@mnemom/mnemom 0.17.38-next.0 → 0.17.38-next.2

package/dist/lib/scan/spend/spend-tiers.d.ts

@@ -1,4 +1,3 @@
-import type { SpendEstimate } from "./spend-estimate.js";
 export declare const ORG_SCAN_ENV = "MNEMOM_ORG_SCAN_MODE";
 /** Default OFF: only the exact string "true" turns the tiers on. */
 export declare const isSpendTiersEnabled: (env?: NodeJS.ProcessEnv) => boolean;
@@ -8,18 +7,4 @@ export declare const SPEND_NO_TERMINAL_MSG = "Pass --monthly-spend <usd> (there
 export declare const MAX_MONTHLY_SPEND_USD = 10000000;
 /** Dollars, or null if the text is not a positive, plausible amount. */
 export declare function parseMonthlySpendUsd(raw: string): number | null;
-export type SpendTier = 1 | 2 | 3;
-export interface SpendSelection {
-    /** null when the evidence is too thin: print nothing. */
-    tier: SpendTier | null;
-    line: string | null;
-    /** May this line leave the machine in a share payload? Never for a self-reported figure. */
-    shareable: boolean;
-}
-export declare function selectSpend(i: {
-    measuredUsd?: number;
-    /** Fraction of measured tokens from requests over 200k context; shown only with a measured figure. */
-    over200kShare?: number | null;
-    selfReportedUsd?: number | null;
-    estimate: SpendEstimate;
-}): SpendSelection;
+export { selectSpend, type SpendTier, type SpendSelection, } from "../../../vendor/shared/org-scan-core/spend/spend-select.js";

package/dist/lib/scan/spend/spend-tiers.js

@@ -1,3 +1,8 @@
+// MNE-9298: the CLI side of the spend tiers (env flag, typed figure). selectSpend is shared (MNE-9752).
+//   Tier 1  measured Anthropic usage the customer connected (a number handed in by the caller).
+//   Tier 2  a dollar figure the CTO gives; self-reported, labelled so, never sent or saved.
+//   Tier 3  the PR-size estimate range, only when the evidence behind it is enough.
+// With none of the three there is NO line: a number is never invented to fill the gap.
 export const ORG_SCAN_ENV = "MNEMOM_ORG_SCAN_MODE";
 /** Default OFF: only the exact string "true" turns the tiers on. */
 export const isSpendTiersEnabled = (env = process.env) => env[ORG_SCAN_ENV] === "true";
@@ -14,29 +19,4 @@ export function parseMonthlySpendUsd(raw) {
     const n = Number(t.replace(/[$,\s]/g, ""));
     return Number.isFinite(n) && n > 0 && n <= MAX_MONTHLY_SPEND_USD ? n : null;
 }
-const usd = (n) => `$${n.toLocaleString("en-US", { maximumFractionDigits: 2 })}`;
-const isUsd = (n) => typeof n === "number" && Number.isFinite(n) && n > 0;
-const pct = (f) => `${Math.round(f * 100)}%`;
-const isShare = (n) => typeof n === "number" && Number.isFinite(n) && n >= 0 && n <= 1;
-export function selectSpend(i) {
-    if (isUsd(i.measuredUsd)) {
-        return {
-            tier: 1,
-            line: `Tier 1, measured: ${usd(i.measuredUsd)} of Anthropic usage over the period${isShare(i.over200kShare)
-                ? ` (${pct(i.over200kShare)} of tokens in requests over 200k context)`
-                : ""}.`,
-            shareable: true,
-        };
-    }
-    if (isUsd(i.selfReportedUsd)) {
-        return {
-            tier: 2,
-            line: `Tier 2, self-reported: about ${usd(i.selfReportedUsd)} a month (given by you; not verified, not sent, not saved).`,
-            shareable: false,
-        };
-    }
-    if (i.estimate.kind === "range") {
-        return { tier: 3, line: `Tier 3, ${i.estimate.line}`, shareable: true };
-    }
-    return { tier: null, line: null, shareable: false };
-}
+export { selectSpend, } from "../../../vendor/shared/org-scan-core/spend/spend-select.js";

package/dist/lib/scan/spend/token-rate.d.ts

@@ -1,30 +1 @@
-/** Rows needed before the rate is trusted at all (data sufficiency, not a group size). */
-export declare const MIN_CORPUS_ROWS = 5;
-export interface CostRowShape {
-    repo: string;
-    pr: number;
-    additions: number;
-    deletions: number;
-    cost_usd: number;
-    runs: number;
-    models: string[];
-}
-export interface TokenRate {
-    /** Price-equivalent tokens per changed (added + deleted) line: 25th percentile. */
-    low: number;
-    median: number;
-    /** 75th percentile. */
-    high: number;
-    rows: number;
-}
-/** Linear-interpolated quantile of a sorted array. */
-export declare function quantile(sorted: number[], q: number): number;
-/**
- * Derive the rate from corpus rows: per-row tokens/line, then the 25th, 50th and 75th percentile.
- * Rows that fail validation are dropped (not repaired); fewer than MIN_CORPUS_ROWS valid rows
- * returns null, never a rate built on a handful.
- */
-export declare function deriveTokenRate(rows: unknown): TokenRate | null;
-export declare const CORPUS_AS_OF: string;
-/** The shipped rate: derived once from the committed fixture. */
-export declare const DERIVED_TOKEN_RATE: TokenRate | null;
+export * from "../../../vendor/shared/org-scan-core/spend/token-rate.js";

package/dist/lib/scan/spend/token-rate.js

@@ -1,54 +1,2 @@
-// MNE-9268: tokens-per-changed-line and its spread, DERIVED from our own agents' PRs whose run cost is
-// known (cost-corpus.v1.json, built by build-cost-corpus.mjs from the ADW "Run cost" PR comments).
-// Nothing here is a typed-in rate: change the fixture and the rate moves, and token-rate.test.ts pins
-// the derivation. Tokens are price-equivalent: cost / (our model's blended list price per token).
-import rawCorpus from "./cost-corpus.v1.js";
-import { TOOL_PRICES, blendedUsdPerToken } from "./prices.js";
-/** Rows needed before the rate is trusted at all (data sufficiency, not a group size). */
-export const MIN_CORPUS_ROWS = 5;
-/** Our agents ran on Sonnet-family models in every corpus row; price their tokens as that. */
-const BASIS_USD_PER_TOKEN = blendedUsdPerToken(TOOL_PRICES.claude_code.low);
-const isCount = (n) => typeof n === "number" && Number.isFinite(n) && n >= 0;
-function validRow(r) {
-    if (typeof r !== "object" || r === null)
-        return false;
-    const o = r;
-    return (isCount(o.additions) &&
-        isCount(o.deletions) &&
-        o.additions + o.deletions > 0 &&
-        isCount(o.cost_usd) &&
-        o.cost_usd > 0);
-}
-/** Linear-interpolated quantile of a sorted array. */
-export function quantile(sorted, q) {
-    if (sorted.length === 0)
-        return NaN;
-    const pos = (sorted.length - 1) * q;
-    const lo = Math.floor(pos);
-    const hi = Math.ceil(pos);
-    return sorted[lo] + (sorted[hi] - sorted[lo]) * (pos - lo);
-}
-/**
- * Derive the rate from corpus rows: per-row tokens/line, then the 25th, 50th and 75th percentile.
- * Rows that fail validation are dropped (not repaired); fewer than MIN_CORPUS_ROWS valid rows
- * returns null, never a rate built on a handful.
- */
-export function deriveTokenRate(rows) {
-    if (!Array.isArray(rows))
-        return null;
-    const per = rows
-        .filter(validRow)
-        .map((r) => r.cost_usd / (r.additions + r.deletions) / BASIS_USD_PER_TOKEN)
-        .sort((a, b) => a - b);
-    if (per.length < MIN_CORPUS_ROWS)
-        return null;
-    return {
-        low: quantile(per, 0.25),
-        median: quantile(per, 0.5),
-        high: quantile(per, 0.75),
-        rows: per.length,
-    };
-}
-export const CORPUS_AS_OF = rawCorpus.as_of;
-/** The shipped rate: derived once from the committed fixture. */
-export const DERIVED_TOKEN_RATE = deriveTokenRate(rawCorpus.rows);
+// Moved to shared/org-scan-core (MNE-9752); vendored at cli/src/vendor/shared/org-scan-core. Re-exported so CLI imports stay put.
+export * from "../../../vendor/shared/org-scan-core/spend/token-rate.js";

package/dist/lib/starter-integrity.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The integrity_mode `wrap` and `onboard` write into their starter alignment card.
+ *
+ * Both commands re-publish the starter card on every run, including a re-run on an agent that
+ * already exists (wrap: the same key + name returns the same agent; onboard: an already-claimed
+ * agent). The card must never change an existing agent's stored mode, so the mode comes from the
+ * agent's own (agent-layer) card when it has one — the same rule `mnemom agent setup` applies to
+ * an existing agent (agent-setup.ts existingAgentPlan):
+ *
+ *   - own card with an integrity_mode   → keep it (off stays off; nudge/enforce stay put)
+ *   - own card without the field        → observe (what the card already resolved to)
+ *   - no own card                       → off   (never silently opt an agent in to billed analysis)
+ *
+ * A newly born agent has its own card: mnemom-api stamps an observe birth card (ADR-API-003), and
+ * the gateway's card-less bootstrap writes observe too, so a new agent keeps observe (MNE-9728).
+ *
+ * THROWS when the read fails (anything but a 404): the caller then skips the card write rather
+ * than guess a mode in either direction.
+ */
+export declare function starterIntegrityMode(agentId: string): Promise<string>;

package/dist/lib/starter-integrity.js

@@ -0,0 +1,28 @@
+/**
+ * The integrity_mode `wrap` and `onboard` write into their starter alignment card.
+ *
+ * Both commands re-publish the starter card on every run, including a re-run on an agent that
+ * already exists (wrap: the same key + name returns the same agent; onboard: an already-claimed
+ * agent). The card must never change an existing agent's stored mode, so the mode comes from the
+ * agent's own (agent-layer) card when it has one — the same rule `mnemom agent setup` applies to
+ * an existing agent (agent-setup.ts existingAgentPlan):
+ *
+ *   - own card with an integrity_mode   → keep it (off stays off; nudge/enforce stay put)
+ *   - own card without the field        → observe (what the card already resolved to)
+ *   - no own card                       → off   (never silently opt an agent in to billed analysis)
+ *
+ * A newly born agent has its own card: mnemom-api stamps an observe birth card (ADR-API-003), and
+ * the gateway's card-less bootstrap writes observe too, so a new agent keeps observe (MNE-9728).
+ *
+ * THROWS when the read fails (anything but a 404): the caller then skips the card write rather
+ * than guess a mode in either direction.
+ */
+import { getCardSources } from "./api.js";
+export async function starterIntegrityMode(agentId) {
+    const sources = await getCardSources("alignment", agentId);
+    const own = sources?.agent?.card_json ?? null;
+    if (!own)
+        return "off";
+    const mode = own.integrity_mode;
+    return typeof mode === "string" && mode ? mode : "observe";
+}

package/dist/vendor/shared/org-scan-core/caps.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Coverage caps and sampling. Port of mnemom-api src/org-scan/scan/capped-scan.ts (PR #4208).
+ *
+ * Coverage decision (Shraddha, 2026-10-28): each scan covers the last 3 months OR the last 2,000 merged
+ * PRs, whichever is MORE; above 2,000 in the window, an even deterministic sample of 2,000.
+ */
+export declare const COVERAGE_MONTHS = 3;
+export interface ScanCaps {
+    maxPrs: number;
+    /** A PR with more additions+deletions than this is skipped, never read in full. */
+    maxPrSizeLines: number;
+    /** Upstream read calls. */
+    maxReads: number;
+    /** Wall-clock budget. */
+    maxMillis: number;
+}
+export declare const DEFAULT_SCAN_CAPS: ScanCaps;
+export type StopReason = "pr-cap" | "read-cap" | "time-cap";
+/** The day `months` calendar months before `end` (YYYY-MM-DD, UTC), clamped to the month's last day. */
+export declare function monthsBefore(end: string, months: number): string;
+/** `k` items spread evenly across `items` (order kept): index floor(i*n/k). Deterministic; n <= k returns all. */
+export declare function evenSample<T>(items: readonly T[], k: number): T[];
+export declare function sanitiseCaps(c: Partial<ScanCaps>): ScanCaps;
+/** Running read budget. Every call is told how many reads it may spend (`room`). */
+export declare class Budget {
+    private caps;
+    private now;
+    private startedAt;
+    reads: number;
+    constructor(caps: ScanCaps, now: () => number, startedAt: number);
+    block(n?: number): StopReason | null;
+    room(): number;
+    overrun(): StopReason | null;
+    charge(n: number): void;
+}

package/dist/vendor/shared/org-scan-core/caps.js

@@ -0,0 +1,68 @@
+// GENERATED from shared/org-scan-core/src/caps.ts by cli/scripts/sync-org-scan-core.mjs; do not edit.
+/**
+ * Coverage caps and sampling. Port of mnemom-api src/org-scan/scan/capped-scan.ts (PR #4208).
+ *
+ * Coverage decision (Shraddha, 2026-10-28): each scan covers the last 3 months OR the last 2,000 merged
+ * PRs, whichever is MORE; above 2,000 in the window, an even deterministic sample of 2,000.
+ */
+export const COVERAGE_MONTHS = 3;
+export const DEFAULT_SCAN_CAPS = {
+    maxPrs: 2_000,
+    maxPrSizeLines: 20_000,
+    maxReads: 4_500,
+    maxMillis: 15 * 60_000,
+};
+/** The day `months` calendar months before `end` (YYYY-MM-DD, UTC), clamped to the month's last day. */
+export function monthsBefore(end, months) {
+    const [y, m, d] = end.split("-").map(Number);
+    const target = new Date(Date.UTC(y, m - 1 - months, 1));
+    const last = new Date(Date.UTC(target.getUTCFullYear(), target.getUTCMonth() + 1, 0)).getUTCDate();
+    target.setUTCDate(Math.min(d, last));
+    return target.toISOString().slice(0, 10);
+}
+/** `k` items spread evenly across `items` (order kept): index floor(i*n/k). Deterministic; n <= k returns all. */
+export function evenSample(items, k) {
+    const n = items.length;
+    if (n <= k)
+        return [...items];
+    return Array.from({ length: k }, (_, i) => items[Math.floor((i * n) / k)]);
+}
+export function sanitiseCaps(c) {
+    const pos = (n, d) => typeof n === "number" && Number.isFinite(n) && n > 0 ? Math.floor(n) : d;
+    return {
+        maxPrs: pos(c.maxPrs, DEFAULT_SCAN_CAPS.maxPrs),
+        maxPrSizeLines: pos(c.maxPrSizeLines, DEFAULT_SCAN_CAPS.maxPrSizeLines),
+        maxReads: pos(c.maxReads, DEFAULT_SCAN_CAPS.maxReads),
+        maxMillis: pos(c.maxMillis, DEFAULT_SCAN_CAPS.maxMillis),
+    };
+}
+/** Running read budget. Every call is told how many reads it may spend (`room`). */
+export class Budget {
+    caps;
+    now;
+    startedAt;
+    reads = 0;
+    constructor(caps, now, startedAt) {
+        this.caps = caps;
+        this.now = now;
+        this.startedAt = startedAt;
+    }
+    block(n = 1) {
+        if (this.now() - this.startedAt >= this.caps.maxMillis)
+            return "time-cap";
+        if (this.reads + n > this.caps.maxReads)
+            return "read-cap";
+        return null;
+    }
+    room() {
+        if (this.now() - this.startedAt >= this.caps.maxMillis)
+            return 0;
+        return Math.max(0, this.caps.maxReads - this.reads);
+    }
+    overrun() {
+        return this.reads > this.caps.maxReads ? "read-cap" : null;
+    }
+    charge(n) {
+        this.reads += n;
+    }
+}

package/dist/vendor/shared/org-scan-core/cost-per-pr.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Cost per merged PR and cost by PR size, for the Org Scan report. Pure: numbers in, numbers out.
+ *
+ * Source of the spend. Measured per-request cost cannot be tied to a PR with the data the scan has:
+ * the Anthropic usage reads return one whole-org total (no per-request or per-PR rows) and the Mnemom
+ * Record totals are one window sum (model cost and a request count, no PR key). So every figure here is
+ * `label: "estimate"`: the period's spend split across the merged PRs in proportion to lines changed.
+ * Each figure names the spend it was split from (`spend_source`); sources are never mixed in one report.
+ *
+ *   anthropic_usage          the whole-org Anthropic cost for the period (the CTO's admin key)
+ *   modelled_range           our modelled estimate (a low to high range, so the figures are ranges)
+ *
+ * Size is per PR, in lines changed = additions + deletions, exactly as GitHub reports them. Lockfiles and
+ * generated files are NOT excluded. small < 50; medium 50..500 inclusive; large > 500.
+ *
+ * Each size figure is the average cost of ONE PR of that size: spend * (mean lines of the bucket) /
+ * (total lines of the PRs in scope). Scope: the modelled estimate prices AI-assisted PRs only, so it is
+ * split across those only (`pr_scope: "ai_assisted"`, buckets too); the others use every merged PR
+ * (`pr_scope: "all_merged"`). `pr_count` counts PRs in that scope. Usage-key figures also carry
+ * `spend_scope: "whole_org"` (the key covers the whole organization, not just the scanned repos). The cost per merged PR is the spend over the count of merged PRs.
+ *
+ * Missing data is an absent field, never 0 or NaN: no usable spend, zero merged PRs in the period, an
+ * empty bucket, a scan that did not read every merged PR in the period, or a result past safe-integer
+ * range. Reverts are listed without sizes, so they are not counted as merged PRs here.
+ */
+import type { SpendEstimate } from "./spend/spend-estimate.js";
+/** Strictly below this is small. 50 is medium. */
+export declare const SMALL_MAX_EXCLUSIVE = 50;
+/** At or below this (and not small) is medium. 500 is medium; 501 is large. */
+export declare const MEDIUM_MAX_INCLUSIVE = 500;
+export type SizeBucket = "small" | "medium" | "large";
+export type CostSpendSourceName = "anthropic_usage" | "modelled_range";
+export interface PrSize {
+    /** YYYY-MM-DD, UTC. */
+    mergedDay: string;
+    /** additions + deletions. */
+    lines: number;
+    /** The PR carries an AI-tool mark (the same rule the modelled spend uses to count AI-assisted PRs). */
+    aiAssisted: boolean;
+}
+/** Where the spend comes from. USD, never cents. */
+export type CostSpend = {
+    source: "anthropic_usage";
+    usd: number;
+} | {
+    source: "modelled_range";
+    lowUsd: number;
+    highUsd: number;
+};
+/** One figure: a single value, or a low to high range for the modelled source. Integer cents. */
+export type PrScope = "ai_assisted" | "all_merged";
+export type CostFigure = {
+    /** "measured" is not possible with current data (see header); every figure is an estimate. */
+    label: "estimate";
+    spend_source: CostSpendSourceName;
+    /**
+     * Which PRs the average is over. The modelled estimate prices AI-assisted PRs only, so it is split
+     * across those only ("ai_assisted"); the usage key covers all spend, so they use "all_merged".
+     */
+    pr_scope: PrScope;
+    /** PRs in that scope. */
+    pr_count: number;
+    /** Present on anthropic_usage only: the key's usage is the whole organization's, not just these PRs'. */
+    spend_scope?: "whole_org";
+} & ({
+    value_cents: number;
+} | {
+    low_cents: number;
+    high_cents: number;
+});
+export interface CostPerPr {
+    cost_per_merged_pr?: CostFigure;
+    cost_by_pr_size?: Partial<Record<SizeBucket, CostFigure>>;
+}
+export declare const sizeBucket: (lines: number) => SizeBucket;
+/** Inclusive day count of YYYY-MM-DD..YYYY-MM-DD, or null if unparsable or reversed. */
+export declare function periodDays(p: {
+    start: string;
+    end: string;
+}): number | null;
+/** The period's spend in USD as [low, high]; null when there is no usable spend. */
+export declare function spendForPeriod(spend: CostSpend): [number, number] | null;
+/** The modelled estimate as a spend source, or null when the estimate is "none". */
+export declare const modelledSpend: (e: SpendEstimate) => CostSpend | null;
+/**
+ * @param prs           every merged PR the scan read, with merge day and size
+ * @param exhaustive    true only if the scan read EVERY merged PR in the period (no sample, no skipped
+ *                      large PR, none unreadable, no cap hit). Otherwise the average is not defined.
+ */
+export declare function buildCostPerPr(prs: readonly PrSize[] | undefined, period: {
+    start: string;
+    end: string;
+}, spend: CostSpend | null, exhaustive: boolean): CostPerPr;

package/dist/vendor/shared/org-scan-core/cost-per-pr.js

@@ -0,0 +1,101 @@
+/** Strictly below this is small. 50 is medium. */
+export const SMALL_MAX_EXCLUSIVE = 50;
+/** At or below this (and not small) is medium. 500 is medium; 501 is large. */
+export const MEDIUM_MAX_INCLUSIVE = 500;
+export const sizeBucket = (lines) => lines < SMALL_MAX_EXCLUSIVE ? "small" : lines <= MEDIUM_MAX_INCLUSIVE ? "medium" : "large";
+const DAY_MS = 86_400_000;
+/** Inclusive day count of YYYY-MM-DD..YYYY-MM-DD, or null if unparsable or reversed. */
+export function periodDays(p) {
+    const s = Date.parse(`${p.start}T00:00:00Z`);
+    const e = Date.parse(`${p.end}T00:00:00Z`);
+    if (!Number.isFinite(s) || !Number.isFinite(e) || e < s)
+        return null;
+    return Math.round((e - s) / DAY_MS) + 1;
+}
+const pos = (n) => typeof n === "number" && Number.isFinite(n) && n > 0;
+/** The period's spend in USD as [low, high]; null when there is no usable spend. */
+export function spendForPeriod(spend) {
+    let r;
+    if (spend.source === "anthropic_usage") {
+        if (!pos(spend.usd))
+            return null;
+        r = [spend.usd, spend.usd];
+    }
+    else {
+        if (!pos(spend.highUsd) || !(spend.lowUsd >= 0) || spend.lowUsd > spend.highUsd)
+            return null;
+        r = [spend.lowUsd, spend.highUsd];
+    }
+    return r.every((x) => Number.isFinite(x) && x * 100 <= Number.MAX_SAFE_INTEGER) ? r : null;
+}
+/** The modelled estimate as a spend source, or null when the estimate is "none". */
+export const modelledSpend = (e) => e.kind === "range" ? { source: "modelled_range", lowUsd: e.lowUsd, highUsd: e.highUsd } : null;
+/**
+ * `share` is the fraction of the period's spend one average PR here carries: always in (0, 1] by
+ * construction, and the spend is already bounded to safe-integer cents by spendForPeriod, so the
+ * rounded cents are finite safe integers without a further guard.
+ */
+function figure(spend, [low, high], count, share, scope) {
+    const c = (usd) => Math.round(usd * share * 100);
+    const base = {
+        label: "estimate",
+        spend_source: spend.source,
+        pr_scope: scope,
+        pr_count: count,
+        ...(spend.source === "anthropic_usage" ? { spend_scope: "whole_org" } : {}),
+    };
+    return spend.source === "modelled_range"
+        ? { ...base, low_cents: c(low), high_cents: c(high) }
+        : { ...base, value_cents: c(low) };
+}
+/**
+ * @param prs           every merged PR the scan read, with merge day and size
+ * @param exhaustive    true only if the scan read EVERY merged PR in the period (no sample, no skipped
+ *                      large PR, none unreadable, no cap hit). Otherwise the average is not defined.
+ */
+export function buildCostPerPr(prs, period, spend, exhaustive) {
+    if (!exhaustive || !spend || !Array.isArray(prs))
+        return {};
+    if (periodDays(period) === null)
+        return {};
+    const total = spendForPeriod(spend);
+    if (!total)
+        return {};
+    const inPeriod = prs.filter((p) => p.mergedDay >= period.start &&
+        p.mergedDay <= period.end &&
+        Number.isSafeInteger(p.lines) &&
+        p.lines >= 0);
+    // The modelled estimate is AI-tool spend, so it is split across AI-assisted PRs only; the usage key is
+    // the whole spend, so it is split across every merged PR.
+    const scope = spend.source === "modelled_range" ? "ai_assisted" : "all_merged";
+    const scoped = scope === "ai_assisted" ? inPeriod.filter((p) => p.aiAssisted) : inPeriod;
+    const n = scoped.length;
+    if (n === 0)
+        return {};
+    const out = {};
+    out.cost_per_merged_pr = figure(spend, total, n, 1 / n, scope);
+    let allLines = 0;
+    const agg = {
+        small: { n: 0, lines: 0 },
+        medium: { n: 0, lines: 0 },
+        large: { n: 0, lines: 0 },
+    };
+    for (const p of scoped) {
+        allLines += p.lines;
+        const a = agg[sizeBucket(p.lines)];
+        a.n += 1;
+        a.lines += p.lines;
+    }
+    // Splitting by lines needs lines: with none (or a sum past safe range) there is no size figure.
+    if (allLines <= 0 || !Number.isSafeInteger(allLines))
+        return out;
+    const bySize = {};
+    for (const b of ["small", "medium", "large"]) {
+        const a = agg[b];
+        if (a.n === 0)
+            continue;
+        bySize[b] = figure(spend, total, a.n, a.lines / a.n / allLines, scope);
+    }
+    out.cost_by_pr_size = bySize;
+    return out;
+}

package/dist/vendor/shared/org-scan-core/credential.d.ts

@@ -0,0 +1,43 @@
+/**
+ * GitHubCredential: the one seam through which a scan obtains a GitHub token.
+ *
+ * The scan core only ever sees this interface. The CLI's default is the GitHub login of whoever runs the
+ * scan (`gh auth token`, cli/src/lib/scan/credential.ts); the Mnemom-side run (mnemom-api, MNE-9743)
+ * supplies a read-only installation token. Port of the read-only rule in mnemom-api
+ * src/org-scan/github-scan-app.ts. Runtime-neutral: no Node or Worker API.
+ */
+/** The complete permission set the CLI's scan credential may hold. Read only. */
+export declare const SCAN_READ_PERMISSIONS: Readonly<Record<string, "read">>;
+/**
+ * The complete permission set the Mnemom-side run's App token may hold (org-scan threat model): no
+ * `contents`. `checks` is what the check-runs read needs on an App installation token.
+ */
+export declare const SERVER_SCAN_READ_PERMISSIONS: Readonly<Record<string, "read">>;
+export interface GitHubCredential {
+    /** Fixed label for diagnostics ("app", "personal"): never a token, login or URL. */
+    readonly kind: string;
+    /** A bearer token for reading `repo` (owner/name). A rejection fails that read closed. */
+    tokenFor(repo: string): Promise<string>;
+    /**
+     * The permissions GitHub granted this credential, when the source can tell. Null = unknown (for
+     * example a classic token); the scan then relies on GET-only egress and does not claim more.
+     */
+    grantedPermissions?(): Promise<Record<string, string> | null>;
+}
+/**
+ * Violations (empty when the map is exactly the read-only set `allowed`, by default the CLI's set).
+ * Port of readOnlyViolations.
+ */
+export declare function readOnlyViolations(permissions: Record<string, string> | null | undefined, allowed?: Readonly<Record<string, "read">>): string[];
+/** owner/name, no dot-only segment. */
+export declare function isValidRepoSlug(s: unknown): s is string;
+/** Fixed-text failure: the message never carries a token, a body or a URL. */
+export declare class ScanCredentialError extends Error {
+    constructor(message: "scan credential refused" | "scan credential not configured");
+}
+/**
+ * Refuses a credential GitHub granted anything other than exactly `allowed` (read only) to. Throws a
+ * fixed-text error and nothing else. Unknown (null) permissions pass: the source cannot tell, and the
+ * scan is GET-only regardless.
+ */
+export declare function assertReadOnlyCredential(c: GitHubCredential, allowed?: Readonly<Record<string, "read">>): Promise<void>;

package/dist/vendor/shared/org-scan-core/credential.js

@@ -0,0 +1,74 @@
+// GENERATED from shared/org-scan-core/src/credential.ts by cli/scripts/sync-org-scan-core.mjs; do not edit.
+/**
+ * GitHubCredential: the one seam through which a scan obtains a GitHub token.
+ *
+ * The scan core only ever sees this interface. The CLI's default is the GitHub login of whoever runs the
+ * scan (`gh auth token`, cli/src/lib/scan/credential.ts); the Mnemom-side run (mnemom-api, MNE-9743)
+ * supplies a read-only installation token. Port of the read-only rule in mnemom-api
+ * src/org-scan/github-scan-app.ts. Runtime-neutral: no Node or Worker API.
+ */
+/** The complete permission set the CLI's scan credential may hold. Read only. */
+export const SCAN_READ_PERMISSIONS = Object.freeze({
+    metadata: "read",
+    contents: "read",
+    pull_requests: "read",
+});
+/**
+ * The complete permission set the Mnemom-side run's App token may hold (org-scan threat model): no
+ * `contents`. `checks` is what the check-runs read needs on an App installation token.
+ */
+export const SERVER_SCAN_READ_PERMISSIONS = Object.freeze({
+    metadata: "read",
+    pull_requests: "read",
+    checks: "read",
+});
+/**
+ * Violations (empty when the map is exactly the read-only set `allowed`, by default the CLI's set).
+ * Port of readOnlyViolations.
+ */
+export function readOnlyViolations(permissions, allowed = SCAN_READ_PERMISSIONS) {
+    const out = [];
+    const p = permissions ?? {};
+    for (const [name, level] of Object.entries(p)) {
+        if (level !== "read")
+            out.push(`${name}:${level} is not read`);
+        if (!(name in allowed))
+            out.push(`${name} is not in the scan permission set`);
+    }
+    for (const name of Object.keys(allowed)) {
+        if (!(name in p))
+            out.push(`${name} missing`);
+    }
+    return out;
+}
+/** owner/name, no dot-only segment. */
+export function isValidRepoSlug(s) {
+    return (typeof s === "string" &&
+        /^[A-Za-z0-9._-]{1,100}\/[A-Za-z0-9._-]{1,100}$/.test(s) &&
+        !s.split("/").some((p) => /^\.+$/.test(p)));
+}
+/** Fixed-text failure: the message never carries a token, a body or a URL. */
+export class ScanCredentialError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ScanCredentialError";
+    }
+}
+/**
+ * Refuses a credential GitHub granted anything other than exactly `allowed` (read only) to. Throws a
+ * fixed-text error and nothing else. Unknown (null) permissions pass: the source cannot tell, and the
+ * scan is GET-only regardless.
+ */
+export async function assertReadOnlyCredential(c, allowed = SCAN_READ_PERMISSIONS) {
+    if (!c.grantedPermissions)
+        return;
+    let perms;
+    try {
+        perms = await c.grantedPermissions();
+    }
+    catch {
+        throw new ScanCredentialError("scan credential refused");
+    }
+    if (perms !== null && readOnlyViolations(perms, allowed).length > 0)
+        throw new ScanCredentialError("scan credential refused");
+}

package/dist/vendor/shared/org-scan-core/failure.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Scan failure reasons. Port of upstreamTag in mnemom-api capped-scan.ts (PRs #4221 / #4223): an
+ * exact-match table of fixed messages to fixed reason tags. The raw error message is NEVER echoed,
+ * so no token, URL or GitHub body can reach the terminal or the report. An unrecognised error maps
+ * to the generic "github" tag.
+ */
+export type FailureReason = "not_installed" | "credential" | "timeout" | "forbidden" | "rate_limited" | "github" | "network" | "invalid_input";
+export declare function classifyFailure(e: unknown): FailureReason;
+/** Fixed sentence for a reason. */
+export declare function failureText(r: FailureReason): string;