herosjourney · Nov 10, 2026 · Nov 11, 2026 · Nov 11, 2026 · Nov 11, 2026 · Nov 11, 2026
@@ -24,10 +24,7 @@
     "per_vcpu_hour_arm64": 0.03238,
     "per_gb_mem_hour_arm64": 0.003556
   },
-  "alb": {
-    "monthly_fixed": 16.43,
-    "per_lcu_hour": 0.008
-  },
+  "alb": {"monthly_fixed": 16.43, "per_lcu_hour": 0.008},
   "nlb": {
     "monthly_fixed": 16.43,
     "per_lcu_hour": 0.006,
@@ -85,9 +82,10 @@
       "db.r6g.2xlarge": 1.038,
       "db.r6g.4xlarge": 2.076,
       "db.r6g.8xlarge": 4.153,
-      "db.r6g.16xlarge": 8.306
+      "db.r6g.16xlarge": 8.306,
+      "db.x2g.16xlarge": 12.064
     },
-    "_instances_note": "Re-verified via the AWS Pricing MCP server on 2026-10-05 (AmazonRDS, databaseEngine=Aurora PostgreSQL, deploymentOption=Single-AZ, non-IO-optimized). r6g.xlarge/2xlarge/4xlarge/8xlarge/16xlarge moved down ~6% from the previous extrapolated values; db.t4g.* and db.r6g.large were unchanged.",
+    "_instances_note": "Re-verified via the AWS Pricing MCP server on 2026-10-05 (AmazonRDS, databaseEngine=Aurora PostgreSQL, deploymentOption=Single-AZ, non-IO-optimized). r6g.xlarge/2xlarge/4xlarge/8xlarge/16xlarge moved down ~6% from the previous extrapolated values; db.t4g.* and db.r6g.large were unchanged. db.x2g.16xlarge (1,024 GiB) added 2026-11-10 from the AWS Pricing MCP server (AmazonRDS, databaseEngine=Aurora PostgreSQL, deploymentOption=Single-AZ, standard not IO-optimized, us-east-1): $12.064/hr.",
     "storage_per_gb_month": 0.1,
     "io_per_million": 0.2
   },
@@ -162,23 +160,15 @@
     },
     "pod_cost": 0
   },
-  "nat_gateway": {
-    "monthly_fixed": 32.85,
-    "per_gb_processed": 0.045
-  },
+  "nat_gateway": {"monthly_fixed": 32.85, "per_gb_processed": 0.045},
   "ebs": {
     "_comment": "EBS volume pricing (us-east-1). Used to price EC2-backed compute root volumes (Elastic Beanstalk instances, EKS nodes) so EB estimates need no known-omission caveat.",
     "gp3_per_gb_month": 0.08,
     "eb_root_volume_gb_default": 8,
     "_default_note": "eb_root_volume_gb_default is the AL2023 EB default root size; use aws_config.root_volume_gb when the design specifies one."
   },
-  "rds_proxy": {
-    "per_vcpu_hour": 0.015
-  },
-  "route53": {
-    "hosted_zone_monthly": 0.5,
-    "per_million_queries": 0.4
-  },
+  "rds_proxy": {"per_vcpu_hour": 0.015},
+  "route53": {"hosted_zone_monthly": 0.5, "per_million_queries": 0.4},
   "sqs": {
     "standard_per_million_requests": 0.4,
     "fifo_per_million_requests": 0.5,
@@ -207,12 +197,8 @@
       "monthly_baseline_est": 1,
       "_basis": "assumes ~1M cron-scale events/mo @ per_million_events"
     },
-    "amazon_mq": {
-      "instance_monthly_est": 130
-    },
-    "opensearch": {
-      "instance_monthly_est": 100
-    },
+    "amazon_mq": {"instance_monthly_est": 130},
+    "opensearch": {"instance_monthly_est": 100},
     "cloudfront": {
       "per_gb_first_10tb": 0.085,
       "monthly_baseline_est": 10,

@@ -1,47 +1,75 @@
 {
   "_comment": "Fast-path add-on -> AWS service mapping for non-core add-ons (anything that is NOT heroku-postgresql/heroku-redis/heroku-kafka). DIRECT LOOKUP on a normalized name. All matches get confidence 'deterministic'.",
   "_match": "EXACT, case-insensitive, full-string match on the NORMALIZED add-on name against a rows key. Partial matches are INVALID (e.g. 'paper' does NOT match 'papertrail'; 'New Relic APM' does NOT match 'new relic').",
-  "_normalize": "from config.addon_service: strip a leading 'heroku-' prefix; replace hyphens with spaces; lowercase. Then apply the prefix aliases below before matching.",
+  "_normalize": "from config.addon_service: strip a leading 'heroku-' prefix; replace hyphens with spaces; lowercase. Then apply the prefix aliases below before matching. Aliases are keyed by the string as it looks AFTER prefix stripping and hyphen replacement: `heroku-connect` -> `connect` -> alias -> `herokuconnect`; `Heroku Connect` -> `heroku connect` -> alias -> `herokuconnect`; `herokuconnect` matches its row directly.",
   "_prefix_aliases": {
     "bonsai": "bonsai elasticsearch",
     "scout": "scout apm",
     "newrelic": "new relic",
-    "new-relic": "new relic"
+    "new-relic": "new relic",
+    "heroku scheduler": "scheduler",
+    "jawsdb-maria": "jawsdb maria",
+    "heroku connect": "herokuconnect",
+    "connect": "herokuconnect"
   },
   "_on_not_found": "route to the specialist gate: append a deferred[] entry {addon_name, addon_plan, provider, reason: 'Not found in Fast_Path_Table', recommendation: 'Engage AWS account team for replacement selection'}; produce NO service entry; continue",
   "rows": {
-    "papertrail": { "type": "single", "aws_services": ["CloudWatch Logs"], "notes": "Log aggregation and search" },
-    "sendgrid": { "type": "single", "aws_services": ["Amazon SES"], "notes": "Transactional and marketing email" },
-    "heroku scheduler": {
+    "papertrail": {"type": "single", "aws_services": ["CloudWatch Logs"], "notes": "Log aggregation and search"},
+    "sendgrid": {"type": "single", "aws_services": ["Amazon SES"], "notes": "Transactional and marketing email"},
+    "scheduler": {
       "type": "single",
       "aws_services": ["EventBridge Scheduler"],
-      "notes": "Cron-style scheduled jobs"
+      "notes": "Heroku Scheduler (CLI slug `scheduler`, display name 'Heroku Scheduler'). Cron-style scheduled jobs"
     },
-    "memcachier": {
+    "advanced scheduler": {
       "type": "single",
-      "aws_services": ["ElastiCache Memcached"],
-      "notes": "In-memory caching (Memcached protocol)"
-    },
-    "bucketeer": { "type": "single", "aws_services": ["S3"], "notes": "Object/file storage" },
-    "cloudamqp": { "type": "single", "aws_services": ["Amazon MQ"], "notes": "RabbitMQ-compatible message broker" },
-    "bonsai elasticsearch": {
-      "type": "single",
-      "aws_services": ["Amazon OpenSearch"],
-      "notes": "Full-text search and analytics"
+      "aws_services": ["EventBridge Scheduler"],
+      "notes": "Advanced Scheduler add-on (slug `advanced-scheduler`). Cron-style jobs with finer intervals; EventBridge Scheduler supports one-minute and one-off schedules"
     },
-    "scout apm": { "type": "composite", "aws_services": ["CloudWatch", "X-Ray"], "notes": "APM + distributed tracing" },
-    "rollbar": { "type": "single", "aws_services": ["CloudWatch"], "notes": "Error tracking via structured logs" },
+    "memcachier": {"type": "single", "aws_services": ["ElastiCache Memcached"], "notes": "In-memory caching (Memcached protocol)"},
+    "bucketeer": {"type": "single", "aws_services": ["S3"], "notes": "Object/file storage"},
+    "cloudamqp": {"type": "single", "aws_services": ["Amazon MQ"], "notes": "RabbitMQ-compatible message broker"},
+    "bonsai elasticsearch": {"type": "single", "aws_services": ["Amazon OpenSearch"], "notes": "Full-text search and analytics"},
+    "scout apm": {"type": "composite", "aws_services": ["CloudWatch", "X-Ray"], "notes": "APM + distributed tracing"},
+    "rollbar": {"type": "single", "aws_services": ["CloudWatch"], "notes": "Error tracking via structured logs"},
     "new relic": {
       "type": "composite",
       "aws_services": ["CloudWatch", "X-Ray"],
       "notes": "Full-stack observability + distributed tracing"
     },
-    "twilio": { "type": "single", "aws_services": ["Amazon SNS (SMS)"], "notes": "SMS messaging" },
-    "cloudinary": {
-      "type": "composite",
-      "aws_services": ["S3", "CloudFront"],
-      "notes": "Media storage + CDN delivery"
+    "twilio": {"type": "single", "aws_services": ["Amazon SNS (SMS)"], "notes": "SMS messaging"},
+    "cloudinary": {"type": "composite", "aws_services": ["S3", "CloudFront"], "notes": "Media storage + CDN delivery"},
+    "sentry": {"type": "single", "aws_services": ["CloudWatch"], "notes": "Error tracking via structured logs"},
+    "rediscloud": {
+      "type": "single",
+      "aws_services": ["ElastiCache Valkey"],
+      "notes": "Redis Cloud (Redis Ltd.) third-party Redis. Plan name is the memory in MB (e.g. `30`, `100`, `250`, `1000`). Design 2E step 4b produces a FULL ElastiCache entry (same shape as 2C step 8, engine valkey; ElastiCache Redis only under the 2C Redis OSS exception). Node type comes from a memory_limit lookup in redis-elasticache-sizing.json — a documented exception to that file's PROVENANCE ONLY rule, because a third-party plan has no Heroku plan row to read node_type from. Plans above the largest row, or with no parseable MB, are deferred.",
+      "sizing": "redis-elasticache-sizing.json by memory_limit (2E step 4b; documented exception to PROVENANCE ONLY)"
+    },
+    "jawsdb": {
+      "type": "single",
+      "aws_services": ["RDS MySQL"],
+      "notes": "JawsDB MySQL. No RDS MySQL rate rows in aws-infra-pricing.json yet — the Estimate marks this line unpriced and excludes it from totals rather than inventing a rate"
     },
-    "sentry": { "type": "single", "aws_services": ["CloudWatch"], "notes": "Error tracking via structured logs" }
+    "jawsdb maria": {
+      "type": "single",
+      "aws_services": ["RDS MariaDB"],
+      "notes": "JawsDB MariaDB. Unpriced in the Estimate until a rate row exists"
+    },
+    "auth0": {
+      "type": "single",
+      "aws_services": ["Amazon Cognito"],
+      "notes": "Identity provider. Auth0 is SaaS and can be retained unchanged; Cognito is the AWS-native target. User-store migration (password hashes, social connections, rules/actions) is a project in itself — surface it in the report, do not imply a lift-and-shift"
+    },
+    "herokuconnect": {
+      "type": "single",
+      "aws_services": ["Amazon AppFlow"],
+      "notes": "Heroku Connect: bidirectional Salesforce <-> Postgres sync. AppFlow's Salesforce connector covers scheduled/event-driven sync into RDS/Aurora via S3 or a custom connector; true bidirectional write-back needs validation per object. Unpriced in the Estimate"
+    },
+    "inference": {
+      "type": "single",
+      "aws_services": ["Amazon Bedrock"],
+      "notes": "Heroku Inference (slug `heroku-inference`). Target is Amazon Bedrock, but nothing carries over unchanged: Heroku Inference model IDs (e.g. `claude-sonnet-5-5`, `nova-pro`, `gpt-oss-120b`) are served on an OpenAI-style /v1/chat/completions endpoint, while Bedrock uses its own model / inference-profile IDs and the Converse or InvokeModel API. Both the IDs and the client code must be remapped — hand the code change to the llm-to-bedrock skill. Unpriced in the Estimate (token-based)"
+    }
   }
 }
@@ -4,10 +4,10 @@
   "_on_not_found": "defer to specialist gate; append warning 'Unrecognized heroku-kafka plan tier: {plan}. Cannot determine MSK broker instance type. Deferring to specialist engagement.'; continue",
   "_broker_count_and_azs": {
     "basic": { "broker_count": 2, "availability_zones": 2 },
-    "standard|extended|private": { "broker_count": 3, "availability_zones": 3 },
-    "_floor": "never fewer than 2 brokers or 2 AZs"
+    "_floor": "never fewer than 2 brokers or 2 AZs",
+    "standard|extended|private|shield": { "broker_count": 3, "availability_zones": 3 }
   },
-  "_topology_preservation": "max_topics from config.topics else row; max_partitions from config.partitions else row; replication_factor from config.replication_factor else default (3 for standard/extended/private, 2 for basic)",
+  "_topology_preservation": "max_topics from config.topics else row; max_partitions from config.partitions else row; replication_factor from config.replication_factor else default (3 for standard/extended/private/shield, 2 for basic)",
   "rows": {
     "basic-0": {
       "tier": "basic",
@@ -79,6 +79,36 @@
       "storage_per_broker_gb": 4096,
       "default_replication_factor": 3
     },
+    "private-standard-0": {
+      "tier": "private",
+      "max_topics": 40,
+      "max_partitions": 160,
+      "storage": "50 GB",
+      "throughput": "20 MB/s",
+      "broker_instance_type": "kafka.m5.large",
+      "storage_per_broker_gb": 100,
+      "default_replication_factor": 3
+    },
+    "private-standard-1": {
+      "tier": "private",
+      "max_topics": 100,
+      "max_partitions": 400,
+      "storage": "200 GB",
+      "throughput": "50 MB/s",
+      "broker_instance_type": "kafka.m5.xlarge",
+      "storage_per_broker_gb": 250,
+      "default_replication_factor": 3
+    },
+    "private-standard-2": {
+      "tier": "private",
+      "max_topics": 200,
+      "max_partitions": 1600,
+      "storage": "1 TB",
+      "throughput": "100 MB/s",
+      "broker_instance_type": "kafka.m5.2xlarge",
+      "storage_per_broker_gb": 500,
+      "default_replication_factor": 3
+    },
     "private-extended-0": {
       "tier": "private",
       "max_topics": 200,
@@ -108,6 +138,73 @@
       "broker_instance_type": "kafka.m5.12xlarge",
       "storage_per_broker_gb": 4096,
       "default_replication_factor": 3
+    },
+    "shield-standard-0": {
+      "tier": "shield",
+      "max_topics": 40,
+      "max_partitions": 160,
+      "storage": "50 GB",
+      "throughput": "20 MB/s",
+      "broker_instance_type": "kafka.m5.large",
+      "storage_per_broker_gb": 100,
+      "default_replication_factor": 3,
+      "compliance": "hipaa/pci"
+    },
+    "shield-standard-1": {
+      "tier": "shield",
+      "max_topics": 100,
+      "max_partitions": 400,
+      "storage": "200 GB",
+      "throughput": "50 MB/s",
+      "broker_instance_type": "kafka.m5.xlarge",
+      "storage_per_broker_gb": 250,
+      "default_replication_factor": 3,
+      "compliance": "hipaa/pci"
+    },
+    "shield-standard-2": {
+      "tier": "shield",
+      "max_topics": 200,
+      "max_partitions": 1600,
+      "storage": "1 TB",
+      "throughput": "100 MB/s",
+      "broker_instance_type": "kafka.m5.2xlarge",
+      "storage_per_broker_gb": 500,
+      "default_replication_factor": 3,
+      "compliance": "hipaa/pci"
+    },
+    "shield-extended-0": {
+      "tier": "shield",
+      "max_topics": 200,
+      "max_partitions": 2000,
+      "storage": "2 TB",
+      "throughput": "150 MB/s",
+      "broker_instance_type": "kafka.m5.4xlarge",
+      "storage_per_broker_gb": 1024,
+      "default_replication_factor": 3,
+      "compliance": "hipaa/pci"
+    },
+    "shield-extended-1": {
+      "tier": "shield",
+      "max_topics": 400,
+      "max_partitions": 4000,
+      "storage": "4 TB",
+      "throughput": "200 MB/s",
+      "broker_instance_type": "kafka.m5.8xlarge",
+      "storage_per_broker_gb": 2048,
+      "default_replication_factor": 3,
+      "compliance": "hipaa/pci"
+    },
+    "shield-extended-2": {
+      "tier": "shield",
+      "max_topics": 600,
+      "max_partitions": 8000,
+      "storage": "8 TB",
+      "throughput": "300 MB/s",
+      "broker_instance_type": "kafka.m5.12xlarge",
+      "storage_per_broker_gb": 4096,
+      "default_replication_factor": 3,
+      "compliance": "hipaa/pci"
     }
-  }
+  },
+  "_tier_note": "private-standard-*/private-extended-* run inside a Private Space and shield-* inside a Shield Space; capacity matches the Common Runtime plan of the same number, so the MSK row is identical — the space itself is handled by the VPC design, not by broker sizing."
 }