@mnemom/mnemom 0.17.38-next.1 → 0.17.38-next.2

package/dist/commands/agent-run.d.ts

@@ -8,7 +8,9 @@
  * errors exit 2 with no outcome line; every outcome line goes to stdout, every log to stderr.
  *
  * The GitHub token (GH_TOKEN, GITHUB_TOKEN, else `gh auth token`) is the runner's own: it reaches
- * git only through GIT_CONFIG_* env (never argv) and the phases never see it (phaseEnv).
+ * git only through GIT_CONFIG_* env (never argv) and the phases never see it (phaseEnv). Under
+ * --oidc the PR is pushed and opened with the job's PR token instead (ruling 34.34): the api's
+ * Record App token for the seal's repo, fetched with the lease key, carried the same way.
  *
  * So is the Anthropic key (ruling 34.30.1): the phases' model calls are billed to the runner's own
  * ANTHROPIC_API_KEY, which only the model proxy holds and sets on each upstream request. A runner
@@ -35,7 +37,9 @@ export interface RunDeps {
     stop: AbortSignal;
     /** The text of this host's executor-state.json, or null when there is none. */
     readExecutorState?(): Promise<string | null>;
-    jobDeps(api: RunnerApi, executorId: string | null, github: GithubBases, modelKey: string): JobDeps;
+    jobDeps(api: RunnerApi, executorId: string | null, github: GithubBases, modelKey: string, 
+    /** True under --oidc: the job opens its PR with the api's PR token (ruling 34.34). */
+    prTokenFromLease: boolean): JobDeps;
 }
 /** The refusal of a runner with no ANTHROPIC_API_KEY (34.30.1); a config error, exit 2. */
 export declare const RUNNER_MODEL_KEY_MISSING = "runner_model_key_missing";
@@ -78,6 +82,10 @@ export declare function liveJobDeps(api: RunnerApi, opts: {
     executorId: string | null;
     github: GithubBases;
     modelKey: string;
+    /** The credential is the --oidc exchange: the PR uses the job's PR token (ruling 34.34). */
+    prTokenFromLease?: boolean;
+    /** The git runner for an env; tests inject one to see which credentials a push carries. */
+    makeGit?: (env: NodeJS.ProcessEnv) => Git;
 }): JobDeps;
 /** The process wiring: signals, stdout and stderr. Resolves the exit code. */
 export declare function runAgentRun(flags: RunFlags): Promise<number>;

package/dist/commands/agent-run.js

@@ -8,7 +8,9 @@
  * errors exit 2 with no outcome line; every outcome line goes to stdout, every log to stderr.
  *
  * The GitHub token (GH_TOKEN, GITHUB_TOKEN, else `gh auth token`) is the runner's own: it reaches
- * git only through GIT_CONFIG_* env (never argv) and the phases never see it (phaseEnv).
+ * git only through GIT_CONFIG_* env (never argv) and the phases never see it (phaseEnv). Under
+ * --oidc the PR is pushed and opened with the job's PR token instead (ruling 34.34): the api's
+ * Record App token for the seal's repo, fetched with the lease key, carried the same way.
  *
  * So is the Anthropic key (ruling 34.30.1): the phases' model calls are billed to the runner's own
  * ANTHROPIC_API_KEY, which only the model proxy holds and sets on each upstream request. A runner
@@ -91,7 +93,7 @@ export async function agentRunCommand(flags, deps) {
     }
     const api = runnerApi({ apiUrl: deps.apiUrl, executorKey, fetch: deps.fetch });
     const loop = { failMode: plan.failMode, stop: deps.stop, emit: deps.emit };
-    const job = deps.jobDeps(api, executorId, gh.bases, modelKey);
+    const job = deps.jobDeps(api, executorId, gh.bases, modelKey, plan.credential.kind === "oidc");
     return plan.form === "once" ? runOnce(job, loop) : runWatch(job, loop);
 }
 // ── GitHub and git, for the live driver ──────────────────────────────────────
@@ -259,7 +261,10 @@ export function runPhaseProcess(inv, ws, modelUrl, signal, parentEnv = process.e
 export function liveJobDeps(api, opts) {
     const gh = opts.github;
     const token = resolveGithubToken(opts.env);
-    const git = liveGit(gitAuthEnv(opts.env, token, gh.web));
+    const makeGit = opts.makeGit ?? liveGit;
+    const git = makeGit(gitAuthEnv(opts.env, token, gh.web));
+    // The PR token's git: a fresh env, so its header replaces the runner token's, never adds to it.
+    const gitFor = (t) => t === null ? git : makeGit(gitAuthEnv(opts.env, t, gh.web));
     return {
         api,
         executorId: opts.executorId,
@@ -272,11 +277,12 @@ export function liveJobDeps(api, opts) {
         startProxy: (state) => startModelProxy(`${getGatewayUrl()}/anthropic`, state, opts.modelKey),
         prepareWorkspace: (repo, sessionId) => prepareWorkspace(git, `${gh.web}/${repo}.git`, sessionId),
         runPhase: (inv, ws, modelUrl, signal) => runPhaseProcess(inv, ws, modelUrl, signal, opts.env),
-        openPr: (repo, ws, title, body) => openPr(git, opts.fetch, token, repo, ws, title, body, gh.api),
+        openPr: (repo, ws, title, body, prToken) => openPr(gitFor(prToken), opts.fetch, prToken ?? token, repo, ws, title, body, gh.api),
         commitsAhead: (ws) => commitsAhead(git, ws),
         headSha: (ws) => headSha(git, ws),
         commitBodies: (ws, since, lineageKey, repo) => commitBodies(git, ws, since, lineageKey, repo),
-        enableAutoMerge: (prUrl) => enableAutoMerge(opts.fetch, token, prUrl, gh),
+        enableAutoMerge: (prUrl, prToken) => enableAutoMerge(opts.fetch, prToken ?? token, prUrl, gh),
+        prTokenFromLease: opts.prTokenFromLease === true,
         cleanup: cleanupWorkspace,
     };
 }
@@ -296,7 +302,7 @@ export function runAgentRun(flags) {
         err: (line) => process.stderr.write(`${line}\n`),
         stop: stop.signal,
         readExecutorState: () => readFile(executorStatePath(homedir()), "utf8").catch(() => null),
-        jobDeps: (api, executorId, github, modelKey) => liveJobDeps(api, { fetch, env: process.env, executorId, github, modelKey }),
+        jobDeps: (api, executorId, github, modelKey, prTokenFromLease) => liveJobDeps(api, { fetch, env: process.env, executorId, github, modelKey, prTokenFromLease }),
     }).finally(() => {
         process.off("SIGTERM", onSignal);
         process.off("SIGINT", onSignal);

package/dist/commands/scan.d.ts

@@ -10,7 +10,7 @@ import { selectSpend } from "../lib/scan/spend/spend-tiers.js";
 import { type AnthropicUsageDeps, type MeasuredUsage } from "../lib/scan/spend/anthropic-usage.js";
 import { type WifDeps } from "../lib/scan/spend/anthropic-wif.js";
 import { type RecordDeps, type RecordOutcome } from "../lib/scan/record.js";
-import { type CostSpend } from "../lib/scan/cost-per-pr.js";
+import type { CostSpend } from "../lib/scan/cost-per-pr.js";
 import { type ReportEmailDeps } from "../lib/scan/report-email.js";
 import { type RepoListDeps } from "../lib/scan/repo-picker.js";
 export interface ScanCommandOptions {

package/dist/commands/scan.js

@@ -15,7 +15,7 @@ import { getAuthInfo } from "../lib/auth.js";
 import { listMyOrgs } from "../lib/api.js";
 import { getActiveOrg } from "../lib/cli-config.js";
 import { fetchRecordTotals, isOrgId, } from "../lib/scan/record.js";
-import { modelledSpend } from "../lib/scan/cost-per-pr.js";
+import { costSpendFor, sendsSpendRange } from "../vendor/shared/org-scan-core/report-build.js";
 import { RECORD_NO_ORG_NOTE, renderRecordSection } from "../lib/scan/report.js";
 import { buildEmailBody, buildEmailReport, DRY_RUN_MSG, UNAVAILABLE_MSG, failureMessage, ReportEmailError, sendReportEmail, } from "../lib/scan/report-email.js";
 import { pickRepos, REPO_PICKER_NO_TERMINAL_HINT, } from "../lib/scan/repo-picker.js";
@@ -110,15 +110,8 @@ export async function resolveSelfReportedSpend(o) {
  * tiers off) the modelled range. Sources are never mixed.
  */
 export function resolveCostSpend(o, result, spend, measured) {
-    if (spend === null)
-        return modelledSpend(result.spend);
-    if (spend.tier === 1) {
-        const usd = measured?.usd ?? o.anthropicUsageUsd;
-        return typeof usd === "number" ? { source: "anthropic_usage", usd } : null;
-    }
-    if (spend.tier === 2)
-        return null;
-    return spend.tier === 3 ? modelledSpend(result.spend) : null;
+    // Shared with the Mnemom-side run (MNE-9752): same spend source, same cost figures.
+    return costSpendFor(result, spend, measured?.usd ?? o.anthropicUsageUsd);
 }
 export const NO_ADMIN_KEY_TERMINAL_MSG = "Set ANTHROPIC_ADMIN_KEY (there is no terminal to ask on).";
 export const TIER1_FALLBACK_NOTE = "Tier 1 skipped: falling back to the next tier.";
@@ -353,21 +346,21 @@ export async function scanCommand(o) {
  * returns it so the caller exits non-zero after the local report is shown.
  */
 async function emailReport(o, org, result, level, spend, period, costSpend, extraEmails) {
-    const fail = (f) => {
-        console.log(failureMessage(f));
+    const fail = (f, retryAfterMs) => {
+        console.log(failureMessage(f, retryAfterMs));
         return f;
     };
     const report = buildEmailReport(result, {
         orgId: org,
         now: o.now ?? Date.now,
-        sendSpendRange: spend ? spend.shareable && spend.tier === 3 : true,
+        sendSpendRange: sendsSpendRange(spend),
         period,
         costSpend,
     });
     const body = buildEmailBody(report, level, result.coverage.complete, extraEmails);
     const outcome = await sendReportEmail(org, body, o.emailDeps);
     if (outcome.status === "failed")
-        return fail(outcome.reason);
+        return fail(outcome.reason, outcome.retryAfterMs);
     if (outcome.status === "unavailable") {
         // Org Scan is off by default: the gate's 404 is not a failure and must not break the scan.
         console.log(UNAVAILABLE_MSG);

package/dist/lib/runner/executor-client.d.ts

@@ -34,6 +34,11 @@ export declare function errorDetails(body: unknown): Record<string, unknown>;
 export declare const JOB_READ_PATH: (sessionId: string) => string;
 /** The served bundle fetch, per claim (W-L12). */
 export declare const BUNDLE_FETCH_PATH: (sessionId: string) => string;
+/**
+ * The job's PR token (ruling 34.34): a Record App installation token narrowed to the seal's repo,
+ * contents and pull_requests write, fetched with the lease key. Never cached or logged.
+ */
+export declare const GITHUB_TOKEN_PATH: (sessionId: string) => string;
 export declare const JWKS_PATH = "/v1/.well-known/jwks.json";
 /** Record's commit index (ruling 34.05 (a)): the lease key may write the session's own commits. */
 export declare const RECORD_COMMITS_PATH: (orgId: string) => string;
@@ -65,6 +70,7 @@ export interface RunnerApi {
     fail(sessionId: string, body: Record<string, unknown>): Promise<HttpResult>;
     job(sessionId: string): Promise<HttpResult>;
     bundle(sessionId: string, leaseKey: string): Promise<HttpResult>;
+    githubToken(sessionId: string, leaseKey: string): Promise<HttpResult>;
     jwks(): Promise<HttpResult>;
     /** One RecordCommit/v1 body, with the lease key; the api pins it to the session's lineage. */
     recordCommit(orgId: string, body: RecordCommitBody, leaseKey: string): Promise<HttpResult>;

package/dist/lib/runner/executor-client.js

@@ -33,6 +33,11 @@ export function errorDetails(body) {
 export const JOB_READ_PATH = (sessionId) => `/v1/executor/sessions/${sessionId}/job`;
 /** The served bundle fetch, per claim (W-L12). */
 export const BUNDLE_FETCH_PATH = (sessionId) => `/v1/executor/sessions/${sessionId}/bundle`;
+/**
+ * The job's PR token (ruling 34.34): a Record App installation token narrowed to the seal's repo,
+ * contents and pull_requests write, fetched with the lease key. Never cached or logged.
+ */
+export const GITHUB_TOKEN_PATH = (sessionId) => `/v1/executor/sessions/${sessionId}/github-token`;
 export const JWKS_PATH = "/v1/.well-known/jwks.json";
 /** Record's commit index (ruling 34.05 (a)): the lease key may write the session's own commits. */
 export const RECORD_COMMITS_PATH = (orgId) => `/v1/orgs/${encodeURIComponent(orgId)}/record/commits`;
@@ -95,6 +100,7 @@ export function runnerApi(opts) {
         fail: (id, body) => call(routePath("exec_fail", scoped(id)), "POST", ex, body),
         job: (id) => call(JOB_READ_PATH(scoped(id)), "GET", ex),
         bundle: (id, leaseKey) => call(BUNDLE_FETCH_PATH(scoped(id)), "GET", leaseKey),
+        githubToken: (id, leaseKey) => call(GITHUB_TOKEN_PATH(scoped(id)), "POST", leaseKey),
         jwks: () => call(JWKS_PATH, "GET", null),
         recordCommit: (orgId, body, leaseKey) => {
             if (!ORG_ID_RE.test(orgId))

package/dist/lib/runner/job.d.ts

@@ -42,8 +42,11 @@ export interface JobDeps {
     prepareWorkspace(repo: string, sessionId: string): Promise<Workspace>;
     /** Run one phase's process; resolves its exit code. Rejects only when it could not start. */
     runPhase(inv: PhaseInvocation, ws: Workspace, modelUrl: string, signal: AbortSignal): Promise<number>;
-    /** Push the job branch and open its PR; resolves the PR URL. */
-    openPr(repo: string, ws: Workspace, title: string, body: string): Promise<string>;
+    /**
+     * Push the job branch and open its PR; resolves the PR URL. `token` is the job's PR token when
+     * `prTokenFromLease` is set; null means the runner's own GitHub token.
+     */
+    openPr(repo: string, ws: Workspace, title: string, body: string, token: string | null): Promise<string>;
     /** Commits on the job branch that the base does not have; 0 means there is nothing to open. */
     commitsAhead(ws: Workspace): Promise<number>;
     /** The working copy's HEAD sha before a phase runs; null only for a clone with no commit. Throws otherwise. */
@@ -53,7 +56,13 @@ export interface JobDeps {
      * first, under `lineageKey` and the job's repo. A commit that cannot be read is left out.
      */
     commitBodies(ws: Workspace, since: string | null, lineageKey: string, repo: string): Promise<RecordCommitBody[]>;
-    enableAutoMerge(prUrl: string): Promise<void>;
+    enableAutoMerge(prUrl: string, token: string | null): Promise<void>;
+    /**
+     * True when the credential is the --oidc exchange: the PR is pushed and opened with the job's PR
+     * token from the api (ruling 34.34), never the runner's own GitHub token, which in a sealed repo's
+     * Action is a GITHUB_TOKEN the org forbids from opening PRs. A refused token fails the job.
+     */
+    prTokenFromLease?: boolean;
     cleanup(ws: Workspace): Promise<void>;
 }
 export interface JobOptions {

package/dist/lib/runner/job.js

@@ -379,6 +379,7 @@ export async function runJob(sessionId, opts, deps) {
             });
         }
         if (opensPr) {
+            let prToken = null;
             try {
                 // Checked before the push, so an empty diff never reaches GitHub's 422 (amendment 59).
                 if ((await deps.commitsAhead(ws)) === 0) {
@@ -386,7 +387,13 @@ export async function runJob(sessionId, opts, deps) {
                     await reportFail(deps, sessionId, claim.epoch, "runner_failed", "pr_no_changes");
                     return { kind: "outcome", outcome: failedOutcome(facts, "pr_no_changes") };
                 }
-                facts.pr_url = await deps.openPr(job.repo, ws, `mnemom: ${bundle.workflow.id} job ${sessionId.slice(0, 8)}`, prBody(job));
+                if (deps.prTokenFromLease) {
+                    const t = await fetchPrToken(deps, sessionId, claim.leaseKey, job.repo);
+                    if (!t.ok)
+                        throw new Error(t.detail);
+                    prToken = t.token;
+                }
+                facts.pr_url = await deps.openPr(job.repo, ws, `mnemom: ${bundle.workflow.id} job ${sessionId.slice(0, 8)}`, prBody(job), prToken);
             }
             catch (e) {
                 deps.log(`opening the PR failed: ${e.message}`);
@@ -395,7 +402,7 @@ export async function runJob(sessionId, opts, deps) {
             }
             if (facts.merge_strategy === "merge_on_green") {
                 try {
-                    await deps.enableAutoMerge(facts.pr_url);
+                    await deps.enableAutoMerge(facts.pr_url, prToken);
                 }
                 catch (e) {
                     deps.log(`enabling auto-merge failed (the PR stays open): ${e.message}`);
@@ -469,6 +476,27 @@ export async function reportPhaseCommits(deps, report, p) {
         deps.log(`commit report failed: ${e.message}`);
     }
 }
+/**
+ * The job's PR token (ruling 34.34), fetched once per claim with the lease key. It must name the
+ * job's repo; the detail never carries the token.
+ */
+async function fetchPrToken(deps, sessionId, leaseKey, repo) {
+    const res = await deps.api.githubToken(sessionId, leaseKey);
+    if (res.status !== 200) {
+        return {
+            ok: false,
+            detail: `the PR token fetch answered ${res.code ?? res.networkError ?? res.status}`,
+        };
+    }
+    const b = (res.body ?? {});
+    if (typeof b.token !== "string" || b.token === "") {
+        return { ok: false, detail: "the PR token fetch answered 200 with no token" };
+    }
+    if (typeof b.repository !== "string" || b.repository.toLowerCase() !== repo.toLowerCase()) {
+        return { ok: false, detail: `the PR token names another repo than the job's ${repo}` };
+    }
+    return { ok: true, token: b.token };
+}
 async function fetchBundle(deps, sessionId, claim) {
     const [jwksRes, res] = await Promise.all([
         deps.api.jwks(),

package/dist/lib/scan/caps.d.ts

@@ -1,35 +1 @@
-/**
- * Coverage caps and sampling. Port of mnemom-api src/org-scan/scan/capped-scan.ts (PR #4208).
- *
- * Coverage decision (Shraddha, 2026-10-28): each scan covers the last 3 months OR the last 2,000 merged
- * PRs, whichever is MORE; above 2,000 in the window, an even deterministic sample of 2,000.
- */
-export declare const COVERAGE_MONTHS = 3;
-export interface ScanCaps {
-    maxPrs: number;
-    /** A PR with more additions+deletions than this is skipped, never read in full. */
-    maxPrSizeLines: number;
-    /** Upstream read calls. */
-    maxReads: number;
-    /** Wall-clock budget. */
-    maxMillis: number;
-}
-export declare const DEFAULT_SCAN_CAPS: ScanCaps;
-export type StopReason = "pr-cap" | "read-cap" | "time-cap";
-/** The day `months` calendar months before `end` (YYYY-MM-DD, UTC), clamped to the month's last day. */
-export declare function monthsBefore(end: string, months: number): string;
-/** `k` items spread evenly across `items` (order kept): index floor(i*n/k). Deterministic; n <= k returns all. */
-export declare function evenSample<T>(items: readonly T[], k: number): T[];
-export declare function sanitiseCaps(c: Partial<ScanCaps>): ScanCaps;
-/** Running read budget. Every call is told how many reads it may spend (`room`). */
-export declare class Budget {
-    private caps;
-    private now;
-    private startedAt;
-    reads: number;
-    constructor(caps: ScanCaps, now: () => number, startedAt: number);
-    block(n?: number): StopReason | null;
-    room(): number;
-    overrun(): StopReason | null;
-    charge(n: number): void;
-}
+export * from "../../vendor/shared/org-scan-core/caps.js";

package/dist/lib/scan/caps.js

@@ -1,67 +1,2 @@
-/**
- * Coverage caps and sampling. Port of mnemom-api src/org-scan/scan/capped-scan.ts (PR #4208).
- *
- * Coverage decision (Shraddha, 2026-10-28): each scan covers the last 3 months OR the last 2,000 merged
- * PRs, whichever is MORE; above 2,000 in the window, an even deterministic sample of 2,000.
- */
-export const COVERAGE_MONTHS = 3;
-export const DEFAULT_SCAN_CAPS = {
-    maxPrs: 2_000,
-    maxPrSizeLines: 20_000,
-    maxReads: 4_500,
-    maxMillis: 15 * 60_000,
-};
-/** The day `months` calendar months before `end` (YYYY-MM-DD, UTC), clamped to the month's last day. */
-export function monthsBefore(end, months) {
-    const [y, m, d] = end.split("-").map(Number);
-    const target = new Date(Date.UTC(y, m - 1 - months, 1));
-    const last = new Date(Date.UTC(target.getUTCFullYear(), target.getUTCMonth() + 1, 0)).getUTCDate();
-    target.setUTCDate(Math.min(d, last));
-    return target.toISOString().slice(0, 10);
-}
-/** `k` items spread evenly across `items` (order kept): index floor(i*n/k). Deterministic; n <= k returns all. */
-export function evenSample(items, k) {
-    const n = items.length;
-    if (n <= k)
-        return [...items];
-    return Array.from({ length: k }, (_, i) => items[Math.floor((i * n) / k)]);
-}
-export function sanitiseCaps(c) {
-    const pos = (n, d) => typeof n === "number" && Number.isFinite(n) && n > 0 ? Math.floor(n) : d;
-    return {
-        maxPrs: pos(c.maxPrs, DEFAULT_SCAN_CAPS.maxPrs),
-        maxPrSizeLines: pos(c.maxPrSizeLines, DEFAULT_SCAN_CAPS.maxPrSizeLines),
-        maxReads: pos(c.maxReads, DEFAULT_SCAN_CAPS.maxReads),
-        maxMillis: pos(c.maxMillis, DEFAULT_SCAN_CAPS.maxMillis),
-    };
-}
-/** Running read budget. Every call is told how many reads it may spend (`room`). */
-export class Budget {
-    caps;
-    now;
-    startedAt;
-    reads = 0;
-    constructor(caps, now, startedAt) {
-        this.caps = caps;
-        this.now = now;
-        this.startedAt = startedAt;
-    }
-    block(n = 1) {
-        if (this.now() - this.startedAt >= this.caps.maxMillis)
-            return "time-cap";
-        if (this.reads + n > this.caps.maxReads)
-            return "read-cap";
-        return null;
-    }
-    room() {
-        if (this.now() - this.startedAt >= this.caps.maxMillis)
-            return 0;
-        return Math.max(0, this.caps.maxReads - this.reads);
-    }
-    overrun() {
-        return this.reads > this.caps.maxReads ? "read-cap" : null;
-    }
-    charge(n) {
-        this.reads += n;
-    }
-}
+// Moved to shared/org-scan-core (MNE-9752); vendored at cli/src/vendor/shared/org-scan-core. Re-exported so CLI imports stay put.
+export * from "../../vendor/shared/org-scan-core/caps.js";

package/dist/lib/scan/cost-per-pr.d.ts

@@ -1,93 +1 @@
-/**
- * Cost per merged PR and cost by PR size, for the Org Scan report. Pure: numbers in, numbers out.
- *
- * Source of the spend. Measured per-request cost cannot be tied to a PR with the data the scan has:
- * the Anthropic usage reads return one whole-org total (no per-request or per-PR rows) and the Mnemom
- * Record totals are one window sum (model cost and a request count, no PR key). So every figure here is
- * `label: "estimate"`: the period's spend split across the merged PRs in proportion to lines changed.
- * Each figure names the spend it was split from (`spend_source`); sources are never mixed in one report.
- *
- *   anthropic_usage          the whole-org Anthropic cost for the period (the CTO's admin key)
- *   modelled_range           our modelled estimate (a low to high range, so the figures are ranges)
- *
- * Size is per PR, in lines changed = additions + deletions, exactly as GitHub reports them. Lockfiles and
- * generated files are NOT excluded. small < 50; medium 50..500 inclusive; large > 500.
- *
- * Each size figure is the average cost of ONE PR of that size: spend * (mean lines of the bucket) /
- * (total lines of the PRs in scope). Scope: the modelled estimate prices AI-assisted PRs only, so it is
- * split across those only (`pr_scope: "ai_assisted"`, buckets too); the others use every merged PR
- * (`pr_scope: "all_merged"`). `pr_count` counts PRs in that scope. Usage-key figures also carry
- * `spend_scope: "whole_org"` (the key covers the whole organization, not just the scanned repos). The cost per merged PR is the spend over the count of merged PRs.
- *
- * Missing data is an absent field, never 0 or NaN: no usable spend, zero merged PRs in the period, an
- * empty bucket, a scan that did not read every merged PR in the period, or a result past safe-integer
- * range. Reverts are listed without sizes, so they are not counted as merged PRs here.
- */
-import type { SpendEstimate } from "./spend/spend-estimate.js";
-/** Strictly below this is small. 50 is medium. */
-export declare const SMALL_MAX_EXCLUSIVE = 50;
-/** At or below this (and not small) is medium. 500 is medium; 501 is large. */
-export declare const MEDIUM_MAX_INCLUSIVE = 500;
-export type SizeBucket = "small" | "medium" | "large";
-export type CostSpendSourceName = "anthropic_usage" | "modelled_range";
-export interface PrSize {
-    /** YYYY-MM-DD, UTC. */
-    mergedDay: string;
-    /** additions + deletions. */
-    lines: number;
-    /** The PR carries an AI-tool mark (the same rule the modelled spend uses to count AI-assisted PRs). */
-    aiAssisted: boolean;
-}
-/** Where the spend comes from. USD, never cents. */
-export type CostSpend = {
-    source: "anthropic_usage";
-    usd: number;
-} | {
-    source: "modelled_range";
-    lowUsd: number;
-    highUsd: number;
-};
-/** One figure: a single value, or a low to high range for the modelled source. Integer cents. */
-export type PrScope = "ai_assisted" | "all_merged";
-export type CostFigure = {
-    /** "measured" is not possible with current data (see header); every figure is an estimate. */
-    label: "estimate";
-    spend_source: CostSpendSourceName;
-    /**
-     * Which PRs the average is over. The modelled estimate prices AI-assisted PRs only, so it is split
-     * across those only ("ai_assisted"); the usage key covers all spend, so they use "all_merged".
-     */
-    pr_scope: PrScope;
-    /** PRs in that scope. */
-    pr_count: number;
-    /** Present on anthropic_usage only: the key's usage is the whole organization's, not just these PRs'. */
-    spend_scope?: "whole_org";
-} & ({
-    value_cents: number;
-} | {
-    low_cents: number;
-    high_cents: number;
-});
-export interface CostPerPr {
-    cost_per_merged_pr?: CostFigure;
-    cost_by_pr_size?: Partial<Record<SizeBucket, CostFigure>>;
-}
-export declare const sizeBucket: (lines: number) => SizeBucket;
-/** Inclusive day count of YYYY-MM-DD..YYYY-MM-DD, or null if unparsable or reversed. */
-export declare function periodDays(p: {
-    start: string;
-    end: string;
-}): number | null;
-/** The period's spend in USD as [low, high]; null when there is no usable spend. */
-export declare function spendForPeriod(spend: CostSpend): [number, number] | null;
-/** The modelled estimate as a spend source, or null when the estimate is "none". */
-export declare const modelledSpend: (e: SpendEstimate) => CostSpend | null;
-/**
- * @param prs           every merged PR the scan read, with merge day and size
- * @param exhaustive    true only if the scan read EVERY merged PR in the period (no sample, no skipped
- *                      large PR, none unreadable, no cap hit). Otherwise the average is not defined.
- */
-export declare function buildCostPerPr(prs: readonly PrSize[] | undefined, period: {
-    start: string;
-    end: string;
-}, spend: CostSpend | null, exhaustive: boolean): CostPerPr;
+export * from "../../vendor/shared/org-scan-core/cost-per-pr.js";

package/dist/lib/scan/cost-per-pr.js

@@ -1,101 +1,2 @@
-/** Strictly below this is small. 50 is medium. */
-export const SMALL_MAX_EXCLUSIVE = 50;
-/** At or below this (and not small) is medium. 500 is medium; 501 is large. */
-export const MEDIUM_MAX_INCLUSIVE = 500;
-export const sizeBucket = (lines) => lines < SMALL_MAX_EXCLUSIVE ? "small" : lines <= MEDIUM_MAX_INCLUSIVE ? "medium" : "large";
-const DAY_MS = 86_400_000;
-/** Inclusive day count of YYYY-MM-DD..YYYY-MM-DD, or null if unparsable or reversed. */
-export function periodDays(p) {
-    const s = Date.parse(`${p.start}T00:00:00Z`);
-    const e = Date.parse(`${p.end}T00:00:00Z`);
-    if (!Number.isFinite(s) || !Number.isFinite(e) || e < s)
-        return null;
-    return Math.round((e - s) / DAY_MS) + 1;
-}
-const pos = (n) => typeof n === "number" && Number.isFinite(n) && n > 0;
-/** The period's spend in USD as [low, high]; null when there is no usable spend. */
-export function spendForPeriod(spend) {
-    let r;
-    if (spend.source === "anthropic_usage") {
-        if (!pos(spend.usd))
-            return null;
-        r = [spend.usd, spend.usd];
-    }
-    else {
-        if (!pos(spend.highUsd) || !(spend.lowUsd >= 0) || spend.lowUsd > spend.highUsd)
-            return null;
-        r = [spend.lowUsd, spend.highUsd];
-    }
-    return r.every((x) => Number.isFinite(x) && x * 100 <= Number.MAX_SAFE_INTEGER) ? r : null;
-}
-/** The modelled estimate as a spend source, or null when the estimate is "none". */
-export const modelledSpend = (e) => e.kind === "range" ? { source: "modelled_range", lowUsd: e.lowUsd, highUsd: e.highUsd } : null;
-/**
- * `share` is the fraction of the period's spend one average PR here carries: always in (0, 1] by
- * construction, and the spend is already bounded to safe-integer cents by spendForPeriod, so the
- * rounded cents are finite safe integers without a further guard.
- */
-function figure(spend, [low, high], count, share, scope) {
-    const c = (usd) => Math.round(usd * share * 100);
-    const base = {
-        label: "estimate",
-        spend_source: spend.source,
-        pr_scope: scope,
-        pr_count: count,
-        ...(spend.source === "anthropic_usage" ? { spend_scope: "whole_org" } : {}),
-    };
-    return spend.source === "modelled_range"
-        ? { ...base, low_cents: c(low), high_cents: c(high) }
-        : { ...base, value_cents: c(low) };
-}
-/**
- * @param prs           every merged PR the scan read, with merge day and size
- * @param exhaustive    true only if the scan read EVERY merged PR in the period (no sample, no skipped
- *                      large PR, none unreadable, no cap hit). Otherwise the average is not defined.
- */
-export function buildCostPerPr(prs, period, spend, exhaustive) {
-    if (!exhaustive || !spend || !Array.isArray(prs))
-        return {};
-    if (periodDays(period) === null)
-        return {};
-    const total = spendForPeriod(spend);
-    if (!total)
-        return {};
-    const inPeriod = prs.filter((p) => p.mergedDay >= period.start &&
-        p.mergedDay <= period.end &&
-        Number.isSafeInteger(p.lines) &&
-        p.lines >= 0);
-    // The modelled estimate is AI-tool spend, so it is split across AI-assisted PRs only; the usage key is
-    // the whole spend, so it is split across every merged PR.
-    const scope = spend.source === "modelled_range" ? "ai_assisted" : "all_merged";
-    const scoped = scope === "ai_assisted" ? inPeriod.filter((p) => p.aiAssisted) : inPeriod;
-    const n = scoped.length;
-    if (n === 0)
-        return {};
-    const out = {};
-    out.cost_per_merged_pr = figure(spend, total, n, 1 / n, scope);
-    let allLines = 0;
-    const agg = {
-        small: { n: 0, lines: 0 },
-        medium: { n: 0, lines: 0 },
-        large: { n: 0, lines: 0 },
-    };
-    for (const p of scoped) {
-        allLines += p.lines;
-        const a = agg[sizeBucket(p.lines)];
-        a.n += 1;
-        a.lines += p.lines;
-    }
-    // Splitting by lines needs lines: with none (or a sum past safe range) there is no size figure.
-    if (allLines <= 0 || !Number.isSafeInteger(allLines))
-        return out;
-    const bySize = {};
-    for (const b of ["small", "medium", "large"]) {
-        const a = agg[b];
-        if (a.n === 0)
-            continue;
-        bySize[b] = figure(spend, total, a.n, a.lines / a.n / allLines, scope);
-    }
-    out.cost_by_pr_size = bySize;
-    return out;
-}
+// Moved to shared/org-scan-core (MNE-9752); vendored at cli/src/vendor/shared/org-scan-core. Re-exported so CLI imports stay put.
+export * from "../../vendor/shared/org-scan-core/cost-per-pr.js";

package/dist/lib/scan/credential.d.ts

@@ -1,29 +1,5 @@
-/** The complete permission set a scan credential may hold. Read only. */
-export declare const SCAN_READ_PERMISSIONS: Readonly<Record<string, "read">>;
-export interface GitHubCredential {
-    /** Fixed label for diagnostics ("app", "personal"): never a token, login or URL. */
-    readonly kind: string;
-    /** A bearer token for reading `repo` (owner/name). A rejection fails that read closed. */
-    tokenFor(repo: string): Promise<string>;
-    /**
-     * The permissions GitHub granted this credential, when the source can tell. Null = unknown (for
-     * example a classic token); the scan then relies on GET-only egress and does not claim more.
-     */
-    grantedPermissions?(): Promise<Record<string, string> | null>;
-}
-/** Violations (empty when the map is exactly the read-only scan set). Port of readOnlyViolations. */
-export declare function readOnlyViolations(permissions: Record<string, string> | null | undefined): string[];
-/** owner/name, no dot-only segment. */
-export declare function isValidRepoSlug(s: unknown): s is string;
-/** Fixed-text failure: the message never carries a token, a body or a URL. */
-export declare class ScanCredentialError extends Error {
-    constructor(message: "scan credential refused" | "scan credential not configured");
-}
-/**
- * Refuses a credential GitHub granted more than read to. Throws a fixed-text error and nothing else.
- * Unknown (null) permissions pass: the source cannot tell, and the scan is GET-only regardless.
- */
-export declare function assertReadOnlyCredential(c: GitHubCredential): Promise<void>;
+import { type GitHubCredential } from "../../vendor/shared/org-scan-core/credential.js";
+export * from "../../vendor/shared/org-scan-core/credential.js";
 /** Runs `gh auth token`; resolves stdout or rejects. Injectable so tests never spawn a process. */
 export type GhTokenRunner = () => Promise<string>;
 /**