@unson/brainbase-mcp 0.44.0 → 0.44.1

package/dist/config-parser.js

@@ -0,0 +1,593 @@
+/**
+ * Config Parser - brainbaseの設定ファイル（YAML）を読み取り、統合ビューを提供
+ */
+import fs from 'fs/promises';
+import path from 'path';
+import yaml from 'js-yaml';
+import { logger as defaultLogger } from './server-support.js';
+function requirePath(name, value) {
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new TypeError(`ConfigParser requires an explicit ${name} path`);
+    }
+    return value;
+}
+export class ConfigParser {
+    /**
+     * Construct a parser with every filesystem boundary supplied by the host.
+     *
+     * The OSS package deliberately has no workspace or repository defaults. A
+     * host that needs compatibility defaults must provide them in its adapter.
+     *
+     * @param paths filesystem boundaries and optional catalog mode supplied by the host
+     */
+    configPath;
+    slackDir;
+    brainbaseRoot;
+    projectsRoot;
+    workspaceRoot;
+    catalogMode;
+    logger;
+    _configSourceStatus;
+    _configCache;
+    _configPromise;
+    constructor(paths) {
+        const { configPath, slackDir, brainbaseRoot, projectsRoot, catalogMode = 'required', logger = defaultLogger } = paths ?? {};
+        this.configPath = requirePath('configPath', configPath);
+        this.slackDir = requirePath('slackDir', slackDir);
+        this.brainbaseRoot = requirePath('brainbaseRoot', brainbaseRoot);
+        this.projectsRoot = requirePath('projectsRoot', projectsRoot);
+        this.catalogMode = catalogMode;
+        this.logger = logger;
+        this._configSourceStatus = this.catalogMode === 'disabled' ? 'not_applicable' : 'not_loaded';
+        // workspaceRoot = parent directory of brainbaseRoot (where 'general' project resides)
+        this.workspaceRoot = path.dirname(this.brainbaseRoot);
+        this._configCache = null;
+        this._configPromise = null;
+    }
+    /**
+     * @template T
+     * @param {string} filePath
+     * @param {T} defaultValue
+     * @param {string} [label]
+     * @returns {Promise<T>}
+     */
+    async _loadYamlFile(filePath, defaultValue, label) {
+        try {
+            const content = await fs.readFile(filePath, 'utf-8');
+            const data = yaml.load(content);
+            return data ?? defaultValue;
+        }
+        catch (err) {
+            const target = label || filePath;
+            const error = err;
+            if (error?.code === 'ENOENT' && filePath.startsWith(this.slackDir)) {
+                this.logger.debug(`Optional config missing: ${target}`, { filePath });
+                return defaultValue;
+            }
+            this.logger.error(`Failed to load ${target}:`, { error: error.message || String(error) });
+            return defaultValue;
+        }
+    }
+    /**
+     * @template T
+     * @param {string} filename
+     * @param {T} defaultValue
+     * @returns {Promise<T>}
+     */
+    async _loadSlackYaml(filename, defaultValue) {
+        return this._loadYamlFile(path.join(this.slackDir, filename), defaultValue, filename);
+    }
+    async _loadConfig() {
+        if (this._configCache) {
+            return this._configCache;
+        }
+        if (this.catalogMode === 'disabled') {
+            this._configSourceStatus = 'not_applicable';
+            this._configCache = {};
+            this.logger.debug('Project catalog is disabled for this runtime', {
+                mode: this.catalogMode
+            });
+            return this._configCache;
+        }
+        if (!this._configPromise) {
+            this._configPromise = fs.readFile(this.configPath, 'utf-8')
+                .then((content) => {
+                const data = yaml.load(content);
+                this._configSourceStatus = 'loaded';
+                return data ?? {};
+            })
+                .catch((err) => {
+                const error = err;
+                this._configSourceStatus = error?.code === 'ENOENT' ? 'missing' : 'invalid';
+                this.logger.error('Failed to load config.yml:', {
+                    error: error.message || String(error),
+                    configPath: this.configPath
+                });
+                return {};
+            });
+        }
+        this._configCache = await this._configPromise;
+        return this._configCache;
+    }
+    /**
+     * SPEC-settings-phase0-guards INV-4: ConfigService.write 後に呼ぶことで stale cache を回避
+     */
+    invalidateCache() {
+        this._configCache = null;
+        this._configPromise = null;
+    }
+    /**
+     * @param {ProjectConfig[]} [projects]
+     * @returns {ProjectConfig[]}
+     */
+    _expandProjectPaths(projects = []) {
+        return projects.map(project => {
+            if (project.local?.path) {
+                const expandedPath = project.local.path.replace(/\$\{PROJECTS_ROOT:-[^}]+\}/g, this.projectsRoot);
+                return {
+                    ...project,
+                    local: {
+                        ...project.local,
+                        path: expandedPath
+                    }
+                };
+            }
+            return project;
+        });
+    }
+    /**
+     * Slackワークスペース一覧を取得
+     */
+    async getWorkspaces() {
+        const data = await this._loadSlackYaml('workspaces.yml', { workspaces: {} });
+        return data?.workspaces || {};
+    }
+    /**
+     * Slackチャンネル一覧を取得
+     */
+    async getChannels() {
+        const data = await this._loadSlackYaml('channels.yml', { channels: [] });
+        return data?.channels || [];
+    }
+    /**
+     * Slackメンバー一覧を取得
+     */
+    async getMembers() {
+        const data = await this._loadSlackYaml('members.yml', { members: [] });
+        return data?.members || [];
+    }
+    /**
+     * プロジェクト設定（config.yml）を取得
+     */
+    async getProjects() {
+        const data = await this._loadConfig();
+        const projects = this._expandProjectPaths(data.projects || []).map(project => {
+            // Legacyの未認証設定APIへProject Profileのtenant・人物・接続意図を露出させない。
+            const { capabilities: _capabilities, people: _people, organization: _organization, created_by: _createdBy, success_criteria: _successCriteria, project_code: _projectCode, ...legacyProject } = project;
+            return legacyProject;
+        });
+        return {
+            root: this.workspaceRoot, // Workspace root directory (where 'general' project resides)
+            projects
+        };
+    }
+    /**
+     * GitHubマッピングを取得（config.ymlから抽出）
+     */
+    async getGitHubMappings() {
+        const data = await this._loadConfig();
+        const projects = data.projects || [];
+        return projects
+            .filter(p => p.github)
+            .map(p => ({
+            project_id: p.id,
+            owner: p.github?.owner,
+            repo: p.github?.repo,
+            branch: p.github?.branch || 'main',
+            url: `https://github.com/${p.github?.owner}/${p.github?.repo}`
+        }));
+    }
+    /**
+     * Airtableマッピングを取得（config.ymlから抽出）
+     */
+    async getAirtableMappings() {
+        const data = await this._loadConfig();
+        const projects = data.projects || [];
+        return projects
+            .filter(p => p.airtable)
+            .map(p => ({
+            project_id: p.id,
+            base_id: p.airtable?.base_id,
+            base_name: p.airtable?.base_name,
+            url: `https://airtable.com/${p.airtable?.base_id}`
+        }));
+    }
+    /**
+     * UI Plugins設定を取得（config.ymlから抽出）
+     * @returns {Promise<any>} { enabled: string[] } - 有効なプラグインID一覧
+     */
+    async getPlugins() {
+        const data = await this._loadConfig();
+        const plugins = data.plugins || {};
+        if (!plugins.enabled && !plugins.disabled) {
+            // OSSの初期状態: 必要最小限のプラグインのみ有効化
+            return {
+                enabled: ['bb-inbox'],
+                disabled: []
+            };
+        }
+        return {
+            enabled: Array.isArray(plugins.enabled) ? plugins.enabled : [],
+            disabled: Array.isArray(plugins.disabled) ? plugins.disabled : []
+        };
+    }
+    /**
+     * 統合ビュー: Workspace → Project → Slack/GitHub/Airtable の関係を一覧
+     */
+    async getUnifiedView() {
+        const [workspaces, channels, projectConfig, githubMappings] = await Promise.all([
+            this.getWorkspaces(),
+            this.getChannels(),
+            this.getProjects(),
+            this.getGitHubMappings()
+        ]);
+        // プロジェクト情報をIDでインデックス化
+        const projectsById = {};
+        for (const p of projectConfig.projects) {
+            if (p.id) {
+                projectsById[p.id] = p;
+            }
+        }
+        // チャンネルをproject_idでグループ化
+        const channelsByProjectId = {};
+        for (const ch of channels) {
+            // proj_xxx → xxx に正規化
+            const normalizedId = ch.project_id?.replace(/^proj_/, '') || '';
+            if (!channelsByProjectId[normalizedId]) {
+                channelsByProjectId[normalizedId] = [];
+            }
+            channelsByProjectId[normalizedId].push({
+                id: ch.channel_id,
+                name: ch.channel_name,
+                type: ch.type || 'general',
+                workspace: ch.workspace
+            });
+        }
+        // GitHubマッピングをproject_idでインデックス化
+        const githubByProjectId = {};
+        for (const g of githubMappings) {
+            if (g.project_id) {
+                githubByProjectId[g.project_id] = g;
+            }
+        }
+        // ワークスペースごとにプロジェクトを整理
+        const result = {
+            workspaces: [],
+            orphanedChannels: [],
+            orphanedProjects: []
+        };
+        // 使用済みプロジェクトを追跡（正規化後のID）
+        const usedProjectIds = new Set();
+        // ID正規化ヘルパー: proj_zeims → zeims
+        const normalizeId = (id) => id.replace(/^proj_/, '');
+        for (const [wsKey, ws] of Object.entries(workspaces)) {
+            const wsProjects = [];
+            // ワークスペースに紐づくプロジェクトを処理
+            const projectIds = ws.projects || [];
+            for (const projId of projectIds) {
+                // proj_zeims → zeims に正規化してマッチング
+                const normalizedProjId = normalizeId(projId);
+                usedProjectIds.add(normalizedProjId);
+                const project = projectsById[normalizedProjId];
+                const github = githubByProjectId[normalizedProjId];
+                const projectChannels = channelsByProjectId[normalizedProjId] || [];
+                // glob_include からパスを抽出
+                let paths = null;
+                if (project?.local?.glob_include) {
+                    paths = project.local.glob_include.map(g => {
+                        const match = g.match(/^([^*]+)/);
+                        return match ? match[1].replace(/\/$/, '') + '/' : null;
+                    }).filter((p) => p !== null);
+                }
+                wsProjects.push({
+                    id: projId,
+                    emoji: project?.emoji || null,
+                    archived: project?.archived || false,
+                    channels: projectChannels.filter(ch => ch.workspace === wsKey),
+                    github: github ? {
+                        owner: github.owner,
+                        repo: github.repo,
+                        branch: github.branch,
+                        url: github.url,
+                        paths: paths
+                    } : null
+                });
+            }
+            result.workspaces.push({
+                key: wsKey,
+                name: ws.name,
+                id: ws.id,
+                projects: wsProjects
+            });
+        }
+        // 孤立プロジェクト（どのワークスペースにも属していない）
+        for (const p of projectConfig.projects) {
+            const projectId = p.id;
+            if (!projectId || !usedProjectIds.has(projectId)) {
+                result.orphanedProjects.push({
+                    id: projectId,
+                    hasGithub: projectId ? !!githubByProjectId[projectId] : false,
+                    channelCount: projectId ? (channelsByProjectId[projectId] || []).length : 0
+                });
+            }
+        }
+        // 孤立チャンネル（proj_otherや未マッピング）
+        const allMappedProjectIds = new Set([
+            ...Object.keys(projectsById),
+            ...Object.values(workspaces).flatMap(ws => ws.projects || [])
+        ]);
+        for (const ch of channels) {
+            const normalizedId = ch.project_id?.replace(/^proj_/, '') || '';
+            if (!allMappedProjectIds.has(normalizedId) && normalizedId !== 'other') {
+                result.orphanedChannels.push({
+                    id: ch.channel_id,
+                    name: ch.channel_name,
+                    workspace: ch.workspace,
+                    project_id: ch.project_id
+                });
+            }
+        }
+        return result;
+    }
+    /**
+     * Organizations（法人）設定を取得
+     * @returns {Promise<any[]>} 法人一覧
+     */
+    async getOrganizations() {
+        const data = await this._loadConfig();
+        return data.organizations || [];
+    }
+    /**
+     * Dependencies（依存関係）設定を取得
+     * @returns {Promise<any>} 依存関係マッピング
+     */
+    async getDependencies() {
+        const data = await this._loadConfig();
+        return data.dependencies || {};
+    }
+    /**
+     * Notifications（通知）設定を取得
+     * @returns {Promise<any>} 通知設定
+     */
+    async getNotifications() {
+        const data = await this._loadConfig();
+        return data.notifications || {
+            channels: {},
+            dnd: {}
+        };
+    }
+    /**
+     * 全設定を統合して取得
+     */
+    async getAll() {
+        const [workspaces, channels, members, projectConfig, githubMappings, airtableMappings, plugins] = await Promise.all([
+            this.getWorkspaces(),
+            this.getChannels(),
+            this.getMembers(),
+            this.getProjects(),
+            this.getGitHubMappings(),
+            this.getAirtableMappings(),
+            this.getPlugins()
+        ]);
+        return {
+            slack: {
+                workspaces,
+                channels,
+                members
+            },
+            projects: projectConfig,
+            github: githubMappings,
+            airtable: airtableMappings,
+            plugins
+        };
+    }
+    /**
+     * 整合性チェック
+     * - チャンネルに定義されているが、プロジェクトに存在しないproject_id
+     * - ワークスペースに定義されているが、チャンネルがないワークスペース
+     * - 重複したSlack ID
+     * - GitHubマッピングの検証
+     */
+    async checkIntegrity() {
+        if (this.catalogMode === 'disabled') {
+            return {
+                applicability: 'not_applicable',
+                source: {
+                    status: 'not_applicable',
+                    path: this.configPath,
+                    mode: this.catalogMode
+                },
+                issues: [],
+                summary: { total: 0, errors: 0, warnings: 0, info: 0 },
+                stats: {
+                    workspaces: 0,
+                    channels: 0,
+                    members: 0,
+                    projects: 0,
+                    github: 0,
+                    airtable: 0
+                }
+            };
+        }
+        const [workspaces, channels, members, projectConfig, githubMappings, airtableMappings] = await Promise.all([
+            this.getWorkspaces(),
+            this.getChannels(),
+            this.getMembers(),
+            this.getProjects(),
+            this.getGitHubMappings(),
+            this.getAirtableMappings()
+        ]);
+        const issues = [];
+        if (this._configSourceStatus !== 'loaded') {
+            issues.push({
+                type: 'config_source_unavailable',
+                severity: 'error',
+                message: `Required project catalog is ${this._configSourceStatus}: ${this.configPath}`,
+                source: 'config.yml'
+            });
+        }
+        // プロジェクトIDのセットを作成
+        const configProjectIds = new Set(projectConfig.projects
+            .map(p => p.id)
+            .filter((id) => typeof id === 'string'));
+        // ワークスペースで定義されているプロジェクトIDのセット
+        const workspaceProjectIds = new Set();
+        Object.values(workspaces).forEach(ws => {
+            (ws.projects || []).forEach(pid => workspaceProjectIds.add(pid));
+        });
+        // チャンネルで使われているプロジェクトIDのセット
+        const channelProjectIds = new Set();
+        channels.forEach(ch => {
+            if (ch.project_id) {
+                channelProjectIds.add(ch.project_id);
+            }
+        });
+        // 1. チャンネルのproject_idがconfig.ymlに存在するか
+        // proj_otherは意図的な「その他」カテゴリなので除外
+        const ignoredProjectIds = new Set(['proj_other', 'other']);
+        channelProjectIds.forEach(pid => {
+            // 除外リストにあるプロジェクトはスキップ
+            if (ignoredProjectIds.has(pid))
+                return;
+            // proj_xxx → xxxに変換してチェック
+            const shortId = pid.replace(/^proj_/, '');
+            if (!configProjectIds.has(shortId) && !configProjectIds.has(pid)) {
+                issues.push({
+                    type: 'missing_project',
+                    severity: 'warning',
+                    message: `Channel uses project_id "${pid}" but not found in config.yml`,
+                    source: 'channels.yml'
+                });
+            }
+        });
+        // 2. ワークスペースごとのチャンネル数をカウント
+        const workspaceChannelCount = {};
+        channels.forEach(ch => {
+            if (ch.workspace) {
+                workspaceChannelCount[ch.workspace] = (workspaceChannelCount[ch.workspace] || 0) + 1;
+            }
+        });
+        Object.keys(workspaces).forEach(wsKey => {
+            if (!workspaceChannelCount[wsKey]) {
+                issues.push({
+                    type: 'empty_workspace',
+                    severity: 'info',
+                    message: `Workspace "${wsKey}" has no mapped channels`,
+                    source: 'workspaces.yml'
+                });
+            }
+        });
+        // 3. メンバーの重複チェック（同じslack_idが複数ある場合）
+        const slackIdCount = {};
+        members.forEach(m => {
+            if (m.slack_id) {
+                slackIdCount[m.slack_id] = (slackIdCount[m.slack_id] || 0) + 1;
+            }
+        });
+        Object.entries(slackIdCount).forEach(([slackId, count]) => {
+            if (count > 1) {
+                const memberNames = members
+                    .filter(m => m.slack_id === slackId)
+                    .map(m => m.brainbase_name)
+                    .filter((name) => typeof name === 'string');
+                // 同一人物のサブアカウントの場合は問題なし
+                const uniqueNames = [...new Set(memberNames)];
+                if (uniqueNames.length > 1) {
+                    issues.push({
+                        type: 'duplicate_slack_id',
+                        severity: 'error',
+                        message: `Slack ID "${slackId}" is mapped to multiple people: ${uniqueNames.join(', ')}`,
+                        source: 'members.yml'
+                    });
+                }
+            }
+        });
+        // 4. チャンネルの重複チェック
+        const channelIdCount = {};
+        channels.forEach(ch => {
+            if (ch.channel_id) {
+                channelIdCount[ch.channel_id] = (channelIdCount[ch.channel_id] || 0) + 1;
+            }
+        });
+        Object.entries(channelIdCount).forEach(([channelId, count]) => {
+            if (count > 1) {
+                issues.push({
+                    type: 'duplicate_channel_id',
+                    severity: 'warning',
+                    message: `Channel ID "${channelId}" appears ${count} times`,
+                    source: 'channels.yml'
+                });
+            }
+        });
+        // 5. GitHubマッピングの検証
+        // 5a. ローカルパスがあるがGitHubがないプロジェクト
+        const projectsWithLocal = projectConfig.projects.filter(p => p.local?.path);
+        const githubProjectIds = new Set(githubMappings
+            .map(g => g.project_id)
+            .filter((id) => typeof id === 'string'));
+        projectsWithLocal.forEach(p => {
+            if (!p.id || !githubProjectIds.has(p.id)) {
+                issues.push({
+                    type: 'missing_github',
+                    severity: 'info',
+                    message: `Project "${p.id}" has local path but no GitHub mapping`,
+                    source: 'config.yml'
+                });
+            }
+        });
+        // 5b. GitHubマッピングの重複チェック
+        const repoCount = {};
+        githubMappings.forEach(g => {
+            const key = `${g.owner}/${g.repo}`;
+            if (!repoCount[key])
+                repoCount[key] = [];
+            if (g.project_id) {
+                repoCount[key].push(g.project_id);
+            }
+        });
+        Object.entries(repoCount).forEach(([repo, projectIds]) => {
+            if (projectIds.length > 1) {
+                issues.push({
+                    type: 'shared_github_repo',
+                    severity: 'info',
+                    message: `GitHub repo "${repo}" is shared by projects: ${projectIds.join(', ')}`,
+                    source: 'config.yml'
+                });
+            }
+        });
+        // 6. Airtableマッピングの検証は無効化（2026-01-17）
+        return {
+            applicability: 'applicable',
+            source: {
+                status: this._configSourceStatus,
+                path: this.configPath,
+                mode: this.catalogMode
+            },
+            issues,
+            summary: {
+                total: issues.length,
+                errors: issues.filter(i => i.severity === 'error').length,
+                warnings: issues.filter(i => i.severity === 'warning').length,
+                info: issues.filter(i => i.severity === 'info').length
+            },
+            stats: {
+                workspaces: Object.keys(workspaces).length,
+                channels: channels.length,
+                members: members.length,
+                projects: projectConfig.projects.length,
+                github: githubMappings.length,
+                airtable: airtableMappings.length
+            }
+        };
+    }
+}

package/dist/connected-onboarding.d.ts

@@ -1,3 +1,60 @@
+/**
+ * Candidate content scanning shared by onboarding hosts.
+ *
+ * The Org server keeps the same legacy result shape (`block`, `review`, and
+ * named counts), while the implementation and detector vocabulary live in the
+ * OSS onboarding boundary.  Keep these detectors separate from the recursive
+ * persistent-value guard above: the former reports review findings, while the
+ * latter rejects unsafe ledger values before they are written.
+ */
+export type OnboardingScanKind = 'block' | 'review';
+export interface OnboardingScanFinding {
+    kind: OnboardingScanKind;
+    name: string;
+    count: number;
+}
+export interface OnboardingContentScan {
+    block: boolean;
+    review: boolean;
+    findings: OnboardingScanFinding[];
+}
+export declare const ONBOARDING_BLOCK_PATTERNS: readonly [{
+    readonly name: "openai_api_key";
+    readonly regex: RegExp;
+}, {
+    readonly name: "github_pat";
+    readonly regex: RegExp;
+}, {
+    readonly name: "anthropic_api_key";
+    readonly regex: RegExp;
+}, {
+    readonly name: "aws_access_key";
+    readonly regex: RegExp;
+}, {
+    readonly name: "slack_token";
+    readonly regex: RegExp;
+}, {
+    readonly name: "private_key_block";
+    readonly regex: RegExp;
+}, {
+    readonly name: "password_assignment";
+    readonly regex: RegExp;
+}, {
+    readonly name: "infisical_ref";
+    readonly regex: RegExp;
+}];
+export declare const ONBOARDING_PII_PATTERNS: readonly [{
+    readonly name: "jp_phone";
+    readonly regex: RegExp;
+}, {
+    readonly name: "email";
+    readonly regex: RegExp;
+}, {
+    readonly name: "credit_card_like";
+    readonly regex: RegExp;
+}];
+/** Scan candidate text without exposing raw content in the finding output. */
+export declare function scanOnboardingContent(content: unknown): OnboardingContentScan;
 declare const WORKFLOW_STATES: readonly ["initialized", "source_ready", "candidates_ready", "promotion_reviewed", "first_value_ready", "first_value_answer_reviewed"];
 export type SourceMode = 'mcp' | 'drive' | 'gmail' | 'local_folder' | 'single_document';
 export type SourceStatus = 'ready' | 'waiting_for_authorization' | 'unavailable' | 'error' | 'unconfirmed';

package/dist/connected-onboarding.js

@@ -15,6 +15,43 @@ const RAW_CONTENT_KEY = /^(?:raw(?:_body|_content|_text)?|body|content|document|
 const SECRET_VALUE = /(?:^|\s)Bearer\s+[A-Za-z0-9._~+/-]+=*|\bsk-[A-Za-z0-9_-]{16,}\b/i;
 const SECRET_ASSIGNMENT = /(?:access[_-]?token|refresh[_-]?token|api[_-]?key|client[_-]?secret|secret|password|credential|authorization|cookie)\s*(?:=|:)\s*[^\s&#;,]+/i;
 const URI_USERINFO = /^[a-z][a-z0-9+.-]*:\/\/[^/?#\s]*:[^@/?#\s]+@/i;
+export const ONBOARDING_BLOCK_PATTERNS = Object.freeze([
+    { name: 'openai_api_key', regex: /sk-[A-Za-z0-9]{20,}/g },
+    { name: 'github_pat', regex: /ghp_[A-Za-z0-9]{20,}/g },
+    { name: 'anthropic_api_key', regex: /sk-ant-[A-Za-z0-9_-]{20,}/g },
+    { name: 'aws_access_key', regex: /AKIA[0-9A-Z]{16}/g },
+    { name: 'slack_token', regex: /xox[abpsr]-[A-Za-z0-9-]{10,}/g },
+    { name: 'private_key_block', regex: /-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----/g },
+    { name: 'password_assignment', regex: /(?:password|passwd|secret)\s*=\s*['"][^'"\s]{6,}['"]/gi },
+    { name: 'infisical_ref', regex: /infisical:\/\/[^\s]+/gi }
+]);
+export const ONBOARDING_PII_PATTERNS = Object.freeze([
+    { name: 'jp_phone', regex: /0\d{1,4}-\d{1,4}-\d{3,4}/g },
+    { name: 'email', regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g },
+    { name: 'credit_card_like', regex: /\b(?:\d{4}[- ]?){3}\d{4}\b/g }
+]);
+/** Scan candidate text without exposing raw content in the finding output. */
+export function scanOnboardingContent(content) {
+    if (typeof content !== 'string' || content.length === 0) {
+        return { block: false, review: false, findings: [] };
+    }
+    const findings = [];
+    for (const { name, regex } of ONBOARDING_BLOCK_PATTERNS) {
+        const matches = content.match(regex);
+        if (matches && matches.length > 0)
+            findings.push({ kind: 'block', name, count: matches.length });
+    }
+    for (const { name, regex } of ONBOARDING_PII_PATTERNS) {
+        const matches = content.match(regex);
+        if (matches && matches.length > 0)
+            findings.push({ kind: 'review', name, count: matches.length });
+    }
+    return {
+        block: findings.some((finding) => finding.kind === 'block'),
+        review: findings.some((finding) => finding.kind === 'review'),
+        findings
+    };
+}
 const PERMISSION_KEYS = new Set([
     'visibility', 'collectedBy', 'provider', 'connectionId', 'grantId', 'accountId',
     'folderId', 'projectCode', 'roleMin', 'sensitivity', 'scope', 'scopes', 'roles',