@mnemom/mnemom 0.17.38-next.1 → 0.17.38-next.3

package/dist/vendor/shared/org-scan-core/scan.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Capped scan core, shared by the CLI and the Mnemom-side run (MNE-9752). Port of the window path of runCappedScan (mnemom-api capped-scan.ts, PR #4208)
+ * plus the spend estimate (#4222). Everything outside is injected (credential, PR source, clock), so the
+ * core touches no network or disk, and the report exists only in memory.
+ */
+import { type GitHubCredential } from "./credential.js";
+import { type ScanCaps, type StopReason } from "./caps.js";
+import { type FailureReason } from "./failure.js";
+import { type PrSource } from "./pr-source.js";
+import type { PrSize } from "./cost-per-pr.js";
+import { type SpendEstimate } from "./spend/spend-estimate.js";
+export interface ScanInput {
+    repos: string[];
+    /** Inclusive dates, YYYY-MM-DD. */
+    period: {
+        start: string;
+        end: string;
+    };
+}
+export interface ScanDeps {
+    credential: GitHubCredential;
+    prs?: PrSource;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    caps?: Partial<ScanCaps>;
+    /** The exact read-only permission set the credential must hold. Defaults to the CLI's set. */
+    permissions?: Readonly<Record<string, "read">>;
+    /** Aborts every GitHub read (the caller's run deadline). */
+    signal?: AbortSignal;
+    /** user-agent for the GitHub reads; defaults to the CLI's. */
+    userAgent?: string;
+}
+export interface Coverage {
+    complete: boolean;
+    stoppedBy: StopReason | null;
+    prsExamined: number;
+    prsSkippedLarge: number;
+    prsUnreadable: number;
+    reposRead: number;
+    reposTotal: number;
+    reads: number;
+    windowStart: string;
+    windowEnd: string;
+    /** Set only when the window held more merged PRs than the quota and an even sample was taken. */
+    windowSampledFrom?: number;
+}
+export interface RepoTotals {
+    repo: string;
+    prs: number;
+    reverts: number;
+    ciGreen: number;
+    /** PRs read and counted (not reverts, not skipped); the per-repo base of the CI-green share. */
+    examined: number;
+}
+export interface ScanResult {
+    coverage: Coverage;
+    totals: {
+        prs: number;
+        reverts: number;
+        ciGreen: number;
+        examined: number;
+    };
+    byRepo: RepoTotals[];
+    spend: SpendEstimate;
+    /** Every merged PR read in full (reverts and unreadable/oversize PRs excluded): merge day and size. In memory only. */
+    prSizes: PrSize[];
+}
+export type ScanOutcome = {
+    status: "done";
+    result: ScanResult;
+} | {
+    status: "withheld";
+    reason: FailureReason;
+};
+export declare function runLocalScan(deps: ScanDeps, input: ScanInput): Promise<ScanOutcome>;

package/dist/vendor/shared/org-scan-core/scan.js

@@ -0,0 +1,202 @@
+// GENERATED from shared/org-scan-core/src/scan.ts by cli/scripts/sync-org-scan-core.mjs; do not edit.
+/**
+ * Capped scan core, shared by the CLI and the Mnemom-side run (MNE-9752). Port of the window path of runCappedScan (mnemom-api capped-scan.ts, PR #4208)
+ * plus the spend estimate (#4222). Everything outside is injected (credential, PR source, clock), so the
+ * core touches no network or disk, and the report exists only in memory.
+ */
+import { assertReadOnlyCredential, isValidRepoSlug } from "./credential.js";
+import { Budget, COVERAGE_MONTHS, evenSample, monthsBefore, sanitiseCaps, } from "./caps.js";
+import { classifyFailure } from "./failure.js";
+import { createGithubPrSource } from "./pr-source.js";
+import { estimateSpend } from "./spend/spend-estimate.js";
+const validDay = (d) => typeof d === "string" &&
+    /^\d{4}-\d{2}-\d{2}$/.test(d) &&
+    !Number.isNaN(Date.parse(`${d}T00:00:00Z`));
+export async function runLocalScan(deps, input) {
+    if (!validDay(input.period.start) ||
+        !validDay(input.period.end) ||
+        input.repos.length === 0 ||
+        !input.repos.every(isValidRepoSlug)) {
+        return { status: "withheld", reason: "invalid_input" };
+    }
+    try {
+        await assertReadOnlyCredential(deps.credential, deps.permissions);
+    }
+    catch (e) {
+        return { status: "withheld", reason: classifyFailure(e) };
+    }
+    const prs = deps.prs ??
+        createGithubPrSource({
+            credential: deps.credential,
+            fetchImpl: deps.fetchImpl,
+            signal: deps.signal,
+            userAgent: deps.userAgent,
+        });
+    const now = deps.now ?? Date.now;
+    const caps = sanitiseCaps(deps.caps ?? {});
+    const budget = new Budget(caps, now, now());
+    let stoppedBy = null;
+    const stop = (r) => {
+        if (r && !stoppedBy)
+            stoppedBy = r;
+        return stoppedBy !== null;
+    };
+    const periodStart = input.period.start;
+    const windowStart = periodStart < monthsBefore(input.period.end, COVERAGE_MONTHS)
+        ? periodStart
+        : monthsBefore(input.period.end, COVERAGE_MONTHS);
+    const endDay = input.period.end;
+    const pool = [];
+    let reposRead = 0;
+    let listingCut = false;
+    try {
+        for (const repo of input.repos) {
+            if (stoppedBy !== null || stop(budget.block()))
+                break;
+            reposRead += 1;
+            let cursor = null;
+            const days = [];
+            let oldestUpdated = "9999-99-99";
+            do {
+                if (stop(budget.block()))
+                    break;
+                // Listing may use at most half the read budget, so it never starves the reads of the PRs it found.
+                if (budget.reads * 2 > caps.maxReads) {
+                    listingCut = true;
+                    break;
+                }
+                budget.charge(1);
+                const page = await prs.indexMerged(repo, cursor, budget.room() + 1);
+                budget.charge((Number.isFinite(page.reads) && page.reads >= 1 ? page.reads : 1) - 1);
+                const overrun = budget.overrun();
+                if (overrun) {
+                    stop(overrun);
+                    break;
+                }
+                for (const item of page.items) {
+                    pool.push({ repo, item });
+                    days.push(item.mergedDay);
+                    if (item.updatedDay < oldestUpdated)
+                        oldestUpdated = item.updatedDay;
+                }
+                cursor = page.next;
+                // Newest-activity first: once a seen PR was last touched before D, no later page holds a PR
+                // merged on or after D. Stop when D is both the window start and the merge day of this repo's
+                // maxPrs-th newest merged PR.
+                const kth = days.length >= caps.maxPrs ? [...days].sort().reverse()[caps.maxPrs - 1] : null;
+                if (kth !== null && oldestUpdated < (kth < windowStart ? kth : windowStart))
+                    break;
+            } while (cursor !== null && stoppedBy === null);
+            if (listingCut) {
+                if (cursor === null && days.length === 0)
+                    reposRead -= 1;
+                break;
+            }
+        }
+        // Newest first, ties by repo then number: the same pool always gives the same sample.
+        for (let i = pool.length - 1; i >= 0; i--)
+            if (pool[i].item.mergedDay > endDay)
+                pool.splice(i, 1);
+        pool.sort((a, b) => (a.item.mergedDay === b.item.mergedDay
+            ? 0
+            : a.item.mergedDay < b.item.mergedDay
+                ? 1
+                : -1) ||
+            (a.repo < b.repo ? -1 : a.repo > b.repo ? 1 : 0) ||
+            b.item.number - a.item.number);
+        const inWindow = pool.filter((p) => p.item.mergedDay >= windowStart);
+        const sampled = inWindow.length > caps.maxPrs;
+        const chosen = sampled ? evenSample(inWindow, caps.maxPrs) : pool.slice(0, caps.maxPrs);
+        const byRepo = new Map();
+        const bucket = (repo) => {
+            let b = byRepo.get(repo);
+            if (!b)
+                byRepo.set(repo, (b = { repo, prs: 0, reverts: 0, ciGreen: 0, examined: 0 }));
+            return b;
+        };
+        const totals = { prs: 0, reverts: 0, ciGreen: 0, examined: 0 };
+        const spendInputs = [];
+        const prSizes = [];
+        let skippedLarge = 0;
+        let unreadable = 0;
+        for (const { repo, item } of chosen) {
+            // A revert PR is never a candidate: counted from the listing, never read.
+            if (item.reverted) {
+                totals.prs += 1;
+                totals.reverts += 1;
+                bucket(repo).prs += 1;
+                bucket(repo).reverts += 1;
+                continue;
+            }
+            if (stop(budget.block(2)))
+                break;
+            budget.charge(1);
+            const res = await prs.readPr(repo, item, budget.room() + 1);
+            budget.charge((Number.isFinite(res.reads) && res.reads >= 1 ? res.reads : 1) - 1);
+            const overrun = budget.overrun();
+            if (overrun) {
+                stop(overrun);
+                break;
+            }
+            const rec = res.pr;
+            if (!rec) {
+                unreadable += 1;
+                continue;
+            }
+            if (rec.additions + rec.deletions > caps.maxPrSizeLines) {
+                skippedLarge += 1;
+                continue;
+            }
+            totals.prs += 1;
+            totals.examined += 1;
+            bucket(repo).examined += 1;
+            bucket(repo).prs += 1;
+            if (rec.ci === "success") {
+                totals.ciGreen += 1;
+                bucket(repo).ciGreen += 1;
+            }
+            prSizes.push({
+                mergedDay: item.mergedDay,
+                lines: rec.additions + rec.deletions,
+                aiAssisted: (rec.tools?.length ?? 0) > 0,
+            });
+            spendInputs.push({
+                additions: rec.additions,
+                deletions: rec.deletions,
+                markText: "",
+                tools: rec.tools,
+            });
+        }
+        const coverage = {
+            complete: stoppedBy === null &&
+                !listingCut &&
+                unreadable === 0 &&
+                reposRead === input.repos.length &&
+                !sampled,
+            stoppedBy: stoppedBy ?? (listingCut ? "read-cap" : null),
+            prsExamined: totals.examined,
+            prsSkippedLarge: skippedLarge,
+            prsUnreadable: unreadable,
+            reposRead,
+            reposTotal: input.repos.length,
+            reads: budget.reads,
+            windowStart,
+            windowEnd: endDay,
+            ...(sampled ? { windowSampledFrom: inWindow.length } : {}),
+        };
+        return {
+            status: "done",
+            result: {
+                coverage,
+                totals,
+                byRepo: [...byRepo.values()],
+                spend: estimateSpend(spendInputs),
+                prSizes,
+            },
+        };
+    }
+    catch (e) {
+        // Reads only; the raw error is dropped and a fixed reason returned.
+        return { status: "withheld", reason: classifyFailure(e) };
+    }
+}

package/dist/vendor/shared/org-scan-core/spend/ai-tool-detect.d.ts

@@ -0,0 +1,6 @@
+import type { AiTool } from "./prices.js";
+/** Upper bound on text scanned per PR, so one huge body cannot dominate a scan. The TAIL is kept: trailers and "generated with" footers sit at the end. */
+export declare const MAX_MARK_TEXT = 20000;
+export declare const AI_TOOLS: AiTool[];
+/** Tools whose mark appears in the text, in a fixed order. Non-string input yields none. */
+export declare function detectAiTools(markText: unknown): AiTool[];

package/dist/vendor/shared/org-scan-core/spend/ai-tool-detect.js

@@ -0,0 +1,18 @@
+/** Upper bound on text scanned per PR, so one huge body cannot dominate a scan. The TAIL is kept: trailers and "generated with" footers sit at the end. */
+export const MAX_MARK_TEXT = 20_000;
+const TRAILER = String.raw `^[ \t>*-]*co-authored-by:[^\n]*?`;
+const GEN = String.raw `generated (?:with|by|using)[^\n]{0,24}?`;
+const MARKS = {
+    claude_code: new RegExp(`${TRAILER}(?:\\bclaude\\b|noreply@anthropic\\.com)|${GEN}\\bclaude code\\b`, "im"),
+    codex: new RegExp(`${TRAILER}\\bcodex\\b|${GEN}\\bcodex\\b`, "im"),
+    copilot: new RegExp(`${TRAILER}\\bcopilot\\b|${GEN}\\bgithub copilot\\b`, "im"),
+    gemini: new RegExp(`${TRAILER}\\bgemini\\b|${GEN}\\bgemini(?: cli)?\\b`, "im"),
+};
+export const AI_TOOLS = Object.keys(MARKS);
+/** Tools whose mark appears in the text, in a fixed order. Non-string input yields none. */
+export function detectAiTools(markText) {
+    if (typeof markText !== "string" || markText.length === 0)
+        return [];
+    const text = markText.length > MAX_MARK_TEXT ? markText.slice(-MAX_MARK_TEXT) : markText;
+    return AI_TOOLS.filter((t) => MARKS[t].test(text));
+}

package/dist/vendor/shared/org-scan-core/spend/anthropic-usage.d.ts

@@ -0,0 +1,76 @@
+export declare const ANTHROPIC_ADMIN_ORIGIN = "https://api.anthropic.com";
+export declare const ADMIN_KEY_ENV = "ANTHROPIC_ADMIN_KEY";
+/** The only paths a usage credential is ever sent to (design T18: fenced to report endpoints). */
+export declare const REPORT_PATHS: readonly string[];
+/** The fence, as one exported check so it is directly testable. Throws AnthropicUsageError for any other path. */
+export declare function assertReportPath(path: string): void;
+/** The exact auth header to send; same shape as mnemom-api src/org-scan/usage/credential-source.ts. */
+export type AnthropicAuthHeader = {
+    header: "x-api-key";
+    value: string;
+} | {
+    header: "authorization";
+    value: string;
+};
+export declare const DEFAULT_MAX_PAGES = 20;
+/** One shared deadline for a request including its retries (not N x timeout). */
+export declare const DEFAULT_TIMEOUT_MS = 15000;
+export declare const DEFAULT_MAX_RETRIES = 2;
+/** Shape check only; the key is never echoed, even on a mismatch. */
+export declare const isAdminKeyShape: (k: unknown) => k is string;
+export type UsageFailure = "key_invalid" | "key_refused" | "token_refused" | "rate_limited" | "timeout" | "network" | "upstream" | "malformed" | "too_large";
+/** Fixed sentence for a failure reason. */
+export declare const usageFailureText: (r: UsageFailure) => string;
+/** Carries only a reason tag. Its message is the fixed sentence: nothing upstream can reach it. */
+export declare class AnthropicUsageError extends Error {
+    readonly reason: UsageFailure;
+    constructor(reason: UsageFailure);
+}
+export type ContextWindow = "0-200k" | "200k-1M";
+export interface UsageRow {
+    tokens: number;
+    contextWindow: ContextWindow | null;
+}
+export interface Page<R> {
+    rows: R[];
+    truncated: boolean;
+    pages: number;
+}
+export interface CostRow {
+    /** Cents, as Anthropic returns it (a decimal string). */
+    cents: number;
+    currency: string;
+}
+export interface AnthropicUsageDeps {
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    maxPages?: number;
+    timeoutMs?: number;
+    maxRetries?: number;
+}
+export declare function parseUsageRow(raw: unknown): UsageRow;
+export declare function parseCostRow(raw: unknown): CostRow;
+/** Buckets are UTC-aligned: floor so a mid-day start reads the whole bucket it falls in. */
+export declare function alignStartingAt(startingAt: string): string;
+export interface MeasuredUsage {
+    /** Whole-org cost over the period, in USD. */
+    usd: number;
+    /** Fraction in [0, 1] of tokens from requests in the 200k-1M context window; null with no tokens. */
+    over200kShare: number | null;
+}
+/**
+ * The same two reads mnemom-api made: usage grouped by context_window (the exact >200k share) and cost
+ * (total spend). The key is shape-checked before any call so a regular API key never leaves the machine.
+ * Throws AnthropicUsageError only. A walk stopped by the page cap is an error, never a short total.
+ */
+export declare function fetchMeasuredUsage(key: string | undefined, period: {
+    start: string;
+    end: string;
+}, deps?: AnthropicUsageDeps): Promise<MeasuredUsage>;
+/** A WIF access token as the bearer for the two report reads. Printable ASCII only, else key_invalid. */
+export declare function bearerAuth(token: string): AnthropicAuthHeader;
+/** The two reads with an already-resolved credential (pasted key or WIF bearer). Throws AnthropicUsageError only. */
+export declare function fetchMeasuredUsageWithAuth(auth: AnthropicAuthHeader, period: {
+    start: string;
+    end: string;
+}, deps?: AnthropicUsageDeps): Promise<MeasuredUsage>;

package/dist/vendor/shared/org-scan-core/spend/anthropic-usage.js

@@ -0,0 +1,270 @@
+// GENERATED from shared/org-scan-core/src/spend/anthropic-usage.ts by cli/scripts/sync-org-scan-core.mjs; do not edit.
+// MNE-9298 Tier 1: the CTO's own Anthropic Admin key, used LOCALLY, to read measured usage. Port of
+// mnemom-api src/org-scan/usage/usage-client.ts (two read-only GETs: usage_report/messages grouped by
+// context_window, and cost_report) with the server-only parts (egress allowlist) dropped.
+//
+// MNE-9706: the reads take either credential, as the server's credential-source.ts does: the pasted Admin
+// key (x-api-key) or a short-lived WIF access token (Authorization: Bearer, see anthropic-wif.ts). Either
+// one is sent ONLY to the two report paths below; walk() refuses any other path (the fence, design T18:
+// Anthropic's WIF scope for these reports is org:admin, so the fence has to live here).
+//
+// The key is held in memory for the length of the two reads. It is never stored, logged, written to disk,
+// echoed, put in argv, a URL or an error message, and is sent only to api.anthropic.com (a constant, not
+// configurable) in the x-api-key header. Every failure surfaces as a fixed sentence: the thrown value, the
+// response body and the key never reach the terminal.
+export const ANTHROPIC_ADMIN_ORIGIN = "https://api.anthropic.com";
+export const ADMIN_KEY_ENV = "ANTHROPIC_ADMIN_KEY";
+const ANTHROPIC_VERSION = "2023-06-01";
+const USAGE_PATH = "/v1/organizations/usage_report/messages";
+const COST_PATH = "/v1/organizations/cost_report";
+/** The only paths a usage credential is ever sent to (design T18: fenced to report endpoints). */
+export const REPORT_PATHS = [USAGE_PATH, COST_PATH];
+/** The fence, as one exported check so it is directly testable. Throws AnthropicUsageError for any other path. */
+export function assertReportPath(path) {
+    if (!REPORT_PATHS.includes(path))
+        throw new AnthropicUsageError("malformed");
+}
+export const DEFAULT_MAX_PAGES = 20;
+/** One shared deadline for a request including its retries (not N x timeout). */
+export const DEFAULT_TIMEOUT_MS = 15_000;
+export const DEFAULT_MAX_RETRIES = 2;
+const MAX_RETRY_WAIT_MS = 5_000;
+const ADMIN_KEY_RE = /^sk-ant-admin[A-Za-z0-9_-]{8,}$/;
+/** Shape check only; the key is never echoed, even on a mismatch. */
+export const isAdminKeyShape = (k) => typeof k === "string" && ADMIN_KEY_RE.test(k.trim());
+const FAILURE_TEXT = {
+    key_invalid: "The Anthropic admin key is not an Admin API key (it should start with sk-ant-admin).",
+    key_refused: "Anthropic refused the admin key (401/403).",
+    token_refused: "Anthropic refused the workload identity token for the usage reports (401/403). The federation rule needs scope org:admin.",
+    rate_limited: "Anthropic rate limit reached.",
+    timeout: "Anthropic did not answer in time.",
+    network: "Anthropic was unreachable.",
+    upstream: "Anthropic usage could not be read.",
+    malformed: "Anthropic returned usage in a shape this CLI does not recognise.",
+    too_large: "Anthropic usage for this period is too large to read completely.",
+};
+/** Fixed sentence for a failure reason. */
+export const usageFailureText = (r) => FAILURE_TEXT[r];
+/** Carries only a reason tag. Its message is the fixed sentence: nothing upstream can reach it. */
+export class AnthropicUsageError extends Error {
+    reason;
+    constructor(reason) {
+        super(FAILURE_TEXT[reason]);
+        this.reason = reason;
+        this.name = "AnthropicUsageError";
+    }
+}
+const bad = () => {
+    throw new AnthropicUsageError("malformed");
+};
+const rec = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : bad();
+function reqNum(r, k) {
+    const v = r[k];
+    return typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : bad();
+}
+/** Optional counter inside an optional object: absent is 0, present-but-wrong is an error. */
+function optNum(o, k) {
+    if (o === undefined || o === null)
+        return 0;
+    if (typeof o !== "object")
+        return bad();
+    const v = o[k];
+    if (v === undefined || v === null)
+        return 0;
+    return typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : bad();
+}
+export function parseUsageRow(raw) {
+    const r = rec(raw);
+    const cw = r.context_window;
+    if (cw !== null && cw !== undefined && cw !== "0-200k" && cw !== "200k-1M")
+        bad();
+    return {
+        tokens: reqNum(r, "uncached_input_tokens") +
+            reqNum(r, "cache_read_input_tokens") +
+            reqNum(r, "output_tokens") +
+            optNum(r.cache_creation, "ephemeral_1h_input_tokens") +
+            optNum(r.cache_creation, "ephemeral_5m_input_tokens"),
+        contextWindow: (cw ?? null),
+    };
+}
+const CENT = /^-?\d+(\.\d+)?$/;
+export function parseCostRow(raw) {
+    const r = rec(raw);
+    if (typeof r.amount !== "string" || !CENT.test(r.amount))
+        bad();
+    if (typeof r.currency !== "string" || r.currency === "")
+        bad();
+    return { cents: Number(r.amount), currency: r.currency };
+}
+const DAY_MS = 86_400_000;
+/** Buckets are UTC-aligned: floor so a mid-day start reads the whole bucket it falls in. */
+export function alignStartingAt(startingAt) {
+    const t = Date.parse(startingAt);
+    if (!Number.isFinite(t))
+        return startingAt;
+    return new Date(Math.floor(t / DAY_MS) * DAY_MS).toISOString().replace(".000Z", "Z");
+}
+const backoff = (attempt) => Math.min(250 * 2 ** (attempt - 1), MAX_RETRY_WAIT_MS);
+function retryWait(res, attempt) {
+    const ra = Number(res.headers.get("retry-after"));
+    return Number.isFinite(ra) && ra > 0 ? ra * 1000 : backoff(attempt);
+}
+class Reader {
+    auth;
+    fetchImpl;
+    sleep;
+    maxPages;
+    timeoutMs;
+    maxRetries;
+    constructor(auth, deps) {
+        this.auth = auth;
+        this.fetchImpl = deps.fetchImpl ?? ((...a) => fetch(...a));
+        this.sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        this.maxPages = deps.maxPages ?? DEFAULT_MAX_PAGES;
+        this.timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.maxRetries = deps.maxRetries ?? DEFAULT_MAX_RETRIES;
+    }
+    async walk(path, base, parse, callMaxPages) {
+        // The fence: the credential goes to the two report paths and nowhere else.
+        assertReportPath(path);
+        const ceiling = typeof callMaxPages === "number" && Number.isFinite(callMaxPages) && callMaxPages >= 1
+            ? Math.min(this.maxPages, Math.floor(callMaxPages))
+            : this.maxPages;
+        const rows = [];
+        let page = null;
+        let pages = 0;
+        for (;;) {
+            const params = new URLSearchParams(base);
+            if (page)
+                params.set("page", page);
+            const body = await this.request(`${ANTHROPIC_ADMIN_ORIGIN}${path}?${params.toString()}`);
+            pages += 1;
+            if (!Array.isArray(body.data))
+                bad();
+            for (const raw of body.data) {
+                const b = rec(raw);
+                if (typeof b.starting_at !== "string" || typeof b.ending_at !== "string")
+                    bad();
+                if (!Array.isArray(b.results))
+                    bad();
+                for (const r of b.results)
+                    rows.push(parse(r));
+            }
+            const more = body.has_more;
+            if (more !== undefined && more !== null && typeof more !== "boolean")
+                bad();
+            if (more !== true)
+                return { rows, truncated: false, pages };
+            if (typeof body.next_page !== "string" || body.next_page === "")
+                bad();
+            if (pages >= ceiling)
+                return { rows, truncated: true, pages };
+            page = body.next_page;
+        }
+    }
+    async request(url) {
+        const deadline = AbortSignal.timeout(this.timeoutMs);
+        for (let attempt = 0;;) {
+            let res;
+            try {
+                res = await this.fetchImpl(url, {
+                    method: "GET",
+                    headers: {
+                        [this.auth.header]: this.auth.value,
+                        "anthropic-version": ANTHROPIC_VERSION,
+                        accept: "application/json",
+                    },
+                    // A redirect would carry the x-api-key header to wherever it points: refuse to follow one.
+                    redirect: "error",
+                    signal: deadline,
+                });
+            }
+            catch {
+                // Never surface the thrown value: it can carry the request.
+                if (deadline.aborted)
+                    throw new AnthropicUsageError("timeout");
+                if (attempt++ < this.maxRetries) {
+                    await this.sleep(backoff(attempt));
+                    continue;
+                }
+                throw new AnthropicUsageError("network");
+            }
+            if (res.ok) {
+                let json;
+                try {
+                    json = await res.json();
+                }
+                catch {
+                    throw new AnthropicUsageError("upstream");
+                }
+                return rec(json);
+            }
+            await res.body?.cancel().catch(() => { });
+            if (res.status === 401 || res.status === 403)
+                throw new AnthropicUsageError(this.auth.header === "x-api-key" ? "key_refused" : "token_refused");
+            const retryable = res.status === 429 || res.status >= 500;
+            const wait = retryable ? retryWait(res, attempt + 1) : 0;
+            if (retryable &&
+                !deadline.aborted &&
+                wait <= MAX_RETRY_WAIT_MS &&
+                attempt++ < this.maxRetries) {
+                await this.sleep(wait);
+                continue;
+            }
+            throw new AnthropicUsageError(res.status === 429 ? "rate_limited" : "upstream");
+        }
+    }
+}
+const validDay = (d) => /^\d{4}-\d{2}-\d{2}$/.test(d) && Number.isFinite(Date.parse(`${d}T00:00:00Z`));
+/**
+ * The same two reads mnemom-api made: usage grouped by context_window (the exact >200k share) and cost
+ * (total spend). The key is shape-checked before any call so a regular API key never leaves the machine.
+ * Throws AnthropicUsageError only. A walk stopped by the page cap is an error, never a short total.
+ */
+export async function fetchMeasuredUsage(key, period, deps = {}) {
+    const k = key?.trim();
+    if (!k || !isAdminKeyShape(k))
+        throw new AnthropicUsageError("key_invalid");
+    return fetchMeasuredUsageWithAuth({ header: "x-api-key", value: k }, period, deps);
+}
+/** A WIF access token as the bearer for the two report reads. Printable ASCII only, else key_invalid. */
+export function bearerAuth(token) {
+    if (!/^[\x21-\x7e]{8,4096}$/.test(token))
+        throw new AnthropicUsageError("key_invalid");
+    return { header: "authorization", value: `Bearer ${token}` };
+}
+/** The two reads with an already-resolved credential (pasted key or WIF bearer). Throws AnthropicUsageError only. */
+export async function fetchMeasuredUsageWithAuth(auth, period, deps = {}) {
+    if (!validDay(period.start) || !validDay(period.end))
+        throw new AnthropicUsageError("malformed");
+    const startingAt = alignStartingAt(`${period.start}T00:00:00Z`);
+    const endingAt = new Date(Date.parse(`${period.end}T00:00:00Z`) + DAY_MS).toISOString();
+    const reader = new Reader(auth, deps);
+    const up = new URLSearchParams({
+        starting_at: startingAt,
+        ending_at: endingAt,
+        bucket_width: "1d",
+    });
+    up.append("group_by[]", "context_window");
+    const usage = await reader.walk(USAGE_PATH, up, parseUsageRow);
+    if (usage.truncated)
+        throw new AnthropicUsageError("too_large");
+    const cp = new URLSearchParams({ starting_at: startingAt, ending_at: endingAt });
+    const cost = await reader.walk(COST_PATH, cp, parseCostRow);
+    if (cost.truncated)
+        throw new AnthropicUsageError("too_large");
+    let total = 0;
+    let over = 0;
+    for (const r of usage.rows) {
+        total += r.tokens;
+        if (r.contextWindow === "200k-1M")
+            over += r.tokens;
+    }
+    let cents = 0;
+    for (const r of cost.rows) {
+        if (r.currency !== "USD")
+            throw new AnthropicUsageError("malformed");
+        cents += r.cents;
+    }
+    return { usd: Math.round(cents) / 100, over200kShare: total > 0 ? over / total : null };
+}

package/dist/{lib/scan → vendor/shared/org-scan-core}/spend/cost-corpus.v1.js

@@ -1,3 +1,4 @@
+// GENERATED from shared/org-scan-core/src/spend/cost-corpus.v1.ts by cli/scripts/sync-org-scan-core.mjs; do not edit.
 // Cost corpus (port of mnemom-api src/org-scan/spend/cost-corpus.v1.json, as_of 2026-10-28T00:00:00Z). A TS module, not a
 // JSON asset, so the build needs no copy-assets entry.
 export default {