@mnemom/mnemom 0.17.38-next.1 → 0.17.38-next.3

package/dist/commands/agent-run.d.ts

@@ -8,7 +8,9 @@
  * errors exit 2 with no outcome line; every outcome line goes to stdout, every log to stderr.
  *
  * The GitHub token (GH_TOKEN, GITHUB_TOKEN, else `gh auth token`) is the runner's own: it reaches
- * git only through GIT_CONFIG_* env (never argv) and the phases never see it (phaseEnv).
+ * git only through GIT_CONFIG_* env (never argv) and the phases never see it (phaseEnv). Under
+ * --oidc the PR is pushed and opened with the job's PR token instead (ruling 34.34): the api's
+ * Record App token for the seal's repo, fetched with the lease key, carried the same way.
  *
  * So is the Anthropic key (ruling 34.30.1): the phases' model calls are billed to the runner's own
  * ANTHROPIC_API_KEY, which only the model proxy holds and sets on each upstream request. A runner
@@ -35,7 +37,9 @@ export interface RunDeps {
     stop: AbortSignal;
     /** The text of this host's executor-state.json, or null when there is none. */
     readExecutorState?(): Promise<string | null>;
-    jobDeps(api: RunnerApi, executorId: string | null, github: GithubBases, modelKey: string): JobDeps;
+    jobDeps(api: RunnerApi, executorId: string | null, github: GithubBases, modelKey: string, 
+    /** True under --oidc: the job opens its PR with the api's PR token (ruling 34.34). */
+    prTokenFromLease: boolean): JobDeps;
 }
 /** The refusal of a runner with no ANTHROPIC_API_KEY (34.30.1); a config error, exit 2. */
 export declare const RUNNER_MODEL_KEY_MISSING = "runner_model_key_missing";
@@ -78,6 +82,10 @@ export declare function liveJobDeps(api: RunnerApi, opts: {
     executorId: string | null;
     github: GithubBases;
     modelKey: string;
+    /** The credential is the --oidc exchange: the PR uses the job's PR token (ruling 34.34). */
+    prTokenFromLease?: boolean;
+    /** The git runner for an env; tests inject one to see which credentials a push carries. */
+    makeGit?: (env: NodeJS.ProcessEnv) => Git;
 }): JobDeps;
 /** The process wiring: signals, stdout and stderr. Resolves the exit code. */
 export declare function runAgentRun(flags: RunFlags): Promise<number>;

package/dist/commands/agent-run.js

@@ -8,7 +8,9 @@
  * errors exit 2 with no outcome line; every outcome line goes to stdout, every log to stderr.
  *
  * The GitHub token (GH_TOKEN, GITHUB_TOKEN, else `gh auth token`) is the runner's own: it reaches
- * git only through GIT_CONFIG_* env (never argv) and the phases never see it (phaseEnv).
+ * git only through GIT_CONFIG_* env (never argv) and the phases never see it (phaseEnv). Under
+ * --oidc the PR is pushed and opened with the job's PR token instead (ruling 34.34): the api's
+ * Record App token for the seal's repo, fetched with the lease key, carried the same way.
  *
  * So is the Anthropic key (ruling 34.30.1): the phases' model calls are billed to the runner's own
  * ANTHROPIC_API_KEY, which only the model proxy holds and sets on each upstream request. A runner
@@ -90,8 +92,13 @@ export async function agentRunCommand(flags, deps) {
         executorId = executorIdFromState(await deps.readExecutorState(), executorKey) ?? executorId;
     }
     const api = runnerApi({ apiUrl: deps.apiUrl, executorKey, fetch: deps.fetch });
-    const loop = { failMode: plan.failMode, stop: deps.stop, emit: deps.emit };
-    const job = deps.jobDeps(api, executorId, gh.bases, modelKey);
+    const loop = {
+        failMode: plan.failMode,
+        stop: deps.stop,
+        emit: deps.emit,
+        ...(plan.sessionId !== undefined ? { sessionId: plan.sessionId } : {}),
+    };
+    const job = deps.jobDeps(api, executorId, gh.bases, modelKey, plan.credential.kind === "oidc");
     return plan.form === "once" ? runOnce(job, loop) : runWatch(job, loop);
 }
 // ── GitHub and git, for the live driver ──────────────────────────────────────
@@ -259,7 +266,10 @@ export function runPhaseProcess(inv, ws, modelUrl, signal, parentEnv = process.e
 export function liveJobDeps(api, opts) {
     const gh = opts.github;
     const token = resolveGithubToken(opts.env);
-    const git = liveGit(gitAuthEnv(opts.env, token, gh.web));
+    const makeGit = opts.makeGit ?? liveGit;
+    const git = makeGit(gitAuthEnv(opts.env, token, gh.web));
+    // The PR token's git: a fresh env, so its header replaces the runner token's, never adds to it.
+    const gitFor = (t) => t === null ? git : makeGit(gitAuthEnv(opts.env, t, gh.web));
     return {
         api,
         executorId: opts.executorId,
@@ -272,11 +282,12 @@ export function liveJobDeps(api, opts) {
         startProxy: (state) => startModelProxy(`${getGatewayUrl()}/anthropic`, state, opts.modelKey),
         prepareWorkspace: (repo, sessionId) => prepareWorkspace(git, `${gh.web}/${repo}.git`, sessionId),
         runPhase: (inv, ws, modelUrl, signal) => runPhaseProcess(inv, ws, modelUrl, signal, opts.env),
-        openPr: (repo, ws, title, body) => openPr(git, opts.fetch, token, repo, ws, title, body, gh.api),
+        openPr: (repo, ws, title, body, prToken) => openPr(gitFor(prToken), opts.fetch, prToken ?? token, repo, ws, title, body, gh.api),
         commitsAhead: (ws) => commitsAhead(git, ws),
         headSha: (ws) => headSha(git, ws),
         commitBodies: (ws, since, lineageKey, repo) => commitBodies(git, ws, since, lineageKey, repo),
-        enableAutoMerge: (prUrl) => enableAutoMerge(opts.fetch, token, prUrl, gh),
+        enableAutoMerge: (prUrl, prToken) => enableAutoMerge(opts.fetch, prToken ?? token, prUrl, gh),
+        prTokenFromLease: opts.prTokenFromLease === true,
         cleanup: cleanupWorkspace,
     };
 }
@@ -296,7 +307,7 @@ export function runAgentRun(flags) {
         err: (line) => process.stderr.write(`${line}\n`),
         stop: stop.signal,
         readExecutorState: () => readFile(executorStatePath(homedir()), "utf8").catch(() => null),
-        jobDeps: (api, executorId, github, modelKey) => liveJobDeps(api, { fetch, env: process.env, executorId, github, modelKey }),
+        jobDeps: (api, executorId, github, modelKey, prTokenFromLease) => liveJobDeps(api, { fetch, env: process.env, executorId, github, modelKey, prTokenFromLease }),
     }).finally(() => {
         process.off("SIGTERM", onSignal);
         process.off("SIGINT", onSignal);

package/dist/commands/scan.d.ts

@@ -10,7 +10,7 @@ import { selectSpend } from "../lib/scan/spend/spend-tiers.js";
 import { type AnthropicUsageDeps, type MeasuredUsage } from "../lib/scan/spend/anthropic-usage.js";
 import { type WifDeps } from "../lib/scan/spend/anthropic-wif.js";
 import { type RecordDeps, type RecordOutcome } from "../lib/scan/record.js";
-import { type CostSpend } from "../lib/scan/cost-per-pr.js";
+import type { CostSpend } from "../lib/scan/cost-per-pr.js";
 import { type ReportEmailDeps } from "../lib/scan/report-email.js";
 import { type RepoListDeps } from "../lib/scan/repo-picker.js";
 export interface ScanCommandOptions {

package/dist/commands/scan.js

@@ -15,7 +15,7 @@ import { getAuthInfo } from "../lib/auth.js";
 import { listMyOrgs } from "../lib/api.js";
 import { getActiveOrg } from "../lib/cli-config.js";
 import { fetchRecordTotals, isOrgId, } from "../lib/scan/record.js";
-import { modelledSpend } from "../lib/scan/cost-per-pr.js";
+import { costSpendFor, sendsSpendRange } from "../vendor/shared/org-scan-core/report-build.js";
 import { RECORD_NO_ORG_NOTE, renderRecordSection } from "../lib/scan/report.js";
 import { buildEmailBody, buildEmailReport, DRY_RUN_MSG, UNAVAILABLE_MSG, failureMessage, ReportEmailError, sendReportEmail, } from "../lib/scan/report-email.js";
 import { pickRepos, REPO_PICKER_NO_TERMINAL_HINT, } from "../lib/scan/repo-picker.js";
@@ -110,15 +110,8 @@ export async function resolveSelfReportedSpend(o) {
  * tiers off) the modelled range. Sources are never mixed.
  */
 export function resolveCostSpend(o, result, spend, measured) {
-    if (spend === null)
-        return modelledSpend(result.spend);
-    if (spend.tier === 1) {
-        const usd = measured?.usd ?? o.anthropicUsageUsd;
-        return typeof usd === "number" ? { source: "anthropic_usage", usd } : null;
-    }
-    if (spend.tier === 2)
-        return null;
-    return spend.tier === 3 ? modelledSpend(result.spend) : null;
+    // Shared with the Mnemom-side run (MNE-9752): same spend source, same cost figures.
+    return costSpendFor(result, spend, measured?.usd ?? o.anthropicUsageUsd);
 }
 export const NO_ADMIN_KEY_TERMINAL_MSG = "Set ANTHROPIC_ADMIN_KEY (there is no terminal to ask on).";
 export const TIER1_FALLBACK_NOTE = "Tier 1 skipped: falling back to the next tier.";
@@ -353,21 +346,21 @@ export async function scanCommand(o) {
  * returns it so the caller exits non-zero after the local report is shown.
  */
 async function emailReport(o, org, result, level, spend, period, costSpend, extraEmails) {
-    const fail = (f) => {
-        console.log(failureMessage(f));
+    const fail = (f, retryAfterMs) => {
+        console.log(failureMessage(f, retryAfterMs));
         return f;
     };
     const report = buildEmailReport(result, {
         orgId: org,
         now: o.now ?? Date.now,
-        sendSpendRange: spend ? spend.shareable && spend.tier === 3 : true,
+        sendSpendRange: sendsSpendRange(spend),
         period,
         costSpend,
     });
     const body = buildEmailBody(report, level, result.coverage.complete, extraEmails);
     const outcome = await sendReportEmail(org, body, o.emailDeps);
     if (outcome.status === "failed")
-        return fail(outcome.reason);
+        return fail(outcome.reason, outcome.retryAfterMs);
     if (outcome.status === "unavailable") {
         // Org Scan is off by default: the gate's 404 is not a failure and must not break the scan.
         console.log(UNAVAILABLE_MSG);

package/dist/index.js

@@ -1220,6 +1220,7 @@ agentCmd
     .option("--fail-mode <mode>", "closed (default) or open; also MNEMOM_RUNNER_FAIL_MODE")
     .option("--json", "Print only outcome lines on stdout; logs go to stderr")
     .option("--oidc", "With --once: exchange the GitHub Actions ID token for a one-job key")
+    .option("--session <uuid>", "With --once: claim only this session (a wake-up's own); never take another from the pool")
     .hook("preAction", () => requireExperimental("`mnemom agent run`", "dispatch"))
     .action(async (opts) => {
     process.exitCode = await runAgentRun(opts);

package/dist/lib/runner/executor-client.d.ts

@@ -34,6 +34,11 @@ export declare function errorDetails(body: unknown): Record<string, unknown>;
 export declare const JOB_READ_PATH: (sessionId: string) => string;
 /** The served bundle fetch, per claim (W-L12). */
 export declare const BUNDLE_FETCH_PATH: (sessionId: string) => string;
+/**
+ * The job's PR token (ruling 34.34): a Record App installation token narrowed to the seal's repo,
+ * contents and pull_requests write, fetched with the lease key. Never cached or logged.
+ */
+export declare const GITHUB_TOKEN_PATH: (sessionId: string) => string;
 export declare const JWKS_PATH = "/v1/.well-known/jwks.json";
 /** Record's commit index (ruling 34.05 (a)): the lease key may write the session's own commits. */
 export declare const RECORD_COMMITS_PATH: (orgId: string) => string;
@@ -65,6 +70,7 @@ export interface RunnerApi {
     fail(sessionId: string, body: Record<string, unknown>): Promise<HttpResult>;
     job(sessionId: string): Promise<HttpResult>;
     bundle(sessionId: string, leaseKey: string): Promise<HttpResult>;
+    githubToken(sessionId: string, leaseKey: string): Promise<HttpResult>;
     jwks(): Promise<HttpResult>;
     /** One RecordCommit/v1 body, with the lease key; the api pins it to the session's lineage. */
     recordCommit(orgId: string, body: RecordCommitBody, leaseKey: string): Promise<HttpResult>;

package/dist/lib/runner/executor-client.js

@@ -33,6 +33,11 @@ export function errorDetails(body) {
 export const JOB_READ_PATH = (sessionId) => `/v1/executor/sessions/${sessionId}/job`;
 /** The served bundle fetch, per claim (W-L12). */
 export const BUNDLE_FETCH_PATH = (sessionId) => `/v1/executor/sessions/${sessionId}/bundle`;
+/**
+ * The job's PR token (ruling 34.34): a Record App installation token narrowed to the seal's repo,
+ * contents and pull_requests write, fetched with the lease key. Never cached or logged.
+ */
+export const GITHUB_TOKEN_PATH = (sessionId) => `/v1/executor/sessions/${sessionId}/github-token`;
 export const JWKS_PATH = "/v1/.well-known/jwks.json";
 /** Record's commit index (ruling 34.05 (a)): the lease key may write the session's own commits. */
 export const RECORD_COMMITS_PATH = (orgId) => `/v1/orgs/${encodeURIComponent(orgId)}/record/commits`;
@@ -95,6 +100,7 @@ export function runnerApi(opts) {
         fail: (id, body) => call(routePath("exec_fail", scoped(id)), "POST", ex, body),
         job: (id) => call(JOB_READ_PATH(scoped(id)), "GET", ex),
         bundle: (id, leaseKey) => call(BUNDLE_FETCH_PATH(scoped(id)), "GET", leaseKey),
+        githubToken: (id, leaseKey) => call(GITHUB_TOKEN_PATH(scoped(id)), "POST", leaseKey),
         jwks: () => call(JWKS_PATH, "GET", null),
         recordCommit: (orgId, body, leaseKey) => {
             if (!ORG_ID_RE.test(orgId))

package/dist/lib/runner/job.d.ts

@@ -42,8 +42,11 @@ export interface JobDeps {
     prepareWorkspace(repo: string, sessionId: string): Promise<Workspace>;
     /** Run one phase's process; resolves its exit code. Rejects only when it could not start. */
     runPhase(inv: PhaseInvocation, ws: Workspace, modelUrl: string, signal: AbortSignal): Promise<number>;
-    /** Push the job branch and open its PR; resolves the PR URL. */
-    openPr(repo: string, ws: Workspace, title: string, body: string): Promise<string>;
+    /**
+     * Push the job branch and open its PR; resolves the PR URL. `token` is the job's PR token when
+     * `prTokenFromLease` is set; null means the runner's own GitHub token.
+     */
+    openPr(repo: string, ws: Workspace, title: string, body: string, token: string | null): Promise<string>;
     /** Commits on the job branch that the base does not have; 0 means there is nothing to open. */
     commitsAhead(ws: Workspace): Promise<number>;
     /** The working copy's HEAD sha before a phase runs; null only for a clone with no commit. Throws otherwise. */
@@ -53,7 +56,13 @@ export interface JobDeps {
      * first, under `lineageKey` and the job's repo. A commit that cannot be read is left out.
      */
     commitBodies(ws: Workspace, since: string | null, lineageKey: string, repo: string): Promise<RecordCommitBody[]>;
-    enableAutoMerge(prUrl: string): Promise<void>;
+    enableAutoMerge(prUrl: string, token: string | null): Promise<void>;
+    /**
+     * True when the credential is the --oidc exchange: the PR is pushed and opened with the job's PR
+     * token from the api (ruling 34.34), never the runner's own GitHub token, which in a sealed repo's
+     * Action is a GITHUB_TOKEN the org forbids from opening PRs. A refused token fails the job.
+     */
+    prTokenFromLease?: boolean;
     cleanup(ws: Workspace): Promise<void>;
 }
 export interface JobOptions {

package/dist/lib/runner/job.js

@@ -379,6 +379,7 @@ export async function runJob(sessionId, opts, deps) {
             });
         }
         if (opensPr) {
+            let prToken = null;
             try {
                 // Checked before the push, so an empty diff never reaches GitHub's 422 (amendment 59).
                 if ((await deps.commitsAhead(ws)) === 0) {
@@ -386,7 +387,13 @@ export async function runJob(sessionId, opts, deps) {
                     await reportFail(deps, sessionId, claim.epoch, "runner_failed", "pr_no_changes");
                     return { kind: "outcome", outcome: failedOutcome(facts, "pr_no_changes") };
                 }
-                facts.pr_url = await deps.openPr(job.repo, ws, `mnemom: ${bundle.workflow.id} job ${sessionId.slice(0, 8)}`, prBody(job));
+                if (deps.prTokenFromLease) {
+                    const t = await fetchPrToken(deps, sessionId, claim.leaseKey, job.repo);
+                    if (!t.ok)
+                        throw new Error(t.detail);
+                    prToken = t.token;
+                }
+                facts.pr_url = await deps.openPr(job.repo, ws, `mnemom: ${bundle.workflow.id} job ${sessionId.slice(0, 8)}`, prBody(job), prToken);
             }
             catch (e) {
                 deps.log(`opening the PR failed: ${e.message}`);
@@ -395,7 +402,7 @@ export async function runJob(sessionId, opts, deps) {
             }
             if (facts.merge_strategy === "merge_on_green") {
                 try {
-                    await deps.enableAutoMerge(facts.pr_url);
+                    await deps.enableAutoMerge(facts.pr_url, prToken);
                 }
                 catch (e) {
                     deps.log(`enabling auto-merge failed (the PR stays open): ${e.message}`);
@@ -469,6 +476,27 @@ export async function reportPhaseCommits(deps, report, p) {
         deps.log(`commit report failed: ${e.message}`);
     }
 }
+/**
+ * The job's PR token (ruling 34.34), fetched once per claim with the lease key. It must name the
+ * job's repo; the detail never carries the token.
+ */
+async function fetchPrToken(deps, sessionId, leaseKey, repo) {
+    const res = await deps.api.githubToken(sessionId, leaseKey);
+    if (res.status !== 200) {
+        return {
+            ok: false,
+            detail: `the PR token fetch answered ${res.code ?? res.networkError ?? res.status}`,
+        };
+    }
+    const b = (res.body ?? {});
+    if (typeof b.token !== "string" || b.token === "") {
+        return { ok: false, detail: "the PR token fetch answered 200 with no token" };
+    }
+    if (typeof b.repository !== "string" || b.repository.toLowerCase() !== repo.toLowerCase()) {
+        return { ok: false, detail: `the PR token names another repo than the job's ${repo}` };
+    }
+    return { ok: true, token: b.token };
+}
 async function fetchBundle(deps, sessionId, claim) {
     const [jwksRes, res] = await Promise.all([
         deps.api.jwks(),

package/dist/lib/runner/loop.d.ts

@@ -3,8 +3,11 @@
  *
  * --once: list the ready pool sessions (exec_ready_list, oldest first), try each in order, and run
  * at most one job. A lost race, or an ineligible waiting / not_pool_member, moves to the next
- * candidate; an empty list, or every candidate lost, ends no_job. --watch: the same, again and
- * again, until SIGTERM or SIGINT. Every job prints exactly one outcome line (none when stopped
+ * candidate; an empty list, or every candidate lost, ends no_job. --once --session <id> (the
+ * wake-up's own session, #1329): try exactly that session and never list the pool; a 404 attest, a
+ * lost race or a skippable ineligible ends no_job, and no other session is tried, so a wake-up
+ * dispatched for one repo's session never works another's. --watch: the same as plain --once, again
+ * and again, until SIGTERM or SIGINT. Every job prints exactly one outcome line (none when stopped
  * mid-job), and the process exit code is the --once outcome's, or 0 for --watch stopped.
  *
  * Every side effect is in `JobDeps` (plus `emit`), so each arm is tested; `liveJobDeps`
@@ -21,6 +24,8 @@ export interface LoopOptions {
     emit(line: string): void;
     /** --watch: wait between empty polls, ms. */
     idlePollMs?: number;
+    /** --once --session: the one session to try; the ready list is never read. */
+    sessionId?: string;
 }
 export declare const WATCH_IDLE_POLL_MS = 15000;
 /** --watch backs off on a ready-list the api cannot answer, up to this, ms. */

package/dist/lib/runner/loop.js

@@ -3,8 +3,11 @@
  *
  * --once: list the ready pool sessions (exec_ready_list, oldest first), try each in order, and run
  * at most one job. A lost race, or an ineligible waiting / not_pool_member, moves to the next
- * candidate; an empty list, or every candidate lost, ends no_job. --watch: the same, again and
- * again, until SIGTERM or SIGINT. Every job prints exactly one outcome line (none when stopped
+ * candidate; an empty list, or every candidate lost, ends no_job. --once --session <id> (the
+ * wake-up's own session, #1329): try exactly that session and never list the pool; a 404 attest, a
+ * lost race or a skippable ineligible ends no_job, and no other session is tried, so a wake-up
+ * dispatched for one repo's session never works another's. --watch: the same as plain --once, again
+ * and again, until SIGTERM or SIGINT. Every job prints exactly one outcome line (none when stopped
  * mid-job), and the process exit code is the --once outcome's, or 0 for --watch stopped.
  *
  * Every side effect is in `JobDeps` (plus `emit`), so each arm is tested; `liveJobDeps`
@@ -58,9 +61,18 @@ async function onePass(deps, opts) {
     }
     return { kind: "none" };
 }
+/** --once --session: that session's outcome, or none; never another session. */
+async function sessionPass(deps, opts, id) {
+    if (opts.stop.aborted)
+        return { kind: "stopped" };
+    const r = await runJob(id, { failMode: opts.failMode, stop: opts.stop }, deps);
+    return r.kind === "next" ? { kind: "none" } : r;
+}
 /** --once: at most one job. Resolves the process exit code. */
 export async function runOnce(deps, opts) {
-    const p = await onePass(deps, opts);
+    const p = opts.sessionId === undefined
+        ? await onePass(deps, opts)
+        : await sessionPass(deps, opts, opts.sessionId);
     if (p.kind === "stopped")
         return 0;
     const outcome = p.kind === "outcome" ? p.outcome : noJobOutcome();

package/dist/lib/runner/options.d.ts

@@ -16,6 +16,8 @@ export interface RunFlags {
     failMode?: string;
     json?: boolean;
     oidc?: boolean;
+    /** --session <uuid>: with --once, claim exactly this session and never list the pool. */
+    session?: string;
 }
 export type RunCredential = {
     kind: "executor_key";
@@ -34,6 +36,11 @@ export interface RunPlan {
     executorId: string | null;
     /** Warnings to print on stderr (an unknown fail mode reads as closed). */
     warnings: string[];
+    /**
+     * --session: the one session this --once run may claim (the wake-up's own, #1329). Absent: the
+     * pool's ready list, oldest first, as before.
+     */
+    sessionId?: string;
 }
 export type RunPlanResult = {
     ok: true;

package/dist/lib/runner/options.js

@@ -22,6 +22,16 @@ export function resolveRunPlan(flags, env) {
     if (flags.oidc && form === "watch") {
         return usage("mnemom agent run: --oidc is valid only with --once");
     }
+    let sessionId;
+    if (flags.session !== undefined) {
+        if (form === "watch") {
+            return usage("mnemom agent run: --session is valid only with --once");
+        }
+        if (!UUID_RE.test(flags.session)) {
+            return usage("mnemom agent run: --session is not a lowercase uuid");
+        }
+        sessionId = flags.session;
+    }
     const fail = resolveFailMode(flags.failMode, env[RUNNER_FAIL_MODE_ENV]);
     const warnings = fail.warning ? [`mnemom agent run: ${fail.warning}`] : [];
     let credential;
@@ -60,6 +70,7 @@ export function resolveRunPlan(flags, env) {
             credential,
             executorId,
             warnings,
+            ...(sessionId !== undefined ? { sessionId } : {}),
         },
     };
 }

package/dist/lib/scan/caps.d.ts

@@ -1,35 +1 @@
-/**
- * Coverage caps and sampling. Port of mnemom-api src/org-scan/scan/capped-scan.ts (PR #4208).
- *
- * Coverage decision (Shraddha, 2026-10-28): each scan covers the last 3 months OR the last 2,000 merged
- * PRs, whichever is MORE; above 2,000 in the window, an even deterministic sample of 2,000.
- */
-export declare const COVERAGE_MONTHS = 3;
-export interface ScanCaps {
-    maxPrs: number;
-    /** A PR with more additions+deletions than this is skipped, never read in full. */
-    maxPrSizeLines: number;
-    /** Upstream read calls. */
-    maxReads: number;
-    /** Wall-clock budget. */
-    maxMillis: number;
-}
-export declare const DEFAULT_SCAN_CAPS: ScanCaps;
-export type StopReason = "pr-cap" | "read-cap" | "time-cap";
-/** The day `months` calendar months before `end` (YYYY-MM-DD, UTC), clamped to the month's last day. */
-export declare function monthsBefore(end: string, months: number): string;
-/** `k` items spread evenly across `items` (order kept): index floor(i*n/k). Deterministic; n <= k returns all. */
-export declare function evenSample<T>(items: readonly T[], k: number): T[];
-export declare function sanitiseCaps(c: Partial<ScanCaps>): ScanCaps;
-/** Running read budget. Every call is told how many reads it may spend (`room`). */
-export declare class Budget {
-    private caps;
-    private now;
-    private startedAt;
-    reads: number;
-    constructor(caps: ScanCaps, now: () => number, startedAt: number);
-    block(n?: number): StopReason | null;
-    room(): number;
-    overrun(): StopReason | null;
-    charge(n: number): void;
-}
+export * from "../../vendor/shared/org-scan-core/caps.js";

package/dist/lib/scan/caps.js

@@ -1,67 +1,2 @@
-/**
- * Coverage caps and sampling. Port of mnemom-api src/org-scan/scan/capped-scan.ts (PR #4208).
- *
- * Coverage decision (Shraddha, 2026-10-28): each scan covers the last 3 months OR the last 2,000 merged
- * PRs, whichever is MORE; above 2,000 in the window, an even deterministic sample of 2,000.
- */
-export const COVERAGE_MONTHS = 3;
-export const DEFAULT_SCAN_CAPS = {
-    maxPrs: 2_000,
-    maxPrSizeLines: 20_000,
-    maxReads: 4_500,
-    maxMillis: 15 * 60_000,
-};
-/** The day `months` calendar months before `end` (YYYY-MM-DD, UTC), clamped to the month's last day. */
-export function monthsBefore(end, months) {
-    const [y, m, d] = end.split("-").map(Number);
-    const target = new Date(Date.UTC(y, m - 1 - months, 1));
-    const last = new Date(Date.UTC(target.getUTCFullYear(), target.getUTCMonth() + 1, 0)).getUTCDate();
-    target.setUTCDate(Math.min(d, last));
-    return target.toISOString().slice(0, 10);
-}
-/** `k` items spread evenly across `items` (order kept): index floor(i*n/k). Deterministic; n <= k returns all. */
-export function evenSample(items, k) {
-    const n = items.length;
-    if (n <= k)
-        return [...items];
-    return Array.from({ length: k }, (_, i) => items[Math.floor((i * n) / k)]);
-}
-export function sanitiseCaps(c) {
-    const pos = (n, d) => typeof n === "number" && Number.isFinite(n) && n > 0 ? Math.floor(n) : d;
-    return {
-        maxPrs: pos(c.maxPrs, DEFAULT_SCAN_CAPS.maxPrs),
-        maxPrSizeLines: pos(c.maxPrSizeLines, DEFAULT_SCAN_CAPS.maxPrSizeLines),
-        maxReads: pos(c.maxReads, DEFAULT_SCAN_CAPS.maxReads),
-        maxMillis: pos(c.maxMillis, DEFAULT_SCAN_CAPS.maxMillis),
-    };
-}
-/** Running read budget. Every call is told how many reads it may spend (`room`). */
-export class Budget {
-    caps;
-    now;
-    startedAt;
-    reads = 0;
-    constructor(caps, now, startedAt) {
-        this.caps = caps;
-        this.now = now;
-        this.startedAt = startedAt;
-    }
-    block(n = 1) {
-        if (this.now() - this.startedAt >= this.caps.maxMillis)
-            return "time-cap";
-        if (this.reads + n > this.caps.maxReads)
-            return "read-cap";
-        return null;
-    }
-    room() {
-        if (this.now() - this.startedAt >= this.caps.maxMillis)
-            return 0;
-        return Math.max(0, this.caps.maxReads - this.reads);
-    }
-    overrun() {
-        return this.reads > this.caps.maxReads ? "read-cap" : null;
-    }
-    charge(n) {
-        this.reads += n;
-    }
-}
+// Moved to shared/org-scan-core (MNE-9752); vendored at cli/src/vendor/shared/org-scan-core. Re-exported so CLI imports stay put.
+export * from "../../vendor/shared/org-scan-core/caps.js";

package/dist/lib/scan/cost-per-pr.d.ts

@@ -1,93 +1 @@
-/**
- * Cost per merged PR and cost by PR size, for the Org Scan report. Pure: numbers in, numbers out.
- *
- * Source of the spend. Measured per-request cost cannot be tied to a PR with the data the scan has:
- * the Anthropic usage reads return one whole-org total (no per-request or per-PR rows) and the Mnemom
- * Record totals are one window sum (model cost and a request count, no PR key). So every figure here is
- * `label: "estimate"`: the period's spend split across the merged PRs in proportion to lines changed.
- * Each figure names the spend it was split from (`spend_source`); sources are never mixed in one report.
- *
- *   anthropic_usage          the whole-org Anthropic cost for the period (the CTO's admin key)
- *   modelled_range           our modelled estimate (a low to high range, so the figures are ranges)
- *
- * Size is per PR, in lines changed = additions + deletions, exactly as GitHub reports them. Lockfiles and
- * generated files are NOT excluded. small < 50; medium 50..500 inclusive; large > 500.
- *
- * Each size figure is the average cost of ONE PR of that size: spend * (mean lines of the bucket) /
- * (total lines of the PRs in scope). Scope: the modelled estimate prices AI-assisted PRs only, so it is
- * split across those only (`pr_scope: "ai_assisted"`, buckets too); the others use every merged PR
- * (`pr_scope: "all_merged"`). `pr_count` counts PRs in that scope. Usage-key figures also carry
- * `spend_scope: "whole_org"` (the key covers the whole organization, not just the scanned repos). The cost per merged PR is the spend over the count of merged PRs.
- *
- * Missing data is an absent field, never 0 or NaN: no usable spend, zero merged PRs in the period, an
- * empty bucket, a scan that did not read every merged PR in the period, or a result past safe-integer
- * range. Reverts are listed without sizes, so they are not counted as merged PRs here.
- */
-import type { SpendEstimate } from "./spend/spend-estimate.js";
-/** Strictly below this is small. 50 is medium. */
-export declare const SMALL_MAX_EXCLUSIVE = 50;
-/** At or below this (and not small) is medium. 500 is medium; 501 is large. */
-export declare const MEDIUM_MAX_INCLUSIVE = 500;
-export type SizeBucket = "small" | "medium" | "large";
-export type CostSpendSourceName = "anthropic_usage" | "modelled_range";
-export interface PrSize {
-    /** YYYY-MM-DD, UTC. */
-    mergedDay: string;
-    /** additions + deletions. */
-    lines: number;
-    /** The PR carries an AI-tool mark (the same rule the modelled spend uses to count AI-assisted PRs). */
-    aiAssisted: boolean;
-}
-/** Where the spend comes from. USD, never cents. */
-export type CostSpend = {
-    source: "anthropic_usage";
-    usd: number;
-} | {
-    source: "modelled_range";
-    lowUsd: number;
-    highUsd: number;
-};
-/** One figure: a single value, or a low to high range for the modelled source. Integer cents. */
-export type PrScope = "ai_assisted" | "all_merged";
-export type CostFigure = {
-    /** "measured" is not possible with current data (see header); every figure is an estimate. */
-    label: "estimate";
-    spend_source: CostSpendSourceName;
-    /**
-     * Which PRs the average is over. The modelled estimate prices AI-assisted PRs only, so it is split
-     * across those only ("ai_assisted"); the usage key covers all spend, so they use "all_merged".
-     */
-    pr_scope: PrScope;
-    /** PRs in that scope. */
-    pr_count: number;
-    /** Present on anthropic_usage only: the key's usage is the whole organization's, not just these PRs'. */
-    spend_scope?: "whole_org";
-} & ({
-    value_cents: number;
-} | {
-    low_cents: number;
-    high_cents: number;
-});
-export interface CostPerPr {
-    cost_per_merged_pr?: CostFigure;
-    cost_by_pr_size?: Partial<Record<SizeBucket, CostFigure>>;
-}
-export declare const sizeBucket: (lines: number) => SizeBucket;
-/** Inclusive day count of YYYY-MM-DD..YYYY-MM-DD, or null if unparsable or reversed. */
-export declare function periodDays(p: {
-    start: string;
-    end: string;
-}): number | null;
-/** The period's spend in USD as [low, high]; null when there is no usable spend. */
-export declare function spendForPeriod(spend: CostSpend): [number, number] | null;
-/** The modelled estimate as a spend source, or null when the estimate is "none". */
-export declare const modelledSpend: (e: SpendEstimate) => CostSpend | null;
-/**
- * @param prs           every merged PR the scan read, with merge day and size
- * @param exhaustive    true only if the scan read EVERY merged PR in the period (no sample, no skipped
- *                      large PR, none unreadable, no cap hit). Otherwise the average is not defined.
- */
-export declare function buildCostPerPr(prs: readonly PrSize[] | undefined, period: {
-    start: string;
-    end: string;
-}, spend: CostSpend | null, exhaustive: boolean): CostPerPr;
+export * from "../../vendor/shared/org-scan-core/cost-per-pr.js";