@mnemom/mnemom 0.17.38-next.1 → 0.17.38-next.2

package/dist/lib/scan/spend/prices.js

@@ -1,57 +1,2 @@
-// MNE-9268: public list prices for the AI coding tools the Tier-3 spend estimator can name.
-// Constants, not magic numbers: every row carries its source page and the date it was read.
-// USD per million tokens (input / output), standard (non-batch) list price. A band is the cheapest
-// and the dearest model a tool's coding agent plausibly runs on, so the estimate is a RANGE.
-// Re-read the pages and bump PRICES_AS_OF when they move; a stale price widens nothing silently,
-// it just shifts the range, which is why the date ships with the estimate's method text.
-export const PRICES_AS_OF = "2026-10-28";
-export const TOOL_PRICES = {
-    claude_code: {
-        source: "https://platform.claude.com/docs/en/about-claude/pricing",
-        low: { model: "Claude Sonnet 5.5", inputPerMTok: 2, outputPerMTok: 10 },
-        high: { model: "Claude Opus 5", inputPerMTok: 5, outputPerMTok: 25 },
-    },
-    codex: {
-        source: "https://developers.openai.com/api/docs/pricing",
-        low: { model: "gpt-5.3-codex (standard)", inputPerMTok: 1.75, outputPerMTok: 14 },
-        high: { model: "gpt-5.3-codex (fast)", inputPerMTok: 3.5, outputPerMTok: 28 },
-    },
-    gemini: {
-        source: "https://ai.google.dev/gemini-api/docs/pricing",
-        // Gemini 3.8 Flash is $0.75/$3.75 through 2026-12-31 and $1.50/$7.50 from 2027-01-01; the
-        // post-promotion price is used so the lower bound does not expire in two months.
-        low: { model: "Gemini 3.8 Flash (from 2027-01-01)", inputPerMTok: 1.5, outputPerMTok: 7.5 },
-        high: { model: "Gemini 3.1 Pro (prompts up to 200k)", inputPerMTok: 2, outputPerMTok: 12 },
-    },
-};
-/**
- * GitHub Copilot bills per premium request, not per token
- * (https://docs.github.com/en/copilot/concepts/billing/copilot-requests),
- * so it has no token price of its own. Its agent routes to the other vendors' models, so its band is
- * the union of the other three: cheapest low to dearest high. An assumption, stated here once.
- */
-export function copilotBand() {
-    const bands = Object.values(TOOL_PRICES);
-    const blend = (p) => p.inputPerMTok * INPUT_SHARE + p.outputPerMTok * (1 - INPUT_SHARE);
-    const low = bands.map((b) => b.low).sort((a, b) => blend(a) - blend(b))[0];
-    const high = bands.map((b) => b.high).sort((a, b) => blend(b) - blend(a))[0];
-    return {
-        low,
-        high,
-        source: "union of the claude_code, codex and gemini bands (per-request billing)",
-    };
-}
-/**
- * Share of billed tokens that are input (the rest output). Agent loops re-read large context and
- * write little, so input dominates. An ASSUMPTION used both to turn our known run cost into
- * tokens-per-line and to price those tokens for each tool; it cancels to first order when the
- * tool's input/output price ratio matches ours, and is the main source of the range's width.
- */
-export const INPUT_SHARE = 0.9;
-export function bandFor(tool) {
-    return tool === "copilot" ? copilotBand() : TOOL_PRICES[tool];
-}
-/** USD per token at the assumed input/output mix. */
-export function blendedUsdPerToken(p) {
-    return (p.inputPerMTok * INPUT_SHARE + p.outputPerMTok * (1 - INPUT_SHARE)) / 1_000_000;
-}
+// Moved to shared/org-scan-core (MNE-9752); vendored at cli/src/vendor/shared/org-scan-core. Re-exported so CLI imports stay put.
+export * from "../../../vendor/shared/org-scan-core/spend/prices.js";

package/dist/lib/scan/spend/spend-estimate.d.ts

@@ -1,30 +1 @@
-import { type AiTool } from "./prices.js";
-import { type TokenRate } from "./token-rate.js";
-/** AI-assisted PRs needed before a range is worth printing. */
-export declare const MIN_AI_PRS = 10;
-/** Per-PR input. `markText` is commit messages / PR body, read for tool marks and dropped. */
-export interface SpendPrInput {
-    additions: number;
-    deletions: number;
-    markText: string;
-    /** Tools already detected inside the PR source (so the body never leaves it). Wins over markText. */
-    tools?: AiTool[];
-}
-export type NoSpendReason = "too_few_ai_prs" | "no_rate" | "invalid_input";
-export type SpendEstimate = {
-    kind: "range";
-    lowUsd: number;
-    highUsd: number;
-    aiPrs: number;
-    scannedPrs: number;
-    byTool: Partial<Record<AiTool, number>>;
-    /** One line, labelled estimate, passes claim-lint. */
-    line: string;
-} | {
-    kind: "none";
-    reason: NoSpendReason;
-    aiPrs: number;
-    scannedPrs: number;
-    line: string;
-};
-export declare function estimateSpend(prs: unknown, rate?: TokenRate | null): SpendEstimate;
+export * from "../../../vendor/shared/org-scan-core/spend/spend-estimate.js";

package/dist/lib/scan/spend/spend-estimate.js

@@ -1,70 +1,2 @@
-// MNE-9268: Tier-3 spend RANGE estimator. Pure and in-memory: takes per-PR counts and mark text, returns
-// one labelled estimate line or an explicit "no estimate". Nothing is stored, fetched or logged.
-//
-// No line is produced when there are too few AI-assisted PRs to price (MIN_AI_PRS). That is a
-// data-sufficiency threshold on the evidence behind the range, nothing to do with how large a
-// reporting cohort is. Default-OFF behind ORG_SCAN_MODE via estimateSpendIfEnabled.
-import { AI_TOOLS, detectAiTools } from "./ai-tool-detect.js";
-import { PRICES_AS_OF, bandFor, blendedUsdPerToken } from "./prices.js";
-import { DERIVED_TOKEN_RATE } from "./token-rate.js";
-/** AI-assisted PRs needed before a range is worth printing. */
-export const MIN_AI_PRS = 10;
-/** Fixed strings only: a failure never carries input or an error message into the output. */
-const NONE_LINES = {
-    too_few_ai_prs: "No spend estimate: too few AI-assisted PRs in this scan to price a range.",
-    no_rate: "No spend estimate: the cost reference data is not sufficient to price a range.",
-    invalid_input: "No spend estimate: the PR counts could not be read.",
-};
-const isCount = (n) => typeof n === "number" && Number.isFinite(n) && n >= 0;
-function none(reason, aiPrs, scannedPrs) {
-    return { kind: "none", reason, aiPrs, scannedPrs, line: NONE_LINES[reason] };
-}
-function validPr(p) {
-    if (typeof p !== "object" || p === null)
-        return false;
-    const o = p;
-    return (isCount(o.additions) &&
-        isCount(o.deletions) &&
-        typeof o.markText === "string" &&
-        (o.tools === undefined ||
-            (Array.isArray(o.tools) && o.tools.every((t) => AI_TOOLS.includes(t)))));
-}
-/** Two significant figures so the range does not claim precision it lacks ($2.4, not $2; 0 stays $0). */
-function usd(n) {
-    return `$${n.toLocaleString("en-US", { maximumSignificantDigits: 2 })}`;
-}
-export function estimateSpend(prs, rate = DERIVED_TOKEN_RATE) {
-    if (!Array.isArray(prs))
-        return none("invalid_input", 0, 0);
-    const scanned = prs.length;
-    if (!prs.every(validPr))
-        return none("invalid_input", 0, scanned);
-    let aiPrs = 0;
-    let low = 0;
-    let high = 0;
-    const byTool = {};
-    for (const p of prs) {
-        const tools = p.tools ?? detectAiTools(p.markText);
-        if (tools.length === 0)
-            continue;
-        aiPrs += 1;
-        for (const t of tools)
-            byTool[t] = (byTool[t] ?? 0) + 1;
-        if (!rate)
-            continue;
-        const lines = p.additions + p.deletions;
-        // A PR carrying several marks is priced once, across the widest band of the tools named.
-        const bands = tools.map(bandFor);
-        const lo = Math.min(...bands.map((b) => blendedUsdPerToken(b.low)));
-        const hi = Math.max(...bands.map((b) => blendedUsdPerToken(b.high)));
-        low += lines * rate.low * lo;
-        high += lines * rate.high * hi;
-    }
-    if (aiPrs < MIN_AI_PRS)
-        return none("too_few_ai_prs", aiPrs, scanned);
-    if (!rate)
-        return none("no_rate", aiPrs, scanned);
-    const line = `Estimate, AI tool spend: ${usd(low)} to ${usd(high)} across ${aiPrs} AI-assisted PRs ` +
-        `(public list prices as of ${PRICES_AS_OF} times a tokens-per-line rate from our own agents' PRs; not billing data).`;
-    return { kind: "range", lowUsd: low, highUsd: high, aiPrs, scannedPrs: scanned, byTool, line };
-}
+// Moved to shared/org-scan-core (MNE-9752); vendored at cli/src/vendor/shared/org-scan-core. Re-exported so CLI imports stay put.
+export * from "../../../vendor/shared/org-scan-core/spend/spend-estimate.js";

package/dist/lib/scan/spend/spend-tiers.d.ts

@@ -1,4 +1,3 @@
-import type { SpendEstimate } from "./spend-estimate.js";
 export declare const ORG_SCAN_ENV = "MNEMOM_ORG_SCAN_MODE";
 /** Default OFF: only the exact string "true" turns the tiers on. */
 export declare const isSpendTiersEnabled: (env?: NodeJS.ProcessEnv) => boolean;
@@ -8,18 +7,4 @@ export declare const SPEND_NO_TERMINAL_MSG = "Pass --monthly-spend <usd> (there
 export declare const MAX_MONTHLY_SPEND_USD = 10000000;
 /** Dollars, or null if the text is not a positive, plausible amount. */
 export declare function parseMonthlySpendUsd(raw: string): number | null;
-export type SpendTier = 1 | 2 | 3;
-export interface SpendSelection {
-    /** null when the evidence is too thin: print nothing. */
-    tier: SpendTier | null;
-    line: string | null;
-    /** May this line leave the machine in a share payload? Never for a self-reported figure. */
-    shareable: boolean;
-}
-export declare function selectSpend(i: {
-    measuredUsd?: number;
-    /** Fraction of measured tokens from requests over 200k context; shown only with a measured figure. */
-    over200kShare?: number | null;
-    selfReportedUsd?: number | null;
-    estimate: SpendEstimate;
-}): SpendSelection;
+export { selectSpend, type SpendTier, type SpendSelection, } from "../../../vendor/shared/org-scan-core/spend/spend-select.js";

package/dist/lib/scan/spend/spend-tiers.js

@@ -1,3 +1,8 @@
+// MNE-9298: the CLI side of the spend tiers (env flag, typed figure). selectSpend is shared (MNE-9752).
+//   Tier 1  measured Anthropic usage the customer connected (a number handed in by the caller).
+//   Tier 2  a dollar figure the CTO gives; self-reported, labelled so, never sent or saved.
+//   Tier 3  the PR-size estimate range, only when the evidence behind it is enough.
+// With none of the three there is NO line: a number is never invented to fill the gap.
 export const ORG_SCAN_ENV = "MNEMOM_ORG_SCAN_MODE";
 /** Default OFF: only the exact string "true" turns the tiers on. */
 export const isSpendTiersEnabled = (env = process.env) => env[ORG_SCAN_ENV] === "true";
@@ -14,29 +19,4 @@ export function parseMonthlySpendUsd(raw) {
     const n = Number(t.replace(/[$,\s]/g, ""));
     return Number.isFinite(n) && n > 0 && n <= MAX_MONTHLY_SPEND_USD ? n : null;
 }
-const usd = (n) => `$${n.toLocaleString("en-US", { maximumFractionDigits: 2 })}`;
-const isUsd = (n) => typeof n === "number" && Number.isFinite(n) && n > 0;
-const pct = (f) => `${Math.round(f * 100)}%`;
-const isShare = (n) => typeof n === "number" && Number.isFinite(n) && n >= 0 && n <= 1;
-export function selectSpend(i) {
-    if (isUsd(i.measuredUsd)) {
-        return {
-            tier: 1,
-            line: `Tier 1, measured: ${usd(i.measuredUsd)} of Anthropic usage over the period${isShare(i.over200kShare)
-                ? ` (${pct(i.over200kShare)} of tokens in requests over 200k context)`
-                : ""}.`,
-            shareable: true,
-        };
-    }
-    if (isUsd(i.selfReportedUsd)) {
-        return {
-            tier: 2,
-            line: `Tier 2, self-reported: about ${usd(i.selfReportedUsd)} a month (given by you; not verified, not sent, not saved).`,
-            shareable: false,
-        };
-    }
-    if (i.estimate.kind === "range") {
-        return { tier: 3, line: `Tier 3, ${i.estimate.line}`, shareable: true };
-    }
-    return { tier: null, line: null, shareable: false };
-}
+export { selectSpend, } from "../../../vendor/shared/org-scan-core/spend/spend-select.js";

package/dist/lib/scan/spend/token-rate.d.ts

@@ -1,30 +1 @@
-/** Rows needed before the rate is trusted at all (data sufficiency, not a group size). */
-export declare const MIN_CORPUS_ROWS = 5;
-export interface CostRowShape {
-    repo: string;
-    pr: number;
-    additions: number;
-    deletions: number;
-    cost_usd: number;
-    runs: number;
-    models: string[];
-}
-export interface TokenRate {
-    /** Price-equivalent tokens per changed (added + deleted) line: 25th percentile. */
-    low: number;
-    median: number;
-    /** 75th percentile. */
-    high: number;
-    rows: number;
-}
-/** Linear-interpolated quantile of a sorted array. */
-export declare function quantile(sorted: number[], q: number): number;
-/**
- * Derive the rate from corpus rows: per-row tokens/line, then the 25th, 50th and 75th percentile.
- * Rows that fail validation are dropped (not repaired); fewer than MIN_CORPUS_ROWS valid rows
- * returns null, never a rate built on a handful.
- */
-export declare function deriveTokenRate(rows: unknown): TokenRate | null;
-export declare const CORPUS_AS_OF: string;
-/** The shipped rate: derived once from the committed fixture. */
-export declare const DERIVED_TOKEN_RATE: TokenRate | null;
+export * from "../../../vendor/shared/org-scan-core/spend/token-rate.js";

package/dist/lib/scan/spend/token-rate.js

@@ -1,54 +1,2 @@
-// MNE-9268: tokens-per-changed-line and its spread, DERIVED from our own agents' PRs whose run cost is
-// known (cost-corpus.v1.json, built by build-cost-corpus.mjs from the ADW "Run cost" PR comments).
-// Nothing here is a typed-in rate: change the fixture and the rate moves, and token-rate.test.ts pins
-// the derivation. Tokens are price-equivalent: cost / (our model's blended list price per token).
-import rawCorpus from "./cost-corpus.v1.js";
-import { TOOL_PRICES, blendedUsdPerToken } from "./prices.js";
-/** Rows needed before the rate is trusted at all (data sufficiency, not a group size). */
-export const MIN_CORPUS_ROWS = 5;
-/** Our agents ran on Sonnet-family models in every corpus row; price their tokens as that. */
-const BASIS_USD_PER_TOKEN = blendedUsdPerToken(TOOL_PRICES.claude_code.low);
-const isCount = (n) => typeof n === "number" && Number.isFinite(n) && n >= 0;
-function validRow(r) {
-    if (typeof r !== "object" || r === null)
-        return false;
-    const o = r;
-    return (isCount(o.additions) &&
-        isCount(o.deletions) &&
-        o.additions + o.deletions > 0 &&
-        isCount(o.cost_usd) &&
-        o.cost_usd > 0);
-}
-/** Linear-interpolated quantile of a sorted array. */
-export function quantile(sorted, q) {
-    if (sorted.length === 0)
-        return NaN;
-    const pos = (sorted.length - 1) * q;
-    const lo = Math.floor(pos);
-    const hi = Math.ceil(pos);
-    return sorted[lo] + (sorted[hi] - sorted[lo]) * (pos - lo);
-}
-/**
- * Derive the rate from corpus rows: per-row tokens/line, then the 25th, 50th and 75th percentile.
- * Rows that fail validation are dropped (not repaired); fewer than MIN_CORPUS_ROWS valid rows
- * returns null, never a rate built on a handful.
- */
-export function deriveTokenRate(rows) {
-    if (!Array.isArray(rows))
-        return null;
-    const per = rows
-        .filter(validRow)
-        .map((r) => r.cost_usd / (r.additions + r.deletions) / BASIS_USD_PER_TOKEN)
-        .sort((a, b) => a - b);
-    if (per.length < MIN_CORPUS_ROWS)
-        return null;
-    return {
-        low: quantile(per, 0.25),
-        median: quantile(per, 0.5),
-        high: quantile(per, 0.75),
-        rows: per.length,
-    };
-}
-export const CORPUS_AS_OF = rawCorpus.as_of;
-/** The shipped rate: derived once from the committed fixture. */
-export const DERIVED_TOKEN_RATE = deriveTokenRate(rawCorpus.rows);
+// Moved to shared/org-scan-core (MNE-9752); vendored at cli/src/vendor/shared/org-scan-core. Re-exported so CLI imports stay put.
+export * from "../../../vendor/shared/org-scan-core/spend/token-rate.js";

package/dist/vendor/shared/org-scan-core/caps.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Coverage caps and sampling. Port of mnemom-api src/org-scan/scan/capped-scan.ts (PR #4208).
+ *
+ * Coverage decision (Shraddha, 2026-10-28): each scan covers the last 3 months OR the last 2,000 merged
+ * PRs, whichever is MORE; above 2,000 in the window, an even deterministic sample of 2,000.
+ */
+export declare const COVERAGE_MONTHS = 3;
+export interface ScanCaps {
+    maxPrs: number;
+    /** A PR with more additions+deletions than this is skipped, never read in full. */
+    maxPrSizeLines: number;
+    /** Upstream read calls. */
+    maxReads: number;
+    /** Wall-clock budget. */
+    maxMillis: number;
+}
+export declare const DEFAULT_SCAN_CAPS: ScanCaps;
+export type StopReason = "pr-cap" | "read-cap" | "time-cap";
+/** The day `months` calendar months before `end` (YYYY-MM-DD, UTC), clamped to the month's last day. */
+export declare function monthsBefore(end: string, months: number): string;
+/** `k` items spread evenly across `items` (order kept): index floor(i*n/k). Deterministic; n <= k returns all. */
+export declare function evenSample<T>(items: readonly T[], k: number): T[];
+export declare function sanitiseCaps(c: Partial<ScanCaps>): ScanCaps;
+/** Running read budget. Every call is told how many reads it may spend (`room`). */
+export declare class Budget {
+    private caps;
+    private now;
+    private startedAt;
+    reads: number;
+    constructor(caps: ScanCaps, now: () => number, startedAt: number);
+    block(n?: number): StopReason | null;
+    room(): number;
+    overrun(): StopReason | null;
+    charge(n: number): void;
+}

package/dist/vendor/shared/org-scan-core/caps.js

@@ -0,0 +1,68 @@
+// GENERATED from shared/org-scan-core/src/caps.ts by cli/scripts/sync-org-scan-core.mjs; do not edit.
+/**
+ * Coverage caps and sampling. Port of mnemom-api src/org-scan/scan/capped-scan.ts (PR #4208).
+ *
+ * Coverage decision (Shraddha, 2026-10-28): each scan covers the last 3 months OR the last 2,000 merged
+ * PRs, whichever is MORE; above 2,000 in the window, an even deterministic sample of 2,000.
+ */
+export const COVERAGE_MONTHS = 3;
+export const DEFAULT_SCAN_CAPS = {
+    maxPrs: 2_000,
+    maxPrSizeLines: 20_000,
+    maxReads: 4_500,
+    maxMillis: 15 * 60_000,
+};
+/** The day `months` calendar months before `end` (YYYY-MM-DD, UTC), clamped to the month's last day. */
+export function monthsBefore(end, months) {
+    const [y, m, d] = end.split("-").map(Number);
+    const target = new Date(Date.UTC(y, m - 1 - months, 1));
+    const last = new Date(Date.UTC(target.getUTCFullYear(), target.getUTCMonth() + 1, 0)).getUTCDate();
+    target.setUTCDate(Math.min(d, last));
+    return target.toISOString().slice(0, 10);
+}
+/** `k` items spread evenly across `items` (order kept): index floor(i*n/k). Deterministic; n <= k returns all. */
+export function evenSample(items, k) {
+    const n = items.length;
+    if (n <= k)
+        return [...items];
+    return Array.from({ length: k }, (_, i) => items[Math.floor((i * n) / k)]);
+}
+export function sanitiseCaps(c) {
+    const pos = (n, d) => typeof n === "number" && Number.isFinite(n) && n > 0 ? Math.floor(n) : d;
+    return {
+        maxPrs: pos(c.maxPrs, DEFAULT_SCAN_CAPS.maxPrs),
+        maxPrSizeLines: pos(c.maxPrSizeLines, DEFAULT_SCAN_CAPS.maxPrSizeLines),
+        maxReads: pos(c.maxReads, DEFAULT_SCAN_CAPS.maxReads),
+        maxMillis: pos(c.maxMillis, DEFAULT_SCAN_CAPS.maxMillis),
+    };
+}
+/** Running read budget. Every call is told how many reads it may spend (`room`). */
+export class Budget {
+    caps;
+    now;
+    startedAt;
+    reads = 0;
+    constructor(caps, now, startedAt) {
+        this.caps = caps;
+        this.now = now;
+        this.startedAt = startedAt;
+    }
+    block(n = 1) {
+        if (this.now() - this.startedAt >= this.caps.maxMillis)
+            return "time-cap";
+        if (this.reads + n > this.caps.maxReads)
+            return "read-cap";
+        return null;
+    }
+    room() {
+        if (this.now() - this.startedAt >= this.caps.maxMillis)
+            return 0;
+        return Math.max(0, this.caps.maxReads - this.reads);
+    }
+    overrun() {
+        return this.reads > this.caps.maxReads ? "read-cap" : null;
+    }
+    charge(n) {
+        this.reads += n;
+    }
+}

package/dist/vendor/shared/org-scan-core/cost-per-pr.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Cost per merged PR and cost by PR size, for the Org Scan report. Pure: numbers in, numbers out.
+ *
+ * Source of the spend. Measured per-request cost cannot be tied to a PR with the data the scan has:
+ * the Anthropic usage reads return one whole-org total (no per-request or per-PR rows) and the Mnemom
+ * Record totals are one window sum (model cost and a request count, no PR key). So every figure here is
+ * `label: "estimate"`: the period's spend split across the merged PRs in proportion to lines changed.
+ * Each figure names the spend it was split from (`spend_source`); sources are never mixed in one report.
+ *
+ *   anthropic_usage          the whole-org Anthropic cost for the period (the CTO's admin key)
+ *   modelled_range           our modelled estimate (a low to high range, so the figures are ranges)
+ *
+ * Size is per PR, in lines changed = additions + deletions, exactly as GitHub reports them. Lockfiles and
+ * generated files are NOT excluded. small < 50; medium 50..500 inclusive; large > 500.
+ *
+ * Each size figure is the average cost of ONE PR of that size: spend * (mean lines of the bucket) /
+ * (total lines of the PRs in scope). Scope: the modelled estimate prices AI-assisted PRs only, so it is
+ * split across those only (`pr_scope: "ai_assisted"`, buckets too); the others use every merged PR
+ * (`pr_scope: "all_merged"`). `pr_count` counts PRs in that scope. Usage-key figures also carry
+ * `spend_scope: "whole_org"` (the key covers the whole organization, not just the scanned repos). The cost per merged PR is the spend over the count of merged PRs.
+ *
+ * Missing data is an absent field, never 0 or NaN: no usable spend, zero merged PRs in the period, an
+ * empty bucket, a scan that did not read every merged PR in the period, or a result past safe-integer
+ * range. Reverts are listed without sizes, so they are not counted as merged PRs here.
+ */
+import type { SpendEstimate } from "./spend/spend-estimate.js";
+/** Strictly below this is small. 50 is medium. */
+export declare const SMALL_MAX_EXCLUSIVE = 50;
+/** At or below this (and not small) is medium. 500 is medium; 501 is large. */
+export declare const MEDIUM_MAX_INCLUSIVE = 500;
+export type SizeBucket = "small" | "medium" | "large";
+export type CostSpendSourceName = "anthropic_usage" | "modelled_range";
+export interface PrSize {
+    /** YYYY-MM-DD, UTC. */
+    mergedDay: string;
+    /** additions + deletions. */
+    lines: number;
+    /** The PR carries an AI-tool mark (the same rule the modelled spend uses to count AI-assisted PRs). */
+    aiAssisted: boolean;
+}
+/** Where the spend comes from. USD, never cents. */
+export type CostSpend = {
+    source: "anthropic_usage";
+    usd: number;
+} | {
+    source: "modelled_range";
+    lowUsd: number;
+    highUsd: number;
+};
+/** One figure: a single value, or a low to high range for the modelled source. Integer cents. */
+export type PrScope = "ai_assisted" | "all_merged";
+export type CostFigure = {
+    /** "measured" is not possible with current data (see header); every figure is an estimate. */
+    label: "estimate";
+    spend_source: CostSpendSourceName;
+    /**
+     * Which PRs the average is over. The modelled estimate prices AI-assisted PRs only, so it is split
+     * across those only ("ai_assisted"); the usage key covers all spend, so they use "all_merged".
+     */
+    pr_scope: PrScope;
+    /** PRs in that scope. */
+    pr_count: number;
+    /** Present on anthropic_usage only: the key's usage is the whole organization's, not just these PRs'. */
+    spend_scope?: "whole_org";
+} & ({
+    value_cents: number;
+} | {
+    low_cents: number;
+    high_cents: number;
+});
+export interface CostPerPr {
+    cost_per_merged_pr?: CostFigure;
+    cost_by_pr_size?: Partial<Record<SizeBucket, CostFigure>>;
+}
+export declare const sizeBucket: (lines: number) => SizeBucket;
+/** Inclusive day count of YYYY-MM-DD..YYYY-MM-DD, or null if unparsable or reversed. */
+export declare function periodDays(p: {
+    start: string;
+    end: string;
+}): number | null;
+/** The period's spend in USD as [low, high]; null when there is no usable spend. */
+export declare function spendForPeriod(spend: CostSpend): [number, number] | null;
+/** The modelled estimate as a spend source, or null when the estimate is "none". */
+export declare const modelledSpend: (e: SpendEstimate) => CostSpend | null;
+/**
+ * @param prs           every merged PR the scan read, with merge day and size
+ * @param exhaustive    true only if the scan read EVERY merged PR in the period (no sample, no skipped
+ *                      large PR, none unreadable, no cap hit). Otherwise the average is not defined.
+ */
+export declare function buildCostPerPr(prs: readonly PrSize[] | undefined, period: {
+    start: string;
+    end: string;
+}, spend: CostSpend | null, exhaustive: boolean): CostPerPr;

package/dist/vendor/shared/org-scan-core/cost-per-pr.js

@@ -0,0 +1,101 @@
+/** Strictly below this is small. 50 is medium. */
+export const SMALL_MAX_EXCLUSIVE = 50;
+/** At or below this (and not small) is medium. 500 is medium; 501 is large. */
+export const MEDIUM_MAX_INCLUSIVE = 500;
+export const sizeBucket = (lines) => lines < SMALL_MAX_EXCLUSIVE ? "small" : lines <= MEDIUM_MAX_INCLUSIVE ? "medium" : "large";
+const DAY_MS = 86_400_000;
+/** Inclusive day count of YYYY-MM-DD..YYYY-MM-DD, or null if unparsable or reversed. */
+export function periodDays(p) {
+    const s = Date.parse(`${p.start}T00:00:00Z`);
+    const e = Date.parse(`${p.end}T00:00:00Z`);
+    if (!Number.isFinite(s) || !Number.isFinite(e) || e < s)
+        return null;
+    return Math.round((e - s) / DAY_MS) + 1;
+}
+const pos = (n) => typeof n === "number" && Number.isFinite(n) && n > 0;
+/** The period's spend in USD as [low, high]; null when there is no usable spend. */
+export function spendForPeriod(spend) {
+    let r;
+    if (spend.source === "anthropic_usage") {
+        if (!pos(spend.usd))
+            return null;
+        r = [spend.usd, spend.usd];
+    }
+    else {
+        if (!pos(spend.highUsd) || !(spend.lowUsd >= 0) || spend.lowUsd > spend.highUsd)
+            return null;
+        r = [spend.lowUsd, spend.highUsd];
+    }
+    return r.every((x) => Number.isFinite(x) && x * 100 <= Number.MAX_SAFE_INTEGER) ? r : null;
+}
+/** The modelled estimate as a spend source, or null when the estimate is "none". */
+export const modelledSpend = (e) => e.kind === "range" ? { source: "modelled_range", lowUsd: e.lowUsd, highUsd: e.highUsd } : null;
+/**
+ * `share` is the fraction of the period's spend one average PR here carries: always in (0, 1] by
+ * construction, and the spend is already bounded to safe-integer cents by spendForPeriod, so the
+ * rounded cents are finite safe integers without a further guard.
+ */
+function figure(spend, [low, high], count, share, scope) {
+    const c = (usd) => Math.round(usd * share * 100);
+    const base = {
+        label: "estimate",
+        spend_source: spend.source,
+        pr_scope: scope,
+        pr_count: count,
+        ...(spend.source === "anthropic_usage" ? { spend_scope: "whole_org" } : {}),
+    };
+    return spend.source === "modelled_range"
+        ? { ...base, low_cents: c(low), high_cents: c(high) }
+        : { ...base, value_cents: c(low) };
+}
+/**
+ * @param prs           every merged PR the scan read, with merge day and size
+ * @param exhaustive    true only if the scan read EVERY merged PR in the period (no sample, no skipped
+ *                      large PR, none unreadable, no cap hit). Otherwise the average is not defined.
+ */
+export function buildCostPerPr(prs, period, spend, exhaustive) {
+    if (!exhaustive || !spend || !Array.isArray(prs))
+        return {};
+    if (periodDays(period) === null)
+        return {};
+    const total = spendForPeriod(spend);
+    if (!total)
+        return {};
+    const inPeriod = prs.filter((p) => p.mergedDay >= period.start &&
+        p.mergedDay <= period.end &&
+        Number.isSafeInteger(p.lines) &&
+        p.lines >= 0);
+    // The modelled estimate is AI-tool spend, so it is split across AI-assisted PRs only; the usage key is
+    // the whole spend, so it is split across every merged PR.
+    const scope = spend.source === "modelled_range" ? "ai_assisted" : "all_merged";
+    const scoped = scope === "ai_assisted" ? inPeriod.filter((p) => p.aiAssisted) : inPeriod;
+    const n = scoped.length;
+    if (n === 0)
+        return {};
+    const out = {};
+    out.cost_per_merged_pr = figure(spend, total, n, 1 / n, scope);
+    let allLines = 0;
+    const agg = {
+        small: { n: 0, lines: 0 },
+        medium: { n: 0, lines: 0 },
+        large: { n: 0, lines: 0 },
+    };
+    for (const p of scoped) {
+        allLines += p.lines;
+        const a = agg[sizeBucket(p.lines)];
+        a.n += 1;
+        a.lines += p.lines;
+    }
+    // Splitting by lines needs lines: with none (or a sum past safe range) there is no size figure.
+    if (allLines <= 0 || !Number.isSafeInteger(allLines))
+        return out;
+    const bySize = {};
+    for (const b of ["small", "medium", "large"]) {
+        const a = agg[b];
+        if (a.n === 0)
+            continue;
+        bySize[b] = figure(spend, total, a.n, a.lines / a.n / allLines, scope);
+    }
+    out.cost_by_pr_size = bySize;
+    return out;
+}