@mnemom/mnemom 0.17.32 → 0.17.34-next.1

package/dist/lib/scan/share.js

@@ -0,0 +1,47 @@
+/**
+ * Share level: what, if anything, may leave the machine. Asked before any output is built for sharing.
+ * Default is summary metrics. "none" yields no payload at all.
+ */
+import { askSelect } from "../prompt.js";
+export const SHARE_OPTIONS = [
+    { level: "summary", label: "Summary metrics only (counts and one estimate line; default)" },
+    { level: "full", label: "Full report (summary plus per-repo counts)" },
+    { level: "none", label: "Nothing (keep results on this machine)" },
+];
+/** Asks the user. Anything but a recognised answer (cancel, EOF, noise) is "none": fail closed. */
+export async function promptShareLevel() {
+    const answer = await askSelect("What may leave this machine?", SHARE_OPTIONS.map((o) => o.label));
+    if (answer === null)
+        return "none";
+    return SHARE_OPTIONS.find((o) => o.label === answer)?.level ?? "none";
+}
+export function parseShareLevel(v) {
+    return v === "summary" || v === "full" || v === "none" ? v : null;
+}
+export function buildSharePayload(level, r, recipients, 
+/** undefined: the legacy line; null: no spend line; string: that line. */
+spendLine) {
+    if (level === "none")
+        return null;
+    const base = {
+        recipients,
+        level,
+        period: { start: r.coverage.windowStart, end: r.coverage.windowEnd },
+        prs: r.totals.prs,
+        reverts: r.totals.reverts,
+        ci_green: r.totals.ciGreen,
+        examined: r.totals.examined,
+        coverage_complete: r.coverage.complete,
+        ...((spendLine === undefined ? r.spend.line : spendLine) === null
+            ? {}
+            : { spend_line: spendLine ?? r.spend.line }),
+    };
+    if (level === "full")
+        base.repos = r.byRepo.map((b) => ({
+            repo: b.repo,
+            prs: b.prs,
+            reverts: b.reverts,
+            ci_green: b.ciGreen,
+        }));
+    return base;
+}

package/dist/lib/scan/spend/ai-tool-detect.d.ts

@@ -0,0 +1,6 @@
+import type { AiTool } from "./prices.js";
+/** Upper bound on text scanned per PR, so one huge body cannot dominate a scan. The TAIL is kept: trailers and "generated with" footers sit at the end. */
+export declare const MAX_MARK_TEXT = 20000;
+export declare const AI_TOOLS: AiTool[];
+/** Tools whose mark appears in the text, in a fixed order. Non-string input yields none. */
+export declare function detectAiTools(markText: unknown): AiTool[];

package/dist/lib/scan/spend/ai-tool-detect.js

@@ -0,0 +1,18 @@
+/** Upper bound on text scanned per PR, so one huge body cannot dominate a scan. The TAIL is kept: trailers and "generated with" footers sit at the end. */
+export const MAX_MARK_TEXT = 20_000;
+const TRAILER = String.raw `^[ \t>*-]*co-authored-by:[^\n]*?`;
+const GEN = String.raw `generated (?:with|by|using)[^\n]{0,24}?`;
+const MARKS = {
+    claude_code: new RegExp(`${TRAILER}(?:\\bclaude\\b|noreply@anthropic\\.com)|${GEN}\\bclaude code\\b`, "im"),
+    codex: new RegExp(`${TRAILER}\\bcodex\\b|${GEN}\\bcodex\\b`, "im"),
+    copilot: new RegExp(`${TRAILER}\\bcopilot\\b|${GEN}\\bgithub copilot\\b`, "im"),
+    gemini: new RegExp(`${TRAILER}\\bgemini\\b|${GEN}\\bgemini(?: cli)?\\b`, "im"),
+};
+export const AI_TOOLS = Object.keys(MARKS);
+/** Tools whose mark appears in the text, in a fixed order. Non-string input yields none. */
+export function detectAiTools(markText) {
+    if (typeof markText !== "string" || markText.length === 0)
+        return [];
+    const text = markText.length > MAX_MARK_TEXT ? markText.slice(-MAX_MARK_TEXT) : markText;
+    return AI_TOOLS.filter((t) => MARKS[t].test(text));
+}

package/dist/lib/scan/spend/anthropic-usage.d.ts

@@ -0,0 +1,57 @@
+export declare const ANTHROPIC_ADMIN_ORIGIN = "https://api.anthropic.com";
+export declare const ADMIN_KEY_ENV = "ANTHROPIC_ADMIN_KEY";
+export declare const DEFAULT_MAX_PAGES = 20;
+/** One shared deadline for a request including its retries (not N x timeout). */
+export declare const DEFAULT_TIMEOUT_MS = 15000;
+export declare const DEFAULT_MAX_RETRIES = 2;
+/** Shape check only; the key is never echoed, even on a mismatch. */
+export declare const isAdminKeyShape: (k: unknown) => k is string;
+export type UsageFailure = "key_invalid" | "key_refused" | "rate_limited" | "timeout" | "network" | "upstream" | "malformed" | "too_large";
+/** Fixed sentence for a failure reason. */
+export declare const usageFailureText: (r: UsageFailure) => string;
+/** Carries only a reason tag. Its message is the fixed sentence: nothing upstream can reach it. */
+export declare class AnthropicUsageError extends Error {
+    readonly reason: UsageFailure;
+    constructor(reason: UsageFailure);
+}
+export type ContextWindow = "0-200k" | "200k-1M";
+export interface UsageRow {
+    tokens: number;
+    contextWindow: ContextWindow | null;
+}
+export interface Page<R> {
+    rows: R[];
+    truncated: boolean;
+    pages: number;
+}
+export interface CostRow {
+    /** Cents, as Anthropic returns it (a decimal string). */
+    cents: number;
+    currency: string;
+}
+export interface AnthropicUsageDeps {
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    maxPages?: number;
+    timeoutMs?: number;
+    maxRetries?: number;
+}
+export declare function parseUsageRow(raw: unknown): UsageRow;
+export declare function parseCostRow(raw: unknown): CostRow;
+/** Buckets are UTC-aligned: floor so a mid-day start reads the whole bucket it falls in. */
+export declare function alignStartingAt(startingAt: string): string;
+export interface MeasuredUsage {
+    /** Whole-org cost over the period, in USD. */
+    usd: number;
+    /** Fraction in [0, 1] of tokens from requests in the 200k-1M context window; null with no tokens. */
+    over200kShare: number | null;
+}
+/**
+ * The same two reads mnemom-api made: usage grouped by context_window (the exact >200k share) and cost
+ * (total spend). The key is shape-checked before any call so a regular API key never leaves the machine.
+ * Throws AnthropicUsageError only. A walk stopped by the page cap is an error, never a short total.
+ */
+export declare function fetchMeasuredUsage(key: string | undefined, period: {
+    start: string;
+    end: string;
+}, deps?: AnthropicUsageDeps): Promise<MeasuredUsage>;

package/dist/lib/scan/spend/anthropic-usage.js

@@ -0,0 +1,244 @@
+// MNE-9298 Tier 1: the CTO's own Anthropic Admin key, used LOCALLY, to read measured usage. Port of
+// mnemom-api src/org-scan/usage/usage-client.ts (two read-only GETs: usage_report/messages grouped by
+// context_window, and cost_report) with the server-only parts (egress allowlist, WIF) dropped.
+//
+// The key is held in memory for the length of the two reads. It is never stored, logged, written to disk,
+// echoed, put in argv, a URL or an error message, and is sent only to api.anthropic.com (a constant, not
+// configurable) in the x-api-key header. Every failure surfaces as a fixed sentence: the thrown value, the
+// response body and the key never reach the terminal.
+export const ANTHROPIC_ADMIN_ORIGIN = "https://api.anthropic.com";
+export const ADMIN_KEY_ENV = "ANTHROPIC_ADMIN_KEY";
+const ANTHROPIC_VERSION = "2023-06-01";
+const USAGE_PATH = "/v1/organizations/usage_report/messages";
+const COST_PATH = "/v1/organizations/cost_report";
+export const DEFAULT_MAX_PAGES = 20;
+/** One shared deadline for a request including its retries (not N x timeout). */
+export const DEFAULT_TIMEOUT_MS = 15_000;
+export const DEFAULT_MAX_RETRIES = 2;
+const MAX_RETRY_WAIT_MS = 5_000;
+const ADMIN_KEY_RE = /^sk-ant-admin[A-Za-z0-9_-]{8,}$/;
+/** Shape check only; the key is never echoed, even on a mismatch. */
+export const isAdminKeyShape = (k) => typeof k === "string" && ADMIN_KEY_RE.test(k.trim());
+const FAILURE_TEXT = {
+    key_invalid: "The Anthropic admin key is not an Admin API key (it should start with sk-ant-admin).",
+    key_refused: "Anthropic refused the admin key (401/403).",
+    rate_limited: "Anthropic rate limit reached.",
+    timeout: "Anthropic did not answer in time.",
+    network: "Anthropic was unreachable.",
+    upstream: "Anthropic usage could not be read.",
+    malformed: "Anthropic returned usage in a shape this CLI does not recognise.",
+    too_large: "Anthropic usage for this period is too large to read completely.",
+};
+/** Fixed sentence for a failure reason. */
+export const usageFailureText = (r) => FAILURE_TEXT[r];
+/** Carries only a reason tag. Its message is the fixed sentence: nothing upstream can reach it. */
+export class AnthropicUsageError extends Error {
+    reason;
+    constructor(reason) {
+        super(FAILURE_TEXT[reason]);
+        this.reason = reason;
+        this.name = "AnthropicUsageError";
+    }
+}
+const bad = () => {
+    throw new AnthropicUsageError("malformed");
+};
+const rec = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : bad();
+function reqNum(r, k) {
+    const v = r[k];
+    return typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : bad();
+}
+/** Optional counter inside an optional object: absent is 0, present-but-wrong is an error. */
+function optNum(o, k) {
+    if (o === undefined || o === null)
+        return 0;
+    if (typeof o !== "object")
+        return bad();
+    const v = o[k];
+    if (v === undefined || v === null)
+        return 0;
+    return typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : bad();
+}
+export function parseUsageRow(raw) {
+    const r = rec(raw);
+    const cw = r.context_window;
+    if (cw !== null && cw !== undefined && cw !== "0-200k" && cw !== "200k-1M")
+        bad();
+    return {
+        tokens: reqNum(r, "uncached_input_tokens") +
+            reqNum(r, "cache_read_input_tokens") +
+            reqNum(r, "output_tokens") +
+            optNum(r.cache_creation, "ephemeral_1h_input_tokens") +
+            optNum(r.cache_creation, "ephemeral_5m_input_tokens"),
+        contextWindow: (cw ?? null),
+    };
+}
+const CENT = /^-?\d+(\.\d+)?$/;
+export function parseCostRow(raw) {
+    const r = rec(raw);
+    if (typeof r.amount !== "string" || !CENT.test(r.amount))
+        bad();
+    if (typeof r.currency !== "string" || r.currency === "")
+        bad();
+    return { cents: Number(r.amount), currency: r.currency };
+}
+const DAY_MS = 86_400_000;
+/** Buckets are UTC-aligned: floor so a mid-day start reads the whole bucket it falls in. */
+export function alignStartingAt(startingAt) {
+    const t = Date.parse(startingAt);
+    if (!Number.isFinite(t))
+        return startingAt;
+    return new Date(Math.floor(t / DAY_MS) * DAY_MS).toISOString().replace(".000Z", "Z");
+}
+const backoff = (attempt) => Math.min(250 * 2 ** (attempt - 1), MAX_RETRY_WAIT_MS);
+function retryWait(res, attempt) {
+    const ra = Number(res.headers.get("retry-after"));
+    return Number.isFinite(ra) && ra > 0 ? ra * 1000 : backoff(attempt);
+}
+class Reader {
+    key;
+    fetchImpl;
+    sleep;
+    maxPages;
+    timeoutMs;
+    maxRetries;
+    constructor(key, deps) {
+        this.key = key;
+        this.fetchImpl = deps.fetchImpl ?? ((...a) => fetch(...a));
+        this.sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        this.maxPages = deps.maxPages ?? DEFAULT_MAX_PAGES;
+        this.timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.maxRetries = deps.maxRetries ?? DEFAULT_MAX_RETRIES;
+    }
+    async walk(path, base, parse, callMaxPages) {
+        const ceiling = typeof callMaxPages === "number" && Number.isFinite(callMaxPages) && callMaxPages >= 1
+            ? Math.min(this.maxPages, Math.floor(callMaxPages))
+            : this.maxPages;
+        const rows = [];
+        let page = null;
+        let pages = 0;
+        for (;;) {
+            const params = new URLSearchParams(base);
+            if (page)
+                params.set("page", page);
+            const body = await this.request(`${ANTHROPIC_ADMIN_ORIGIN}${path}?${params.toString()}`);
+            pages += 1;
+            if (!Array.isArray(body.data))
+                bad();
+            for (const raw of body.data) {
+                const b = rec(raw);
+                if (typeof b.starting_at !== "string" || typeof b.ending_at !== "string")
+                    bad();
+                if (!Array.isArray(b.results))
+                    bad();
+                for (const r of b.results)
+                    rows.push(parse(r));
+            }
+            const more = body.has_more;
+            if (more !== undefined && more !== null && typeof more !== "boolean")
+                bad();
+            if (more !== true)
+                return { rows, truncated: false, pages };
+            if (typeof body.next_page !== "string" || body.next_page === "")
+                bad();
+            if (pages >= ceiling)
+                return { rows, truncated: true, pages };
+            page = body.next_page;
+        }
+    }
+    async request(url) {
+        const deadline = AbortSignal.timeout(this.timeoutMs);
+        for (let attempt = 0;;) {
+            let res;
+            try {
+                res = await this.fetchImpl(url, {
+                    method: "GET",
+                    headers: {
+                        "x-api-key": this.key,
+                        "anthropic-version": ANTHROPIC_VERSION,
+                        accept: "application/json",
+                    },
+                    // A redirect would carry the x-api-key header to wherever it points: refuse to follow one.
+                    redirect: "error",
+                    signal: deadline,
+                });
+            }
+            catch {
+                // Never surface the thrown value: it can carry the request.
+                if (deadline.aborted)
+                    throw new AnthropicUsageError("timeout");
+                if (attempt++ < this.maxRetries) {
+                    await this.sleep(backoff(attempt));
+                    continue;
+                }
+                throw new AnthropicUsageError("network");
+            }
+            if (res.ok) {
+                let json;
+                try {
+                    json = await res.json();
+                }
+                catch {
+                    throw new AnthropicUsageError("upstream");
+                }
+                return rec(json);
+            }
+            await res.body?.cancel().catch(() => { });
+            if (res.status === 401 || res.status === 403)
+                throw new AnthropicUsageError("key_refused");
+            const retryable = res.status === 429 || res.status >= 500;
+            const wait = retryable ? retryWait(res, attempt + 1) : 0;
+            if (retryable &&
+                !deadline.aborted &&
+                wait <= MAX_RETRY_WAIT_MS &&
+                attempt++ < this.maxRetries) {
+                await this.sleep(wait);
+                continue;
+            }
+            throw new AnthropicUsageError(res.status === 429 ? "rate_limited" : "upstream");
+        }
+    }
+}
+const validDay = (d) => /^\d{4}-\d{2}-\d{2}$/.test(d) && Number.isFinite(Date.parse(`${d}T00:00:00Z`));
+/**
+ * The same two reads mnemom-api made: usage grouped by context_window (the exact >200k share) and cost
+ * (total spend). The key is shape-checked before any call so a regular API key never leaves the machine.
+ * Throws AnthropicUsageError only. A walk stopped by the page cap is an error, never a short total.
+ */
+export async function fetchMeasuredUsage(key, period, deps = {}) {
+    const k = key?.trim();
+    if (!k || !isAdminKeyShape(k))
+        throw new AnthropicUsageError("key_invalid");
+    if (!validDay(period.start) || !validDay(period.end))
+        throw new AnthropicUsageError("malformed");
+    const startingAt = alignStartingAt(`${period.start}T00:00:00Z`);
+    const endingAt = new Date(Date.parse(`${period.end}T00:00:00Z`) + DAY_MS).toISOString();
+    const reader = new Reader(k, deps);
+    const up = new URLSearchParams({
+        starting_at: startingAt,
+        ending_at: endingAt,
+        bucket_width: "1d",
+    });
+    up.append("group_by[]", "context_window");
+    const usage = await reader.walk(USAGE_PATH, up, parseUsageRow);
+    if (usage.truncated)
+        throw new AnthropicUsageError("too_large");
+    const cp = new URLSearchParams({ starting_at: startingAt, ending_at: endingAt });
+    const cost = await reader.walk(COST_PATH, cp, parseCostRow);
+    if (cost.truncated)
+        throw new AnthropicUsageError("too_large");
+    let total = 0;
+    let over = 0;
+    for (const r of usage.rows) {
+        total += r.tokens;
+        if (r.contextWindow === "200k-1M")
+            over += r.tokens;
+    }
+    let cents = 0;
+    for (const r of cost.rows) {
+        if (r.currency !== "USD")
+            throw new AnthropicUsageError("malformed");
+        cents += r.cents;
+    }
+    return { usd: Math.round(cents) / 100, over200kShare: total > 0 ? over / total : null };
+}

package/dist/lib/scan/spend/cost-corpus.v1.d.ts

@@ -0,0 +1,56 @@
+declare const _default: {
+    readonly schema_version: 1;
+    readonly as_of: "2026-10-28T00:00:00Z";
+    readonly source: "ADW 'Run cost' PR comments (cost_report.py) on merged fleet PRs (org-wide GitHub search for run-cost comments, plus shipped PRs from the eval sets); cost_usd sums distinct runs and is a floor";
+    readonly candidates: 236;
+    readonly rows: readonly [{
+        readonly repo: "aap";
+        readonly pr: 100;
+        readonly additions: 117;
+        readonly deletions: 68;
+        readonly cost_usd: 0.4;
+        readonly runs: 1;
+        readonly models: readonly ["sonnet"];
+    }, {
+        readonly repo: "mnemom-api";
+        readonly pr: 1816;
+        readonly additions: 239;
+        readonly deletions: 0;
+        readonly cost_usd: 0.55;
+        readonly runs: 1;
+        readonly models: readonly ["haiku", "sonnet"];
+    }, {
+        readonly repo: "mnemom-api";
+        readonly pr: 3639;
+        readonly additions: 2260;
+        readonly deletions: 0;
+        readonly cost_usd: 5.42;
+        readonly runs: 1;
+        readonly models: readonly ["sonnet"];
+    }, {
+        readonly repo: "mnemom-research-grade";
+        readonly pr: 112;
+        readonly additions: 73;
+        readonly deletions: 10;
+        readonly cost_usd: 0.35;
+        readonly runs: 1;
+        readonly models: readonly ["haiku", "sonnet"];
+    }, {
+        readonly repo: "mnemom-website";
+        readonly pr: 1668;
+        readonly additions: 78;
+        readonly deletions: 119;
+        readonly cost_usd: 0.23;
+        readonly runs: 1;
+        readonly models: readonly ["sonnet"];
+    }, {
+        readonly repo: "mnemom-website";
+        readonly pr: 1669;
+        readonly additions: 126;
+        readonly deletions: 22;
+        readonly cost_usd: 0.28;
+        readonly runs: 1;
+        readonly models: readonly ["sonnet"];
+    }];
+};
+export default _default;

package/dist/lib/scan/spend/cost-corpus.v1.js

@@ -0,0 +1,64 @@
+// Cost corpus (port of mnemom-api src/org-scan/spend/cost-corpus.v1.json, as_of 2026-10-28T00:00:00Z). A TS module, not a
+// JSON asset, so the build needs no copy-assets entry.
+export default {
+    schema_version: 1,
+    as_of: "2026-10-28T00:00:00Z",
+    source: "ADW 'Run cost' PR comments (cost_report.py) on merged fleet PRs (org-wide GitHub search for run-cost comments, plus shipped PRs from the eval sets); cost_usd sums distinct runs and is a floor",
+    candidates: 236,
+    rows: [
+        {
+            repo: "aap",
+            pr: 100,
+            additions: 117,
+            deletions: 68,
+            cost_usd: 0.4,
+            runs: 1,
+            models: ["sonnet"],
+        },
+        {
+            repo: "mnemom-api",
+            pr: 1816,
+            additions: 239,
+            deletions: 0,
+            cost_usd: 0.55,
+            runs: 1,
+            models: ["haiku", "sonnet"],
+        },
+        {
+            repo: "mnemom-api",
+            pr: 3639,
+            additions: 2260,
+            deletions: 0,
+            cost_usd: 5.42,
+            runs: 1,
+            models: ["sonnet"],
+        },
+        {
+            repo: "mnemom-research-grade",
+            pr: 112,
+            additions: 73,
+            deletions: 10,
+            cost_usd: 0.35,
+            runs: 1,
+            models: ["haiku", "sonnet"],
+        },
+        {
+            repo: "mnemom-website",
+            pr: 1668,
+            additions: 78,
+            deletions: 119,
+            cost_usd: 0.23,
+            runs: 1,
+            models: ["sonnet"],
+        },
+        {
+            repo: "mnemom-website",
+            pr: 1669,
+            additions: 126,
+            deletions: 22,
+            cost_usd: 0.28,
+            runs: 1,
+            models: ["sonnet"],
+        },
+    ],
+};

package/dist/lib/scan/spend/prices.d.ts

@@ -0,0 +1,33 @@
+export type AiTool = "claude_code" | "codex" | "copilot" | "gemini";
+export interface TokenPrice {
+    /** USD per 1M input tokens. */
+    inputPerMTok: number;
+    /** USD per 1M output tokens. */
+    outputPerMTok: number;
+    model: string;
+}
+export interface PriceBand {
+    low: TokenPrice;
+    high: TokenPrice;
+    /** Page the prices were read from. */
+    source: string;
+}
+export declare const PRICES_AS_OF = "2026-10-28";
+export declare const TOOL_PRICES: Record<Exclude<AiTool, "copilot">, PriceBand>;
+/**
+ * GitHub Copilot bills per premium request, not per token
+ * (https://docs.github.com/en/copilot/concepts/billing/copilot-requests),
+ * so it has no token price of its own. Its agent routes to the other vendors' models, so its band is
+ * the union of the other three: cheapest low to dearest high. An assumption, stated here once.
+ */
+export declare function copilotBand(): PriceBand;
+/**
+ * Share of billed tokens that are input (the rest output). Agent loops re-read large context and
+ * write little, so input dominates. An ASSUMPTION used both to turn our known run cost into
+ * tokens-per-line and to price those tokens for each tool; it cancels to first order when the
+ * tool's input/output price ratio matches ours, and is the main source of the range's width.
+ */
+export declare const INPUT_SHARE = 0.9;
+export declare function bandFor(tool: AiTool): PriceBand;
+/** USD per token at the assumed input/output mix. */
+export declare function blendedUsdPerToken(p: TokenPrice): number;

package/dist/lib/scan/spend/prices.js

@@ -0,0 +1,57 @@
+// MNE-9268: public list prices for the AI coding tools the Tier-3 spend estimator can name.
+// Constants, not magic numbers: every row carries its source page and the date it was read.
+// USD per million tokens (input / output), standard (non-batch) list price. A band is the cheapest
+// and the dearest model a tool's coding agent plausibly runs on, so the estimate is a RANGE.
+// Re-read the pages and bump PRICES_AS_OF when they move; a stale price widens nothing silently,
+// it just shifts the range, which is why the date ships with the estimate's method text.
+export const PRICES_AS_OF = "2026-10-28";
+export const TOOL_PRICES = {
+    claude_code: {
+        source: "https://platform.claude.com/docs/en/about-claude/pricing",
+        low: { model: "Claude Sonnet 5.5", inputPerMTok: 2, outputPerMTok: 10 },
+        high: { model: "Claude Opus 5", inputPerMTok: 5, outputPerMTok: 25 },
+    },
+    codex: {
+        source: "https://developers.openai.com/api/docs/pricing",
+        low: { model: "gpt-5.3-codex (standard)", inputPerMTok: 1.75, outputPerMTok: 14 },
+        high: { model: "gpt-5.3-codex (fast)", inputPerMTok: 3.5, outputPerMTok: 28 },
+    },
+    gemini: {
+        source: "https://ai.google.dev/gemini-api/docs/pricing",
+        // Gemini 3.8 Flash is $0.75/$3.75 through 2026-12-31 and $1.50/$7.50 from 2027-01-01; the
+        // post-promotion price is used so the lower bound does not expire in two months.
+        low: { model: "Gemini 3.8 Flash (from 2027-01-01)", inputPerMTok: 1.5, outputPerMTok: 7.5 },
+        high: { model: "Gemini 3.1 Pro (prompts up to 200k)", inputPerMTok: 2, outputPerMTok: 12 },
+    },
+};
+/**
+ * GitHub Copilot bills per premium request, not per token
+ * (https://docs.github.com/en/copilot/concepts/billing/copilot-requests),
+ * so it has no token price of its own. Its agent routes to the other vendors' models, so its band is
+ * the union of the other three: cheapest low to dearest high. An assumption, stated here once.
+ */
+export function copilotBand() {
+    const bands = Object.values(TOOL_PRICES);
+    const blend = (p) => p.inputPerMTok * INPUT_SHARE + p.outputPerMTok * (1 - INPUT_SHARE);
+    const low = bands.map((b) => b.low).sort((a, b) => blend(a) - blend(b))[0];
+    const high = bands.map((b) => b.high).sort((a, b) => blend(b) - blend(a))[0];
+    return {
+        low,
+        high,
+        source: "union of the claude_code, codex and gemini bands (per-request billing)",
+    };
+}
+/**
+ * Share of billed tokens that are input (the rest output). Agent loops re-read large context and
+ * write little, so input dominates. An ASSUMPTION used both to turn our known run cost into
+ * tokens-per-line and to price those tokens for each tool; it cancels to first order when the
+ * tool's input/output price ratio matches ours, and is the main source of the range's width.
+ */
+export const INPUT_SHARE = 0.9;
+export function bandFor(tool) {
+    return tool === "copilot" ? copilotBand() : TOOL_PRICES[tool];
+}
+/** USD per token at the assumed input/output mix. */
+export function blendedUsdPerToken(p) {
+    return (p.inputPerMTok * INPUT_SHARE + p.outputPerMTok * (1 - INPUT_SHARE)) / 1_000_000;
+}

package/dist/lib/scan/spend/spend-estimate.d.ts

@@ -0,0 +1,30 @@
+import { type AiTool } from "./prices.js";
+import { type TokenRate } from "./token-rate.js";
+/** AI-assisted PRs needed before a range is worth printing. */
+export declare const MIN_AI_PRS = 10;
+/** Per-PR input. `markText` is commit messages / PR body, read for tool marks and dropped. */
+export interface SpendPrInput {
+    additions: number;
+    deletions: number;
+    markText: string;
+    /** Tools already detected inside the PR source (so the body never leaves it). Wins over markText. */
+    tools?: AiTool[];
+}
+export type NoSpendReason = "too_few_ai_prs" | "no_rate" | "invalid_input";
+export type SpendEstimate = {
+    kind: "range";
+    lowUsd: number;
+    highUsd: number;
+    aiPrs: number;
+    scannedPrs: number;
+    byTool: Partial<Record<AiTool, number>>;
+    /** One line, labelled estimate, passes claim-lint. */
+    line: string;
+} | {
+    kind: "none";
+    reason: NoSpendReason;
+    aiPrs: number;
+    scannedPrs: number;
+    line: string;
+};
+export declare function estimateSpend(prs: unknown, rate?: TokenRate | null): SpendEstimate;