@mnemom/mnemom 0.17.38-next.1 → 0.17.38-next.3

package/dist/vendor/durable-contract/index.js

@@ -1065,6 +1065,7 @@ var CLAIM_UNAVAILABLE_CAUSES = [
   /** A pool claim with no valid registry default cap (ruling 34.05.1 (3)). */
   "lease_cap_config"
 ];
+var SEAL_REPO_MISMATCH_CAUSES = ["no_repo_claim", "no_seal_repo", "repo_mismatch"];
 var UNSUPPORTED_FEATURES = [
   "tool_classes",
   "launch_spec_change",
@@ -1173,6 +1174,11 @@ var DURABLE_CODES = {
   // The per-org claim rate limit (ruling 34.24): nothing written, no key minted. retry_after_s is
   // the number of seconds to wait (claimRateLimitedDetailsOk).
   durable_claim_rate_limited: { status: 429, surfaces: ["api"], fields: ["retry_after_s"] },
+  // An OIDC executor key (bound to the repo whose GitHub Actions token minted it) claiming a session
+  // not sealed for that repo (mnemom-test#1329; mnemom-api#4530). Its own code, not a
+  // durable_claim_ineligible reason: the session is claimable, only not by this executor, and a
+  // runner never skips past it to another session. cause is a SEAL_REPO_MISMATCH_CAUSES value.
+  seal_repo_mismatch: { status: 403, surfaces: ["api"], fields: ["cause"] },
   // ---- api journal (C10-R0 (i), (j), (k)) ----
   /** Lost CAS race on (session_id, seq). */
   durable_append_conflict: { status: 409, surfaces: ["api"], fields: ["tip_seq"] },
@@ -1670,7 +1676,8 @@ var M1_CLI_SURFACE = Object.freeze([
   entry(["agent", "pause"], ["--json"]),
   entry(["agent", "resume"], ["--json"]),
   // Doors thin runner (W-L13), ruling 34.12 (1): --watch or --once, --fail-mode, --json, --oidc.
-  entry(["agent", "run"], ["--fail-mode", "--json", "--oidc", "--once", "--watch"]),
+  // --session (#1329, approved by the Durable lead): with --once, claim only the wake-up's session.
+  entry(["agent", "run"], ["--fail-mode", "--json", "--oidc", "--once", "--session", "--watch"]),
   // BACKBONE C4 (line 147: buildDurableLaunchSpec serves 'sessions adopt'); options: C14 spec
   // (`sessions adopt --dry-run --json`, `sessions adopt --own-agent`); ruling 32.33.
   entry(["agent", "sessions", "adopt"], ["--dry-run", "--json", "--own-agent"]),
@@ -2393,12 +2400,18 @@ var DISPATCH_SESSION_CID_PREFIX = "dispatch-";
 var DISPATCH_SESSION_NAME_PREFIX = "job-";
 var CREATE_READY_SESSION_REFUSALS = [
   "no_dispatch_agent",
+  // amendment 63 (signed off by Wassim 2026-11-05): neither the seal's confirmer nor the dispatch agent's
+  // creator is a user (NULL, empty or scheme-prefixed, such as github:<login>); nothing written
+  "dispatch_owner_missing",
   "seal_not_found",
   "cell_unmapped",
   // 34.10.1 (4): the api-built charter v1 or its envelope does not match the seal; nothing written
   "charter_mismatch"
 ];
 var CREATE_READY_SESSION_OUTCOMES = ["created", "existing", "refused"];
+function isUserCreator(createdBy) {
+  return typeof createdBy === "string" && createdBy !== "" && !createdBy.includes(":");
+}
 var CREATE_READY_SESSION_ANSWERS = Object.freeze({
   created: ["outcome", "session_id"],
   existing: ["outcome", "session_id"],
@@ -4092,7 +4105,9 @@ var M1_COLUMNS = {
     "last_seen_at",
     "risk_line_version",
     "created_at",
-    "scope"
+    "scope",
+    "oidc_repo",
+    "oidc_bound"
   ],
   agent_durable_profiles: [
     "id",
@@ -6572,6 +6587,7 @@ export {
   RUNNER_OUTCOME_FIELDS,
   RUNNER_REFUSED_REASONS,
   SEALED_CONTRACT_FIELDS,
+  SEAL_REPO_MISMATCH_CAUSES,
   SEAL_VECTORS,
   SEAT_DAEMON_FLAGS,
   SEAT_MAX_ATTEMPTS_NONRETRY,
@@ -6776,6 +6792,7 @@ export {
   isTerminalState,
   isTestAllowlisted,
   isUnchainedCountTokens,
+  isUserCreator,
   isValidCommitment,
   isValidSessionName,
   isValidStateReason,

package/dist/vendor/shared/durable-contract/cli-surface.js

@@ -60,7 +60,8 @@ export const M1_CLI_SURFACE = Object.freeze([
     entry(["agent", "pause"], ["--json"]),
     entry(["agent", "resume"], ["--json"]),
     // Doors thin runner (W-L13), ruling 34.12 (1): --watch or --once, --fail-mode, --json, --oidc.
-    entry(["agent", "run"], ["--fail-mode", "--json", "--oidc", "--once", "--watch"]),
+    // --session (#1329, approved by the Durable lead): with --once, claim only the wake-up's session.
+    entry(["agent", "run"], ["--fail-mode", "--json", "--oidc", "--once", "--session", "--watch"]),
     // BACKBONE C4 (line 147: buildDurableLaunchSpec serves 'sessions adopt'); options: C14 spec
     // (`sessions adopt --dry-run --json`, `sessions adopt --own-agent`); ruling 32.33.
     entry(["agent", "sessions", "adopt"], ["--dry-run", "--json", "--own-agent"]),

package/dist/vendor/shared/durable-contract/codes.d.ts

@@ -8,6 +8,13 @@
  */
 export declare const CLAIM_UNAVAILABLE_CAUSES: readonly ["schema", "arm_probe", "entitlement_lookup", "protection_probe", "guard", "lease_cap_config"];
 export type ClaimUnavailableCause = (typeof CLAIM_UNAVAILABLE_CAUSES)[number];
+/**
+ * seal_repo_mismatch details.cause (mnemom-test#1329; mnemom-api#4530 claim.ts oidcRepoBinding): the
+ * bound executor names no repo, the session has no dispatch seal naming a repo, or the seal names
+ * another repo than the executor's (owner/name, case-insensitive).
+ */
+export declare const SEAL_REPO_MISMATCH_CAUSES: readonly ["no_repo_claim", "no_seal_repo", "repo_mismatch"];
+export type SealRepoMismatchCause = (typeof SEAL_REPO_MISMATCH_CAUSES)[number];
 export declare const UNSUPPORTED_FEATURES: readonly ["tool_classes", "launch_spec_change", "above_limit_raise", "remote_control"];
 export type UnsupportedFeature = (typeof UNSUPPORTED_FEATURES)[number];
 export declare const CWD_KINDS: readonly ["subdirectory", "not_git", "symlink_transcript"];
@@ -261,6 +268,11 @@ export declare const DURABLE_CODES: {
         readonly surfaces: readonly ["api"];
         readonly fields: readonly ["retry_after_s"];
     };
+    readonly seal_repo_mismatch: {
+        readonly status: 403;
+        readonly surfaces: readonly ["api"];
+        readonly fields: readonly ["cause"];
+    };
     /** Lost CAS race on (session_id, seq). */
     readonly durable_append_conflict: {
         readonly status: 409;

package/dist/vendor/shared/durable-contract/codes.js

@@ -18,6 +18,12 @@ export const CLAIM_UNAVAILABLE_CAUSES = [
     /** A pool claim with no valid registry default cap (ruling 34.05.1 (3)). */
     "lease_cap_config",
 ];
+/**
+ * seal_repo_mismatch details.cause (mnemom-test#1329; mnemom-api#4530 claim.ts oidcRepoBinding): the
+ * bound executor names no repo, the session has no dispatch seal naming a repo, or the seal names
+ * another repo than the executor's (owner/name, case-insensitive).
+ */
+export const SEAL_REPO_MISMATCH_CAUSES = ["no_repo_claim", "no_seal_repo", "repo_mismatch"];
 export const UNSUPPORTED_FEATURES = [
     "tool_classes",
     "launch_spec_change",
@@ -134,6 +140,11 @@ export const DURABLE_CODES = {
     // The per-org claim rate limit (ruling 34.24): nothing written, no key minted. retry_after_s is
     // the number of seconds to wait (claimRateLimitedDetailsOk).
     durable_claim_rate_limited: { status: 429, surfaces: ["api"], fields: ["retry_after_s"] },
+    // An OIDC executor key (bound to the repo whose GitHub Actions token minted it) claiming a session
+    // not sealed for that repo (mnemom-test#1329; mnemom-api#4530). Its own code, not a
+    // durable_claim_ineligible reason: the session is claimable, only not by this executor, and a
+    // runner never skips past it to another session. cause is a SEAL_REPO_MISMATCH_CAUSES value.
+    seal_repo_mismatch: { status: 403, surfaces: ["api"], fields: ["cause"] },
     // ---- api journal (C10-R0 (i), (j), (k)) ----
     /** Lost CAS race on (session_id, seq). */
     durable_append_conflict: { status: 409, surfaces: ["api"], fields: ["tip_seq"] },

package/dist/vendor/shared/durable-contract/constants.d.ts

@@ -4,7 +4,13 @@
  * freeze record" are chosen here; each carries its reason. `freeze-record.ts` copies them into
  * the JSON record the eval runner reads as `$S1.<NAME>`.
  */
-/** The contract version of this package. Any change to FREEZE.json bumps it. */
+/**
+ * The contract version of this package. The per-file hashes in FREEZE.json are the change signal
+ * for S1; this number moves only on a breaking change to the contract's shape, by ruling.
+ * Precedent: amendments 59, 60 and 34.03.4 all changed FREEZE.json at 1.0.0 (lead ruling 34.35.1,
+ * 2026-11-05: the contract version is held at 1.0.0 while FREEZE hashes carry change; a bump is a
+ * separate ruling).
+ */
 export declare const DURABLE_CONTRACT_VERSION = "1.0.0";
 /**
  * `durable_schema_version()` must return exactly this. A mismatch makes the entitlement `durable`

package/dist/vendor/shared/durable-contract/constants.js

@@ -5,7 +5,13 @@
  * freeze record" are chosen here; each carries its reason. `freeze-record.ts` copies them into
  * the JSON record the eval runner reads as `$S1.<NAME>`.
  */
-/** The contract version of this package. Any change to FREEZE.json bumps it. */
+/**
+ * The contract version of this package. The per-file hashes in FREEZE.json are the change signal
+ * for S1; this number moves only on a breaking change to the contract's shape, by ruling.
+ * Precedent: amendments 59, 60 and 34.03.4 all changed FREEZE.json at 1.0.0 (lead ruling 34.35.1,
+ * 2026-11-05: the contract version is held at 1.0.0 while FREEZE hashes carry change; a bump is a
+ * separate ruling).
+ */
 export const DURABLE_CONTRACT_VERSION = "1.0.0";
 /**
  * `durable_schema_version()` must return exactly this. A mismatch makes the entitlement `durable`

package/dist/vendor/shared/durable-contract/doors.d.ts

@@ -60,8 +60,16 @@ export declare function effectiveLeaseCap(orgLimits: {
 } | null, defaultCap: number | null): number;
 export declare const DISPATCH_SESSION_CID_PREFIX = "dispatch-";
 export declare const DISPATCH_SESSION_NAME_PREFIX = "job-";
-export declare const CREATE_READY_SESSION_REFUSALS: readonly ["no_dispatch_agent", "seal_not_found", "cell_unmapped", "charter_mismatch"];
+export declare const CREATE_READY_SESSION_REFUSALS: readonly ["no_dispatch_agent", "dispatch_owner_missing", "seal_not_found", "cell_unmapped", "charter_mismatch"];
 export declare const CREATE_READY_SESSION_OUTCOMES: readonly ["created", "existing", "refused"];
+/**
+ * Amendment 63 (ruling 34.35): the one test for whether a session creator is a user, shared by the
+ * api (owner choice at dispatch, the claim's 403 not_owner, the repair) and its SQL twin
+ * public.durable_is_user_creator. A creator is a user unless it is null, empty or scheme-prefixed
+ * (contains ':', as github:<login> does). No id shape is read: uuids, Zitadel numeric ids and
+ * test-mode harness-<x> are users, so an identity-provider change does not move it.
+ */
+export declare function isUserCreator(createdBy: unknown): boolean;
 /** durable_create_ready_session's answer keys per outcome, closed (34.10 (g)(1)). */
 export declare const CREATE_READY_SESSION_ANSWERS: Readonly<{
     readonly created: readonly ["outcome", "session_id"];

package/dist/vendor/shared/durable-contract/doors.js

@@ -91,12 +91,25 @@ export const DISPATCH_SESSION_CID_PREFIX = "dispatch-";
 export const DISPATCH_SESSION_NAME_PREFIX = "job-";
 export const CREATE_READY_SESSION_REFUSALS = [
     "no_dispatch_agent",
+    // amendment 63 (signed off by Wassim 2026-11-05): neither the seal's confirmer nor the dispatch agent's
+    // creator is a user (NULL, empty or scheme-prefixed, such as github:<login>); nothing written
+    "dispatch_owner_missing",
     "seal_not_found",
     "cell_unmapped",
     // 34.10.1 (4): the api-built charter v1 or its envelope does not match the seal; nothing written
     "charter_mismatch",
 ];
 export const CREATE_READY_SESSION_OUTCOMES = ["created", "existing", "refused"];
+/**
+ * Amendment 63 (ruling 34.35): the one test for whether a session creator is a user, shared by the
+ * api (owner choice at dispatch, the claim's 403 not_owner, the repair) and its SQL twin
+ * public.durable_is_user_creator. A creator is a user unless it is null, empty or scheme-prefixed
+ * (contains ':', as github:<login> does). No id shape is read: uuids, Zitadel numeric ids and
+ * test-mode harness-<x> are users, so an identity-provider change does not move it.
+ */
+export function isUserCreator(createdBy) {
+    return typeof createdBy === "string" && createdBy !== "" && !createdBy.includes(":");
+}
 /** durable_create_ready_session's answer keys per outcome, closed (34.10 (g)(1)). */
 export const CREATE_READY_SESSION_ANSWERS = Object.freeze({
     created: ["outcome", "session_id"],

package/dist/vendor/shared/durable-contract/freeze-record.d.ts

@@ -737,7 +737,7 @@ export declare const FREEZE_STRUCTURED: Readonly<{
     OIDC_EXCHANGE_REFUSALS: readonly ["bad_issuer", "repo_not_enrolled", "ref_not_allowed", "pool_flag_off"];
     ORG_POLICY_LIMIT_KEYS: readonly ["per_session_budget_usd", "live_lease_cap"];
     POOL_CLAIM_FIELDS: readonly ["contract_sha256", "contract_version", "cap"];
-    CREATE_READY_SESSION_REFUSALS: readonly ["no_dispatch_agent", "seal_not_found", "cell_unmapped", "charter_mismatch"];
+    CREATE_READY_SESSION_REFUSALS: readonly ["no_dispatch_agent", "dispatch_owner_missing", "seal_not_found", "cell_unmapped", "charter_mismatch"];
     CREATE_READY_SESSION_OUTCOMES: readonly ["created", "existing", "refused"];
     CREATE_READY_SESSION_ANSWERS: Readonly<{
         readonly created: readonly ["outcome", "session_id"];

package/dist/vendor/shared/durable-contract/schema.d.ts

@@ -27,6 +27,15 @@
  *  - agent_sessions.job_failures (INTEGER NOT NULL DEFAULT 0, CHECK >= 0): the pool job's accepted
  *    runner_failed count, never reset. Separate from resume_failures, so a lease lapse never spends
  *    a job retry and a job retry never counts towards respawn_failed.
+ *
+ * OIDC repo binding (mnemom-test#1329; S1 amendment approved by the Durable lead; mnemom-api#4530
+ * migration durable_m1_doors_48_w17_oidc_repo_binding), appended to its table:
+ *  - agent_executors.oidc_repo (TEXT NULL): the owner/name repo whose GitHub Actions token minted
+ *    the executor in the OIDC exchange (durable_apply_oidc_enrollment); NULL on every other row;
+ *  - agent_executors.oidc_bound (BOOLEAN NOT NULL DEFAULT false): true only on a row the OIDC
+ *    exchange wrote with oidc_repo. A bound executor claims only sessions whose dispatch seal names
+ *    that repo, else 403 seal_repo_mismatch (SEAL_REPO_MISMATCH_CAUSES); an unbound row (every
+ *    row written before the migration) is not checked.
  */
 export declare const M1_TABLES: readonly ["agent_sessions", "durable_lease_keys", "agent_session_charters", "agent_session_events", "durable_event_kinds", "agent_session_chains", "agent_executors", "agent_durable_profiles", "durable_cell_state", "durable_org_policy", "durable_user_policy", "durable_approvals", "durable_approval_attestations"];
 export type M1Table = (typeof M1_TABLES)[number];

package/dist/vendor/shared/durable-contract/schema.js

@@ -28,6 +28,15 @@
  *  - agent_sessions.job_failures (INTEGER NOT NULL DEFAULT 0, CHECK >= 0): the pool job's accepted
  *    runner_failed count, never reset. Separate from resume_failures, so a lease lapse never spends
  *    a job retry and a job retry never counts towards respawn_failed.
+ *
+ * OIDC repo binding (mnemom-test#1329; S1 amendment approved by the Durable lead; mnemom-api#4530
+ * migration durable_m1_doors_48_w17_oidc_repo_binding), appended to its table:
+ *  - agent_executors.oidc_repo (TEXT NULL): the owner/name repo whose GitHub Actions token minted
+ *    the executor in the OIDC exchange (durable_apply_oidc_enrollment); NULL on every other row;
+ *  - agent_executors.oidc_bound (BOOLEAN NOT NULL DEFAULT false): true only on a row the OIDC
+ *    exchange wrote with oidc_repo. A bound executor claims only sessions whose dispatch seal names
+ *    that repo, else 403 seal_repo_mismatch (SEAL_REPO_MISMATCH_CAUSES); an unbound row (every
+ *    row written before the migration) is not checked.
  */
 import { canonicalJson, sha256Hex, UUID_RE } from "./canonical.js";
 import { CANONICAL_CELL_IDS } from "./cell-id.js";
@@ -150,6 +159,8 @@ export const M1_COLUMNS = {
         "risk_line_version",
         "created_at",
         "scope",
+        "oidc_repo",
+        "oidc_bound",
     ],
     agent_durable_profiles: [
         "id",

package/dist/vendor/shared/org-scan-core/caps.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Coverage caps and sampling. Port of mnemom-api src/org-scan/scan/capped-scan.ts (PR #4208).
+ *
+ * Coverage decision (Shraddha, 2026-10-28): each scan covers the last 3 months OR the last 2,000 merged
+ * PRs, whichever is MORE; above 2,000 in the window, an even deterministic sample of 2,000.
+ */
+export declare const COVERAGE_MONTHS = 3;
+export interface ScanCaps {
+    maxPrs: number;
+    /** A PR with more additions+deletions than this is skipped, never read in full. */
+    maxPrSizeLines: number;
+    /** Upstream read calls. */
+    maxReads: number;
+    /** Wall-clock budget. */
+    maxMillis: number;
+}
+export declare const DEFAULT_SCAN_CAPS: ScanCaps;
+export type StopReason = "pr-cap" | "read-cap" | "time-cap";
+/** The day `months` calendar months before `end` (YYYY-MM-DD, UTC), clamped to the month's last day. */
+export declare function monthsBefore(end: string, months: number): string;
+/** `k` items spread evenly across `items` (order kept): index floor(i*n/k). Deterministic; n <= k returns all. */
+export declare function evenSample<T>(items: readonly T[], k: number): T[];
+export declare function sanitiseCaps(c: Partial<ScanCaps>): ScanCaps;
+/** Running read budget. Every call is told how many reads it may spend (`room`). */
+export declare class Budget {
+    private caps;
+    private now;
+    private startedAt;
+    reads: number;
+    constructor(caps: ScanCaps, now: () => number, startedAt: number);
+    block(n?: number): StopReason | null;
+    room(): number;
+    overrun(): StopReason | null;
+    charge(n: number): void;
+}

package/dist/vendor/shared/org-scan-core/caps.js

@@ -0,0 +1,68 @@
+// GENERATED from shared/org-scan-core/src/caps.ts by cli/scripts/sync-org-scan-core.mjs; do not edit.
+/**
+ * Coverage caps and sampling. Port of mnemom-api src/org-scan/scan/capped-scan.ts (PR #4208).
+ *
+ * Coverage decision (Shraddha, 2026-10-28): each scan covers the last 3 months OR the last 2,000 merged
+ * PRs, whichever is MORE; above 2,000 in the window, an even deterministic sample of 2,000.
+ */
+export const COVERAGE_MONTHS = 3;
+export const DEFAULT_SCAN_CAPS = {
+    maxPrs: 2_000,
+    maxPrSizeLines: 20_000,
+    maxReads: 4_500,
+    maxMillis: 15 * 60_000,
+};
+/** The day `months` calendar months before `end` (YYYY-MM-DD, UTC), clamped to the month's last day. */
+export function monthsBefore(end, months) {
+    const [y, m, d] = end.split("-").map(Number);
+    const target = new Date(Date.UTC(y, m - 1 - months, 1));
+    const last = new Date(Date.UTC(target.getUTCFullYear(), target.getUTCMonth() + 1, 0)).getUTCDate();
+    target.setUTCDate(Math.min(d, last));
+    return target.toISOString().slice(0, 10);
+}
+/** `k` items spread evenly across `items` (order kept): index floor(i*n/k). Deterministic; n <= k returns all. */
+export function evenSample(items, k) {
+    const n = items.length;
+    if (n <= k)
+        return [...items];
+    return Array.from({ length: k }, (_, i) => items[Math.floor((i * n) / k)]);
+}
+export function sanitiseCaps(c) {
+    const pos = (n, d) => typeof n === "number" && Number.isFinite(n) && n > 0 ? Math.floor(n) : d;
+    return {
+        maxPrs: pos(c.maxPrs, DEFAULT_SCAN_CAPS.maxPrs),
+        maxPrSizeLines: pos(c.maxPrSizeLines, DEFAULT_SCAN_CAPS.maxPrSizeLines),
+        maxReads: pos(c.maxReads, DEFAULT_SCAN_CAPS.maxReads),
+        maxMillis: pos(c.maxMillis, DEFAULT_SCAN_CAPS.maxMillis),
+    };
+}
+/** Running read budget. Every call is told how many reads it may spend (`room`). */
+export class Budget {
+    caps;
+    now;
+    startedAt;
+    reads = 0;
+    constructor(caps, now, startedAt) {
+        this.caps = caps;
+        this.now = now;
+        this.startedAt = startedAt;
+    }
+    block(n = 1) {
+        if (this.now() - this.startedAt >= this.caps.maxMillis)
+            return "time-cap";
+        if (this.reads + n > this.caps.maxReads)
+            return "read-cap";
+        return null;
+    }
+    room() {
+        if (this.now() - this.startedAt >= this.caps.maxMillis)
+            return 0;
+        return Math.max(0, this.caps.maxReads - this.reads);
+    }
+    overrun() {
+        return this.reads > this.caps.maxReads ? "read-cap" : null;
+    }
+    charge(n) {
+        this.reads += n;
+    }
+}

package/dist/vendor/shared/org-scan-core/cost-per-pr.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Cost per merged PR and cost by PR size, for the Org Scan report. Pure: numbers in, numbers out.
+ *
+ * Source of the spend. Measured per-request cost cannot be tied to a PR with the data the scan has:
+ * the Anthropic usage reads return one whole-org total (no per-request or per-PR rows) and the Mnemom
+ * Record totals are one window sum (model cost and a request count, no PR key). So every figure here is
+ * `label: "estimate"`: the period's spend split across the merged PRs in proportion to lines changed.
+ * Each figure names the spend it was split from (`spend_source`); sources are never mixed in one report.
+ *
+ *   anthropic_usage          the whole-org Anthropic cost for the period (the CTO's admin key)
+ *   modelled_range           our modelled estimate (a low to high range, so the figures are ranges)
+ *
+ * Size is per PR, in lines changed = additions + deletions, exactly as GitHub reports them. Lockfiles and
+ * generated files are NOT excluded. small < 50; medium 50..500 inclusive; large > 500.
+ *
+ * Each size figure is the average cost of ONE PR of that size: spend * (mean lines of the bucket) /
+ * (total lines of the PRs in scope). Scope: the modelled estimate prices AI-assisted PRs only, so it is
+ * split across those only (`pr_scope: "ai_assisted"`, buckets too); the others use every merged PR
+ * (`pr_scope: "all_merged"`). `pr_count` counts PRs in that scope. Usage-key figures also carry
+ * `spend_scope: "whole_org"` (the key covers the whole organization, not just the scanned repos). The cost per merged PR is the spend over the count of merged PRs.
+ *
+ * Missing data is an absent field, never 0 or NaN: no usable spend, zero merged PRs in the period, an
+ * empty bucket, a scan that did not read every merged PR in the period, or a result past safe-integer
+ * range. Reverts are listed without sizes, so they are not counted as merged PRs here.
+ */
+import type { SpendEstimate } from "./spend/spend-estimate.js";
+/** Strictly below this is small. 50 is medium. */
+export declare const SMALL_MAX_EXCLUSIVE = 50;
+/** At or below this (and not small) is medium. 500 is medium; 501 is large. */
+export declare const MEDIUM_MAX_INCLUSIVE = 500;
+export type SizeBucket = "small" | "medium" | "large";
+export type CostSpendSourceName = "anthropic_usage" | "modelled_range";
+export interface PrSize {
+    /** YYYY-MM-DD, UTC. */
+    mergedDay: string;
+    /** additions + deletions. */
+    lines: number;
+    /** The PR carries an AI-tool mark (the same rule the modelled spend uses to count AI-assisted PRs). */
+    aiAssisted: boolean;
+}
+/** Where the spend comes from. USD, never cents. */
+export type CostSpend = {
+    source: "anthropic_usage";
+    usd: number;
+} | {
+    source: "modelled_range";
+    lowUsd: number;
+    highUsd: number;
+};
+/** One figure: a single value, or a low to high range for the modelled source. Integer cents. */
+export type PrScope = "ai_assisted" | "all_merged";
+export type CostFigure = {
+    /** "measured" is not possible with current data (see header); every figure is an estimate. */
+    label: "estimate";
+    spend_source: CostSpendSourceName;
+    /**
+     * Which PRs the average is over. The modelled estimate prices AI-assisted PRs only, so it is split
+     * across those only ("ai_assisted"); the usage key covers all spend, so they use "all_merged".
+     */
+    pr_scope: PrScope;
+    /** PRs in that scope. */
+    pr_count: number;
+    /** Present on anthropic_usage only: the key's usage is the whole organization's, not just these PRs'. */
+    spend_scope?: "whole_org";
+} & ({
+    value_cents: number;
+} | {
+    low_cents: number;
+    high_cents: number;
+});
+export interface CostPerPr {
+    cost_per_merged_pr?: CostFigure;
+    cost_by_pr_size?: Partial<Record<SizeBucket, CostFigure>>;
+}
+export declare const sizeBucket: (lines: number) => SizeBucket;
+/** Inclusive day count of YYYY-MM-DD..YYYY-MM-DD, or null if unparsable or reversed. */
+export declare function periodDays(p: {
+    start: string;
+    end: string;
+}): number | null;
+/** The period's spend in USD as [low, high]; null when there is no usable spend. */
+export declare function spendForPeriod(spend: CostSpend): [number, number] | null;
+/** The modelled estimate as a spend source, or null when the estimate is "none". */
+export declare const modelledSpend: (e: SpendEstimate) => CostSpend | null;
+/**
+ * @param prs           every merged PR the scan read, with merge day and size
+ * @param exhaustive    true only if the scan read EVERY merged PR in the period (no sample, no skipped
+ *                      large PR, none unreadable, no cap hit). Otherwise the average is not defined.
+ */
+export declare function buildCostPerPr(prs: readonly PrSize[] | undefined, period: {
+    start: string;
+    end: string;
+}, spend: CostSpend | null, exhaustive: boolean): CostPerPr;

package/dist/vendor/shared/org-scan-core/cost-per-pr.js

@@ -0,0 +1,101 @@
+/** Strictly below this is small. 50 is medium. */
+export const SMALL_MAX_EXCLUSIVE = 50;
+/** At or below this (and not small) is medium. 500 is medium; 501 is large. */
+export const MEDIUM_MAX_INCLUSIVE = 500;
+export const sizeBucket = (lines) => lines < SMALL_MAX_EXCLUSIVE ? "small" : lines <= MEDIUM_MAX_INCLUSIVE ? "medium" : "large";
+const DAY_MS = 86_400_000;
+/** Inclusive day count of YYYY-MM-DD..YYYY-MM-DD, or null if unparsable or reversed. */
+export function periodDays(p) {
+    const s = Date.parse(`${p.start}T00:00:00Z`);
+    const e = Date.parse(`${p.end}T00:00:00Z`);
+    if (!Number.isFinite(s) || !Number.isFinite(e) || e < s)
+        return null;
+    return Math.round((e - s) / DAY_MS) + 1;
+}
+const pos = (n) => typeof n === "number" && Number.isFinite(n) && n > 0;
+/** The period's spend in USD as [low, high]; null when there is no usable spend. */
+export function spendForPeriod(spend) {
+    let r;
+    if (spend.source === "anthropic_usage") {
+        if (!pos(spend.usd))
+            return null;
+        r = [spend.usd, spend.usd];
+    }
+    else {
+        if (!pos(spend.highUsd) || !(spend.lowUsd >= 0) || spend.lowUsd > spend.highUsd)
+            return null;
+        r = [spend.lowUsd, spend.highUsd];
+    }
+    return r.every((x) => Number.isFinite(x) && x * 100 <= Number.MAX_SAFE_INTEGER) ? r : null;
+}
+/** The modelled estimate as a spend source, or null when the estimate is "none". */
+export const modelledSpend = (e) => e.kind === "range" ? { source: "modelled_range", lowUsd: e.lowUsd, highUsd: e.highUsd } : null;
+/**
+ * `share` is the fraction of the period's spend one average PR here carries: always in (0, 1] by
+ * construction, and the spend is already bounded to safe-integer cents by spendForPeriod, so the
+ * rounded cents are finite safe integers without a further guard.
+ */
+function figure(spend, [low, high], count, share, scope) {
+    const c = (usd) => Math.round(usd * share * 100);
+    const base = {
+        label: "estimate",
+        spend_source: spend.source,
+        pr_scope: scope,
+        pr_count: count,
+        ...(spend.source === "anthropic_usage" ? { spend_scope: "whole_org" } : {}),
+    };
+    return spend.source === "modelled_range"
+        ? { ...base, low_cents: c(low), high_cents: c(high) }
+        : { ...base, value_cents: c(low) };
+}
+/**
+ * @param prs           every merged PR the scan read, with merge day and size
+ * @param exhaustive    true only if the scan read EVERY merged PR in the period (no sample, no skipped
+ *                      large PR, none unreadable, no cap hit). Otherwise the average is not defined.
+ */
+export function buildCostPerPr(prs, period, spend, exhaustive) {
+    if (!exhaustive || !spend || !Array.isArray(prs))
+        return {};
+    if (periodDays(period) === null)
+        return {};
+    const total = spendForPeriod(spend);
+    if (!total)
+        return {};
+    const inPeriod = prs.filter((p) => p.mergedDay >= period.start &&
+        p.mergedDay <= period.end &&
+        Number.isSafeInteger(p.lines) &&
+        p.lines >= 0);
+    // The modelled estimate is AI-tool spend, so it is split across AI-assisted PRs only; the usage key is
+    // the whole spend, so it is split across every merged PR.
+    const scope = spend.source === "modelled_range" ? "ai_assisted" : "all_merged";
+    const scoped = scope === "ai_assisted" ? inPeriod.filter((p) => p.aiAssisted) : inPeriod;
+    const n = scoped.length;
+    if (n === 0)
+        return {};
+    const out = {};
+    out.cost_per_merged_pr = figure(spend, total, n, 1 / n, scope);
+    let allLines = 0;
+    const agg = {
+        small: { n: 0, lines: 0 },
+        medium: { n: 0, lines: 0 },
+        large: { n: 0, lines: 0 },
+    };
+    for (const p of scoped) {
+        allLines += p.lines;
+        const a = agg[sizeBucket(p.lines)];
+        a.n += 1;
+        a.lines += p.lines;
+    }
+    // Splitting by lines needs lines: with none (or a sum past safe range) there is no size figure.
+    if (allLines <= 0 || !Number.isSafeInteger(allLines))
+        return out;
+    const bySize = {};
+    for (const b of ["small", "medium", "large"]) {
+        const a = agg[b];
+        if (a.n === 0)
+            continue;
+        bySize[b] = figure(spend, total, a.n, a.lines / a.n / allLines, scope);
+    }
+    out.cost_by_pr_size = bySize;
+    return out;
+}

package/dist/vendor/shared/org-scan-core/credential.d.ts

@@ -0,0 +1,43 @@
+/**
+ * GitHubCredential: the one seam through which a scan obtains a GitHub token.
+ *
+ * The scan core only ever sees this interface. The CLI's default is the GitHub login of whoever runs the
+ * scan (`gh auth token`, cli/src/lib/scan/credential.ts); the Mnemom-side run (mnemom-api, MNE-9743)
+ * supplies a read-only installation token. Port of the read-only rule in mnemom-api
+ * src/org-scan/github-scan-app.ts. Runtime-neutral: no Node or Worker API.
+ */
+/** The complete permission set the CLI's scan credential may hold. Read only. */
+export declare const SCAN_READ_PERMISSIONS: Readonly<Record<string, "read">>;
+/**
+ * The complete permission set the Mnemom-side run's App token may hold (org-scan threat model): no
+ * `contents`. `checks` is what the check-runs read needs on an App installation token.
+ */
+export declare const SERVER_SCAN_READ_PERMISSIONS: Readonly<Record<string, "read">>;
+export interface GitHubCredential {
+    /** Fixed label for diagnostics ("app", "personal"): never a token, login or URL. */
+    readonly kind: string;
+    /** A bearer token for reading `repo` (owner/name). A rejection fails that read closed. */
+    tokenFor(repo: string): Promise<string>;
+    /**
+     * The permissions GitHub granted this credential, when the source can tell. Null = unknown (for
+     * example a classic token); the scan then relies on GET-only egress and does not claim more.
+     */
+    grantedPermissions?(): Promise<Record<string, string> | null>;
+}
+/**
+ * Violations (empty when the map is exactly the read-only set `allowed`, by default the CLI's set).
+ * Port of readOnlyViolations.
+ */
+export declare function readOnlyViolations(permissions: Record<string, string> | null | undefined, allowed?: Readonly<Record<string, "read">>): string[];
+/** owner/name, no dot-only segment. */
+export declare function isValidRepoSlug(s: unknown): s is string;
+/** Fixed-text failure: the message never carries a token, a body or a URL. */
+export declare class ScanCredentialError extends Error {
+    constructor(message: "scan credential refused" | "scan credential not configured");
+}
+/**
+ * Refuses a credential GitHub granted anything other than exactly `allowed` (read only) to. Throws a
+ * fixed-text error and nothing else. Unknown (null) permissions pass: the source cannot tell, and the
+ * scan is GET-only regardless.
+ */
+export declare function assertReadOnlyCredential(c: GitHubCredential, allowed?: Readonly<Record<string, "read">>): Promise<void>;