diff --git a/gen/go/infracost/parser/options/options.pb.go b/gen/go/infracost/parser/options/options.pb.go
index 27e7d0d..115274e 100644
--- a/gen/go/infracost/parser/options/options.pb.go
+++ b/gen/go/infracost/parser/options/options.pb.go
@@ -104,8 +104,24 @@ type GenericOptions struct {
 	DependencyRequest *DependencyRequest `protobuf:"bytes,13,opt,name=dependency_request,json=dependencyRequest,proto3,oneof" json:"dependency_request,omitempty"`
 	// Enable http first git normalization
 	EnableGitNormalization bool `protobuf:"varint,14,opt,name=enable_git_normalization,json=enableGitNormalization,proto3" json:"enable_git_normalization,omitempty"`
-	unknownFields          protoimpl.UnknownFields
-	sizeCache              protoimpl.SizeCache
+	// FinOps naming-policy requirements (resource type -> required attributes). Source: org/dashboard
+	// policy. Cross-plugin (any IaC with taggable resources); today read by the terraform-family plugins.
+	RequiredAttributes []*AttributeRequirement `protobuf:"bytes,15,rep,name=required_attributes,json=requiredAttributes,proto3" json:"required_attributes,omitempty"`
+	// Default tags applied to all resources. Source: YOR config file / YOR_SIMPLE_TAGS env.
+	// Consumed by the terraform-family plugins.
+	DefaultTags map[string]string `protobuf:"bytes,16,rep,name=default_tags,json=defaultTags,proto3" json:"default_tags,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Flat module source map (module source -> replacement). Source: INFRACOST_TERRAFORM_SOURCE_MAP
+	// env. Consumed by the terraform-family plugins. NOTE: the regex source map from the config file
+	// (terraform.source_map) is user config and travels in the raw_options blob instead.
+	SourceMap map[string]string `protobuf:"bytes,17,rep,name=source_map,json=sourceMap,proto3" json:"source_map,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Environment variables for parsing (e.g. TF_VAR_*, TF_WORKSPACE). Source: runtime/integration
+	// env merged with the project's configured env. Consumed by the terraform-family plugins.
+	Env map[string]string `protobuf:"bytes,18,rep,name=env,proto3" json:"env,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Force module sources to resolve as local paths instead of downloading them. Source: caller flag.
+	// Consumed by the terraform-family plugins.
+	ForceLocalModulePaths bool `protobuf:"varint,19,opt,name=force_local_module_paths,json=forceLocalModulePaths,proto3" json:"force_local_module_paths,omitempty"`
+	unknownFields         protoimpl.UnknownFields
+	sizeCache             protoimpl.SizeCache
 }
 
 func (x *GenericOptions) Reset() {
@@ -236,6 +252,97 @@ func (x *GenericOptions) GetEnableGitNormalization() bool {
 	return false
 }
 
+func (x *GenericOptions) GetRequiredAttributes() []*AttributeRequirement {
+	if x != nil {
+		return x.RequiredAttributes
+	}
+	return nil
+}
+
+func (x *GenericOptions) GetDefaultTags() map[string]string {
+	if x != nil {
+		return x.DefaultTags
+	}
+	return nil
+}
+
+func (x *GenericOptions) GetSourceMap() map[string]string {
+	if x != nil {
+		return x.SourceMap
+	}
+	return nil
+}
+
+func (x *GenericOptions) GetEnv() map[string]string {
+	if x != nil {
+		return x.Env
+	}
+	return nil
+}
+
+func (x *GenericOptions) GetForceLocalModulePaths() bool {
+	if x != nil {
+		return x.ForceLocalModulePaths
+	}
+	return false
+}
+
+// AttributeRequirement lists the attributes a given resource type must set for a FinOps
+// naming/tagging policy.
+type AttributeRequirement struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The resource type the requirement applies to (e.g. "aws_instance").
+	ResourceType string `protobuf:"bytes,1,opt,name=resource_type,json=resourceType,proto3" json:"resource_type,omitempty"`
+	// The attributes that must be present on that resource type.
+	Attributes    []string `protobuf:"bytes,2,rep,name=attributes,proto3" json:"attributes,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AttributeRequirement) Reset() {
+	*x = AttributeRequirement{}
+	mi := &file_infracost_parser_options_options_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AttributeRequirement) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AttributeRequirement) ProtoMessage() {}
+
+func (x *AttributeRequirement) ProtoReflect() protoreflect.Message {
+	mi := &file_infracost_parser_options_options_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AttributeRequirement.ProtoReflect.Descriptor instead.
+func (*AttributeRequirement) Descriptor() ([]byte, []int) {
+	return file_infracost_parser_options_options_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *AttributeRequirement) GetResourceType() string {
+	if x != nil {
+		return x.ResourceType
+	}
+	return ""
+}
+
+func (x *AttributeRequirement) GetAttributes() []string {
+	if x != nil {
+		return x.Attributes
+	}
+	return nil
+}
+
 // DependencyRequest specifies parameters for extracting resource dependencies during parsing.
 // When set, the parser will use internal hooks to extract dependencies while the graph is available.
 type DependencyRequest struct {
@@ -254,7 +361,7 @@ type DependencyRequest struct {
 
 func (x *DependencyRequest) Reset() {
 	*x = DependencyRequest{}
-	mi := &file_infracost_parser_options_options_proto_msgTypes[1]
+	mi := &file_infracost_parser_options_options_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -266,7 +373,7 @@ func (x *DependencyRequest) String() string {
 func (*DependencyRequest) ProtoMessage() {}
 
 func (x *DependencyRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_infracost_parser_options_options_proto_msgTypes[1]
+	mi := &file_infracost_parser_options_options_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -279,7 +386,7 @@ func (x *DependencyRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DependencyRequest.ProtoReflect.Descriptor instead.
 func (*DependencyRequest) Descriptor() ([]byte, []int) {
-	return file_infracost_parser_options_options_proto_rawDescGZIP(), []int{1}
+	return file_infracost_parser_options_options_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *DependencyRequest) GetProjectName() string {
@@ -322,7 +429,7 @@ type Debug struct {
 
 func (x *Debug) Reset() {
 	*x = Debug{}
-	mi := &file_infracost_parser_options_options_proto_msgTypes[2]
+	mi := &file_infracost_parser_options_options_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -334,7 +441,7 @@ func (x *Debug) String() string {
 func (*Debug) ProtoMessage() {}
 
 func (x *Debug) ProtoReflect() protoreflect.Message {
-	mi := &file_infracost_parser_options_options_proto_msgTypes[2]
+	mi := &file_infracost_parser_options_options_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -347,7 +454,7 @@ func (x *Debug) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Debug.ProtoReflect.Descriptor instead.
 func (*Debug) Descriptor() ([]byte, []int) {
-	return file_infracost_parser_options_options_proto_rawDescGZIP(), []int{2}
+	return file_infracost_parser_options_options_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *Debug) GetAddresses() []string {
@@ -378,7 +485,7 @@ type CredentialSet struct {
 
 func (x *CredentialSet) Reset() {
 	*x = CredentialSet{}
-	mi := &file_infracost_parser_options_options_proto_msgTypes[3]
+	mi := &file_infracost_parser_options_options_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -390,7 +497,7 @@ func (x *CredentialSet) String() string {
 func (*CredentialSet) ProtoMessage() {}
 
 func (x *CredentialSet) ProtoReflect() protoreflect.Message {
-	mi := &file_infracost_parser_options_options_proto_msgTypes[3]
+	mi := &file_infracost_parser_options_options_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -403,7 +510,7 @@ func (x *CredentialSet) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CredentialSet.ProtoReflect.Descriptor instead.
 func (*CredentialSet) Descriptor() ([]byte, []int) {
-	return file_infracost_parser_options_options_proto_rawDescGZIP(), []int{3}
+	return file_infracost_parser_options_options_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *CredentialSet) GetToken() string {
@@ -443,7 +550,7 @@ type RemoteModuleCacheConfig struct {
 
 func (x *RemoteModuleCacheConfig) Reset() {
 	*x = RemoteModuleCacheConfig{}
-	mi := &file_infracost_parser_options_options_proto_msgTypes[4]
+	mi := &file_infracost_parser_options_options_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -455,7 +562,7 @@ func (x *RemoteModuleCacheConfig) String() string {
 func (*RemoteModuleCacheConfig) ProtoMessage() {}
 
 func (x *RemoteModuleCacheConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_infracost_parser_options_options_proto_msgTypes[4]
+	mi := &file_infracost_parser_options_options_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -468,7 +575,7 @@ func (x *RemoteModuleCacheConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RemoteModuleCacheConfig.ProtoReflect.Descriptor instead.
 func (*RemoteModuleCacheConfig) Descriptor() ([]byte, []int) {
-	return file_infracost_parser_options_options_proto_rawDescGZIP(), []int{4}
+	return file_infracost_parser_options_options_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *RemoteModuleCacheConfig) GetRegion() string {
@@ -515,7 +622,7 @@ type AwsCredentials struct {
 
 func (x *AwsCredentials) Reset() {
 	*x = AwsCredentials{}
-	mi := &file_infracost_parser_options_options_proto_msgTypes[5]
+	mi := &file_infracost_parser_options_options_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -527,7 +634,7 @@ func (x *AwsCredentials) String() string {
 func (*AwsCredentials) ProtoMessage() {}
 
 func (x *AwsCredentials) ProtoReflect() protoreflect.Message {
-	mi := &file_infracost_parser_options_options_proto_msgTypes[5]
+	mi := &file_infracost_parser_options_options_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -540,7 +647,7 @@ func (x *AwsCredentials) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AwsCredentials.ProtoReflect.Descriptor instead.
 func (*AwsCredentials) Descriptor() ([]byte, []int) {
-	return file_infracost_parser_options_options_proto_rawDescGZIP(), []int{5}
+	return file_infracost_parser_options_options_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *AwsCredentials) GetAccessKeyId() string {
@@ -580,7 +687,7 @@ type ProxyRouter struct {
 
 func (x *ProxyRouter) Reset() {
 	*x = ProxyRouter{}
-	mi := &file_infracost_parser_options_options_proto_msgTypes[6]
+	mi := &file_infracost_parser_options_options_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -592,7 +699,7 @@ func (x *ProxyRouter) String() string {
 func (*ProxyRouter) ProtoMessage() {}
 
 func (x *ProxyRouter) ProtoReflect() protoreflect.Message {
-	mi := &file_infracost_parser_options_options_proto_msgTypes[6]
+	mi := &file_infracost_parser_options_options_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -605,7 +712,7 @@ func (x *ProxyRouter) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProxyRouter.ProtoReflect.Descriptor instead.
 func (*ProxyRouter) Descriptor() ([]byte, []int) {
-	return file_infracost_parser_options_options_proto_rawDescGZIP(), []int{6}
+	return file_infracost_parser_options_options_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *ProxyRouter) GetRoutes() map[string]string {
@@ -619,7 +726,7 @@ var File_infracost_parser_options_options_proto protoreflect.FileDescriptor
 
 const file_infracost_parser_options_options_proto_rawDesc = "" +
 	"\n" +
-	"&infracost/parser/options/options.proto\x12\x18infracost.parser.options\"\xfd\x06\n" +
+	"&infracost/parser/options/options.proto\x12\x18infracost.parser.options\"\xc8\v\n" +
 	"\x0eGenericOptions\x12!\n" +
 	"\fproject_name\x18\x01 \x01(\tR\vprojectName\x12)\n" +
 	"\x10environment_name\x18\x02 \x01(\tR\x0fenvironmentName\x12%\n" +
@@ -635,8 +742,28 @@ const file_infracost_parser_options_options_proto_rawDesc = "" +
 	"\fproxy_router\x18\v \x01(\v2%.infracost.parser.options.ProxyRouterR\vproxyRouter\x12n\n" +
 	"\x1aremote_module_cache_config\x18\f \x01(\v21.infracost.parser.options.RemoteModuleCacheConfigR\x17remoteModuleCacheConfig\x12_\n" +
 	"\x12dependency_request\x18\r \x01(\v2+.infracost.parser.options.DependencyRequestH\x00R\x11dependencyRequest\x88\x01\x01\x128\n" +
-	"\x18enable_git_normalization\x18\x0e \x01(\bR\x16enableGitNormalizationB\x15\n" +
-	"\x13_dependency_request\"\xcb\x01\n" +
+	"\x18enable_git_normalization\x18\x0e \x01(\bR\x16enableGitNormalization\x12_\n" +
+	"\x13required_attributes\x18\x0f \x03(\v2..infracost.parser.options.AttributeRequirementR\x12requiredAttributes\x12\\\n" +
+	"\fdefault_tags\x18\x10 \x03(\v29.infracost.parser.options.GenericOptions.DefaultTagsEntryR\vdefaultTags\x12V\n" +
+	"\n" +
+	"source_map\x18\x11 \x03(\v27.infracost.parser.options.GenericOptions.SourceMapEntryR\tsourceMap\x12C\n" +
+	"\x03env\x18\x12 \x03(\v21.infracost.parser.options.GenericOptions.EnvEntryR\x03env\x127\n" +
+	"\x18force_local_module_paths\x18\x13 \x01(\bR\x15forceLocalModulePaths\x1a>\n" +
+	"\x10DefaultTagsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a<\n" +
+	"\x0eSourceMapEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a6\n" +
+	"\bEnvEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\x15\n" +
+	"\x13_dependency_request\"[\n" +
+	"\x14AttributeRequirement\x12#\n" +
+	"\rresource_type\x18\x01 \x01(\tR\fresourceType\x12\x1e\n" +
+	"\n" +
+	"attributes\x18\x02 \x03(\tR\n" +
+	"attributes\"\xcb\x01\n" +
 	"\x11DependencyRequest\x12!\n" +
 	"\fproject_name\x18\x01 \x01(\tR\vprojectName\x12)\n" +
 	"\x10resource_address\x18\x02 \x01(\tR\x0fresourceAddress\x12;\n" +
@@ -685,32 +812,40 @@ func file_infracost_parser_options_options_proto_rawDescGZIP() []byte {
 }
 
 var file_infracost_parser_options_options_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_infracost_parser_options_options_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_infracost_parser_options_options_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
 var file_infracost_parser_options_options_proto_goTypes = []any{
 	(CredentialType)(0),             // 0: infracost.parser.options.CredentialType
 	(*GenericOptions)(nil),          // 1: infracost.parser.options.GenericOptions
-	(*DependencyRequest)(nil),       // 2: infracost.parser.options.DependencyRequest
-	(*Debug)(nil),                   // 3: infracost.parser.options.Debug
-	(*CredentialSet)(nil),           // 4: infracost.parser.options.CredentialSet
-	(*RemoteModuleCacheConfig)(nil), // 5: infracost.parser.options.RemoteModuleCacheConfig
-	(*AwsCredentials)(nil),          // 6: infracost.parser.options.AwsCredentials
-	(*ProxyRouter)(nil),             // 7: infracost.parser.options.ProxyRouter
-	nil,                             // 8: infracost.parser.options.ProxyRouter.RoutesEntry
+	(*AttributeRequirement)(nil),    // 2: infracost.parser.options.AttributeRequirement
+	(*DependencyRequest)(nil),       // 3: infracost.parser.options.DependencyRequest
+	(*Debug)(nil),                   // 4: infracost.parser.options.Debug
+	(*CredentialSet)(nil),           // 5: infracost.parser.options.CredentialSet
+	(*RemoteModuleCacheConfig)(nil), // 6: infracost.parser.options.RemoteModuleCacheConfig
+	(*AwsCredentials)(nil),          // 7: infracost.parser.options.AwsCredentials
+	(*ProxyRouter)(nil),             // 8: infracost.parser.options.ProxyRouter
+	nil,                             // 9: infracost.parser.options.GenericOptions.DefaultTagsEntry
+	nil,                             // 10: infracost.parser.options.GenericOptions.SourceMapEntry
+	nil,                             // 11: infracost.parser.options.GenericOptions.EnvEntry
+	nil,                             // 12: infracost.parser.options.ProxyRouter.RoutesEntry
 }
 var file_infracost_parser_options_options_proto_depIdxs = []int32{
-	4, // 0: infracost.parser.options.GenericOptions.credential_sets:type_name -> infracost.parser.options.CredentialSet
-	6, // 1: infracost.parser.options.GenericOptions.aws_credentials:type_name -> infracost.parser.options.AwsCredentials
-	3, // 2: infracost.parser.options.GenericOptions.debug:type_name -> infracost.parser.options.Debug
-	7, // 3: infracost.parser.options.GenericOptions.proxy_router:type_name -> infracost.parser.options.ProxyRouter
-	5, // 4: infracost.parser.options.GenericOptions.remote_module_cache_config:type_name -> infracost.parser.options.RemoteModuleCacheConfig
-	2, // 5: infracost.parser.options.GenericOptions.dependency_request:type_name -> infracost.parser.options.DependencyRequest
-	0, // 6: infracost.parser.options.CredentialSet.type:type_name -> infracost.parser.options.CredentialType
-	8, // 7: infracost.parser.options.ProxyRouter.routes:type_name -> infracost.parser.options.ProxyRouter.RoutesEntry
-	8, // [8:8] is the sub-list for method output_type
-	8, // [8:8] is the sub-list for method input_type
-	8, // [8:8] is the sub-list for extension type_name
-	8, // [8:8] is the sub-list for extension extendee
-	0, // [0:8] is the sub-list for field type_name
+	5,  // 0: infracost.parser.options.GenericOptions.credential_sets:type_name -> infracost.parser.options.CredentialSet
+	7,  // 1: infracost.parser.options.GenericOptions.aws_credentials:type_name -> infracost.parser.options.AwsCredentials
+	4,  // 2: infracost.parser.options.GenericOptions.debug:type_name -> infracost.parser.options.Debug
+	8,  // 3: infracost.parser.options.GenericOptions.proxy_router:type_name -> infracost.parser.options.ProxyRouter
+	6,  // 4: infracost.parser.options.GenericOptions.remote_module_cache_config:type_name -> infracost.parser.options.RemoteModuleCacheConfig
+	3,  // 5: infracost.parser.options.GenericOptions.dependency_request:type_name -> infracost.parser.options.DependencyRequest
+	2,  // 6: infracost.parser.options.GenericOptions.required_attributes:type_name -> infracost.parser.options.AttributeRequirement
+	9,  // 7: infracost.parser.options.GenericOptions.default_tags:type_name -> infracost.parser.options.GenericOptions.DefaultTagsEntry
+	10, // 8: infracost.parser.options.GenericOptions.source_map:type_name -> infracost.parser.options.GenericOptions.SourceMapEntry
+	11, // 9: infracost.parser.options.GenericOptions.env:type_name -> infracost.parser.options.GenericOptions.EnvEntry
+	0,  // 10: infracost.parser.options.CredentialSet.type:type_name -> infracost.parser.options.CredentialType
+	12, // 11: infracost.parser.options.ProxyRouter.routes:type_name -> infracost.parser.options.ProxyRouter.RoutesEntry
+	12, // [12:12] is the sub-list for method output_type
+	12, // [12:12] is the sub-list for method input_type
+	12, // [12:12] is the sub-list for extension type_name
+	12, // [12:12] is the sub-list for extension extendee
+	0,  // [0:12] is the sub-list for field type_name
 }
 
 func init() { file_infracost_parser_options_options_proto_init() }
@@ -725,7 +860,7 @@ func file_infracost_parser_options_options_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_infracost_parser_options_options_proto_rawDesc), len(file_infracost_parser_options_options_proto_rawDesc)),
 			NumEnums:      1,
-			NumMessages:   8,
+			NumMessages:   12,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/gen/go/infracost/plugin/parser.pb.go b/gen/go/infracost/plugin/parser.pb.go
index 2ac128b..e1ac64a 100644
--- a/gen/go/infracost/plugin/parser.pb.go
+++ b/gen/go/infracost/plugin/parser.pb.go
@@ -167,8 +167,13 @@ type IdentifyProjectsResponse struct {
 	Files []string `protobuf:"bytes,2,rep,name=files,proto3" json:"files,omitempty"`
 	// dependencies, relative to the directory
 	DependencyPaths []string `protobuf:"bytes,3,rep,name=dependency_paths,json=dependencyPaths,proto3" json:"dependency_paths,omitempty"`
-	unknownFields   protoimpl.UnknownFields
-	sizeCache       protoimpl.SizeCache
+	// Plugin-authored parse options for the identified project(s), always JSON. Same schema the
+	// plugin consumes in ParseRequest.raw_options. Opaque to the caller: it is persisted (as a
+	// YAML map in the config file) and forwarded, never interpreted. This is a directory-level
+	// seed; the authoritative per-project blob is produced by IdentifyEnvironments.
+	RawOptions    []byte `protobuf:"bytes,4,opt,name=raw_options,json=rawOptions,proto3" json:"raw_options,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *IdentifyProjectsResponse) Reset() {
@@ -222,6 +227,13 @@ func (x *IdentifyProjectsResponse) GetDependencyPaths() []string {
 	return nil
 }
 
+func (x *IdentifyProjectsResponse) GetRawOptions() []byte {
+	if x != nil {
+		return x.RawOptions
+	}
+	return nil
+}
+
 type IdentifyEnvironmentsRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// a project root previously returned by IdentifyProjects.
@@ -235,8 +247,11 @@ type IdentifyEnvironmentsRequest struct {
 	// to be retired once the heuristic is dropped. Plugins for other formats should IGNORE it
 	// and derive their environments from directory alone.
 	AttributedFiles []*AttributedVarFile `protobuf:"bytes,2,rep,name=attributed_files,json=attributedFiles,proto3" json:"attributed_files,omitempty"`
-	unknownFields   protoimpl.UnknownFields
-	sizeCache       protoimpl.SizeCache
+	// the seed blob IdentifyProjects produced for this project root, for the plugin to refine.
+	// Always JSON, opaque to the caller.
+	RawOptions    []byte `protobuf:"bytes,3,opt,name=raw_options,json=rawOptions,proto3" json:"raw_options,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *IdentifyEnvironmentsRequest) Reset() {
@@ -283,6 +298,13 @@ func (x *IdentifyEnvironmentsRequest) GetAttributedFiles() []*AttributedVarFile
 	return nil
 }
 
+func (x *IdentifyEnvironmentsRequest) GetRawOptions() []byte {
+	if x != nil {
+		return x.RawOptions
+	}
+	return nil
+}
+
 // AttributedVarFile is one input file the caller has already associated with a project,
 // together with the environment it resolved. Terraform/Terragrunt only (see IdentifyEnvironmentsRequest).
 type AttributedVarFile struct {
@@ -407,8 +429,12 @@ type Environment struct {
 	// shared inputs this environment pulls in, relative to the request directory.
 	// Kustomize: base/components dirs; Terraform: n/a.
 	DependencyPaths []string `protobuf:"bytes,4,rep,name=dependency_paths,json=dependencyPaths,proto3" json:"dependency_paths,omitempty"`
-	unknownFields   protoimpl.UnknownFields
-	sizeCache       protoimpl.SizeCache
+	// Per-environment, plugin-specific parse options, always JSON. This is the blob that is
+	// persisted in the config file (as a YAML map, readable/editable) and passed verbatim into
+	// ParseRequest.raw_options for this environment. Opaque to the caller.
+	RawOptions    []byte `protobuf:"bytes,5,opt,name=raw_options,json=rawOptions,proto3" json:"raw_options,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Environment) Reset() {
@@ -469,6 +495,13 @@ func (x *Environment) GetDependencyPaths() []string {
 	return nil
 }
 
+func (x *Environment) GetRawOptions() []byte {
+	if x != nil {
+		return x.RawOptions
+	}
+	return nil
+}
+
 // ParseRequest is the unified request for all parser types.
 type ParseRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -476,12 +509,13 @@ type ParseRequest struct {
 	Path string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
 	// Generic options that aren't specific to any IaC
 	GenericOptions *options.GenericOptions `protobuf:"bytes,2,opt,name=generic_options,json=genericOptions,proto3" json:"generic_options,omitempty"`
-	// Options data pertaining to the specific plugin. Different plugins may expect different formats/shapes/contents e.g. protobuf, json, yaml etc. - plugins should document this themselves.
-	RawOptions []byte `protobuf:"bytes,3,opt,name=raw_options,json=rawOptions,proto3" json:"raw_options,omitempty"`
-	// Used to tell the consuming plugin what format the raw_options data is in e.g. "application/json".
-	RawOptionsFormat string `protobuf:"bytes,4,opt,name=raw_options_format,json=rawOptionsFormat,proto3" json:"raw_options_format,omitempty"`
-	unknownFields    protoimpl.UnknownFields
-	sizeCache        protoimpl.SizeCache
+	// Plugin-specific parse options for this project/environment, always JSON. This is the same
+	// blob generated during identification and persisted in the config file (see
+	// Environment.raw_options), passed through without the config library / CLI / runner
+	// interpreting it. Plugins document their own schema.
+	RawOptions    []byte `protobuf:"bytes,3,opt,name=raw_options,json=rawOptions,proto3" json:"raw_options,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ParseRequest) Reset() {
@@ -535,13 +569,6 @@ func (x *ParseRequest) GetRawOptions() []byte {
 	return nil
 }
 
-func (x *ParseRequest) GetRawOptionsFormat() string {
-	if x != nil {
-		return x.RawOptionsFormat
-	}
-	return ""
-}
-
 // ParseResponse is the iac-agnostic parser response
 type ParseResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -746,31 +773,36 @@ const file_infracost_plugin_parser_proto_rawDesc = "" +
 	"\x18config_file_project_type\x18\x02 \x01(\tH\x00R\x15configFileProjectType\x88\x01\x01B\x1b\n" +
 	"\x19_config_file_project_type\"7\n" +
 	"\x17IdentifyProjectsRequest\x12\x1c\n" +
-	"\tdirectory\x18\x01 \x01(\tR\tdirectory\"y\n" +
+	"\tdirectory\x18\x01 \x01(\tR\tdirectory\"\x9a\x01\n" +
 	"\x18IdentifyProjectsResponse\x12\x1c\n" +
 	"\tdirectory\x18\x01 \x01(\bR\tdirectory\x12\x14\n" +
 	"\x05files\x18\x02 \x03(\tR\x05files\x12)\n" +
-	"\x10dependency_paths\x18\x03 \x03(\tR\x0fdependencyPaths\"\x8b\x01\n" +
+	"\x10dependency_paths\x18\x03 \x03(\tR\x0fdependencyPaths\x12\x1f\n" +
+	"\vraw_options\x18\x04 \x01(\fR\n" +
+	"rawOptions\"\xac\x01\n" +
 	"\x1bIdentifyEnvironmentsRequest\x12\x1c\n" +
 	"\tdirectory\x18\x01 \x01(\tR\tdirectory\x12N\n" +
-	"\x10attributed_files\x18\x02 \x03(\v2#.infracost.plugin.AttributedVarFileR\x0fattributedFiles\"V\n" +
+	"\x10attributed_files\x18\x02 \x03(\v2#.infracost.plugin.AttributedVarFileR\x0fattributedFiles\x12\x1f\n" +
+	"\vraw_options\x18\x03 \x01(\fR\n" +
+	"rawOptions\"V\n" +
 	"\x11AttributedVarFile\x12\x12\n" +
 	"\x04path\x18\x01 \x01(\tR\x04path\x12\x10\n" +
 	"\x03env\x18\x02 \x01(\tR\x03env\x12\x1b\n" +
 	"\tis_global\x18\x03 \x01(\bR\bisGlobal\"a\n" +
 	"\x1cIdentifyEnvironmentsResponse\x12A\n" +
-	"\fenvironments\x18\x01 \x03(\v2\x1d.infracost.plugin.EnvironmentR\fenvironments\"v\n" +
+	"\fenvironments\x18\x01 \x03(\v2\x1d.infracost.plugin.EnvironmentR\fenvironments\"\x97\x01\n" +
 	"\vEnvironment\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x12\n" +
 	"\x04path\x18\x02 \x01(\tR\x04path\x12\x14\n" +
 	"\x05files\x18\x03 \x03(\tR\x05files\x12)\n" +
-	"\x10dependency_paths\x18\x04 \x03(\tR\x0fdependencyPaths\"\xc4\x01\n" +
+	"\x10dependency_paths\x18\x04 \x03(\tR\x0fdependencyPaths\x12\x1f\n" +
+	"\vraw_options\x18\x05 \x01(\fR\n" +
+	"rawOptions\"\xb0\x01\n" +
 	"\fParseRequest\x12\x12\n" +
 	"\x04path\x18\x01 \x01(\tR\x04path\x12Q\n" +
 	"\x0fgeneric_options\x18\x02 \x01(\v2(.infracost.parser.options.GenericOptionsR\x0egenericOptions\x12\x1f\n" +
 	"\vraw_options\x18\x03 \x01(\fR\n" +
-	"rawOptions\x12,\n" +
-	"\x12raw_options_format\x18\x04 \x01(\tR\x10rawOptionsFormat\"\xce\x01\n" +
+	"rawOptionsJ\x04\b\x04\x10\x05R\x12raw_options_format\"\xce\x01\n" +
 	"\rParseResponse\x12>\n" +
 	"\vdiagnostics\x18\x01 \x03(\v2\x1c.infracost.parser.DiagnosticR\vdiagnostics\x12(\n" +
 	"\x04tree\x18\x02 \x01(\v2\x14.infracost.tree.TreeR\x04tree\x12S\n" +
diff --git a/gen/ts/infracost/parser/options/options_pb.d.ts b/gen/ts/infracost/parser/options/options_pb.d.ts
index a812d74..182ca89 100644
--- a/gen/ts/infracost/parser/options/options_pb.d.ts
+++ b/gen/ts/infracost/parser/options/options_pb.d.ts
@@ -112,6 +112,47 @@ export declare type GenericOptions = Message<"infracost.parser.options.GenericOp
    * @generated from field: bool enable_git_normalization = 14;
    */
   enableGitNormalization: boolean;
+
+  /**
+   * FinOps naming-policy requirements (resource type -> required attributes). Source: org/dashboard
+   * policy. Cross-plugin (any IaC with taggable resources); today read by the terraform-family plugins.
+   *
+   * @generated from field: repeated infracost.parser.options.AttributeRequirement required_attributes = 15;
+   */
+  requiredAttributes: AttributeRequirement[];
+
+  /**
+   * Default tags applied to all resources. Source: YOR config file / YOR_SIMPLE_TAGS env.
+   * Consumed by the terraform-family plugins.
+   *
+   * @generated from field: map<string, string> default_tags = 16;
+   */
+  defaultTags: { [key: string]: string };
+
+  /**
+   * Flat module source map (module source -> replacement). Source: INFRACOST_TERRAFORM_SOURCE_MAP
+   * env. Consumed by the terraform-family plugins. NOTE: the regex source map from the config file
+   * (terraform.source_map) is user config and travels in the raw_options blob instead.
+   *
+   * @generated from field: map<string, string> source_map = 17;
+   */
+  sourceMap: { [key: string]: string };
+
+  /**
+   * Environment variables for parsing (e.g. TF_VAR_*, TF_WORKSPACE). Source: runtime/integration
+   * env merged with the project's configured env. Consumed by the terraform-family plugins.
+   *
+   * @generated from field: map<string, string> env = 18;
+   */
+  env: { [key: string]: string };
+
+  /**
+   * Force module sources to resolve as local paths instead of downloading them. Source: caller flag.
+   * Consumed by the terraform-family plugins.
+   *
+   * @generated from field: bool force_local_module_paths = 19;
+   */
+  forceLocalModulePaths: boolean;
 };
 
 /**
@@ -120,6 +161,34 @@ export declare type GenericOptions = Message<"infracost.parser.options.GenericOp
  */
 export declare const GenericOptionsSchema: GenMessage<GenericOptions>;
 
+/**
+ * AttributeRequirement lists the attributes a given resource type must set for a FinOps
+ * naming/tagging policy.
+ *
+ * @generated from message infracost.parser.options.AttributeRequirement
+ */
+export declare type AttributeRequirement = Message<"infracost.parser.options.AttributeRequirement"> & {
+  /**
+   * The resource type the requirement applies to (e.g. "aws_instance").
+   *
+   * @generated from field: string resource_type = 1;
+   */
+  resourceType: string;
+
+  /**
+   * The attributes that must be present on that resource type.
+   *
+   * @generated from field: repeated string attributes = 2;
+   */
+  attributes: string[];
+};
+
+/**
+ * Describes the message infracost.parser.options.AttributeRequirement.
+ * Use `create(AttributeRequirementSchema)` to create a new message.
+ */
+export declare const AttributeRequirementSchema: GenMessage<AttributeRequirement>;
+
 /**
  * DependencyRequest specifies parameters for extracting resource dependencies during parsing.
  * When set, the parser will use internal hooks to extract dependencies while the graph is available.
diff --git a/gen/ts/infracost/parser/options/options_pb.js b/gen/ts/infracost/parser/options/options_pb.js
index e55eca1..8dd3122 100644
--- a/gen/ts/infracost/parser/options/options_pb.js
+++ b/gen/ts/infracost/parser/options/options_pb.js
@@ -8,7 +8,7 @@ import { enumDesc, fileDesc, messageDesc, tsEnum } from "@bufbuild/protobuf/code
  * Describes the file infracost/parser/options/options.proto.
  */
 export const file_infracost_parser_options_options = /*@__PURE__*/
-  fileDesc("CiZpbmZyYWNvc3QvcGFyc2VyL29wdGlvbnMvb3B0aW9ucy5wcm90bxIYaW5mcmFjb3N0LnBhcnNlci5vcHRpb25zIpIFCg5HZW5lcmljT3B0aW9ucxIUCgxwcm9qZWN0X25hbWUYASABKAkSGAoQZW52aXJvbm1lbnRfbmFtZRgCIAEoCRIWCg5yZXBvX2RpcmVjdG9yeRgDIAEoCRIbChN0ZW1wb3JhcnlfZGlyZWN0b3J5GAQgASgJEhcKD2NhY2hlX2RpcmVjdG9yeRgFIAEoCRIZChF3b3JraW5nX2RpcmVjdG9yeRgGIAEoCRJACg9jcmVkZW50aWFsX3NldHMYByADKAsyJy5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuQ3JlZGVudGlhbFNldBJBCg9hd3NfY3JlZGVudGlhbHMYCCABKAsyKC5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuQXdzQ3JlZGVudGlhbHMSLgoFZGVidWcYCSABKAsyHy5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuRGVidWcSFwoPc3BhcnNlX2NoZWNrb3V0GAogASgIEjsKDHByb3h5X3JvdXRlchgLIAEoCzIlLmluZnJhY29zdC5wYXJzZXIub3B0aW9ucy5Qcm94eVJvdXRlchJVChpyZW1vdGVfbW9kdWxlX2NhY2hlX2NvbmZpZxgMIAEoCzIxLmluZnJhY29zdC5wYXJzZXIub3B0aW9ucy5SZW1vdGVNb2R1bGVDYWNoZUNvbmZpZxJMChJkZXBlbmRlbmN5X3JlcXVlc3QYDSABKAsyKy5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuRGVwZW5kZW5jeVJlcXVlc3RIAIgBARIgChhlbmFibGVfZ2l0X25vcm1hbGl6YXRpb24YDiABKAhCFQoTX2RlcGVuZGVuY3lfcmVxdWVzdCKCAQoRRGVwZW5kZW5jeVJlcXVlc3QSFAoMcHJvamVjdF9uYW1lGAEgASgJEhgKEHJlc291cmNlX2FkZHJlc3MYAiABKAkSIgoadXNlX3JlbW90ZV9tb2R1bGVfc25pcHBldHMYAyABKAgSGQoRd29ya2luZ19kaXJlY3RvcnkYBCABKAkiMQoFRGVidWcSEQoJYWRkcmVzc2VzGAEgAygJEhUKDWluY2x1ZGVfZHVtcHMYAiABKAgiZAoNQ3JlZGVudGlhbFNldBINCgV0b2tlbhgBIAEoCRIMCgRob3N0GAIgASgJEjYKBHR5cGUYAyABKA4yKC5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuQ3JlZGVudGlhbFR5cGUiYgoXUmVtb3RlTW9kdWxlQ2FjaGVDb25maWcSDgoGcmVnaW9uGAEgASgJEhMKC2J1Y2tldF9uYW1lGAIgASgJEg4KBnByZWZpeBgDIAEoCRISCgppc19wcml2YXRlGAQgASgIImgKDkF3c0NyZWRlbnRpYWxzEhUKDWFjY2Vzc19rZXlfaWQYASABKAkSGQoRc2VjcmV0X2FjY2Vzc19rZXkYAiABKAkSFAoMYWNjZXNzX3Rva2VuGAMgASgJEg4KBnJlZ2lvbhgEIAEoCSJ/CgtQcm94eVJvdXRlchJBCgZyb3V0ZXMYASADKAsyMS5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuUHJveHlSb3V0ZXIuUm91dGVzRW50cnkaLQoLUm91dGVzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASpRCg5DcmVkZW50aWFsVHlwZRIfChtDUkVERU5USUFMX1RZUEVfVU5TUEVDSUZJRUQQABIJCgVUT0tFThABEhMKD1RFUlJBRk9STV9DTE9VRBACQuoBChxjb20uaW5mcmFjb3N0LnBhcnNlci5vcHRpb25zQgxPcHRpb25zUHJvdG9QAVo6Z2l0aHViLmNvbS9pbmZyYWNvc3QvcHJvdG8vZ2VuL2dvL2luZnJhY29zdC9wYXJzZXIvb3B0aW9uc6ICA0lQT6oCGEluZnJhY29zdC5QYXJzZXIuT3B0aW9uc8oCGEluZnJhY29zdFxQYXJzZXJcT3B0aW9uc+ICJEluZnJhY29zdFxQYXJzZXJcT3B0aW9uc1xHUEJNZXRhZGF0YeoCGkluZnJhY29zdDo6UGFyc2VyOjpPcHRpb25zYgZwcm90bzM");
+  fileDesc("CiZpbmZyYWNvc3QvcGFyc2VyL29wdGlvbnMvb3B0aW9ucy5wcm90bxIYaW5mcmFjb3N0LnBhcnNlci5vcHRpb25zIvEICg5HZW5lcmljT3B0aW9ucxIUCgxwcm9qZWN0X25hbWUYASABKAkSGAoQZW52aXJvbm1lbnRfbmFtZRgCIAEoCRIWCg5yZXBvX2RpcmVjdG9yeRgDIAEoCRIbChN0ZW1wb3JhcnlfZGlyZWN0b3J5GAQgASgJEhcKD2NhY2hlX2RpcmVjdG9yeRgFIAEoCRIZChF3b3JraW5nX2RpcmVjdG9yeRgGIAEoCRJACg9jcmVkZW50aWFsX3NldHMYByADKAsyJy5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuQ3JlZGVudGlhbFNldBJBCg9hd3NfY3JlZGVudGlhbHMYCCABKAsyKC5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuQXdzQ3JlZGVudGlhbHMSLgoFZGVidWcYCSABKAsyHy5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuRGVidWcSFwoPc3BhcnNlX2NoZWNrb3V0GAogASgIEjsKDHByb3h5X3JvdXRlchgLIAEoCzIlLmluZnJhY29zdC5wYXJzZXIub3B0aW9ucy5Qcm94eVJvdXRlchJVChpyZW1vdGVfbW9kdWxlX2NhY2hlX2NvbmZpZxgMIAEoCzIxLmluZnJhY29zdC5wYXJzZXIub3B0aW9ucy5SZW1vdGVNb2R1bGVDYWNoZUNvbmZpZxJMChJkZXBlbmRlbmN5X3JlcXVlc3QYDSABKAsyKy5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuRGVwZW5kZW5jeVJlcXVlc3RIAIgBARIgChhlbmFibGVfZ2l0X25vcm1hbGl6YXRpb24YDiABKAgSSwoTcmVxdWlyZWRfYXR0cmlidXRlcxgPIAMoCzIuLmluZnJhY29zdC5wYXJzZXIub3B0aW9ucy5BdHRyaWJ1dGVSZXF1aXJlbWVudBJPCgxkZWZhdWx0X3RhZ3MYECADKAsyOS5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuR2VuZXJpY09wdGlvbnMuRGVmYXVsdFRhZ3NFbnRyeRJLCgpzb3VyY2VfbWFwGBEgAygLMjcuaW5mcmFjb3N0LnBhcnNlci5vcHRpb25zLkdlbmVyaWNPcHRpb25zLlNvdXJjZU1hcEVudHJ5Ej4KA2VudhgSIAMoCzIxLmluZnJhY29zdC5wYXJzZXIub3B0aW9ucy5HZW5lcmljT3B0aW9ucy5FbnZFbnRyeRIgChhmb3JjZV9sb2NhbF9tb2R1bGVfcGF0aHMYEyABKAgaMgoQRGVmYXVsdFRhZ3NFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBGjAKDlNvdXJjZU1hcEVudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEaKgoIRW52RW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4AUIVChNfZGVwZW5kZW5jeV9yZXF1ZXN0IkEKFEF0dHJpYnV0ZVJlcXVpcmVtZW50EhUKDXJlc291cmNlX3R5cGUYASABKAkSEgoKYXR0cmlidXRlcxgCIAMoCSKCAQoRRGVwZW5kZW5jeVJlcXVlc3QSFAoMcHJvamVjdF9uYW1lGAEgASgJEhgKEHJlc291cmNlX2FkZHJlc3MYAiABKAkSIgoadXNlX3JlbW90ZV9tb2R1bGVfc25pcHBldHMYAyABKAgSGQoRd29ya2luZ19kaXJlY3RvcnkYBCABKAkiMQoFRGVidWcSEQoJYWRkcmVzc2VzGAEgAygJEhUKDWluY2x1ZGVfZHVtcHMYAiABKAgiZAoNQ3JlZGVudGlhbFNldBINCgV0b2tlbhgBIAEoCRIMCgRob3N0GAIgASgJEjYKBHR5cGUYAyABKA4yKC5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuQ3JlZGVudGlhbFR5cGUiYgoXUmVtb3RlTW9kdWxlQ2FjaGVDb25maWcSDgoGcmVnaW9uGAEgASgJEhMKC2J1Y2tldF9uYW1lGAIgASgJEg4KBnByZWZpeBgDIAEoCRISCgppc19wcml2YXRlGAQgASgIImgKDkF3c0NyZWRlbnRpYWxzEhUKDWFjY2Vzc19rZXlfaWQYASABKAkSGQoRc2VjcmV0X2FjY2Vzc19rZXkYAiABKAkSFAoMYWNjZXNzX3Rva2VuGAMgASgJEg4KBnJlZ2lvbhgEIAEoCSJ/CgtQcm94eVJvdXRlchJBCgZyb3V0ZXMYASADKAsyMS5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuUHJveHlSb3V0ZXIuUm91dGVzRW50cnkaLQoLUm91dGVzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASpRCg5DcmVkZW50aWFsVHlwZRIfChtDUkVERU5USUFMX1RZUEVfVU5TUEVDSUZJRUQQABIJCgVUT0tFThABEhMKD1RFUlJBRk9STV9DTE9VRBACQuoBChxjb20uaW5mcmFjb3N0LnBhcnNlci5vcHRpb25zQgxPcHRpb25zUHJvdG9QAVo6Z2l0aHViLmNvbS9pbmZyYWNvc3QvcHJvdG8vZ2VuL2dvL2luZnJhY29zdC9wYXJzZXIvb3B0aW9uc6ICA0lQT6oCGEluZnJhY29zdC5QYXJzZXIuT3B0aW9uc8oCGEluZnJhY29zdFxQYXJzZXJcT3B0aW9uc+ICJEluZnJhY29zdFxQYXJzZXJcT3B0aW9uc1xHUEJNZXRhZGF0YeoCGkluZnJhY29zdDo6UGFyc2VyOjpPcHRpb25zYgZwcm90bzM");
 
 /**
  * Describes the message infracost.parser.options.GenericOptions.
@@ -17,47 +17,54 @@ export const file_infracost_parser_options_options = /*@__PURE__*/
 export const GenericOptionsSchema = /*@__PURE__*/
   messageDesc(file_infracost_parser_options_options, 0);
 
+/**
+ * Describes the message infracost.parser.options.AttributeRequirement.
+ * Use `create(AttributeRequirementSchema)` to create a new message.
+ */
+export const AttributeRequirementSchema = /*@__PURE__*/
+  messageDesc(file_infracost_parser_options_options, 1);
+
 /**
  * Describes the message infracost.parser.options.DependencyRequest.
  * Use `create(DependencyRequestSchema)` to create a new message.
  */
 export const DependencyRequestSchema = /*@__PURE__*/
-  messageDesc(file_infracost_parser_options_options, 1);
+  messageDesc(file_infracost_parser_options_options, 2);
 
 /**
  * Describes the message infracost.parser.options.Debug.
  * Use `create(DebugSchema)` to create a new message.
  */
 export const DebugSchema = /*@__PURE__*/
-  messageDesc(file_infracost_parser_options_options, 2);
+  messageDesc(file_infracost_parser_options_options, 3);
 
 /**
  * Describes the message infracost.parser.options.CredentialSet.
  * Use `create(CredentialSetSchema)` to create a new message.
  */
 export const CredentialSetSchema = /*@__PURE__*/
-  messageDesc(file_infracost_parser_options_options, 3);
+  messageDesc(file_infracost_parser_options_options, 4);
 
 /**
  * Describes the message infracost.parser.options.RemoteModuleCacheConfig.
  * Use `create(RemoteModuleCacheConfigSchema)` to create a new message.
  */
 export const RemoteModuleCacheConfigSchema = /*@__PURE__*/
-  messageDesc(file_infracost_parser_options_options, 4);
+  messageDesc(file_infracost_parser_options_options, 5);
 
 /**
  * Describes the message infracost.parser.options.AwsCredentials.
  * Use `create(AwsCredentialsSchema)` to create a new message.
  */
 export const AwsCredentialsSchema = /*@__PURE__*/
-  messageDesc(file_infracost_parser_options_options, 5);
+  messageDesc(file_infracost_parser_options_options, 6);
 
 /**
  * Describes the message infracost.parser.options.ProxyRouter.
  * Use `create(ProxyRouterSchema)` to create a new message.
  */
 export const ProxyRouterSchema = /*@__PURE__*/
-  messageDesc(file_infracost_parser_options_options, 6);
+  messageDesc(file_infracost_parser_options_options, 7);
 
 /**
  * Describes the enum infracost.parser.options.CredentialType.
diff --git a/gen/ts/infracost/parser/options/options_pb.ts b/gen/ts/infracost/parser/options/options_pb.ts
index 2ebd560..34b7986 100644
--- a/gen/ts/infracost/parser/options/options_pb.ts
+++ b/gen/ts/infracost/parser/options/options_pb.ts
@@ -10,7 +10,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file infracost/parser/options/options.proto.
  */
 export const file_infracost_parser_options_options: GenFile = /*@__PURE__*/
-  fileDesc("CiZpbmZyYWNvc3QvcGFyc2VyL29wdGlvbnMvb3B0aW9ucy5wcm90bxIYaW5mcmFjb3N0LnBhcnNlci5vcHRpb25zIpIFCg5HZW5lcmljT3B0aW9ucxIUCgxwcm9qZWN0X25hbWUYASABKAkSGAoQZW52aXJvbm1lbnRfbmFtZRgCIAEoCRIWCg5yZXBvX2RpcmVjdG9yeRgDIAEoCRIbChN0ZW1wb3JhcnlfZGlyZWN0b3J5GAQgASgJEhcKD2NhY2hlX2RpcmVjdG9yeRgFIAEoCRIZChF3b3JraW5nX2RpcmVjdG9yeRgGIAEoCRJACg9jcmVkZW50aWFsX3NldHMYByADKAsyJy5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuQ3JlZGVudGlhbFNldBJBCg9hd3NfY3JlZGVudGlhbHMYCCABKAsyKC5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuQXdzQ3JlZGVudGlhbHMSLgoFZGVidWcYCSABKAsyHy5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuRGVidWcSFwoPc3BhcnNlX2NoZWNrb3V0GAogASgIEjsKDHByb3h5X3JvdXRlchgLIAEoCzIlLmluZnJhY29zdC5wYXJzZXIub3B0aW9ucy5Qcm94eVJvdXRlchJVChpyZW1vdGVfbW9kdWxlX2NhY2hlX2NvbmZpZxgMIAEoCzIxLmluZnJhY29zdC5wYXJzZXIub3B0aW9ucy5SZW1vdGVNb2R1bGVDYWNoZUNvbmZpZxJMChJkZXBlbmRlbmN5X3JlcXVlc3QYDSABKAsyKy5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuRGVwZW5kZW5jeVJlcXVlc3RIAIgBARIgChhlbmFibGVfZ2l0X25vcm1hbGl6YXRpb24YDiABKAhCFQoTX2RlcGVuZGVuY3lfcmVxdWVzdCKCAQoRRGVwZW5kZW5jeVJlcXVlc3QSFAoMcHJvamVjdF9uYW1lGAEgASgJEhgKEHJlc291cmNlX2FkZHJlc3MYAiABKAkSIgoadXNlX3JlbW90ZV9tb2R1bGVfc25pcHBldHMYAyABKAgSGQoRd29ya2luZ19kaXJlY3RvcnkYBCABKAkiMQoFRGVidWcSEQoJYWRkcmVzc2VzGAEgAygJEhUKDWluY2x1ZGVfZHVtcHMYAiABKAgiZAoNQ3JlZGVudGlhbFNldBINCgV0b2tlbhgBIAEoCRIMCgRob3N0GAIgASgJEjYKBHR5cGUYAyABKA4yKC5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuQ3JlZGVudGlhbFR5cGUiYgoXUmVtb3RlTW9kdWxlQ2FjaGVDb25maWcSDgoGcmVnaW9uGAEgASgJEhMKC2J1Y2tldF9uYW1lGAIgASgJEg4KBnByZWZpeBgDIAEoCRISCgppc19wcml2YXRlGAQgASgIImgKDkF3c0NyZWRlbnRpYWxzEhUKDWFjY2Vzc19rZXlfaWQYASABKAkSGQoRc2VjcmV0X2FjY2Vzc19rZXkYAiABKAkSFAoMYWNjZXNzX3Rva2VuGAMgASgJEg4KBnJlZ2lvbhgEIAEoCSJ/CgtQcm94eVJvdXRlchJBCgZyb3V0ZXMYASADKAsyMS5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuUHJveHlSb3V0ZXIuUm91dGVzRW50cnkaLQoLUm91dGVzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASpRCg5DcmVkZW50aWFsVHlwZRIfChtDUkVERU5USUFMX1RZUEVfVU5TUEVDSUZJRUQQABIJCgVUT0tFThABEhMKD1RFUlJBRk9STV9DTE9VRBACQuoBChxjb20uaW5mcmFjb3N0LnBhcnNlci5vcHRpb25zQgxPcHRpb25zUHJvdG9QAVo6Z2l0aHViLmNvbS9pbmZyYWNvc3QvcHJvdG8vZ2VuL2dvL2luZnJhY29zdC9wYXJzZXIvb3B0aW9uc6ICA0lQT6oCGEluZnJhY29zdC5QYXJzZXIuT3B0aW9uc8oCGEluZnJhY29zdFxQYXJzZXJcT3B0aW9uc+ICJEluZnJhY29zdFxQYXJzZXJcT3B0aW9uc1xHUEJNZXRhZGF0YeoCGkluZnJhY29zdDo6UGFyc2VyOjpPcHRpb25zYgZwcm90bzM");
+  fileDesc("CiZpbmZyYWNvc3QvcGFyc2VyL29wdGlvbnMvb3B0aW9ucy5wcm90bxIYaW5mcmFjb3N0LnBhcnNlci5vcHRpb25zIvEICg5HZW5lcmljT3B0aW9ucxIUCgxwcm9qZWN0X25hbWUYASABKAkSGAoQZW52aXJvbm1lbnRfbmFtZRgCIAEoCRIWCg5yZXBvX2RpcmVjdG9yeRgDIAEoCRIbChN0ZW1wb3JhcnlfZGlyZWN0b3J5GAQgASgJEhcKD2NhY2hlX2RpcmVjdG9yeRgFIAEoCRIZChF3b3JraW5nX2RpcmVjdG9yeRgGIAEoCRJACg9jcmVkZW50aWFsX3NldHMYByADKAsyJy5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuQ3JlZGVudGlhbFNldBJBCg9hd3NfY3JlZGVudGlhbHMYCCABKAsyKC5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuQXdzQ3JlZGVudGlhbHMSLgoFZGVidWcYCSABKAsyHy5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuRGVidWcSFwoPc3BhcnNlX2NoZWNrb3V0GAogASgIEjsKDHByb3h5X3JvdXRlchgLIAEoCzIlLmluZnJhY29zdC5wYXJzZXIub3B0aW9ucy5Qcm94eVJvdXRlchJVChpyZW1vdGVfbW9kdWxlX2NhY2hlX2NvbmZpZxgMIAEoCzIxLmluZnJhY29zdC5wYXJzZXIub3B0aW9ucy5SZW1vdGVNb2R1bGVDYWNoZUNvbmZpZxJMChJkZXBlbmRlbmN5X3JlcXVlc3QYDSABKAsyKy5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuRGVwZW5kZW5jeVJlcXVlc3RIAIgBARIgChhlbmFibGVfZ2l0X25vcm1hbGl6YXRpb24YDiABKAgSSwoTcmVxdWlyZWRfYXR0cmlidXRlcxgPIAMoCzIuLmluZnJhY29zdC5wYXJzZXIub3B0aW9ucy5BdHRyaWJ1dGVSZXF1aXJlbWVudBJPCgxkZWZhdWx0X3RhZ3MYECADKAsyOS5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuR2VuZXJpY09wdGlvbnMuRGVmYXVsdFRhZ3NFbnRyeRJLCgpzb3VyY2VfbWFwGBEgAygLMjcuaW5mcmFjb3N0LnBhcnNlci5vcHRpb25zLkdlbmVyaWNPcHRpb25zLlNvdXJjZU1hcEVudHJ5Ej4KA2VudhgSIAMoCzIxLmluZnJhY29zdC5wYXJzZXIub3B0aW9ucy5HZW5lcmljT3B0aW9ucy5FbnZFbnRyeRIgChhmb3JjZV9sb2NhbF9tb2R1bGVfcGF0aHMYEyABKAgaMgoQRGVmYXVsdFRhZ3NFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBGjAKDlNvdXJjZU1hcEVudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEaKgoIRW52RW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4AUIVChNfZGVwZW5kZW5jeV9yZXF1ZXN0IkEKFEF0dHJpYnV0ZVJlcXVpcmVtZW50EhUKDXJlc291cmNlX3R5cGUYASABKAkSEgoKYXR0cmlidXRlcxgCIAMoCSKCAQoRRGVwZW5kZW5jeVJlcXVlc3QSFAoMcHJvamVjdF9uYW1lGAEgASgJEhgKEHJlc291cmNlX2FkZHJlc3MYAiABKAkSIgoadXNlX3JlbW90ZV9tb2R1bGVfc25pcHBldHMYAyABKAgSGQoRd29ya2luZ19kaXJlY3RvcnkYBCABKAkiMQoFRGVidWcSEQoJYWRkcmVzc2VzGAEgAygJEhUKDWluY2x1ZGVfZHVtcHMYAiABKAgiZAoNQ3JlZGVudGlhbFNldBINCgV0b2tlbhgBIAEoCRIMCgRob3N0GAIgASgJEjYKBHR5cGUYAyABKA4yKC5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuQ3JlZGVudGlhbFR5cGUiYgoXUmVtb3RlTW9kdWxlQ2FjaGVDb25maWcSDgoGcmVnaW9uGAEgASgJEhMKC2J1Y2tldF9uYW1lGAIgASgJEg4KBnByZWZpeBgDIAEoCRISCgppc19wcml2YXRlGAQgASgIImgKDkF3c0NyZWRlbnRpYWxzEhUKDWFjY2Vzc19rZXlfaWQYASABKAkSGQoRc2VjcmV0X2FjY2Vzc19rZXkYAiABKAkSFAoMYWNjZXNzX3Rva2VuGAMgASgJEg4KBnJlZ2lvbhgEIAEoCSJ/CgtQcm94eVJvdXRlchJBCgZyb3V0ZXMYASADKAsyMS5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuUHJveHlSb3V0ZXIuUm91dGVzRW50cnkaLQoLUm91dGVzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASpRCg5DcmVkZW50aWFsVHlwZRIfChtDUkVERU5USUFMX1RZUEVfVU5TUEVDSUZJRUQQABIJCgVUT0tFThABEhMKD1RFUlJBRk9STV9DTE9VRBACQuoBChxjb20uaW5mcmFjb3N0LnBhcnNlci5vcHRpb25zQgxPcHRpb25zUHJvdG9QAVo6Z2l0aHViLmNvbS9pbmZyYWNvc3QvcHJvdG8vZ2VuL2dvL2luZnJhY29zdC9wYXJzZXIvb3B0aW9uc6ICA0lQT6oCGEluZnJhY29zdC5QYXJzZXIuT3B0aW9uc8oCGEluZnJhY29zdFxQYXJzZXJcT3B0aW9uc+ICJEluZnJhY29zdFxQYXJzZXJcT3B0aW9uc1xHUEJNZXRhZGF0YeoCGkluZnJhY29zdDo6UGFyc2VyOjpPcHRpb25zYgZwcm90bzM");
 
 /**
  * @generated from message infracost.parser.options.GenericOptions
@@ -114,6 +114,47 @@ export type GenericOptions = Message<"infracost.parser.options.GenericOptions">
    * @generated from field: bool enable_git_normalization = 14;
    */
   enableGitNormalization: boolean;
+
+  /**
+   * FinOps naming-policy requirements (resource type -> required attributes). Source: org/dashboard
+   * policy. Cross-plugin (any IaC with taggable resources); today read by the terraform-family plugins.
+   *
+   * @generated from field: repeated infracost.parser.options.AttributeRequirement required_attributes = 15;
+   */
+  requiredAttributes: AttributeRequirement[];
+
+  /**
+   * Default tags applied to all resources. Source: YOR config file / YOR_SIMPLE_TAGS env.
+   * Consumed by the terraform-family plugins.
+   *
+   * @generated from field: map<string, string> default_tags = 16;
+   */
+  defaultTags: { [key: string]: string };
+
+  /**
+   * Flat module source map (module source -> replacement). Source: INFRACOST_TERRAFORM_SOURCE_MAP
+   * env. Consumed by the terraform-family plugins. NOTE: the regex source map from the config file
+   * (terraform.source_map) is user config and travels in the raw_options blob instead.
+   *
+   * @generated from field: map<string, string> source_map = 17;
+   */
+  sourceMap: { [key: string]: string };
+
+  /**
+   * Environment variables for parsing (e.g. TF_VAR_*, TF_WORKSPACE). Source: runtime/integration
+   * env merged with the project's configured env. Consumed by the terraform-family plugins.
+   *
+   * @generated from field: map<string, string> env = 18;
+   */
+  env: { [key: string]: string };
+
+  /**
+   * Force module sources to resolve as local paths instead of downloading them. Source: caller flag.
+   * Consumed by the terraform-family plugins.
+   *
+   * @generated from field: bool force_local_module_paths = 19;
+   */
+  forceLocalModulePaths: boolean;
 };
 
 /**
@@ -123,6 +164,35 @@ export type GenericOptions = Message<"infracost.parser.options.GenericOptions">
 export const GenericOptionsSchema: GenMessage<GenericOptions> = /*@__PURE__*/
   messageDesc(file_infracost_parser_options_options, 0);
 
+/**
+ * AttributeRequirement lists the attributes a given resource type must set for a FinOps
+ * naming/tagging policy.
+ *
+ * @generated from message infracost.parser.options.AttributeRequirement
+ */
+export type AttributeRequirement = Message<"infracost.parser.options.AttributeRequirement"> & {
+  /**
+   * The resource type the requirement applies to (e.g. "aws_instance").
+   *
+   * @generated from field: string resource_type = 1;
+   */
+  resourceType: string;
+
+  /**
+   * The attributes that must be present on that resource type.
+   *
+   * @generated from field: repeated string attributes = 2;
+   */
+  attributes: string[];
+};
+
+/**
+ * Describes the message infracost.parser.options.AttributeRequirement.
+ * Use `create(AttributeRequirementSchema)` to create a new message.
+ */
+export const AttributeRequirementSchema: GenMessage<AttributeRequirement> = /*@__PURE__*/
+  messageDesc(file_infracost_parser_options_options, 1);
+
 /**
  * DependencyRequest specifies parameters for extracting resource dependencies during parsing.
  * When set, the parser will use internal hooks to extract dependencies while the graph is available.
@@ -164,7 +234,7 @@ export type DependencyRequest = Message<"infracost.parser.options.DependencyRequ
  * Use `create(DependencyRequestSchema)` to create a new message.
  */
 export const DependencyRequestSchema: GenMessage<DependencyRequest> = /*@__PURE__*/
-  messageDesc(file_infracost_parser_options_options, 1);
+  messageDesc(file_infracost_parser_options_options, 2);
 
 /**
  * @generated from message infracost.parser.options.Debug
@@ -190,7 +260,7 @@ export type Debug = Message<"infracost.parser.options.Debug"> & {
  * Use `create(DebugSchema)` to create a new message.
  */
 export const DebugSchema: GenMessage<Debug> = /*@__PURE__*/
-  messageDesc(file_infracost_parser_options_options, 2);
+  messageDesc(file_infracost_parser_options_options, 3);
 
 /**
  * @generated from message infracost.parser.options.CredentialSet
@@ -223,7 +293,7 @@ export type CredentialSet = Message<"infracost.parser.options.CredentialSet"> &
  * Use `create(CredentialSetSchema)` to create a new message.
  */
 export const CredentialSetSchema: GenMessage<CredentialSet> = /*@__PURE__*/
-  messageDesc(file_infracost_parser_options_options, 3);
+  messageDesc(file_infracost_parser_options_options, 4);
 
 /**
  * @generated from message infracost.parser.options.RemoteModuleCacheConfig
@@ -263,7 +333,7 @@ export type RemoteModuleCacheConfig = Message<"infracost.parser.options.RemoteMo
  * Use `create(RemoteModuleCacheConfigSchema)` to create a new message.
  */
 export const RemoteModuleCacheConfigSchema: GenMessage<RemoteModuleCacheConfig> = /*@__PURE__*/
-  messageDesc(file_infracost_parser_options_options, 4);
+  messageDesc(file_infracost_parser_options_options, 5);
 
 /**
  * @generated from message infracost.parser.options.AwsCredentials
@@ -303,7 +373,7 @@ export type AwsCredentials = Message<"infracost.parser.options.AwsCredentials">
  * Use `create(AwsCredentialsSchema)` to create a new message.
  */
 export const AwsCredentialsSchema: GenMessage<AwsCredentials> = /*@__PURE__*/
-  messageDesc(file_infracost_parser_options_options, 5);
+  messageDesc(file_infracost_parser_options_options, 6);
 
 /**
  * @generated from message infracost.parser.options.ProxyRouter
@@ -320,7 +390,7 @@ export type ProxyRouter = Message<"infracost.parser.options.ProxyRouter"> & {
  * Use `create(ProxyRouterSchema)` to create a new message.
  */
 export const ProxyRouterSchema: GenMessage<ProxyRouter> = /*@__PURE__*/
-  messageDesc(file_infracost_parser_options_options, 6);
+  messageDesc(file_infracost_parser_options_options, 7);
 
 /**
  * @generated from enum infracost.parser.options.CredentialType
diff --git a/gen/ts/infracost/plugin/parser_pb.d.ts b/gen/ts/infracost/plugin/parser_pb.d.ts
index c02868f..f28edcb 100644
--- a/gen/ts/infracost/plugin/parser_pb.d.ts
+++ b/gen/ts/infracost/plugin/parser_pb.d.ts
@@ -91,6 +91,16 @@ export declare type IdentifyProjectsResponse = Message<"infracost.plugin.Identif
    * @generated from field: repeated string dependency_paths = 3;
    */
   dependencyPaths: string[];
+
+  /**
+   * Plugin-authored parse options for the identified project(s), always JSON. Same schema the
+   * plugin consumes in ParseRequest.raw_options. Opaque to the caller: it is persisted (as a
+   * YAML map in the config file) and forwarded, never interpreted. This is a directory-level
+   * seed; the authoritative per-project blob is produced by IdentifyEnvironments.
+   *
+   * @generated from field: bytes raw_options = 4;
+   */
+  rawOptions: Uint8Array;
 };
 
 /**
@@ -123,6 +133,14 @@ export declare type IdentifyEnvironmentsRequest = Message<"infracost.plugin.Iden
    * @generated from field: repeated infracost.plugin.AttributedVarFile attributed_files = 2;
    */
   attributedFiles: AttributedVarFile[];
+
+  /**
+   * the seed blob IdentifyProjects produced for this project root, for the plugin to refine.
+   * Always JSON, opaque to the caller.
+   *
+   * @generated from field: bytes raw_options = 3;
+   */
+  rawOptions: Uint8Array;
 };
 
 /**
@@ -219,6 +237,15 @@ export declare type Environment = Message<"infracost.plugin.Environment"> & {
    * @generated from field: repeated string dependency_paths = 4;
    */
   dependencyPaths: string[];
+
+  /**
+   * Per-environment, plugin-specific parse options, always JSON. This is the blob that is
+   * persisted in the config file (as a YAML map, readable/editable) and passed verbatim into
+   * ParseRequest.raw_options for this environment. Opaque to the caller.
+   *
+   * @generated from field: bytes raw_options = 5;
+   */
+  rawOptions: Uint8Array;
 };
 
 /**
@@ -248,18 +275,14 @@ export declare type ParseRequest = Message<"infracost.plugin.ParseRequest"> & {
   genericOptions?: GenericOptions;
 
   /**
-   * Options data pertaining to the specific plugin. Different plugins may expect different formats/shapes/contents e.g. protobuf, json, yaml etc. - plugins should document this themselves.
+   * Plugin-specific parse options for this project/environment, always JSON. This is the same
+   * blob generated during identification and persisted in the config file (see
+   * Environment.raw_options), passed through without the config library / CLI / runner
+   * interpreting it. Plugins document their own schema.
    *
    * @generated from field: bytes raw_options = 3;
    */
   rawOptions: Uint8Array;
-
-  /**
-   * Used to tell the consuming plugin what format the raw_options data is in e.g. "application/json".
-   *
-   * @generated from field: string raw_options_format = 4;
-   */
-  rawOptionsFormat: string;
 };
 
 /**
diff --git a/gen/ts/infracost/plugin/parser_pb.js b/gen/ts/infracost/plugin/parser_pb.js
index 357602d..072c00f 100644
--- a/gen/ts/infracost/plugin/parser_pb.js
+++ b/gen/ts/infracost/plugin/parser_pb.js
@@ -11,7 +11,7 @@ import { file_infracost_tree_tree } from "../tree/tree_pb.js";
  * Describes the file infracost/plugin/parser.proto.
  */
 export const file_infracost_plugin_parser = /*@__PURE__*/
-  fileDesc("Ch1pbmZyYWNvc3QvcGx1Z2luL3BhcnNlci5wcm90bxIQaW5mcmFjb3N0LnBsdWdpbiIYChZHZXRQYXJzZXJDb25maWdSZXF1ZXN0In4KF0dldFBhcnNlckNvbmZpZ1Jlc3BvbnNlEh8KF2lkZW50aWZpY2F0aW9uX3ByaW9yaXR5GAEgASgNEiUKGGNvbmZpZ19maWxlX3Byb2plY3RfdHlwZRgCIAEoCUgAiAEBQhsKGV9jb25maWdfZmlsZV9wcm9qZWN0X3R5cGUiLAoXSWRlbnRpZnlQcm9qZWN0c1JlcXVlc3QSEQoJZGlyZWN0b3J5GAEgASgJIlYKGElkZW50aWZ5UHJvamVjdHNSZXNwb25zZRIRCglkaXJlY3RvcnkYASABKAgSDQoFZmlsZXMYAiADKAkSGAoQZGVwZW5kZW5jeV9wYXRocxgDIAMoCSJvChtJZGVudGlmeUVudmlyb25tZW50c1JlcXVlc3QSEQoJZGlyZWN0b3J5GAEgASgJEj0KEGF0dHJpYnV0ZWRfZmlsZXMYAiADKAsyIy5pbmZyYWNvc3QucGx1Z2luLkF0dHJpYnV0ZWRWYXJGaWxlIkEKEUF0dHJpYnV0ZWRWYXJGaWxlEgwKBHBhdGgYASABKAkSCwoDZW52GAIgASgJEhEKCWlzX2dsb2JhbBgDIAEoCCJTChxJZGVudGlmeUVudmlyb25tZW50c1Jlc3BvbnNlEjMKDGVudmlyb25tZW50cxgBIAMoCzIdLmluZnJhY29zdC5wbHVnaW4uRW52aXJvbm1lbnQiUgoLRW52aXJvbm1lbnQSDAoEbmFtZRgBIAEoCRIMCgRwYXRoGAIgASgJEg0KBWZpbGVzGAMgAygJEhgKEGRlcGVuZGVuY3lfcGF0aHMYBCADKAkikAEKDFBhcnNlUmVxdWVzdBIMCgRwYXRoGAEgASgJEkEKD2dlbmVyaWNfb3B0aW9ucxgCIAEoCzIoLmluZnJhY29zdC5wYXJzZXIub3B0aW9ucy5HZW5lcmljT3B0aW9ucxITCgtyYXdfb3B0aW9ucxgDIAEoDBIaChJyYXdfb3B0aW9uc19mb3JtYXQYBCABKAkipAEKDVBhcnNlUmVzcG9uc2USMQoLZGlhZ25vc3RpY3MYASADKAsyHC5pbmZyYWNvc3QucGFyc2VyLkRpYWdub3N0aWMSIgoEdHJlZRgCIAEoCzIULmluZnJhY29zdC50cmVlLlRyZWUSPAoWcmVxdWVzdGVkX2RlcGVuZGVuY2llcxgDIAMoCzIcLmluZnJhY29zdC5wbHVnaW4uRGVwZW5kZW5jeSLuAQoKRGVwZW5kZW5jeRIRCglmaWxlX3BhdGgYASABKAkSEgoKbGluZV9zdGFydBgCIAEoAxIQCghsaW5lX2VuZBgDIAEoAxIZChFtb2R1bGVfZGVmaW5pdGlvbhgEIAEoCRIYChBpc19yZW1vdGVfbW9kdWxlGAUgASgIEh0KFWlzX2V4dGVybmFsbHlfZGVmaW5lZBgGIAEoCBIYChBleHRlcm5hbF9zbmlwcGV0GAcgASgJEhQKDGlzX3N5bnRoZXRpYxgIIAEoCBIUCgxpc19nZW5lcmF0ZWQYCSABKAgSDQoFZGVwdGgYCiABKAUyowMKDVBhcnNlclNlcnZpY2USZgoPR2V0UGFyc2VyQ29uZmlnEiguaW5mcmFjb3N0LnBsdWdpbi5HZXRQYXJzZXJDb25maWdSZXF1ZXN0GikuaW5mcmFjb3N0LnBsdWdpbi5HZXRQYXJzZXJDb25maWdSZXNwb25zZRJpChBJZGVudGlmeVByb2plY3RzEikuaW5mcmFjb3N0LnBsdWdpbi5JZGVudGlmeVByb2plY3RzUmVxdWVzdBoqLmluZnJhY29zdC5wbHVnaW4uSWRlbnRpZnlQcm9qZWN0c1Jlc3BvbnNlEnUKFElkZW50aWZ5RW52aXJvbm1lbnRzEi0uaW5mcmFjb3N0LnBsdWdpbi5JZGVudGlmeUVudmlyb25tZW50c1JlcXVlc3QaLi5pbmZyYWNvc3QucGx1Z2luLklkZW50aWZ5RW52aXJvbm1lbnRzUmVzcG9uc2USSAoFUGFyc2USHi5pbmZyYWNvc3QucGx1Z2luLlBhcnNlUmVxdWVzdBofLmluZnJhY29zdC5wbHVnaW4uUGFyc2VSZXNwb25zZUK4AQoUY29tLmluZnJhY29zdC5wbHVnaW5CC1BhcnNlclByb3RvUAFaMmdpdGh1Yi5jb20vaW5mcmFjb3N0L3Byb3RvL2dlbi9nby9pbmZyYWNvc3QvcGx1Z2luogIDSVBYqgIQSW5mcmFjb3N0LlBsdWdpbsoCEEluZnJhY29zdFxQbHVnaW7iAhxJbmZyYWNvc3RcUGx1Z2luXEdQQk1ldGFkYXRh6gIRSW5mcmFjb3N0OjpQbHVnaW5iBnByb3RvMw", [file_infracost_parser_diagnostic, file_infracost_parser_options_options, file_infracost_tree_tree]);
+  fileDesc("Ch1pbmZyYWNvc3QvcGx1Z2luL3BhcnNlci5wcm90bxIQaW5mcmFjb3N0LnBsdWdpbiIYChZHZXRQYXJzZXJDb25maWdSZXF1ZXN0In4KF0dldFBhcnNlckNvbmZpZ1Jlc3BvbnNlEh8KF2lkZW50aWZpY2F0aW9uX3ByaW9yaXR5GAEgASgNEiUKGGNvbmZpZ19maWxlX3Byb2plY3RfdHlwZRgCIAEoCUgAiAEBQhsKGV9jb25maWdfZmlsZV9wcm9qZWN0X3R5cGUiLAoXSWRlbnRpZnlQcm9qZWN0c1JlcXVlc3QSEQoJZGlyZWN0b3J5GAEgASgJImsKGElkZW50aWZ5UHJvamVjdHNSZXNwb25zZRIRCglkaXJlY3RvcnkYASABKAgSDQoFZmlsZXMYAiADKAkSGAoQZGVwZW5kZW5jeV9wYXRocxgDIAMoCRITCgtyYXdfb3B0aW9ucxgEIAEoDCKEAQobSWRlbnRpZnlFbnZpcm9ubWVudHNSZXF1ZXN0EhEKCWRpcmVjdG9yeRgBIAEoCRI9ChBhdHRyaWJ1dGVkX2ZpbGVzGAIgAygLMiMuaW5mcmFjb3N0LnBsdWdpbi5BdHRyaWJ1dGVkVmFyRmlsZRITCgtyYXdfb3B0aW9ucxgDIAEoDCJBChFBdHRyaWJ1dGVkVmFyRmlsZRIMCgRwYXRoGAEgASgJEgsKA2VudhgCIAEoCRIRCglpc19nbG9iYWwYAyABKAgiUwocSWRlbnRpZnlFbnZpcm9ubWVudHNSZXNwb25zZRIzCgxlbnZpcm9ubWVudHMYASADKAsyHS5pbmZyYWNvc3QucGx1Z2luLkVudmlyb25tZW50ImcKC0Vudmlyb25tZW50EgwKBG5hbWUYASABKAkSDAoEcGF0aBgCIAEoCRINCgVmaWxlcxgDIAMoCRIYChBkZXBlbmRlbmN5X3BhdGhzGAQgAygJEhMKC3Jhd19vcHRpb25zGAUgASgMIo4BCgxQYXJzZVJlcXVlc3QSDAoEcGF0aBgBIAEoCRJBCg9nZW5lcmljX29wdGlvbnMYAiABKAsyKC5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuR2VuZXJpY09wdGlvbnMSEwoLcmF3X29wdGlvbnMYAyABKAxKBAgEEAVSEnJhd19vcHRpb25zX2Zvcm1hdCKkAQoNUGFyc2VSZXNwb25zZRIxCgtkaWFnbm9zdGljcxgBIAMoCzIcLmluZnJhY29zdC5wYXJzZXIuRGlhZ25vc3RpYxIiCgR0cmVlGAIgASgLMhQuaW5mcmFjb3N0LnRyZWUuVHJlZRI8ChZyZXF1ZXN0ZWRfZGVwZW5kZW5jaWVzGAMgAygLMhwuaW5mcmFjb3N0LnBsdWdpbi5EZXBlbmRlbmN5Iu4BCgpEZXBlbmRlbmN5EhEKCWZpbGVfcGF0aBgBIAEoCRISCgpsaW5lX3N0YXJ0GAIgASgDEhAKCGxpbmVfZW5kGAMgASgDEhkKEW1vZHVsZV9kZWZpbml0aW9uGAQgASgJEhgKEGlzX3JlbW90ZV9tb2R1bGUYBSABKAgSHQoVaXNfZXh0ZXJuYWxseV9kZWZpbmVkGAYgASgIEhgKEGV4dGVybmFsX3NuaXBwZXQYByABKAkSFAoMaXNfc3ludGhldGljGAggASgIEhQKDGlzX2dlbmVyYXRlZBgJIAEoCBINCgVkZXB0aBgKIAEoBTKjAwoNUGFyc2VyU2VydmljZRJmCg9HZXRQYXJzZXJDb25maWcSKC5pbmZyYWNvc3QucGx1Z2luLkdldFBhcnNlckNvbmZpZ1JlcXVlc3QaKS5pbmZyYWNvc3QucGx1Z2luLkdldFBhcnNlckNvbmZpZ1Jlc3BvbnNlEmkKEElkZW50aWZ5UHJvamVjdHMSKS5pbmZyYWNvc3QucGx1Z2luLklkZW50aWZ5UHJvamVjdHNSZXF1ZXN0GiouaW5mcmFjb3N0LnBsdWdpbi5JZGVudGlmeVByb2plY3RzUmVzcG9uc2USdQoUSWRlbnRpZnlFbnZpcm9ubWVudHMSLS5pbmZyYWNvc3QucGx1Z2luLklkZW50aWZ5RW52aXJvbm1lbnRzUmVxdWVzdBouLmluZnJhY29zdC5wbHVnaW4uSWRlbnRpZnlFbnZpcm9ubWVudHNSZXNwb25zZRJICgVQYXJzZRIeLmluZnJhY29zdC5wbHVnaW4uUGFyc2VSZXF1ZXN0Gh8uaW5mcmFjb3N0LnBsdWdpbi5QYXJzZVJlc3BvbnNlQrgBChRjb20uaW5mcmFjb3N0LnBsdWdpbkILUGFyc2VyUHJvdG9QAVoyZ2l0aHViLmNvbS9pbmZyYWNvc3QvcHJvdG8vZ2VuL2dvL2luZnJhY29zdC9wbHVnaW6iAgNJUFiqAhBJbmZyYWNvc3QuUGx1Z2luygIQSW5mcmFjb3N0XFBsdWdpbuICHEluZnJhY29zdFxQbHVnaW5cR1BCTWV0YWRhdGHqAhFJbmZyYWNvc3Q6OlBsdWdpbmIGcHJvdG8z", [file_infracost_parser_diagnostic, file_infracost_parser_options_options, file_infracost_tree_tree]);
 
 /**
  * Describes the message infracost.plugin.GetParserConfigRequest.
diff --git a/gen/ts/infracost/plugin/parser_pb.ts b/gen/ts/infracost/plugin/parser_pb.ts
index deb0b2b..bfd6a48 100644
--- a/gen/ts/infracost/plugin/parser_pb.ts
+++ b/gen/ts/infracost/plugin/parser_pb.ts
@@ -16,7 +16,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file infracost/plugin/parser.proto.
  */
 export const file_infracost_plugin_parser: GenFile = /*@__PURE__*/
-  fileDesc("Ch1pbmZyYWNvc3QvcGx1Z2luL3BhcnNlci5wcm90bxIQaW5mcmFjb3N0LnBsdWdpbiIYChZHZXRQYXJzZXJDb25maWdSZXF1ZXN0In4KF0dldFBhcnNlckNvbmZpZ1Jlc3BvbnNlEh8KF2lkZW50aWZpY2F0aW9uX3ByaW9yaXR5GAEgASgNEiUKGGNvbmZpZ19maWxlX3Byb2plY3RfdHlwZRgCIAEoCUgAiAEBQhsKGV9jb25maWdfZmlsZV9wcm9qZWN0X3R5cGUiLAoXSWRlbnRpZnlQcm9qZWN0c1JlcXVlc3QSEQoJZGlyZWN0b3J5GAEgASgJIlYKGElkZW50aWZ5UHJvamVjdHNSZXNwb25zZRIRCglkaXJlY3RvcnkYASABKAgSDQoFZmlsZXMYAiADKAkSGAoQZGVwZW5kZW5jeV9wYXRocxgDIAMoCSJvChtJZGVudGlmeUVudmlyb25tZW50c1JlcXVlc3QSEQoJZGlyZWN0b3J5GAEgASgJEj0KEGF0dHJpYnV0ZWRfZmlsZXMYAiADKAsyIy5pbmZyYWNvc3QucGx1Z2luLkF0dHJpYnV0ZWRWYXJGaWxlIkEKEUF0dHJpYnV0ZWRWYXJGaWxlEgwKBHBhdGgYASABKAkSCwoDZW52GAIgASgJEhEKCWlzX2dsb2JhbBgDIAEoCCJTChxJZGVudGlmeUVudmlyb25tZW50c1Jlc3BvbnNlEjMKDGVudmlyb25tZW50cxgBIAMoCzIdLmluZnJhY29zdC5wbHVnaW4uRW52aXJvbm1lbnQiUgoLRW52aXJvbm1lbnQSDAoEbmFtZRgBIAEoCRIMCgRwYXRoGAIgASgJEg0KBWZpbGVzGAMgAygJEhgKEGRlcGVuZGVuY3lfcGF0aHMYBCADKAkikAEKDFBhcnNlUmVxdWVzdBIMCgRwYXRoGAEgASgJEkEKD2dlbmVyaWNfb3B0aW9ucxgCIAEoCzIoLmluZnJhY29zdC5wYXJzZXIub3B0aW9ucy5HZW5lcmljT3B0aW9ucxITCgtyYXdfb3B0aW9ucxgDIAEoDBIaChJyYXdfb3B0aW9uc19mb3JtYXQYBCABKAkipAEKDVBhcnNlUmVzcG9uc2USMQoLZGlhZ25vc3RpY3MYASADKAsyHC5pbmZyYWNvc3QucGFyc2VyLkRpYWdub3N0aWMSIgoEdHJlZRgCIAEoCzIULmluZnJhY29zdC50cmVlLlRyZWUSPAoWcmVxdWVzdGVkX2RlcGVuZGVuY2llcxgDIAMoCzIcLmluZnJhY29zdC5wbHVnaW4uRGVwZW5kZW5jeSLuAQoKRGVwZW5kZW5jeRIRCglmaWxlX3BhdGgYASABKAkSEgoKbGluZV9zdGFydBgCIAEoAxIQCghsaW5lX2VuZBgDIAEoAxIZChFtb2R1bGVfZGVmaW5pdGlvbhgEIAEoCRIYChBpc19yZW1vdGVfbW9kdWxlGAUgASgIEh0KFWlzX2V4dGVybmFsbHlfZGVmaW5lZBgGIAEoCBIYChBleHRlcm5hbF9zbmlwcGV0GAcgASgJEhQKDGlzX3N5bnRoZXRpYxgIIAEoCBIUCgxpc19nZW5lcmF0ZWQYCSABKAgSDQoFZGVwdGgYCiABKAUyowMKDVBhcnNlclNlcnZpY2USZgoPR2V0UGFyc2VyQ29uZmlnEiguaW5mcmFjb3N0LnBsdWdpbi5HZXRQYXJzZXJDb25maWdSZXF1ZXN0GikuaW5mcmFjb3N0LnBsdWdpbi5HZXRQYXJzZXJDb25maWdSZXNwb25zZRJpChBJZGVudGlmeVByb2plY3RzEikuaW5mcmFjb3N0LnBsdWdpbi5JZGVudGlmeVByb2plY3RzUmVxdWVzdBoqLmluZnJhY29zdC5wbHVnaW4uSWRlbnRpZnlQcm9qZWN0c1Jlc3BvbnNlEnUKFElkZW50aWZ5RW52aXJvbm1lbnRzEi0uaW5mcmFjb3N0LnBsdWdpbi5JZGVudGlmeUVudmlyb25tZW50c1JlcXVlc3QaLi5pbmZyYWNvc3QucGx1Z2luLklkZW50aWZ5RW52aXJvbm1lbnRzUmVzcG9uc2USSAoFUGFyc2USHi5pbmZyYWNvc3QucGx1Z2luLlBhcnNlUmVxdWVzdBofLmluZnJhY29zdC5wbHVnaW4uUGFyc2VSZXNwb25zZUK4AQoUY29tLmluZnJhY29zdC5wbHVnaW5CC1BhcnNlclByb3RvUAFaMmdpdGh1Yi5jb20vaW5mcmFjb3N0L3Byb3RvL2dlbi9nby9pbmZyYWNvc3QvcGx1Z2luogIDSVBYqgIQSW5mcmFjb3N0LlBsdWdpbsoCEEluZnJhY29zdFxQbHVnaW7iAhxJbmZyYWNvc3RcUGx1Z2luXEdQQk1ldGFkYXRh6gIRSW5mcmFjb3N0OjpQbHVnaW5iBnByb3RvMw", [file_infracost_parser_diagnostic, file_infracost_parser_options_options, file_infracost_tree_tree]);
+  fileDesc("Ch1pbmZyYWNvc3QvcGx1Z2luL3BhcnNlci5wcm90bxIQaW5mcmFjb3N0LnBsdWdpbiIYChZHZXRQYXJzZXJDb25maWdSZXF1ZXN0In4KF0dldFBhcnNlckNvbmZpZ1Jlc3BvbnNlEh8KF2lkZW50aWZpY2F0aW9uX3ByaW9yaXR5GAEgASgNEiUKGGNvbmZpZ19maWxlX3Byb2plY3RfdHlwZRgCIAEoCUgAiAEBQhsKGV9jb25maWdfZmlsZV9wcm9qZWN0X3R5cGUiLAoXSWRlbnRpZnlQcm9qZWN0c1JlcXVlc3QSEQoJZGlyZWN0b3J5GAEgASgJImsKGElkZW50aWZ5UHJvamVjdHNSZXNwb25zZRIRCglkaXJlY3RvcnkYASABKAgSDQoFZmlsZXMYAiADKAkSGAoQZGVwZW5kZW5jeV9wYXRocxgDIAMoCRITCgtyYXdfb3B0aW9ucxgEIAEoDCKEAQobSWRlbnRpZnlFbnZpcm9ubWVudHNSZXF1ZXN0EhEKCWRpcmVjdG9yeRgBIAEoCRI9ChBhdHRyaWJ1dGVkX2ZpbGVzGAIgAygLMiMuaW5mcmFjb3N0LnBsdWdpbi5BdHRyaWJ1dGVkVmFyRmlsZRITCgtyYXdfb3B0aW9ucxgDIAEoDCJBChFBdHRyaWJ1dGVkVmFyRmlsZRIMCgRwYXRoGAEgASgJEgsKA2VudhgCIAEoCRIRCglpc19nbG9iYWwYAyABKAgiUwocSWRlbnRpZnlFbnZpcm9ubWVudHNSZXNwb25zZRIzCgxlbnZpcm9ubWVudHMYASADKAsyHS5pbmZyYWNvc3QucGx1Z2luLkVudmlyb25tZW50ImcKC0Vudmlyb25tZW50EgwKBG5hbWUYASABKAkSDAoEcGF0aBgCIAEoCRINCgVmaWxlcxgDIAMoCRIYChBkZXBlbmRlbmN5X3BhdGhzGAQgAygJEhMKC3Jhd19vcHRpb25zGAUgASgMIo4BCgxQYXJzZVJlcXVlc3QSDAoEcGF0aBgBIAEoCRJBCg9nZW5lcmljX29wdGlvbnMYAiABKAsyKC5pbmZyYWNvc3QucGFyc2VyLm9wdGlvbnMuR2VuZXJpY09wdGlvbnMSEwoLcmF3X29wdGlvbnMYAyABKAxKBAgEEAVSEnJhd19vcHRpb25zX2Zvcm1hdCKkAQoNUGFyc2VSZXNwb25zZRIxCgtkaWFnbm9zdGljcxgBIAMoCzIcLmluZnJhY29zdC5wYXJzZXIuRGlhZ25vc3RpYxIiCgR0cmVlGAIgASgLMhQuaW5mcmFjb3N0LnRyZWUuVHJlZRI8ChZyZXF1ZXN0ZWRfZGVwZW5kZW5jaWVzGAMgAygLMhwuaW5mcmFjb3N0LnBsdWdpbi5EZXBlbmRlbmN5Iu4BCgpEZXBlbmRlbmN5EhEKCWZpbGVfcGF0aBgBIAEoCRISCgpsaW5lX3N0YXJ0GAIgASgDEhAKCGxpbmVfZW5kGAMgASgDEhkKEW1vZHVsZV9kZWZpbml0aW9uGAQgASgJEhgKEGlzX3JlbW90ZV9tb2R1bGUYBSABKAgSHQoVaXNfZXh0ZXJuYWxseV9kZWZpbmVkGAYgASgIEhgKEGV4dGVybmFsX3NuaXBwZXQYByABKAkSFAoMaXNfc3ludGhldGljGAggASgIEhQKDGlzX2dlbmVyYXRlZBgJIAEoCBINCgVkZXB0aBgKIAEoBTKjAwoNUGFyc2VyU2VydmljZRJmCg9HZXRQYXJzZXJDb25maWcSKC5pbmZyYWNvc3QucGx1Z2luLkdldFBhcnNlckNvbmZpZ1JlcXVlc3QaKS5pbmZyYWNvc3QucGx1Z2luLkdldFBhcnNlckNvbmZpZ1Jlc3BvbnNlEmkKEElkZW50aWZ5UHJvamVjdHMSKS5pbmZyYWNvc3QucGx1Z2luLklkZW50aWZ5UHJvamVjdHNSZXF1ZXN0GiouaW5mcmFjb3N0LnBsdWdpbi5JZGVudGlmeVByb2plY3RzUmVzcG9uc2USdQoUSWRlbnRpZnlFbnZpcm9ubWVudHMSLS5pbmZyYWNvc3QucGx1Z2luLklkZW50aWZ5RW52aXJvbm1lbnRzUmVxdWVzdBouLmluZnJhY29zdC5wbHVnaW4uSWRlbnRpZnlFbnZpcm9ubWVudHNSZXNwb25zZRJICgVQYXJzZRIeLmluZnJhY29zdC5wbHVnaW4uUGFyc2VSZXF1ZXN0Gh8uaW5mcmFjb3N0LnBsdWdpbi5QYXJzZVJlc3BvbnNlQrgBChRjb20uaW5mcmFjb3N0LnBsdWdpbkILUGFyc2VyUHJvdG9QAVoyZ2l0aHViLmNvbS9pbmZyYWNvc3QvcHJvdG8vZ2VuL2dvL2luZnJhY29zdC9wbHVnaW6iAgNJUFiqAhBJbmZyYWNvc3QuUGx1Z2luygIQSW5mcmFjb3N0XFBsdWdpbuICHEluZnJhY29zdFxQbHVnaW5cR1BCTWV0YWRhdGHqAhFJbmZyYWNvc3Q6OlBsdWdpbmIGcHJvdG8z", [file_infracost_parser_diagnostic, file_infracost_parser_options_options, file_infracost_tree_tree]);
 
 /**
  * @generated from message infracost.plugin.GetParserConfigRequest
@@ -99,6 +99,16 @@ export type IdentifyProjectsResponse = Message<"infracost.plugin.IdentifyProject
    * @generated from field: repeated string dependency_paths = 3;
    */
   dependencyPaths: string[];
+
+  /**
+   * Plugin-authored parse options for the identified project(s), always JSON. Same schema the
+   * plugin consumes in ParseRequest.raw_options. Opaque to the caller: it is persisted (as a
+   * YAML map in the config file) and forwarded, never interpreted. This is a directory-level
+   * seed; the authoritative per-project blob is produced by IdentifyEnvironments.
+   *
+   * @generated from field: bytes raw_options = 4;
+   */
+  rawOptions: Uint8Array;
 };
 
 /**
@@ -132,6 +142,14 @@ export type IdentifyEnvironmentsRequest = Message<"infracost.plugin.IdentifyEnvi
    * @generated from field: repeated infracost.plugin.AttributedVarFile attributed_files = 2;
    */
   attributedFiles: AttributedVarFile[];
+
+  /**
+   * the seed blob IdentifyProjects produced for this project root, for the plugin to refine.
+   * Always JSON, opaque to the caller.
+   *
+   * @generated from field: bytes raw_options = 3;
+   */
+  rawOptions: Uint8Array;
 };
 
 /**
@@ -231,6 +249,15 @@ export type Environment = Message<"infracost.plugin.Environment"> & {
    * @generated from field: repeated string dependency_paths = 4;
    */
   dependencyPaths: string[];
+
+  /**
+   * Per-environment, plugin-specific parse options, always JSON. This is the blob that is
+   * persisted in the config file (as a YAML map, readable/editable) and passed verbatim into
+   * ParseRequest.raw_options for this environment. Opaque to the caller.
+   *
+   * @generated from field: bytes raw_options = 5;
+   */
+  rawOptions: Uint8Array;
 };
 
 /**
@@ -261,18 +288,14 @@ export type ParseRequest = Message<"infracost.plugin.ParseRequest"> & {
   genericOptions?: GenericOptions;
 
   /**
-   * Options data pertaining to the specific plugin. Different plugins may expect different formats/shapes/contents e.g. protobuf, json, yaml etc. - plugins should document this themselves.
+   * Plugin-specific parse options for this project/environment, always JSON. This is the same
+   * blob generated during identification and persisted in the config file (see
+   * Environment.raw_options), passed through without the config library / CLI / runner
+   * interpreting it. Plugins document their own schema.
    *
    * @generated from field: bytes raw_options = 3;
    */
   rawOptions: Uint8Array;
-
-  /**
-   * Used to tell the consuming plugin what format the raw_options data is in e.g. "application/json".
-   *
-   * @generated from field: string raw_options_format = 4;
-   */
-  rawOptionsFormat: string;
 };
 
 /**
diff --git a/package-lock.json b/package-lock.json
index 6d8f1c4..812fe21 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@infracost/proto",
-  "version": "1.156.0",
+  "version": "1.157.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@infracost/proto",
-      "version": "1.156.0",
+      "version": "1.157.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@bufbuild/protobuf": "^2.10.1"
diff --git a/proto/infracost/parser/options/options.proto b/proto/infracost/parser/options/options.proto
index 4f91a5e..cbb4285 100644
--- a/proto/infracost/parser/options/options.proto
+++ b/proto/infracost/parser/options/options.proto
@@ -32,6 +32,36 @@ message GenericOptions {
   optional DependencyRequest dependency_request = 13;
   // Enable http first git normalization
   bool enable_git_normalization = 14;
+
+  // Caller-sourced options (flag/env/API): data the caller assembles that a plugin cannot derive
+  // from the repo, so it is typed here rather than in the opaque raw_options blob. Each is only
+  // consumed by the plugins noted; others ignore it.
+
+  // FinOps naming-policy requirements (resource type -> required attributes). Source: org/dashboard
+  // policy. Cross-plugin (any IaC with taggable resources); today read by the terraform-family plugins.
+  repeated AttributeRequirement required_attributes = 15;
+  // Default tags applied to all resources. Source: YOR config file / YOR_SIMPLE_TAGS env.
+  // Consumed by the terraform-family plugins.
+  map<string, string> default_tags = 16;
+  // Flat module source map (module source -> replacement). Source: INFRACOST_TERRAFORM_SOURCE_MAP
+  // env. Consumed by the terraform-family plugins. NOTE: the regex source map from the config file
+  // (terraform.source_map) is user config and travels in the raw_options blob instead.
+  map<string, string> source_map = 17;
+  // Environment variables for parsing (e.g. TF_VAR_*, TF_WORKSPACE). Source: runtime/integration
+  // env merged with the project's configured env. Consumed by the terraform-family plugins.
+  map<string, string> env = 18;
+  // Force module sources to resolve as local paths instead of downloading them. Source: caller flag.
+  // Consumed by the terraform-family plugins.
+  bool force_local_module_paths = 19;
+}
+
+// AttributeRequirement lists the attributes a given resource type must set for a FinOps
+// naming/tagging policy.
+message AttributeRequirement {
+  // The resource type the requirement applies to (e.g. "aws_instance").
+  string resource_type = 1;
+  // The attributes that must be present on that resource type.
+  repeated string attributes = 2;
 }
 
 // DependencyRequest specifies parameters for extracting resource dependencies during parsing.
diff --git a/proto/infracost/plugin/parser.proto b/proto/infracost/plugin/parser.proto
index 740685e..b359333 100644
--- a/proto/infracost/plugin/parser.proto
+++ b/proto/infracost/plugin/parser.proto
@@ -50,6 +50,11 @@ message IdentifyProjectsResponse {
   repeated string files = 2;
   // dependencies, relative to the directory
   repeated string dependency_paths = 3;
+  // Plugin-authored parse options for the identified project(s), always JSON. Same schema the
+  // plugin consumes in ParseRequest.raw_options. Opaque to the caller: it is persisted (as a
+  // YAML map in the config file) and forwarded, never interpreted. This is a directory-level
+  // seed; the authoritative per-project blob is produced by IdentifyEnvironments.
+  bytes raw_options = 4;
 }
 
 message IdentifyEnvironmentsRequest {
@@ -65,6 +70,10 @@ message IdentifyEnvironmentsRequest {
   // to be retired once the heuristic is dropped. Plugins for other formats should IGNORE it
   // and derive their environments from directory alone.
   repeated AttributedVarFile attributed_files = 2;
+
+  // the seed blob IdentifyProjects produced for this project root, for the plugin to refine.
+  // Always JSON, opaque to the caller.
+  bytes raw_options = 3;
 }
 
 // AttributedVarFile is one input file the caller has already associated with a project,
@@ -96,6 +105,10 @@ message Environment {
   // shared inputs this environment pulls in, relative to the request directory.
   // Kustomize: base/components dirs; Terraform: n/a.
   repeated string dependency_paths = 4;
+  // Per-environment, plugin-specific parse options, always JSON. This is the blob that is
+  // persisted in the config file (as a YAML map, readable/editable) and passed verbatim into
+  // ParseRequest.raw_options for this environment. Opaque to the caller.
+  bytes raw_options = 5;
 }
 
 // ParseRequest is the unified request for all parser types.
@@ -104,10 +117,14 @@ message ParseRequest {
   string path = 1;
   // Generic options that aren't specific to any IaC
   infracost.parser.options.GenericOptions generic_options = 2;
-  // Options data pertaining to the specific plugin. Different plugins may expect different formats/shapes/contents e.g. protobuf, json, yaml etc. - plugins should document this themselves.
+  // Plugin-specific parse options for this project/environment, always JSON. This is the same
+  // blob generated during identification and persisted in the config file (see
+  // Environment.raw_options), passed through without the config library / CLI / runner
+  // interpreting it. Plugins document their own schema.
   bytes raw_options = 3;
-  // Used to tell the consuming plugin what format the raw_options data is in e.g. "application/json".
-  string raw_options_format = 4;
+  // field 4 was `string raw_options_format` - dropped: raw_options is always JSON.
+  reserved 4;
+  reserved "raw_options_format";
 }
 
 // ParseResponse is the iac-agnostic parser response