@mnemom/mnemom 0.17.38-next.1 → 0.17.38-next.2

package/dist/lib/scan/credential.js

@@ -1,64 +1,11 @@
 /**
- * GitHubCredential: the one seam through which a local scan obtains a GitHub token.
- *
- * The scan core only ever sees this interface. The concrete default is the GitHub login of whoever
- * runs the scan (`gh auth token`, see createGhLoginCredential); the server-issued App token path is
- * retired (design owner, 2026-10-28). Port of the read-only rule in mnemom-api
- * src/org-scan/github-scan-app.ts.
+ * The CLI's GitHub credential. The runtime-neutral seam (GitHubCredential, the read-only rule) lives in
+ * shared/org-scan-core (MNE-9752) and is re-exported here; only the `gh auth token` default, which needs
+ * node:child_process, stays in the CLI.
  */
 import { execFile } from "node:child_process";
-/** The complete permission set a scan credential may hold. Read only. */
-export const SCAN_READ_PERMISSIONS = Object.freeze({
-    metadata: "read",
-    contents: "read",
-    pull_requests: "read",
-});
-/** Violations (empty when the map is exactly the read-only scan set). Port of readOnlyViolations. */
-export function readOnlyViolations(permissions) {
-    const out = [];
-    const p = permissions ?? {};
-    for (const [name, level] of Object.entries(p)) {
-        if (level !== "read")
-            out.push(`${name}:${level} is not read`);
-        if (!(name in SCAN_READ_PERMISSIONS))
-            out.push(`${name} is not in the scan permission set`);
-    }
-    for (const name of Object.keys(SCAN_READ_PERMISSIONS)) {
-        if (!(name in p))
-            out.push(`${name} missing`);
-    }
-    return out;
-}
-/** owner/name, no dot-only segment. */
-export function isValidRepoSlug(s) {
-    return (typeof s === "string" &&
-        /^[A-Za-z0-9._-]{1,100}\/[A-Za-z0-9._-]{1,100}$/.test(s) &&
-        !s.split("/").some((p) => /^\.+$/.test(p)));
-}
-/** Fixed-text failure: the message never carries a token, a body or a URL. */
-export class ScanCredentialError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "ScanCredentialError";
-    }
-}
-/**
- * Refuses a credential GitHub granted more than read to. Throws a fixed-text error and nothing else.
- * Unknown (null) permissions pass: the source cannot tell, and the scan is GET-only regardless.
- */
-export async function assertReadOnlyCredential(c) {
-    if (!c.grantedPermissions)
-        return;
-    let perms;
-    try {
-        perms = await c.grantedPermissions();
-    }
-    catch {
-        throw new ScanCredentialError("scan credential refused");
-    }
-    if (perms !== null && readOnlyViolations(perms).length > 0)
-        throw new ScanCredentialError("scan credential refused");
-}
+import { ScanCredentialError, } from "../../vendor/shared/org-scan-core/credential.js";
+export * from "../../vendor/shared/org-scan-core/credential.js";
 const runGhAuthToken = () => new Promise((resolve, reject) => {
     try {
         execFile("gh", ["auth", "token"], { shell: false, windowsHide: true, timeout: 10_000, maxBuffer: 64 * 1024 }, (err, stdout) => {

package/dist/lib/scan/failure.d.ts

@@ -1,10 +1 @@
-/**
- * Scan failure reasons. Port of upstreamTag in mnemom-api capped-scan.ts (PRs #4221 / #4223): an
- * exact-match table of fixed messages to fixed reason tags. The raw error message is NEVER echoed,
- * so no token, URL or GitHub body can reach the terminal or the report. An unrecognised error maps
- * to the generic "github" tag.
- */
-export type FailureReason = "not_installed" | "credential" | "timeout" | "forbidden" | "rate_limited" | "github" | "network" | "invalid_input";
-export declare function classifyFailure(e: unknown): FailureReason;
-/** Fixed sentence for a reason. */
-export declare function failureText(r: FailureReason): string;
+export * from "../../vendor/shared/org-scan-core/failure.js";

package/dist/lib/scan/failure.js

@@ -1,43 +1,2 @@
-const EXACT = new Map([
-    ["github repo not visible", "not_installed"],
-    ["scan credential refused", "credential"],
-    ["scan credential not configured", "credential"],
-    ["invalid repo", "invalid_input"],
-    ["invalid cursor", "invalid_input"],
-    ["scan read not allowed", "invalid_input"],
-    ["unexpected list shape", "github"],
-]);
-export function classifyFailure(e) {
-    if (e instanceof Error) {
-        if (e.name === "TimeoutError" || e.name === "AbortError")
-            return "timeout";
-        const exact = EXACT.get(e.message);
-        if (exact)
-            return exact;
-        const gh = /^github read failed \((\d{3})\)$/.exec(e.message);
-        if (gh) {
-            if (gh[1] === "401" || gh[1] === "403")
-                return "forbidden";
-            if (gh[1] === "429")
-                return "rate_limited";
-            return "github";
-        }
-        if (e instanceof TypeError)
-            return "network";
-    }
-    return "github";
-}
-const TEXT = {
-    not_installed: "a repo is not visible to the credential (check your GitHub access to it)",
-    credential: "the GitHub credential was refused or is not configured",
-    timeout: "GitHub did not answer in time",
-    forbidden: "GitHub refused the credential (401/403)",
-    rate_limited: "GitHub rate limit reached",
-    github: "a GitHub read failed",
-    network: "GitHub was unreachable",
-    invalid_input: "an input to the scan was invalid",
-};
-/** Fixed sentence for a reason. */
-export function failureText(r) {
-    return TEXT[r];
-}
+// Moved to shared/org-scan-core (MNE-9752); vendored at cli/src/vendor/shared/org-scan-core. Re-exported so CLI imports stay put.
+export * from "../../vendor/shared/org-scan-core/failure.js";

package/dist/lib/scan/pr-source.d.ts

@@ -1,57 +1 @@
-/**
- * Read-only GitHub PR source for the local scan. Port of mnemom-api src/org-scan/scan/github-pr-source.ts
- * (window path, PRs #4208 / #4221 / #4223).
- *
- * METADATA only: size counts, a CI rollup, a revert boolean and the AI tools named in the PR body.
- * Titles and bodies are inspected in memory and dropped; author logins, branch names, and code never
- * leave this module (PrRecord has no such field). Every call goes through `guardedGet`, which only
- * ever issues a GET to api.github.com on an allowlisted path. Failures throw fixed-text errors:
- * never a GitHub body, a header, a URL or the token.
- */
-import { type GitHubCredential } from "./credential.js";
-import type { AiTool } from "./spend/prices.js";
-export declare const GITHUB_API = "https://api.github.com";
-/** Merged PRs are listed 100 at a time; a list page is one read however many PRs it holds. */
-export declare const INDEX_PAGE_SIZE = 100;
-export type CiRollup = "none" | "pending" | "success" | "failure";
-export interface PrIndexItem {
-    number: number;
-    /** YYYY-MM-DD, UTC. */
-    mergedDay: string;
-    /** YYYY-MM-DD, UTC, last activity (the listing is newest-activity first). */
-    updatedDay: string;
-    reverted: boolean;
-}
-export interface PrIndexPage {
-    items: PrIndexItem[];
-    next: string | null;
-    reads: number;
-}
-export interface PrRecord {
-    additions: number;
-    deletions: number;
-    changed_files: number;
-    ci?: CiRollup;
-    reverted: boolean;
-    /** AI tools named in the PR body, detected here so the body never leaves this module. */
-    tools: AiTool[];
-}
-export interface PrSource {
-    indexMerged(repo: string, cursor: string | null, maxReads?: number): Promise<PrIndexPage>;
-    readPr(repo: string, item: PrIndexItem, maxReads?: number): Promise<{
-        pr: PrRecord | null;
-        reads: number;
-    }>;
-}
-export interface GithubPrSourceDeps {
-    credential: GitHubCredential;
-    fetchImpl?: typeof fetch;
-    timeoutMs?: number;
-}
-/** Pure: one word from check-run conclusions. No check names, logs or URLs are kept. */
-export declare function rollupCi(runs: Array<{
-    status?: unknown;
-    conclusion?: unknown;
-}>): CiRollup;
-export declare function isAllowedScanPath(path: string): boolean;
-export declare function createGithubPrSource(deps: GithubPrSourceDeps): PrSource;
+export * from "../../vendor/shared/org-scan-core/pr-source.js";

package/dist/lib/scan/pr-source.js

@@ -1,132 +1,2 @@
-/**
- * Read-only GitHub PR source for the local scan. Port of mnemom-api src/org-scan/scan/github-pr-source.ts
- * (window path, PRs #4208 / #4221 / #4223).
- *
- * METADATA only: size counts, a CI rollup, a revert boolean and the AI tools named in the PR body.
- * Titles and bodies are inspected in memory and dropped; author logins, branch names, and code never
- * leave this module (PrRecord has no such field). Every call goes through `guardedGet`, which only
- * ever issues a GET to api.github.com on an allowlisted path. Failures throw fixed-text errors:
- * never a GitHub body, a header, a URL or the token.
- */
-import { isValidRepoSlug } from "./credential.js";
-import { detectAiTools } from "./spend/ai-tool-detect.js";
-export const GITHUB_API = "https://api.github.com";
-/** Merged PRs are listed 100 at a time; a list page is one read however many PRs it holds. */
-export const INDEX_PAGE_SIZE = 100;
-/** Pure: one word from check-run conclusions. No check names, logs or URLs are kept. */
-export function rollupCi(runs) {
-    if (runs.length === 0)
-        return "none";
-    if (runs.some((r) => r.status !== "completed"))
-        return "pending";
-    const ok = new Set(["success", "neutral", "skipped"]);
-    return runs.every((r) => typeof r.conclusion === "string" && ok.has(r.conclusion))
-        ? "success"
-        : "failure";
-}
-const isCount = (n) => typeof n === "number" && Number.isInteger(n) && n >= 0;
-const SLUG = "[A-Za-z0-9._-]{1,100}/[A-Za-z0-9._-]{1,100}";
-/** The only paths the scan may read. Anything else is refused before a request is made. */
-const ALLOWED_PATHS = [
-    new RegExp(`^/repos/${SLUG}/pulls\\?state=closed&sort=updated&direction=desc&per_page=\\d{1,3}&page=\\d{1,4}$`),
-    new RegExp(`^/repos/${SLUG}/pulls/\\d{1,9}$`),
-    new RegExp(`^/repos/${SLUG}/commits/[0-9a-f]{40}/check-runs\\?per_page=100$`),
-    // The repo picker's one list read (MNE-9643): the repos this login can read, newest push first.
-    /^\/user\/repos\?sort=pushed&direction=desc&per_page=\d{1,3}$/,
-];
-export function isAllowedScanPath(path) {
-    return ALLOWED_PATHS.some((re) => re.test(path));
-}
-export function createGithubPrSource(deps) {
-    const doFetch = deps.fetchImpl ?? fetch;
-    const headers = {
-        accept: "application/vnd.github+json",
-        "x-github-api-version": "2022-11-28",
-        "user-agent": "mnemom-cli-scan/1",
-    };
-    /**
-     * `list` marks the PR list read, the first read of a repo. GitHub hides a repo the credential cannot
-     * see behind a 404, so only there is a 404 "repo not visible"; a 404 on a later detail or
-     * check-runs read is an ordinary upstream miss and keeps its numeric message (#4223).
-     */
-    async function guardedGet(path, repo, list = false) {
-        if (!isAllowedScanPath(path))
-            throw new Error("scan read not allowed");
-        const bearer = await deps.credential.tokenFor(repo);
-        const res = await doFetch(`${GITHUB_API}${path}`, {
-            method: "GET",
-            headers: { ...headers, authorization: `Bearer ${bearer}` },
-            redirect: "error",
-            signal: AbortSignal.timeout(deps.timeoutMs ?? 10_000),
-        });
-        if (!res.ok) {
-            await res.body?.cancel().catch(() => { });
-            throw new Error(list && res.status === 404
-                ? "github repo not visible"
-                : `github read failed (${res.status})`);
-        }
-        return res.json();
-    }
-    const day = (v) => {
-        const t = typeof v === "string" ? Date.parse(v) : NaN;
-        return Number.isFinite(t) ? new Date(t).toISOString().slice(0, 10) : null;
-    };
-    return {
-        async indexMerged(repo, cursor) {
-            if (!isValidRepoSlug(repo))
-                throw new Error("invalid repo");
-            const page = cursor === null ? 1 : Number(cursor);
-            if (!Number.isInteger(page) || page < 1 || page > 1000)
-                throw new Error("invalid cursor");
-            const list = (await guardedGet(`/repos/${repo}/pulls?state=closed&sort=updated&direction=desc&per_page=${INDEX_PAGE_SIZE}&page=${page}`, repo, true));
-            if (!Array.isArray(list))
-                throw new Error("unexpected list shape");
-            const items = [];
-            for (const it of list) {
-                const mergedDay = day(it.merged_at);
-                const updatedDay = day(it.updated_at);
-                if (mergedDay === null || updatedDay === null || !isCount(it.number))
-                    continue;
-                // The title is read for the revert marker only and dropped here.
-                items.push({
-                    number: it.number,
-                    mergedDay,
-                    updatedDay,
-                    reverted: typeof it.title === "string" && /^revert\b/i.test(it.title),
-                });
-            }
-            return { items, next: list.length < INDEX_PAGE_SIZE ? null : String(page + 1), reads: 1 };
-        },
-        async readPr(repo, item, maxReads = Number.POSITIVE_INFINITY) {
-            if (!isValidRepoSlug(repo))
-                throw new Error("invalid repo");
-            if (!isCount(item.number) || maxReads < 2)
-                return { pr: null, reads: 0 };
-            const detail = (await guardedGet(`/repos/${repo}/pulls/${item.number}`, repo));
-            let reads = 1;
-            let ci;
-            const sha = detail.head?.sha;
-            if (typeof sha === "string" && /^[0-9a-f]{40}$/.test(sha)) {
-                const checks = (await guardedGet(`/repos/${repo}/commits/${sha}/check-runs?per_page=100`, repo));
-                reads += 1;
-                ci = rollupCi(Array.isArray(checks.check_runs) ? checks.check_runs : []);
-            }
-            if (!isCount(detail.additions) ||
-                !isCount(detail.deletions) ||
-                !isCount(detail.changed_files))
-                return { pr: null, reads };
-            const tools = detectAiTools(detail.body);
-            return {
-                pr: {
-                    additions: detail.additions,
-                    deletions: detail.deletions,
-                    changed_files: detail.changed_files,
-                    ci,
-                    reverted: item.reverted,
-                    tools,
-                },
-                reads,
-            };
-        },
-    };
-}
+// Moved to shared/org-scan-core (MNE-9752); vendored at cli/src/vendor/shared/org-scan-core. Re-exported so CLI imports stay put.
+export * from "../../vendor/shared/org-scan-core/pr-source.js";

package/dist/lib/scan/report-email.d.ts

@@ -1,108 +1,10 @@
-import { type CostPerPr, type CostSpend } from "./cost-per-pr.js";
-import type { ScanResult } from "./scan.js";
-import type { ShareLevel } from "./share.js";
-export declare const REPORT_SCHEMA_VERSION = "org-scan-report/1";
-export declare const ESTIMATE_NAME = "automatable_work_share";
-export declare const METHOD_URL = "https://www.mnemom.ai/org-scan-method";
-export interface EmailReport {
-    schema_version: typeof REPORT_SCHEMA_VERSION;
-    org_id: string;
-    scan_id: string;
-    period: {
-        start: string;
-        end: string;
-    };
-    generated_at: string;
-    measured: {
-        teams: [];
-        summary: {
-            pr_count: number;
-            revert_count: number;
-            automatable_count: number;
-            examined_count: number;
-            tokens_total: 0;
-        };
-        spend: {
-            source: "pr_estimate";
-            figure?: {
-                low_cents: number;
-                high_cents: number;
-            };
-            ai_prs_by_tool?: Array<{
-                tool: string;
-                count: number;
-            }>;
-        };
-    };
-    estimate: {
-        name: string;
-        value: number;
-        unit: string;
-        method_url: string;
-    };
-    /**
-     * Optional, added after org-scan-report/1 shipped; absent whenever it cannot be computed (no spend,
-     * no merged PR in the period, an incomplete scan, an empty bucket). See cost-per-pr.ts.
-     *   cost_per_merged_pr  average cost of one merged PR in the period
-     *   cost_by_pr_size     { small | medium | large }: average cost of ONE PR of that size, per-bucket
-     *                       keys absent when the bucket is empty. small < 50 lines changed, medium 50..500, large > 500.
-     * A figure is { label: "estimate", spend_source, pr_scope, pr_count } (+ spend_scope: "whole_org" on
-     * anthropic_usage) plus { value_cents } (anthropic_usage) or { low_cents, high_cents } (modelled_range). Integer cents.
-     * pr_scope is "ai_assisted" for modelled_range (spend and size buckets split across AI-assisted PRs only;
-     * absent if none) and "all_merged" otherwise; pr_count counts PRs in that scope.
-     * Always attached when present. The API's report validator (mnemom-api src/org-scan/report-schema.ts) is
-     * closed, so an API that does not yet list these keys answers 400 invalid_report; sendReportEmail then
-     * retries once without them so the report email still goes out.
-     */
-    cost_per_merged_pr?: CostPerPr["cost_per_merged_pr"];
-    cost_by_pr_size?: CostPerPr["cost_by_pr_size"];
-    /**
-     * The per-repo counts, by name (MNE-9634). Always sent, at every share level: the emailed report is the full
-     * report. Optional on the wire so an API that predates it can be retried without it. Capped at 500 repos
-     * (busiest first), valid names only, each name once.
-     */
-    by_repo?: Array<{
-        repo: string;
-        pr_count: number;
-        revert_count: number;
-        automatable_count: number;
-        examined_count: number;
-    }>;
-}
-export interface ReportEmailBody {
-    report: EmailReport;
-    share_level: ShareLevel;
-    coverage: {
-        complete: boolean;
-    };
-    /** The extra recipients the runner added. Absent when none. */
-    emails?: string[];
-    /** Only set on the retry to an API that predates `emails`: it reads one extra address under this name. */
-    cto_email?: string;
-}
-/**
- * Maps the local scan onto the route's closed report shape. Team totals stay empty (they come only from
- * Anthropic usage, which the local scan does not carry). The estimate is the share of examined merged
- * PRs that finished with every CI check passing. `figure` (tier 3 range) is included only when the CLI
- * itself would let that line leave the machine (`sendSpendRange`).
- */
-export declare function buildEmailReport(result: ScanResult, o: {
-    orgId: string;
-    now: () => number;
-    sendSpendRange: boolean;
-    scanId?: string;
-    /** The requested scan period (the one the spend covers), not the examined window. */
-    period?: {
-        start: string;
-        end: string;
-    };
-    /** The one spend source the cost figures are split from; null/absent leaves them out. */
-    costSpend?: CostSpend | null;
-}): EmailReport;
-export declare function buildEmailBody(report: EmailReport, level: ShareLevel, complete: boolean, extraEmails?: string[]): ReportEmailBody;
+import type { ReportEmailBody } from "../../vendor/shared/org-scan-core/report-build.js";
+export { REPORT_SCHEMA_VERSION, ESTIMATE_NAME, METHOD_URL, buildEmailReport, buildEmailBody, type EmailReport, type ReportEmailBody, } from "../../vendor/shared/org-scan-core/report-build.js";
 /** Closed set of failure names; each has fixed text. */
-export type EmailFailure = "presend_check_failed" | "email_not_sent" | "not_signed_in" | "not_a_member" | "report_rejected" | "no_recipients" | "runner_not_emailed" | "emails_rejected" | "email_domain_not_allowed" | "admins_not_found" | "network_error" | "unexpected_response";
-export declare const failureMessage: (f: EmailFailure) => string;
+export type EmailFailure = "presend_check_failed" | "email_not_sent" | "not_signed_in" | "not_a_member" | "report_rejected" | "no_recipients" | "runner_not_emailed" | "emails_rejected" | "email_domain_not_allowed" | "admins_not_found" | "scan_limit_reached" | "network_error" | "unexpected_response";
+/** How long to wait, in plain words (rounded up to whole seconds, minutes or hours). */
+export declare function retryWait(ms: number): string;
+export declare const failureMessage: (f: EmailFailure, retryAfterMs?: number) => string;
 export declare const DRY_RUN_MSG = "Report email is in dry-run on this environment; nothing was sent.";
 export declare const UNAVAILABLE_MSG = "Report email is not available for this org yet; nothing was sent.";
 export declare class ReportEmailError extends Error {
@@ -121,6 +23,7 @@ export type EmailOutcome = {
 } | {
     status: "failed";
     reason: EmailFailure;
+    retryAfterMs?: number;
 };
 export interface ReportEmailDeps {
     post?: (endpoint: string, body: ReportEmailBody) => Promise<unknown>;

package/dist/lib/scan/report-email.js

@@ -12,102 +12,9 @@
  * Every failure has a fixed name and fixed text. The server's body, the thrown value and the
  * credential never reach the terminal.
  */
-import { randomUUID } from "node:crypto";
 import { MnemomApiError, postApi } from "../api.js";
-import { buildCostPerPr } from "./cost-per-pr.js";
-export const REPORT_SCHEMA_VERSION = "org-scan-report/1";
-export const ESTIMATE_NAME = "automatable_work_share";
-export const METHOD_URL = "https://www.mnemom.ai/org-scan-method";
-const cents = (usd) => Math.max(0, Math.round(usd * 100));
-/**
- * Maps the local scan onto the route's closed report shape. Team totals stay empty (they come only from
- * Anthropic usage, which the local scan does not carry). The estimate is the share of examined merged
- * PRs that finished with every CI check passing. `figure` (tier 3 range) is included only when the CLI
- * itself would let that line leave the machine (`sendSpendRange`).
- */
-export function buildEmailReport(result, o) {
-    const { totals, coverage } = result;
-    const value = totals.examined > 0 ? Math.round((totals.ciGreen / totals.examined) * 1000) / 10 : 0;
-    const scope = coverage.complete
-        ? "every merged pull request in the period"
-        : "a capped sample (not every merged pull request in the period)";
-    const unit = `percent of merged pull requests examined (${totals.examined} of ${totals.prs}, ${scope}) ` +
-        `that finished with all CI checks passing; an estimate from pull request metadata, not a measured share`;
-    const byTool = result.spend.kind === "range"
-        ? Object.entries(result.spend.byTool)
-            .filter(([, n]) => typeof n === "number" && n > 0)
-            .map(([tool, count]) => ({ tool, count: count }))
-        : [];
-    // Only a scan that read every merged PR in the period gives an average that means anything.
-    const exhaustive = coverage.complete && coverage.prsSkippedLarge === 0 && coverage.prsUnreadable === 0;
-    const cost = buildCostPerPr(result.prSizes, o.period ?? { start: coverage.windowStart, end: coverage.windowEnd }, o.costSpend ?? null, exhaustive);
-    const byRepo = repoRows(result);
-    return {
-        schema_version: REPORT_SCHEMA_VERSION,
-        org_id: o.orgId,
-        scan_id: o.scanId ?? randomUUID(),
-        // The span the scan actually examined (coverage), never the requested period: with no --period
-        // that defaults to today..today, which is not what was read.
-        period: { start: coverage.windowStart, end: coverage.windowEnd },
-        generated_at: new Date(o.now()).toISOString(),
-        measured: {
-            teams: [],
-            summary: {
-                pr_count: totals.prs,
-                revert_count: totals.reverts,
-                automatable_count: totals.ciGreen,
-                examined_count: totals.examined,
-                tokens_total: 0,
-            },
-            spend: {
-                source: "pr_estimate",
-                ...(o.sendSpendRange && result.spend.kind === "range"
-                    ? {
-                        figure: {
-                            low_cents: cents(result.spend.lowUsd),
-                            high_cents: cents(result.spend.highUsd),
-                        },
-                    }
-                    : {}),
-                ...(o.sendSpendRange && byTool.length > 0 ? { ai_prs_by_tool: byTool } : {}),
-            },
-        },
-        estimate: { name: ESTIMATE_NAME, value, unit, method_url: METHOD_URL },
-        ...cost,
-        ...(byRepo.length > 0 ? { by_repo: byRepo } : {}),
-    };
-}
-const MAX_REPOS = 500;
-const REPO_NAME = /^[A-Za-z0-9._-]{1,100}\/[A-Za-z0-9._-]{1,100}$/;
-/** The per-repo rows for the report: valid names only, each once (any case), busiest first, at most 500. */
-function repoRows(result) {
-    const seen = new Set();
-    return [...result.byRepo]
-        .sort((a, b) => b.prs - a.prs || a.repo.localeCompare(b.repo))
-        .filter((r) => {
-        const k = r.repo.toLowerCase();
-        if (!REPO_NAME.test(r.repo) || seen.has(k))
-            return false;
-        seen.add(k);
-        return true;
-    })
-        .slice(0, MAX_REPOS)
-        .map((r) => ({
-        repo: r.repo,
-        pr_count: r.prs,
-        revert_count: r.reverts,
-        automatable_count: r.ciGreen,
-        examined_count: r.examined,
-    }));
-}
-export function buildEmailBody(report, level, complete, extraEmails = []) {
-    return {
-        report,
-        share_level: level,
-        coverage: { complete },
-        ...(extraEmails.length > 0 ? { emails: extraEmails } : {}),
-    };
-}
+// The report body is built by the shared core (MNE-9752), so the Mnemom-side run sends the same report.
+export { REPORT_SCHEMA_VERSION, ESTIMATE_NAME, METHOD_URL, buildEmailReport, buildEmailBody, } from "../../vendor/shared/org-scan-core/report-build.js";
 const FAILURE_TEXT = {
     presend_check_failed: "the report failed Mnemom's pre-send checks, so no email was sent.",
     email_not_sent: "Mnemom could not send the email.",
@@ -119,10 +26,26 @@ const FAILURE_TEXT = {
     emails_rejected: "an address you added was not accepted. Add up to 10 valid email addresses.",
     email_domain_not_allowed: "an address you added is not on your organization's email domain. Add addresses on your own domain or mnemom.ai.",
     admins_not_found: "Mnemom could not look up your org admins, so no email was sent. Try again in a moment.",
+    scan_limit_reached: "the scan limit was reached, so no email was sent.",
     network_error: "Mnemom could not be reached.",
     unexpected_response: "Mnemom answered in an unexpected way.",
 };
-export const failureMessage = (f) => `Your report was NOT emailed: ${f}. ${FAILURE_TEXT[f]}`;
+/** How long to wait, in plain words (rounded up to whole seconds, minutes or hours). */
+export function retryWait(ms) {
+    const s = Math.max(1, Math.ceil(ms / 1000));
+    if (s < 60)
+        return `${s} second${s === 1 ? "" : "s"}`;
+    const m = Math.ceil(s / 60);
+    if (m < 120)
+        return `${m} minute${m === 1 ? "" : "s"}`;
+    const h = Math.ceil(m / 60);
+    return `${h} hour${h === 1 ? "" : "s"}`;
+}
+export const failureMessage = (f, retryAfterMs) => f === "scan_limit_reached"
+    ? `Your report was NOT emailed: ${f}. ${FAILURE_TEXT[f]} ${retryAfterMs !== undefined
+        ? `Try again in about ${retryWait(retryAfterMs)}.`
+        : "Try again later."}`
+    : `Your report was NOT emailed: ${f}. ${FAILURE_TEXT[f]}`;
 export const DRY_RUN_MSG = "Report email is in dry-run on this environment; nothing was sent.";
 export const UNAVAILABLE_MSG = "Report email is not available for this org yet; nothing was sent.";
 export class ReportEmailError extends Error {
@@ -139,6 +62,8 @@ function classifyStatus(status) {
         return "not_signed_in";
     if (status === 403)
         return "not_a_member";
+    if (status === 429)
+        return "scan_limit_reached";
     if (status === 422)
         return "presend_check_failed";
     if (status === 502)
@@ -199,7 +124,10 @@ export async function sendReportEmail(orgId, body, deps = {}) {
                 return { status: "failed", reason: "admins_not_found" };
             if (e.effectiveStatus >= 400 && e.effectiveStatus < 500 && /runner/i.test(e.code ?? ""))
                 return { status: "failed", reason: "runner_not_emailed" };
-            return { status: "failed", reason: classifyStatus(e.effectiveStatus) };
+            const reason = classifyStatus(e.effectiveStatus);
+            return reason === "scan_limit_reached" && e.retryAfterMs !== undefined
+                ? { status: "failed", reason, retryAfterMs: e.retryAfterMs }
+                : { status: "failed", reason };
         }
         return { status: "failed", reason: "network_error" };
     }

package/dist/lib/scan/scan.d.ts

@@ -1,69 +1 @@
-/**
- * Local capped scan core. Port of the window path of runCappedScan (mnemom-api capped-scan.ts, PR #4208)
- * plus the spend estimate (#4222). Everything outside is injected (credential, PR source, clock), so the
- * core touches no network or disk, and the report exists only in memory.
- */
-import { type GitHubCredential } from "./credential.js";
-import { type ScanCaps, type StopReason } from "./caps.js";
-import { type FailureReason } from "./failure.js";
-import { type PrSource } from "./pr-source.js";
-import type { PrSize } from "./cost-per-pr.js";
-import { type SpendEstimate } from "./spend/spend-estimate.js";
-export interface ScanInput {
-    repos: string[];
-    /** Inclusive dates, YYYY-MM-DD. */
-    period: {
-        start: string;
-        end: string;
-    };
-}
-export interface ScanDeps {
-    credential: GitHubCredential;
-    prs?: PrSource;
-    fetchImpl?: typeof fetch;
-    now?: () => number;
-    caps?: Partial<ScanCaps>;
-}
-export interface Coverage {
-    complete: boolean;
-    stoppedBy: StopReason | null;
-    prsExamined: number;
-    prsSkippedLarge: number;
-    prsUnreadable: number;
-    reposRead: number;
-    reposTotal: number;
-    reads: number;
-    windowStart: string;
-    windowEnd: string;
-    /** Set only when the window held more merged PRs than the quota and an even sample was taken. */
-    windowSampledFrom?: number;
-}
-export interface RepoTotals {
-    repo: string;
-    prs: number;
-    reverts: number;
-    ciGreen: number;
-    /** PRs read and counted (not reverts, not skipped); the per-repo base of the CI-green share. */
-    examined: number;
-}
-export interface ScanResult {
-    coverage: Coverage;
-    totals: {
-        prs: number;
-        reverts: number;
-        ciGreen: number;
-        examined: number;
-    };
-    byRepo: RepoTotals[];
-    spend: SpendEstimate;
-    /** Every merged PR read in full (reverts and unreadable/oversize PRs excluded): merge day and size. In memory only. */
-    prSizes: PrSize[];
-}
-export type ScanOutcome = {
-    status: "done";
-    result: ScanResult;
-} | {
-    status: "withheld";
-    reason: FailureReason;
-};
-export declare function runLocalScan(deps: ScanDeps, input: ScanInput): Promise<ScanOutcome>;
+export * from "../../vendor/shared/org-scan-core/scan.js";