@mnemom/mnemom 0.17.38-next.0 → 0.17.38-next.2

package/dist/lib/scan/caps.js

@@ -1,67 +1,2 @@
-/**
- * Coverage caps and sampling. Port of mnemom-api src/org-scan/scan/capped-scan.ts (PR #4208).
- *
- * Coverage decision (Shraddha, 2026-10-28): each scan covers the last 3 months OR the last 2,000 merged
- * PRs, whichever is MORE; above 2,000 in the window, an even deterministic sample of 2,000.
- */
-export const COVERAGE_MONTHS = 3;
-export const DEFAULT_SCAN_CAPS = {
-    maxPrs: 2_000,
-    maxPrSizeLines: 20_000,
-    maxReads: 4_500,
-    maxMillis: 15 * 60_000,
-};
-/** The day `months` calendar months before `end` (YYYY-MM-DD, UTC), clamped to the month's last day. */
-export function monthsBefore(end, months) {
-    const [y, m, d] = end.split("-").map(Number);
-    const target = new Date(Date.UTC(y, m - 1 - months, 1));
-    const last = new Date(Date.UTC(target.getUTCFullYear(), target.getUTCMonth() + 1, 0)).getUTCDate();
-    target.setUTCDate(Math.min(d, last));
-    return target.toISOString().slice(0, 10);
-}
-/** `k` items spread evenly across `items` (order kept): index floor(i*n/k). Deterministic; n <= k returns all. */
-export function evenSample(items, k) {
-    const n = items.length;
-    if (n <= k)
-        return [...items];
-    return Array.from({ length: k }, (_, i) => items[Math.floor((i * n) / k)]);
-}
-export function sanitiseCaps(c) {
-    const pos = (n, d) => typeof n === "number" && Number.isFinite(n) && n > 0 ? Math.floor(n) : d;
-    return {
-        maxPrs: pos(c.maxPrs, DEFAULT_SCAN_CAPS.maxPrs),
-        maxPrSizeLines: pos(c.maxPrSizeLines, DEFAULT_SCAN_CAPS.maxPrSizeLines),
-        maxReads: pos(c.maxReads, DEFAULT_SCAN_CAPS.maxReads),
-        maxMillis: pos(c.maxMillis, DEFAULT_SCAN_CAPS.maxMillis),
-    };
-}
-/** Running read budget. Every call is told how many reads it may spend (`room`). */
-export class Budget {
-    caps;
-    now;
-    startedAt;
-    reads = 0;
-    constructor(caps, now, startedAt) {
-        this.caps = caps;
-        this.now = now;
-        this.startedAt = startedAt;
-    }
-    block(n = 1) {
-        if (this.now() - this.startedAt >= this.caps.maxMillis)
-            return "time-cap";
-        if (this.reads + n > this.caps.maxReads)
-            return "read-cap";
-        return null;
-    }
-    room() {
-        if (this.now() - this.startedAt >= this.caps.maxMillis)
-            return 0;
-        return Math.max(0, this.caps.maxReads - this.reads);
-    }
-    overrun() {
-        return this.reads > this.caps.maxReads ? "read-cap" : null;
-    }
-    charge(n) {
-        this.reads += n;
-    }
-}
+// Moved to shared/org-scan-core (MNE-9752); vendored at cli/src/vendor/shared/org-scan-core. Re-exported so CLI imports stay put.
+export * from "../../vendor/shared/org-scan-core/caps.js";

package/dist/lib/scan/cost-per-pr.d.ts

@@ -1,93 +1 @@
-/**
- * Cost per merged PR and cost by PR size, for the Org Scan report. Pure: numbers in, numbers out.
- *
- * Source of the spend. Measured per-request cost cannot be tied to a PR with the data the scan has:
- * the Anthropic usage reads return one whole-org total (no per-request or per-PR rows) and the Mnemom
- * Record totals are one window sum (model cost and a request count, no PR key). So every figure here is
- * `label: "estimate"`: the period's spend split across the merged PRs in proportion to lines changed.
- * Each figure names the spend it was split from (`spend_source`); sources are never mixed in one report.
- *
- *   anthropic_usage          the whole-org Anthropic cost for the period (the CTO's admin key)
- *   modelled_range           our modelled estimate (a low to high range, so the figures are ranges)
- *
- * Size is per PR, in lines changed = additions + deletions, exactly as GitHub reports them. Lockfiles and
- * generated files are NOT excluded. small < 50; medium 50..500 inclusive; large > 500.
- *
- * Each size figure is the average cost of ONE PR of that size: spend * (mean lines of the bucket) /
- * (total lines of the PRs in scope). Scope: the modelled estimate prices AI-assisted PRs only, so it is
- * split across those only (`pr_scope: "ai_assisted"`, buckets too); the others use every merged PR
- * (`pr_scope: "all_merged"`). `pr_count` counts PRs in that scope. Usage-key figures also carry
- * `spend_scope: "whole_org"` (the key covers the whole organization, not just the scanned repos). The cost per merged PR is the spend over the count of merged PRs.
- *
- * Missing data is an absent field, never 0 or NaN: no usable spend, zero merged PRs in the period, an
- * empty bucket, a scan that did not read every merged PR in the period, or a result past safe-integer
- * range. Reverts are listed without sizes, so they are not counted as merged PRs here.
- */
-import type { SpendEstimate } from "./spend/spend-estimate.js";
-/** Strictly below this is small. 50 is medium. */
-export declare const SMALL_MAX_EXCLUSIVE = 50;
-/** At or below this (and not small) is medium. 500 is medium; 501 is large. */
-export declare const MEDIUM_MAX_INCLUSIVE = 500;
-export type SizeBucket = "small" | "medium" | "large";
-export type CostSpendSourceName = "anthropic_usage" | "modelled_range";
-export interface PrSize {
-    /** YYYY-MM-DD, UTC. */
-    mergedDay: string;
-    /** additions + deletions. */
-    lines: number;
-    /** The PR carries an AI-tool mark (the same rule the modelled spend uses to count AI-assisted PRs). */
-    aiAssisted: boolean;
-}
-/** Where the spend comes from. USD, never cents. */
-export type CostSpend = {
-    source: "anthropic_usage";
-    usd: number;
-} | {
-    source: "modelled_range";
-    lowUsd: number;
-    highUsd: number;
-};
-/** One figure: a single value, or a low to high range for the modelled source. Integer cents. */
-export type PrScope = "ai_assisted" | "all_merged";
-export type CostFigure = {
-    /** "measured" is not possible with current data (see header); every figure is an estimate. */
-    label: "estimate";
-    spend_source: CostSpendSourceName;
-    /**
-     * Which PRs the average is over. The modelled estimate prices AI-assisted PRs only, so it is split
-     * across those only ("ai_assisted"); the usage key covers all spend, so they use "all_merged".
-     */
-    pr_scope: PrScope;
-    /** PRs in that scope. */
-    pr_count: number;
-    /** Present on anthropic_usage only: the key's usage is the whole organization's, not just these PRs'. */
-    spend_scope?: "whole_org";
-} & ({
-    value_cents: number;
-} | {
-    low_cents: number;
-    high_cents: number;
-});
-export interface CostPerPr {
-    cost_per_merged_pr?: CostFigure;
-    cost_by_pr_size?: Partial<Record<SizeBucket, CostFigure>>;
-}
-export declare const sizeBucket: (lines: number) => SizeBucket;
-/** Inclusive day count of YYYY-MM-DD..YYYY-MM-DD, or null if unparsable or reversed. */
-export declare function periodDays(p: {
-    start: string;
-    end: string;
-}): number | null;
-/** The period's spend in USD as [low, high]; null when there is no usable spend. */
-export declare function spendForPeriod(spend: CostSpend): [number, number] | null;
-/** The modelled estimate as a spend source, or null when the estimate is "none". */
-export declare const modelledSpend: (e: SpendEstimate) => CostSpend | null;
-/**
- * @param prs           every merged PR the scan read, with merge day and size
- * @param exhaustive    true only if the scan read EVERY merged PR in the period (no sample, no skipped
- *                      large PR, none unreadable, no cap hit). Otherwise the average is not defined.
- */
-export declare function buildCostPerPr(prs: readonly PrSize[] | undefined, period: {
-    start: string;
-    end: string;
-}, spend: CostSpend | null, exhaustive: boolean): CostPerPr;
+export * from "../../vendor/shared/org-scan-core/cost-per-pr.js";

package/dist/lib/scan/cost-per-pr.js

@@ -1,101 +1,2 @@
-/** Strictly below this is small. 50 is medium. */
-export const SMALL_MAX_EXCLUSIVE = 50;
-/** At or below this (and not small) is medium. 500 is medium; 501 is large. */
-export const MEDIUM_MAX_INCLUSIVE = 500;
-export const sizeBucket = (lines) => lines < SMALL_MAX_EXCLUSIVE ? "small" : lines <= MEDIUM_MAX_INCLUSIVE ? "medium" : "large";
-const DAY_MS = 86_400_000;
-/** Inclusive day count of YYYY-MM-DD..YYYY-MM-DD, or null if unparsable or reversed. */
-export function periodDays(p) {
-    const s = Date.parse(`${p.start}T00:00:00Z`);
-    const e = Date.parse(`${p.end}T00:00:00Z`);
-    if (!Number.isFinite(s) || !Number.isFinite(e) || e < s)
-        return null;
-    return Math.round((e - s) / DAY_MS) + 1;
-}
-const pos = (n) => typeof n === "number" && Number.isFinite(n) && n > 0;
-/** The period's spend in USD as [low, high]; null when there is no usable spend. */
-export function spendForPeriod(spend) {
-    let r;
-    if (spend.source === "anthropic_usage") {
-        if (!pos(spend.usd))
-            return null;
-        r = [spend.usd, spend.usd];
-    }
-    else {
-        if (!pos(spend.highUsd) || !(spend.lowUsd >= 0) || spend.lowUsd > spend.highUsd)
-            return null;
-        r = [spend.lowUsd, spend.highUsd];
-    }
-    return r.every((x) => Number.isFinite(x) && x * 100 <= Number.MAX_SAFE_INTEGER) ? r : null;
-}
-/** The modelled estimate as a spend source, or null when the estimate is "none". */
-export const modelledSpend = (e) => e.kind === "range" ? { source: "modelled_range", lowUsd: e.lowUsd, highUsd: e.highUsd } : null;
-/**
- * `share` is the fraction of the period's spend one average PR here carries: always in (0, 1] by
- * construction, and the spend is already bounded to safe-integer cents by spendForPeriod, so the
- * rounded cents are finite safe integers without a further guard.
- */
-function figure(spend, [low, high], count, share, scope) {
-    const c = (usd) => Math.round(usd * share * 100);
-    const base = {
-        label: "estimate",
-        spend_source: spend.source,
-        pr_scope: scope,
-        pr_count: count,
-        ...(spend.source === "anthropic_usage" ? { spend_scope: "whole_org" } : {}),
-    };
-    return spend.source === "modelled_range"
-        ? { ...base, low_cents: c(low), high_cents: c(high) }
-        : { ...base, value_cents: c(low) };
-}
-/**
- * @param prs           every merged PR the scan read, with merge day and size
- * @param exhaustive    true only if the scan read EVERY merged PR in the period (no sample, no skipped
- *                      large PR, none unreadable, no cap hit). Otherwise the average is not defined.
- */
-export function buildCostPerPr(prs, period, spend, exhaustive) {
-    if (!exhaustive || !spend || !Array.isArray(prs))
-        return {};
-    if (periodDays(period) === null)
-        return {};
-    const total = spendForPeriod(spend);
-    if (!total)
-        return {};
-    const inPeriod = prs.filter((p) => p.mergedDay >= period.start &&
-        p.mergedDay <= period.end &&
-        Number.isSafeInteger(p.lines) &&
-        p.lines >= 0);
-    // The modelled estimate is AI-tool spend, so it is split across AI-assisted PRs only; the usage key is
-    // the whole spend, so it is split across every merged PR.
-    const scope = spend.source === "modelled_range" ? "ai_assisted" : "all_merged";
-    const scoped = scope === "ai_assisted" ? inPeriod.filter((p) => p.aiAssisted) : inPeriod;
-    const n = scoped.length;
-    if (n === 0)
-        return {};
-    const out = {};
-    out.cost_per_merged_pr = figure(spend, total, n, 1 / n, scope);
-    let allLines = 0;
-    const agg = {
-        small: { n: 0, lines: 0 },
-        medium: { n: 0, lines: 0 },
-        large: { n: 0, lines: 0 },
-    };
-    for (const p of scoped) {
-        allLines += p.lines;
-        const a = agg[sizeBucket(p.lines)];
-        a.n += 1;
-        a.lines += p.lines;
-    }
-    // Splitting by lines needs lines: with none (or a sum past safe range) there is no size figure.
-    if (allLines <= 0 || !Number.isSafeInteger(allLines))
-        return out;
-    const bySize = {};
-    for (const b of ["small", "medium", "large"]) {
-        const a = agg[b];
-        if (a.n === 0)
-            continue;
-        bySize[b] = figure(spend, total, a.n, a.lines / a.n / allLines, scope);
-    }
-    out.cost_by_pr_size = bySize;
-    return out;
-}
+// Moved to shared/org-scan-core (MNE-9752); vendored at cli/src/vendor/shared/org-scan-core. Re-exported so CLI imports stay put.
+export * from "../../vendor/shared/org-scan-core/cost-per-pr.js";

package/dist/lib/scan/credential.d.ts

@@ -1,29 +1,5 @@
-/** The complete permission set a scan credential may hold. Read only. */
-export declare const SCAN_READ_PERMISSIONS: Readonly<Record<string, "read">>;
-export interface GitHubCredential {
-    /** Fixed label for diagnostics ("app", "personal"): never a token, login or URL. */
-    readonly kind: string;
-    /** A bearer token for reading `repo` (owner/name). A rejection fails that read closed. */
-    tokenFor(repo: string): Promise<string>;
-    /**
-     * The permissions GitHub granted this credential, when the source can tell. Null = unknown (for
-     * example a classic token); the scan then relies on GET-only egress and does not claim more.
-     */
-    grantedPermissions?(): Promise<Record<string, string> | null>;
-}
-/** Violations (empty when the map is exactly the read-only scan set). Port of readOnlyViolations. */
-export declare function readOnlyViolations(permissions: Record<string, string> | null | undefined): string[];
-/** owner/name, no dot-only segment. */
-export declare function isValidRepoSlug(s: unknown): s is string;
-/** Fixed-text failure: the message never carries a token, a body or a URL. */
-export declare class ScanCredentialError extends Error {
-    constructor(message: "scan credential refused" | "scan credential not configured");
-}
-/**
- * Refuses a credential GitHub granted more than read to. Throws a fixed-text error and nothing else.
- * Unknown (null) permissions pass: the source cannot tell, and the scan is GET-only regardless.
- */
-export declare function assertReadOnlyCredential(c: GitHubCredential): Promise<void>;
+import { type GitHubCredential } from "../../vendor/shared/org-scan-core/credential.js";
+export * from "../../vendor/shared/org-scan-core/credential.js";
 /** Runs `gh auth token`; resolves stdout or rejects. Injectable so tests never spawn a process. */
 export type GhTokenRunner = () => Promise<string>;
 /**

package/dist/lib/scan/credential.js

@@ -1,64 +1,11 @@
 /**
- * GitHubCredential: the one seam through which a local scan obtains a GitHub token.
- *
- * The scan core only ever sees this interface. The concrete default is the GitHub login of whoever
- * runs the scan (`gh auth token`, see createGhLoginCredential); the server-issued App token path is
- * retired (design owner, 2026-10-28). Port of the read-only rule in mnemom-api
- * src/org-scan/github-scan-app.ts.
+ * The CLI's GitHub credential. The runtime-neutral seam (GitHubCredential, the read-only rule) lives in
+ * shared/org-scan-core (MNE-9752) and is re-exported here; only the `gh auth token` default, which needs
+ * node:child_process, stays in the CLI.
  */
 import { execFile } from "node:child_process";
-/** The complete permission set a scan credential may hold. Read only. */
-export const SCAN_READ_PERMISSIONS = Object.freeze({
-    metadata: "read",
-    contents: "read",
-    pull_requests: "read",
-});
-/** Violations (empty when the map is exactly the read-only scan set). Port of readOnlyViolations. */
-export function readOnlyViolations(permissions) {
-    const out = [];
-    const p = permissions ?? {};
-    for (const [name, level] of Object.entries(p)) {
-        if (level !== "read")
-            out.push(`${name}:${level} is not read`);
-        if (!(name in SCAN_READ_PERMISSIONS))
-            out.push(`${name} is not in the scan permission set`);
-    }
-    for (const name of Object.keys(SCAN_READ_PERMISSIONS)) {
-        if (!(name in p))
-            out.push(`${name} missing`);
-    }
-    return out;
-}
-/** owner/name, no dot-only segment. */
-export function isValidRepoSlug(s) {
-    return (typeof s === "string" &&
-        /^[A-Za-z0-9._-]{1,100}\/[A-Za-z0-9._-]{1,100}$/.test(s) &&
-        !s.split("/").some((p) => /^\.+$/.test(p)));
-}
-/** Fixed-text failure: the message never carries a token, a body or a URL. */
-export class ScanCredentialError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "ScanCredentialError";
-    }
-}
-/**
- * Refuses a credential GitHub granted more than read to. Throws a fixed-text error and nothing else.
- * Unknown (null) permissions pass: the source cannot tell, and the scan is GET-only regardless.
- */
-export async function assertReadOnlyCredential(c) {
-    if (!c.grantedPermissions)
-        return;
-    let perms;
-    try {
-        perms = await c.grantedPermissions();
-    }
-    catch {
-        throw new ScanCredentialError("scan credential refused");
-    }
-    if (perms !== null && readOnlyViolations(perms).length > 0)
-        throw new ScanCredentialError("scan credential refused");
-}
+import { ScanCredentialError, } from "../../vendor/shared/org-scan-core/credential.js";
+export * from "../../vendor/shared/org-scan-core/credential.js";
 const runGhAuthToken = () => new Promise((resolve, reject) => {
     try {
         execFile("gh", ["auth", "token"], { shell: false, windowsHide: true, timeout: 10_000, maxBuffer: 64 * 1024 }, (err, stdout) => {

package/dist/lib/scan/failure.d.ts

@@ -1,10 +1 @@
-/**
- * Scan failure reasons. Port of upstreamTag in mnemom-api capped-scan.ts (PRs #4221 / #4223): an
- * exact-match table of fixed messages to fixed reason tags. The raw error message is NEVER echoed,
- * so no token, URL or GitHub body can reach the terminal or the report. An unrecognised error maps
- * to the generic "github" tag.
- */
-export type FailureReason = "not_installed" | "credential" | "timeout" | "forbidden" | "rate_limited" | "github" | "network" | "invalid_input";
-export declare function classifyFailure(e: unknown): FailureReason;
-/** Fixed sentence for a reason. */
-export declare function failureText(r: FailureReason): string;
+export * from "../../vendor/shared/org-scan-core/failure.js";

package/dist/lib/scan/failure.js

@@ -1,43 +1,2 @@
-const EXACT = new Map([
-    ["github repo not visible", "not_installed"],
-    ["scan credential refused", "credential"],
-    ["scan credential not configured", "credential"],
-    ["invalid repo", "invalid_input"],
-    ["invalid cursor", "invalid_input"],
-    ["scan read not allowed", "invalid_input"],
-    ["unexpected list shape", "github"],
-]);
-export function classifyFailure(e) {
-    if (e instanceof Error) {
-        if (e.name === "TimeoutError" || e.name === "AbortError")
-            return "timeout";
-        const exact = EXACT.get(e.message);
-        if (exact)
-            return exact;
-        const gh = /^github read failed \((\d{3})\)$/.exec(e.message);
-        if (gh) {
-            if (gh[1] === "401" || gh[1] === "403")
-                return "forbidden";
-            if (gh[1] === "429")
-                return "rate_limited";
-            return "github";
-        }
-        if (e instanceof TypeError)
-            return "network";
-    }
-    return "github";
-}
-const TEXT = {
-    not_installed: "a repo is not visible to the credential (check your GitHub access to it)",
-    credential: "the GitHub credential was refused or is not configured",
-    timeout: "GitHub did not answer in time",
-    forbidden: "GitHub refused the credential (401/403)",
-    rate_limited: "GitHub rate limit reached",
-    github: "a GitHub read failed",
-    network: "GitHub was unreachable",
-    invalid_input: "an input to the scan was invalid",
-};
-/** Fixed sentence for a reason. */
-export function failureText(r) {
-    return TEXT[r];
-}
+// Moved to shared/org-scan-core (MNE-9752); vendored at cli/src/vendor/shared/org-scan-core. Re-exported so CLI imports stay put.
+export * from "../../vendor/shared/org-scan-core/failure.js";

package/dist/lib/scan/pr-source.d.ts

@@ -1,57 +1 @@
-/**
- * Read-only GitHub PR source for the local scan. Port of mnemom-api src/org-scan/scan/github-pr-source.ts
- * (window path, PRs #4208 / #4221 / #4223).
- *
- * METADATA only: size counts, a CI rollup, a revert boolean and the AI tools named in the PR body.
- * Titles and bodies are inspected in memory and dropped; author logins, branch names, and code never
- * leave this module (PrRecord has no such field). Every call goes through `guardedGet`, which only
- * ever issues a GET to api.github.com on an allowlisted path. Failures throw fixed-text errors:
- * never a GitHub body, a header, a URL or the token.
- */
-import { type GitHubCredential } from "./credential.js";
-import type { AiTool } from "./spend/prices.js";
-export declare const GITHUB_API = "https://api.github.com";
-/** Merged PRs are listed 100 at a time; a list page is one read however many PRs it holds. */
-export declare const INDEX_PAGE_SIZE = 100;
-export type CiRollup = "none" | "pending" | "success" | "failure";
-export interface PrIndexItem {
-    number: number;
-    /** YYYY-MM-DD, UTC. */
-    mergedDay: string;
-    /** YYYY-MM-DD, UTC, last activity (the listing is newest-activity first). */
-    updatedDay: string;
-    reverted: boolean;
-}
-export interface PrIndexPage {
-    items: PrIndexItem[];
-    next: string | null;
-    reads: number;
-}
-export interface PrRecord {
-    additions: number;
-    deletions: number;
-    changed_files: number;
-    ci?: CiRollup;
-    reverted: boolean;
-    /** AI tools named in the PR body, detected here so the body never leaves this module. */
-    tools: AiTool[];
-}
-export interface PrSource {
-    indexMerged(repo: string, cursor: string | null, maxReads?: number): Promise<PrIndexPage>;
-    readPr(repo: string, item: PrIndexItem, maxReads?: number): Promise<{
-        pr: PrRecord | null;
-        reads: number;
-    }>;
-}
-export interface GithubPrSourceDeps {
-    credential: GitHubCredential;
-    fetchImpl?: typeof fetch;
-    timeoutMs?: number;
-}
-/** Pure: one word from check-run conclusions. No check names, logs or URLs are kept. */
-export declare function rollupCi(runs: Array<{
-    status?: unknown;
-    conclusion?: unknown;
-}>): CiRollup;
-export declare function isAllowedScanPath(path: string): boolean;
-export declare function createGithubPrSource(deps: GithubPrSourceDeps): PrSource;
+export * from "../../vendor/shared/org-scan-core/pr-source.js";

package/dist/lib/scan/pr-source.js

@@ -1,132 +1,2 @@
-/**
- * Read-only GitHub PR source for the local scan. Port of mnemom-api src/org-scan/scan/github-pr-source.ts
- * (window path, PRs #4208 / #4221 / #4223).
- *
- * METADATA only: size counts, a CI rollup, a revert boolean and the AI tools named in the PR body.
- * Titles and bodies are inspected in memory and dropped; author logins, branch names, and code never
- * leave this module (PrRecord has no such field). Every call goes through `guardedGet`, which only
- * ever issues a GET to api.github.com on an allowlisted path. Failures throw fixed-text errors:
- * never a GitHub body, a header, a URL or the token.
- */
-import { isValidRepoSlug } from "./credential.js";
-import { detectAiTools } from "./spend/ai-tool-detect.js";
-export const GITHUB_API = "https://api.github.com";
-/** Merged PRs are listed 100 at a time; a list page is one read however many PRs it holds. */
-export const INDEX_PAGE_SIZE = 100;
-/** Pure: one word from check-run conclusions. No check names, logs or URLs are kept. */
-export function rollupCi(runs) {
-    if (runs.length === 0)
-        return "none";
-    if (runs.some((r) => r.status !== "completed"))
-        return "pending";
-    const ok = new Set(["success", "neutral", "skipped"]);
-    return runs.every((r) => typeof r.conclusion === "string" && ok.has(r.conclusion))
-        ? "success"
-        : "failure";
-}
-const isCount = (n) => typeof n === "number" && Number.isInteger(n) && n >= 0;
-const SLUG = "[A-Za-z0-9._-]{1,100}/[A-Za-z0-9._-]{1,100}";
-/** The only paths the scan may read. Anything else is refused before a request is made. */
-const ALLOWED_PATHS = [
-    new RegExp(`^/repos/${SLUG}/pulls\\?state=closed&sort=updated&direction=desc&per_page=\\d{1,3}&page=\\d{1,4}$`),
-    new RegExp(`^/repos/${SLUG}/pulls/\\d{1,9}$`),
-    new RegExp(`^/repos/${SLUG}/commits/[0-9a-f]{40}/check-runs\\?per_page=100$`),
-    // The repo picker's one list read (MNE-9643): the repos this login can read, newest push first.
-    /^\/user\/repos\?sort=pushed&direction=desc&per_page=\d{1,3}$/,
-];
-export function isAllowedScanPath(path) {
-    return ALLOWED_PATHS.some((re) => re.test(path));
-}
-export function createGithubPrSource(deps) {
-    const doFetch = deps.fetchImpl ?? fetch;
-    const headers = {
-        accept: "application/vnd.github+json",
-        "x-github-api-version": "2022-11-28",
-        "user-agent": "mnemom-cli-scan/1",
-    };
-    /**
-     * `list` marks the PR list read, the first read of a repo. GitHub hides a repo the credential cannot
-     * see behind a 404, so only there is a 404 "repo not visible"; a 404 on a later detail or
-     * check-runs read is an ordinary upstream miss and keeps its numeric message (#4223).
-     */
-    async function guardedGet(path, repo, list = false) {
-        if (!isAllowedScanPath(path))
-            throw new Error("scan read not allowed");
-        const bearer = await deps.credential.tokenFor(repo);
-        const res = await doFetch(`${GITHUB_API}${path}`, {
-            method: "GET",
-            headers: { ...headers, authorization: `Bearer ${bearer}` },
-            redirect: "error",
-            signal: AbortSignal.timeout(deps.timeoutMs ?? 10_000),
-        });
-        if (!res.ok) {
-            await res.body?.cancel().catch(() => { });
-            throw new Error(list && res.status === 404
-                ? "github repo not visible"
-                : `github read failed (${res.status})`);
-        }
-        return res.json();
-    }
-    const day = (v) => {
-        const t = typeof v === "string" ? Date.parse(v) : NaN;
-        return Number.isFinite(t) ? new Date(t).toISOString().slice(0, 10) : null;
-    };
-    return {
-        async indexMerged(repo, cursor) {
-            if (!isValidRepoSlug(repo))
-                throw new Error("invalid repo");
-            const page = cursor === null ? 1 : Number(cursor);
-            if (!Number.isInteger(page) || page < 1 || page > 1000)
-                throw new Error("invalid cursor");
-            const list = (await guardedGet(`/repos/${repo}/pulls?state=closed&sort=updated&direction=desc&per_page=${INDEX_PAGE_SIZE}&page=${page}`, repo, true));
-            if (!Array.isArray(list))
-                throw new Error("unexpected list shape");
-            const items = [];
-            for (const it of list) {
-                const mergedDay = day(it.merged_at);
-                const updatedDay = day(it.updated_at);
-                if (mergedDay === null || updatedDay === null || !isCount(it.number))
-                    continue;
-                // The title is read for the revert marker only and dropped here.
-                items.push({
-                    number: it.number,
-                    mergedDay,
-                    updatedDay,
-                    reverted: typeof it.title === "string" && /^revert\b/i.test(it.title),
-                });
-            }
-            return { items, next: list.length < INDEX_PAGE_SIZE ? null : String(page + 1), reads: 1 };
-        },
-        async readPr(repo, item, maxReads = Number.POSITIVE_INFINITY) {
-            if (!isValidRepoSlug(repo))
-                throw new Error("invalid repo");
-            if (!isCount(item.number) || maxReads < 2)
-                return { pr: null, reads: 0 };
-            const detail = (await guardedGet(`/repos/${repo}/pulls/${item.number}`, repo));
-            let reads = 1;
-            let ci;
-            const sha = detail.head?.sha;
-            if (typeof sha === "string" && /^[0-9a-f]{40}$/.test(sha)) {
-                const checks = (await guardedGet(`/repos/${repo}/commits/${sha}/check-runs?per_page=100`, repo));
-                reads += 1;
-                ci = rollupCi(Array.isArray(checks.check_runs) ? checks.check_runs : []);
-            }
-            if (!isCount(detail.additions) ||
-                !isCount(detail.deletions) ||
-                !isCount(detail.changed_files))
-                return { pr: null, reads };
-            const tools = detectAiTools(detail.body);
-            return {
-                pr: {
-                    additions: detail.additions,
-                    deletions: detail.deletions,
-                    changed_files: detail.changed_files,
-                    ci,
-                    reverted: item.reverted,
-                    tools,
-                },
-                reads,
-            };
-        },
-    };
-}
+// Moved to shared/org-scan-core (MNE-9752); vendored at cli/src/vendor/shared/org-scan-core. Re-exported so CLI imports stay put.
+export * from "../../vendor/shared/org-scan-core/pr-source.js";