter: accountFilter(accountIds) })),
+        this.explorerService.grouped(client, accounts, range, "SERVICE"),
+        this.explorerService.grouped(client, accounts, range, "LINKED_ACCOUNT"),
+        this.explorerService.grouped(client, accounts, range, "REGION"),
+        accounts.length ? Promise.resolve(null) : client.send(new GetDimensionValuesCommand({ TimePeriod: range, Dimension: "LINKED_ACCOUNT" })),
+      ]);
+      for (const item of accountDirectory?.DimensionValues || []) if (item.Value) names.set(item.Value, item.Attributes?.description || item.Value);
+      let trends = (trendResponse.ResultsByTime || []).map((period) => ({ month: period.TimePeriod?.Start, amount: round(amount(period.Total?.UnblendedCost)), currency: "USD" }));
+      if (trendMode === "yearly") {
+        const years = new Map();
+        for (const item of trends) {
+          const year = String(item.month || "").slice(0, 4);
+          years.set(year, round((years.get(year) || 0) + item.amount));
+        }
+        const firstYear = trendStart.getUTCFullYear();
+        const trendEnd = new Date(`${range.End}T00:00:00Z`); trendEnd.setUTCDate(trendEnd.getUTCDate() - 1);
+        const lastYear = trendEnd.getUTCFullYear();
+        trends = Array.from({ length: lastYear - firstYear + 1 }, (_, offset) => {
+          const year = String(firstYear + offset);
+          return { month: `${year}-01-01`, amount: years.get(year) || 0, currency: "USD" };
+        });
+      }
+      const totalCost = round((trendResponse.ResultsByTime || []).filter((period) => period.TimePeriod?.Start >= range.Start).reduce((total, period) => total + amount(period.Total?.UnblendedCost), 0));
+      const netCost = round((netTrendResponse.ResultsByTime || []).reduce((total, period) => total + amount(period.Total?.UnblendedCost), 0));
+      const creditsAndAdjustments = round(netCost - totalCost);
+      const activeResources = null;
+      const topResources = [];
+      let forecast = null;
+      if (!req.query.start && !req.query.end) {
+        try {
+          const now = new Date();
+          const tomorrow = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() + 1));
+          const nextMonth = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1));
+          if (tomorrow < nextMonth) {
+            const result = await client.send(new GetCostForecastCommand({ TimePeriod: { Start: iso(tomorrow), End: iso(nextMonth) }, Metric: "UNBLENDED_COST", Granularity: "MONTHLY" }));
+            forecast = round(totalCost + Number(result.Total?.Amount || 0));
+          }
+        } catch (error) { this.logger.warn?.("[Cost] Forecast unavailable", error.message); }
+      }
+      const topAccounts = parseGroups(accountPeriods, names, "account");
+      const resolvedAccounts = accounts.length ? accounts : topAccounts.map((item) => ({ id: item.accountId || item.key, name: item.label, region: "global", status: "active" }));
+      return res.json({ tenantId: tenant, accounts: resolvedAccounts, currency: "USD", period: range, totalCost, grossCost: totalCost, netCost, creditsAndAdjustments, forecast, activeAccounts: resolvedAccounts.length, activeResources, activeResourcesMessage: "Exact active-resource totals require CUR/Athena resource IDs.", trends, topServices: parseGroups(servicePeriods, names, "service").slice(0, 10), topAccounts, topRegions: parseGroups(regionPeriods).slice(0, 10), topResources, costBasis: "gross-positive-unblended", dataSource: "aws-cost-explorer", accessMode });
+    } catch (error) { return next(error); }
+  }
+
+  async filterOptions(req, res, next) {
+    try {
+      const ctx = await this.contextService.resolve(req);
+      const { accounts, client, queryEnabled, accessMode } = ctx;
+      const range = dateRange(req.query);
+      const tagKey = String(req.query.tagKey || "").trim();
+      const names = new Map(accounts.map((item) => [item.id, item.name]));
+      const cur = await this.curProvider.run(ctx, (athena, config) => getCurFilterOptions({ client: athena, config, tenant: ctx.tenant, range, tagKey, accountNames: names }));
+      if (cur) return res.json({ ...cur, tenantId: ctx.tenant, updatedAt: new Date().toISOString() });
+      if (!queryEnabled) return res.json({ services: [], regions: [], accounts, tagKeys: [], tagValues: [], accessMode, updatedAt: new Date().toISOString() });
+      const baseFilter = grossCostFilter(accounts.map((item) => item.id));
+      const getDimensions = async (dimension) => {
+        const values = [];
+        let token;
+        do {
+          const page = await client.send(new GetDimensionValuesCommand({ TimePeriod: range, Dimension: dimension, Filter: baseFilter, NextPageToken: token }));
+          values.push(...(page.DimensionValues || [])); token = page.NextPageToken;
+        } while (token);
+        return values;
+      };
+      const getTagValues = async () => {
+        const values = [];
+        let token;
+        do {
+          const page = await client.send(new GetTagsCommand({ TimePeriod: range, Filter: accountFilter(accounts.map((item) => item.id)), TagKey: tagKey || undefined, NextPageToken: token }));
+          values.push(...(page.Tags || [])); token = page.NextPageToken;
+        } while (token);
+        return [...new Set(values)];
+      };
+      const [serviceValues, regionValues, accountValues, tags] = await Promise.all([getDimensions("SERVICE"), getDimensions("REGION"), getDimensions("LINKED_ACCOUNT"), getTagValues()]);
+      const options = (items = []) => items.map((item) => ({ value: item.Value, label: item.Attributes?.description || item.Value })).filter((item) => item.value);
+      return res.json({ services: options(serviceValues), regions: options(regionValues), accounts: options(accountValues), tagKeys: tagKey ? [] : tags, tagValues: tagKey ? tags : [], accessMode, updatedAt: new Date().toISOString() });
+    } catch (error) { return next(error); }
+  }
+
+  async reports(req, res, next) {
+    try {
+      const ctx = await this.contextService.resolve(req);
+      const { tenant, accounts, client, queryEnabled, accessMode } = ctx;
+      const range = dateRange(req.query);
+      const groupBy = String(req.query.groupBy || "service").toLowerCase();
+      const map = { service: "SERVICE", account: "LINKED_ACCOUNT", region: "REGION", resource: "RESOURCE_ID" };
+      const dimension = groupBy === "tag" ? `tag:${String(req.query.tagKey || "Name")}` : map[groupBy];
+      if (!dimension) return res.status(400).json({ error: "groupBy must be service, account, region, resource, or tag" });
+      const names = new Map(accounts.map((item) => [item.id, item.name]));
+      if (!accounts.length && queryEnabled) {
+        try {
+          const directory = await client.send(new GetDimensionValuesCommand({ TimePeriod: range, Dimension: "LINKED_ACCOUNT" }));
+          for (const item of directory.DimensionValues || []) if (item.Value) names.set(item.Value, item.Attributes?.description || item.Value);
+        } catch (error) { this.logger.warn?.("[Cost] Account-name lookup unavailable", error.message); }
+      }
+      const granularity = String(req.query.granularity || "MONTHLY").toUpperCase();
+      const selections = { services: listParam(req.query.services), regions: listParam(req.query.regions), accountIds: listParam(req.query.accountIds), tagKey: String(req.query.filterTagKey || "").trim(), tagValues: listParam(req.query.tagValues) };
+      const cur = await this.curProvider.run(ctx, (athena, config) => getCurReport({ client: athena, config, tenant, range, groupBy, granularity, tagKey: req.query.tagKey, accountNames: names, filters: selections, includeBreakdown: true }));
+      if (cur) return res.json({ ...cur, tenantId: tenant, updatedAt: new Date().toISOString() });
+      let periods = [];
+      let accountRelationPeriods = [];
+      let regionRelationPeriods = [];
+      let message;
+      if (queryEnabled) {
+        try {
+          const primaryGranularity = granularity === "DAILY" ? "DAILY" : "MONTHLY";
+          [periods, accountRelationPeriods, regionRelationPeriods] = await Promise.all([
+            this.explorerService.grouped(client, accounts, range, dimension, primaryGranularity, selections),
+            groupBy === "resource" || groupBy === "account" ? Promise.resolve([]) : this.explorerService.grouped(client, accounts, range, [dimension, "LINKED_ACCOUNT"], primaryGranularity, selections),
+            groupBy === "resource" || groupBy === "region" ? Promise.resolve([]) : this.explorerService.grouped(client, accounts, range, [dimension, "REGION"], primaryGranularity, selections),
+          ]);
+        } catch (error) {
+          if (groupBy !== "resource" || error.name !== "ValidationException") throw error;
+          message = "Resource-level Cost Explorer data is not enabled for this payer account.";
+          this.logger.warn?.("[Cost] Resource report unavailable", error.message);
+        }
+      }
+      const parseType = groupBy === "service" ? "service" : groupBy === "account" ? "account" : undefined;
+      const accountRelationships = parseRelationships(accountRelationPeriods, parseType, "account", names);
+      const regionRelationships = parseRelationships(regionRelationPeriods, parseType, "region", names);
+      const summary = parseGroups(periods, names, parseType).map((item) => ({ ...item, accounts: groupBy === "account" ? [{ key: item.accountId || item.key, label: item.label, amount: item.amount }] : accountRelationships.get(item.key) || [], regions: groupBy === "region" ? [{ key: item.key, label: item.label, amount: item.amount }] : regionRelationships.get(item.key) || [] }));
+      const timeline = periods.map((period) => ({ start: period.TimePeriod?.Start, end: period.TimePeriod?.End, total: round((period.Groups || []).reduce((sum, group) => sum + amount(group.Metrics?.UnblendedCost), 0)), groups: parseGroups([period], names, parseType) }));
+      return res.json({ tenantId: tenant, groupBy, range, currency: "USD", totalCost: round(summary.reduce((sum, item) => sum + item.amount, 0)), count: summary.length, summary, timeline, filters: selections, updatedAt: new Date().toISOString(), costBasis: queryEnabled ? "gross-positive-unblended" : undefined, dataSource: queryEnabled ? "aws-cost-explorer" : "onboarding", accessMode, message });
+    } catch (error) { return next(error); }
+  }
+
+  async tags(req, res, next) {
+    try {
+      const ctx = await this.contextService.resolve(req);
+      const { accounts, client, queryEnabled, accessMode } = ctx;
+      const cur = await this.curProvider.run(ctx, (athena, config) => getCurTags({ client: athena, config, tenant: ctx.tenant }));
+      if (cur) return res.json({ tags: cur, dataSource: "aws-cur-athena", accessMode: "cur-readonly" });
+      if (!queryEnabled) return res.json({ tags: [], dataSource: "onboarding", accessMode });
+      const response = await client.send(new GetTagsCommand({ TimePeriod: dateRange(req.query), Filter: accountFilter(accounts.map((item) => item.id)) }));
+      return res.json({ tags: response.Tags || [], dataSource: "aws-cost-explorer", accessMode });
+    } catch (error) { return next(error); }
+  }
+
+  async curDiscovery(req, res, next) {
+    try {
+      const ctx = await this.contextService.resolve(req);
+      if (!this.discoveryRepository) return res.json({ tenantId: ctx.tenant, jobs: [], logs: [] });
+      const { jobs, logs } = await this.discoveryRepository.statusForTenant(ctx.tenant, req.query.logLimit);
+      return res.json({
+        tenantId: ctx.tenant,
+        jobs: jobs.map((job) => ({
+          id: String(job.id),
+          connectionId: job.connection_id,
+          status: job.status,
+          attemptCount: Number(job.attempt_count || 0),
+          bucket: job.cur_bucket,
+          prefix: job.cur_prefix,
+          region: job.cur_region,
+          tenantPartition: job.tenant_partition,
+          database: job.glue_database,
+          table: job.glue_table,
+          tableLocation: job.table_location,
+          curS3Uri: job.cur_s3_uri,
+          sampleObjectKey: job.sample_object_key,
+          lastDataAt: job.last_data_at,
+          lastError: job.last_error,
+          nextRunAt: job.next_run_at,
+          lastStartedAt: job.last_started_at,
+          lastFinishedAt: job.last_finished_at,
+          updatedAt: job.updated_at,
+        })),
+        logs: logs.map((entry) => ({
+          id: String(entry.id),
+          jobId: String(entry.job_id),
+          level: entry.level,
+          event: entry.event,
+          message: entry.message,
+          details: entry.details || {},
+          createdAt: entry.created_at,
+        })),
+      });
+    } catch (error) { return next(error); }
+  }
+
+  async dataStatus(req, res, next) {
+    try {
+      const ctx = await this.contextService.resolve(req);
+      const status = await this.curProvider.status(ctx);
+      try {
+        await this.contextService.recordCurStatus(ctx.tenant, status);
+      } catch (error) {
+        this.logger.warn?.("[Cost] Failed to persist CUR readiness", error.message);
+      }
+      return res.json({
+        tenantId: ctx.tenant,
+        customerAccessMode: ctx.accessMode,
+        ...status,
+      });
+    } catch (error) { return next(error); }
+  }
+
+}

package/src/cur-discovery/cur-discovery.aws.js

@@ -0,0 +1,82 @@
+import { GetTablesCommand, GlueClient } from "@aws-sdk/client-glue";
+import { ListObjectsV2Command, S3Client } from "@aws-sdk/client-s3";
+import { fromTemporaryCredentials } from "@aws-sdk/credential-providers";
+
+const cleanPrefix = (value) => String(value || "").replace(/^\/+|\/+$/g, "");
+const normalizeS3Uri = (value) => `${String(value || "").replace(/\/+$/g, "")}/`;
+
+function centralCredentials(env, credentialProvider) {
+  const roleArn = String(env.COST_CUR_ROLE_ARN || "").trim();
+  if (!roleArn) return undefined;
+  return credentialProvider({
+    params: {
+      RoleArn: roleArn,
+      RoleSessionName: "meyi-cur-discovery",
+      ExternalId: env.COST_CUR_EXTERNAL_ID || undefined,
+    },
+  });
+}
+
+export class CurDiscoveryAws {
+  constructor({
+    env = process.env,
+    credentialProvider = fromTemporaryCredentials,
+    glueClient,
+    s3Client,
+  } = {}) {
+    this.env = env;
+    this.region = String(env.COST_CUR_REGION || env.AWS_REGION || "us-east-1");
+    this.database = String(env.COST_CUR_DATABASE || "").trim();
+    this.tableOverride = String(env.COST_CUR_TABLE || "").trim();
+    this.tenantColumn = String(env.COST_CUR_TENANT_COLUMN || "tenant_id").trim();
+    const credentials = centralCredentials(env, credentialProvider);
+    this.glue = glueClient || new GlueClient({ region: this.region, credentials });
+    this.s3 = s3Client || new S3Client({ region: this.region, credentials });
+  }
+
+  async firstTenantObject(job) {
+    const prefix = `${cleanPrefix(job.cur_prefix)}/`;
+    const response = await this.s3.send(new ListObjectsV2Command({
+      Bucket: job.cur_bucket,
+      Prefix: prefix,
+      MaxKeys: 1,
+    }));
+    const object = response.Contents?.[0];
+    return object ? { key: object.Key, lastModified: object.LastModified || null } : null;
+  }
+
+  async findCompatibleTable(job) {
+    if (!this.database) return null;
+    const tenantUri = normalizeS3Uri(`s3://${job.cur_bucket}/${cleanPrefix(job.cur_prefix)}`);
+    const candidates = [];
+    let nextToken;
+    do {
+      const response = await this.glue.send(new GetTablesCommand({
+        DatabaseName: this.database,
+        NextToken: nextToken,
+      }));
+      for (const table of response.TableList || []) {
+        const location = normalizeS3Uri(table.StorageDescriptor?.Location);
+        const columns = new Set((table.StorageDescriptor?.Columns || []).map((item) => String(item.Name || "").toLowerCase()));
+        const partitions = new Set((table.PartitionKeys || []).map((item) => String(item.Name || "").toLowerCase()));
+        const pathMatches = location && (tenantUri.startsWith(location) || location.startsWith(tenantUri));
+        const tenantSafe = partitions.has(this.tenantColumn.toLowerCase()) || columns.has(this.tenantColumn.toLowerCase());
+        const curSchema = columns.has("line_item_usage_start_date");
+        if (pathMatches && tenantSafe && curSchema) {
+          candidates.push({
+            database: this.database,
+            name: table.Name,
+            location,
+            tenantColumn: this.tenantColumn,
+          });
+        }
+      }
+      nextToken = response.NextToken;
+    } while (nextToken);
+
+    if (this.tableOverride) {
+      return candidates.find((table) => table.name === this.tableOverride) || null;
+    }
+    return candidates.length === 1 ? candidates[0] : null;
+  }
+}

package/src/cur-discovery/cur-discovery.repository.js

@@ -0,0 +1,177 @@
+import { sql } from "drizzle-orm";
+import { rows } from "../lib/cost-utils.js";
+
+export class CurDiscoveryRepository {
+  constructor({ db, schema, qSchema }) {
+    this.db = db;
+    this.schema = schema;
+    this.jobsTable = `${qSchema}.cost_cur_discovery_jobs`;
+    this.logsTable = `${qSchema}.cost_cur_discovery_job_logs`;
+    this.curConfigTable = `${qSchema}.cost_cur_config`;
+    this.connectionsTable = `${qSchema}.aws_connections`;
+    this.pluginsTable = `${qSchema}.plugins`;
+  }
+
+  async seedEligibleJobs() {
+    const relations = rows(await this.db.execute(sql`
+      SELECT
+        to_regclass(${`${this.schema}.cost_cur_config`}) AS cur_config_table,
+        to_regclass(${`${this.schema}.aws_connections`}) AS connections_table,
+        to_regclass(${`${this.schema}.plugins`}) AS plugins_table
+    `))[0] || {};
+    if (!relations.cur_config_table || !relations.connections_table || !relations.plugins_table) return 0;
+
+    const result = await this.db.execute(sql.raw(`
+      INSERT INTO ${this.jobsTable} (
+        tenant_id, connection_id, cur_bucket, cur_prefix, cur_region, tenant_partition, next_run_at
+      )
+      SELECT
+        c.tenant_id::text, c.connection_id, c.bucket, c.prefix, c.region, c.tenant_partition, now()
+      FROM ${this.curConfigTable} c
+      JOIN ${this.connectionsTable} a
+        ON a.connection_id = c.connection_id
+       AND a.tenant_id::text = c.tenant_id::text
+      JOIN ${this.pluginsTable} p
+        ON p.tenant_id::text = c.tenant_id::text
+       AND lower(p.name) = 'cost'
+      WHERE a.status = 'CONNECTED'
+        AND a.plugins ? 'Cost'
+        AND COALESCE(p.is_entitled, false) = true
+        AND COALESCE(p.is_installed, false) = true
+        AND COALESCE(p.is_enabled, false) = true
+      ON CONFLICT (tenant_id, connection_id) DO UPDATE SET
+        cur_bucket = EXCLUDED.cur_bucket,
+        cur_prefix = EXCLUDED.cur_prefix,
+        cur_region = EXCLUDED.cur_region,
+        tenant_partition = EXCLUDED.tenant_partition,
+        updated_at = now()
+      RETURNING id
+    `));
+    return rows(result).length;
+  }
+
+  async dueJobs(limit = 25) {
+    return rows(await this.db.execute(sql.raw(`
+      SELECT j.*
+      FROM ${this.jobsTable} j
+      JOIN ${this.curConfigTable} c
+        ON c.tenant_id::text = j.tenant_id
+       AND c.connection_id = j.connection_id
+      JOIN ${this.connectionsTable} a
+        ON a.connection_id = j.connection_id
+       AND a.tenant_id::text = j.tenant_id
+      JOIN ${this.pluginsTable} p
+        ON p.tenant_id::text = j.tenant_id
+       AND lower(p.name) = 'cost'
+      WHERE j.status <> 'READY'
+        AND (j.next_run_at IS NULL OR j.next_run_at <= now())
+        AND a.status = 'CONNECTED'
+        AND a.plugins ? 'Cost'
+        AND COALESCE(p.is_entitled, false) = true
+        AND COALESCE(p.is_installed, false) = true
+        AND COALESCE(p.is_enabled, false) = true
+      ORDER BY COALESCE(j.next_run_at, j.created_at), j.id
+      LIMIT ${Math.min(Math.max(Number(limit) || 25, 1), 100)}
+    `)));
+  }
+
+  async claim(jobId, leaseMs = 1_200_000) {
+    const leaseUntil = new Date(Date.now() + leaseMs);
+    const staleBefore = new Date(Date.now() - leaseMs);
+    return rows(await this.db.execute(sql`
+      UPDATE ${sql.raw(this.jobsTable)}
+      SET status = 'RUNNING',
+          attempt_count = attempt_count + 1,
+          last_started_at = now(),
+          next_run_at = ${leaseUntil},
+          last_error = NULL,
+          updated_at = now()
+      WHERE id = ${jobId}
+        AND status <> 'READY'
+        AND (next_run_at IS NULL OR next_run_at <= now())
+        AND (status <> 'RUNNING' OR last_started_at IS NULL OR last_started_at <= ${staleBefore})
+      RETURNING *
+    `))[0] || null;
+  }
+
+  async log(job, level, event, message, details = {}) {
+    await this.db.execute(sql`
+      INSERT INTO ${sql.raw(this.logsTable)} (job_id, tenant_id, level, event, message, details)
+      VALUES (${job.id}, ${job.tenant_id}, ${level}, ${event}, ${message}, ${JSON.stringify(details)}::jsonb)
+    `);
+  }
+
+  async wait(job, { status, intervalMs, error = null, sampleObjectKey = null, table = null }) {
+    const nextRunAt = new Date(Date.now() + intervalMs);
+    await this.db.execute(sql`
+      UPDATE ${sql.raw(this.jobsTable)}
+      SET status = ${status},
+          next_run_at = ${nextRunAt},
+          last_finished_at = now(),
+          sample_object_key = COALESCE(${sampleObjectKey}, sample_object_key),
+          glue_database = COALESCE(${table?.database || null}, glue_database),
+          glue_table = COALESCE(${table?.name || null}, glue_table),
+          table_location = COALESCE(${table?.location || null}, table_location),
+          cur_s3_uri = ${`s3://${job.cur_bucket}/${String(job.cur_prefix).replace(/^\/+|\/+$/g, "")}/`},
+          last_error = ${error},
+          updated_at = now()
+      WHERE id = ${job.id}
+    `);
+    await this.updateCurConfig(job, status === "FAILED" ? "FAILED" : "WAITING_FOR_DATA", null);
+  }
+
+  async ready(job, { table, sampleObjectKey, lastDataAt }) {
+    await this.db.execute(sql`
+      UPDATE ${sql.raw(this.jobsTable)}
+      SET status = 'READY',
+          next_run_at = NULL,
+          last_finished_at = now(),
+          glue_database = ${table.database},
+          glue_table = ${table.name},
+          table_location = ${table.location},
+          cur_s3_uri = ${`s3://${job.cur_bucket}/${String(job.cur_prefix).replace(/^\/+|\/+$/g, "")}/`},
+          sample_object_key = ${sampleObjectKey},
+          last_data_at = ${lastDataAt || null},
+          last_error = NULL,
+          updated_at = now()
+      WHERE id = ${job.id}
+    `);
+    await this.updateCurConfig(job, "READY", lastDataAt);
+  }
+
+  async updateCurConfig(job, status, lastDataAt) {
+    await this.db.execute(sql`
+      UPDATE ${sql.raw(this.curConfigTable)}
+      SET status = ${status},
+          last_data_at = COALESCE(${lastDataAt || null}, last_data_at),
+          verified_at = now(),
+          updated_at = now()
+      WHERE tenant_id::text = ${job.tenant_id}
+        AND connection_id = ${job.connection_id}
+    `);
+  }
+  /**
+   * Discovery jobs for a tenant with their most recent log lines, for the
+   * Cost > CUR Discovery screen. Read-only: the scheduler owns every write.
+   */
+  async statusForTenant(tenant, logLimit = 50) {
+    const jobs = rows(await this.db.execute(sql`
+      SELECT id, tenant_id, connection_id, cur_bucket, cur_prefix, cur_region,
+             tenant_partition, status, attempt_count, next_run_at, last_started_at,
+             last_finished_at, glue_database, glue_table, table_location, cur_s3_uri,
+             sample_object_key, last_data_at, last_error, created_at, updated_at
+      FROM ${sql.raw(this.jobsTable)}
+      WHERE tenant_id = ${tenant}
+      ORDER BY updated_at DESC
+    `));
+    if (!jobs.length) return { jobs: [], logs: [] };
+    const logs = rows(await this.db.execute(sql`
+      SELECT id, job_id, level, event, message, details, created_at
+      FROM ${sql.raw(this.logsTable)}
+      WHERE tenant_id = ${tenant}
+      ORDER BY created_at DESC, id DESC
+      LIMIT ${Math.min(Math.max(Number(logLimit) || 50, 1), 500)}
+    `));
+    return { jobs, logs };
+  }
+}

package/src/cur-discovery/cur-discovery.service.js

@@ -0,0 +1,112 @@
+import { getCurDataStatus } from "../services/cur.service.js";
+
+const safeError = (error) => String(error?.message || error || "Unknown CUR discovery error").slice(0, 2000);
+
+export class CurDiscoveryService {
+  constructor({ repository, aws, athenaContextService, logger = console, intervalMs = 3_600_000 }) {
+    this.repository = repository;
+    this.aws = aws;
+    this.athenaContextService = athenaContextService;
+    this.logger = logger;
+    this.intervalMs = intervalMs;
+  }
+
+  write(job, level, event, message, details = {}) {
+    const prefix = `[Cost CUR Discovery][tenant=${job.tenant_id}][job=${job.id}]`;
+    const method = level === "ERROR" ? "error" : level === "WARN" ? "warn" : "log";
+    this.logger[method]?.(`${prefix} ${event}: ${message}`, details);
+    return this.repository.log(job, level, event, message, details);
+  }
+
+  async run(rawJob) {
+    const job = await this.repository.claim(rawJob.id, this.intervalMs);
+    if (!job) return;
+    await this.write(job, "INFO", "STARTED", "Checking tenant CUR delivery and catalog state", {
+      connectionId: job.connection_id,
+      bucket: job.cur_bucket,
+      prefix: job.cur_prefix,
+      attempt: job.attempt_count,
+    });
+
+    try {
+      const object = await this.aws.firstTenantObject(job);
+      if (!object) {
+        await this.repository.wait(job, { status: "WAITING_FOR_DATA", intervalMs: this.intervalMs });
+        await this.write(job, "INFO", "S3_DATA_PENDING", "No CUR object is available for this tenant; retry scheduled", {
+          nextCheckMinutes: Math.round(this.intervalMs / 60000),
+        });
+        return;
+      }
+
+      const table = await this.aws.findCompatibleTable(job);
+      if (!table) {
+        await this.repository.wait(job, {
+          status: "WAITING_FOR_TABLE",
+          intervalMs: this.intervalMs,
+          sampleObjectKey: object.key,
+        });
+        await this.write(job, "INFO", "GLUE_TABLE_PENDING", "Tenant CUR data exists but no unique compatible Glue table was found", {
+          database: this.aws.database,
+          sampleObjectKey: object.key,
+          nextCheckMinutes: Math.round(this.intervalMs / 60000),
+        });
+        return;
+      }
+
+      const customerContext = {
+        tenant: job.tenant_id,
+        meta: {
+          curDiscoveredTable: table.name,
+          curTenantPartition: job.tenant_partition,
+          curSourceBucket: job.cur_bucket,
+          curSourcePrefix: job.cur_prefix,
+          curSourceRegion: job.cur_region,
+          curIngestionMode: "central",
+        },
+      };
+      const context = this.athenaContextService.resolve(customerContext);
+      if (!context.config.enabled || !context.client) {
+        throw new Error(context.config.disabledReason || "Central CUR/Athena is not fully configured");
+      }
+      const readiness = await getCurDataStatus({
+        client: context.client,
+        config: context.config,
+        tenant: job.tenant_id,
+      });
+      if (readiness.recordCount < 1) {
+        await this.repository.wait(job, {
+          status: "WAITING_FOR_DATA",
+          intervalMs: this.intervalMs,
+          sampleObjectKey: object.key,
+          table,
+        });
+        await this.write(job, "INFO", "ATHENA_DATA_PENDING", "Glue table exists but Athena has no rows for this tenant partition", {
+          database: table.database,
+          table: table.name,
+          tableLocation: table.location,
+          nextCheckMinutes: Math.round(this.intervalMs / 60000),
+        });
+        return;
+      }
+
+      await this.repository.ready(job, {
+        table,
+        sampleObjectKey: object.key,
+        lastDataAt: readiness.lastDataAt,
+      });
+      await this.write(job, "INFO", "READY", "Tenant CUR discovery completed; automatic polling stopped for this job", {
+        database: table.database,
+        table: table.name,
+        tableLocation: table.location,
+        recordCount: readiness.recordCount,
+        lastDataAt: readiness.lastDataAt,
+      });
+    } catch (error) {
+      const message = safeError(error);
+      await this.repository.wait(job, { status: "FAILED", intervalMs: this.intervalMs, error: message });
+      await this.write(job, "ERROR", "FAILED", message, {
+        nextCheckMinutes: Math.round(this.intervalMs / 60000),
+      });
+    }
+  }
+}