@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/src/modules/mcp/__tests__/mcp-session-store.test.ts

@@ -1,151 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { McpSessionStore } from '../mcp-session-store.js';
-
-/**
- * Builds a store with a controllable clock so the idle-TTL and eviction
- * paths don't depend on real time. Tests bump `clock.ts` directly between
- * operations.
- */
-function makeStore(opts: { idleTtlMs?: number; maxSessions?: number } = {}) {
-  const clock = { ts: 1_000_000 };
-  const store = new McpSessionStore({
-    idleTtlMs: opts.idleTtlMs ?? 60_000,
-    maxSessions: opts.maxSessions ?? 100,
-    now: () => clock.ts,
-  });
-  return { store, clock };
-}
-
-describe('McpSessionStore', () => {
-  it('create + get round-trips the session', () => {
-    const { store } = makeStore();
-    store.create('sess-1', 'user-A');
-
-    const session = store.get('sess-1');
-    expect(session?.userId).toBe('user-A');
-  });
-
-  it('get bumps lastTouchedAt so an active session never ages out under steady use', () => {
-    const { store, clock } = makeStore({ idleTtlMs: 1000 });
-    store.create('sess-1', 'user-A');
-
-    // Advance just below TTL and touch; advance again just below TTL and
-    // touch. Total elapsed > TTL, but no single gap exceeds it.
-    clock.ts += 900;
-    expect(store.get('sess-1')).not.toBeNull();
-    clock.ts += 900;
-    expect(store.get('sess-1')).not.toBeNull();
-  });
-
-  it('get returns null and drops the session once idle longer than ttl', () => {
-    const { store, clock } = makeStore({ idleTtlMs: 1000 });
-    store.create('sess-1', 'user-A');
-
-    clock.ts += 1500;
-    expect(store.get('sess-1')).toBeNull();
-    // The sweep ran during the get, so the entry is actually gone.
-    expect(store.size()).toBe(0);
-  });
-
-  it('evicts the oldest-touched session when the size cap is hit', () => {
-    const { store, clock } = makeStore({ maxSessions: 2 });
-
-    store.create('old', 'user-A');
-    clock.ts += 10;
-    store.create('middle', 'user-B');
-    clock.ts += 10;
-    // Touch `middle` so `old` is the oldest-touched.
-    store.get('middle');
-
-    clock.ts += 10;
-    store.create('new', 'user-C');
-
-    expect(store.get('old')).toBeNull();
-    expect(store.get('middle')).not.toBeNull();
-    expect(store.get('new')).not.toBeNull();
-    expect(store.size()).toBe(2);
-  });
-
-  it('delete removes an entry immediately', () => {
-    const { store } = makeStore();
-    store.create('sess-1', 'user-A');
-    store.delete('sess-1');
-    expect(store.get('sess-1')).toBeNull();
-  });
-
-  describe('onEvict', () => {
-    it('fires the listener with the session id when the TTL sweep drops an entry', () => {
-      const { store, clock } = makeStore({ idleTtlMs: 1000 });
-      const evicted: string[] = [];
-      store.onEvict((id) => evicted.push(id));
-      store.create('sess-1', 'user-A');
-
-      clock.ts += 1500;
-      store.get('sess-1'); // triggers sweep
-
-      expect(evicted).toEqual(['sess-1']);
-    });
-
-    it('fires the listener with the session id when the size cap evicts the oldest', () => {
-      const { store, clock } = makeStore({ maxSessions: 2 });
-      const evicted: string[] = [];
-      store.onEvict((id) => evicted.push(id));
-
-      store.create('old', 'user-A');
-      clock.ts += 10;
-      store.create('middle', 'user-B');
-      clock.ts += 10;
-      store.get('middle'); // bumps middle, so `old` is oldest-touched
-
-      clock.ts += 10;
-      store.create('new', 'user-C');
-
-      expect(evicted).toEqual(['old']);
-    });
-
-    it('does NOT fire on explicit delete() — that path is the consumer asking for removal', () => {
-      const { store } = makeStore();
-      const evicted: string[] = [];
-      store.onEvict((id) => evicted.push(id));
-      store.create('sess-1', 'user-A');
-
-      store.delete('sess-1');
-
-      expect(evicted).toEqual([]);
-    });
-
-    it('keeps sweeping the remaining entries when a listener throws', () => {
-      const { store, clock } = makeStore({ idleTtlMs: 1000 });
-      const evicted: string[] = [];
-      store.onEvict((id) => {
-        if (id === 'sess-1') throw new Error('bad listener');
-        evicted.push(id);
-      });
-      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-
-      store.create('sess-1', 'user-A');
-      store.create('sess-2', 'user-B');
-      clock.ts += 1500;
-      store.create('trigger', 'user-C'); // sweep runs at create time too
-
-      // Both 'sess-1' (listener threw) and 'sess-2' must have been swept;
-      // we observe sess-2 in `evicted` and sess-1 via the warn spy.
-      expect(evicted).toContain('sess-2');
-      expect(warn).toHaveBeenCalled();
-      warn.mockRestore();
-    });
-
-    it('returns an unsubscribe function that stops further notifications', () => {
-      const { store, clock } = makeStore({ idleTtlMs: 1000 });
-      const evicted: string[] = [];
-      const off = store.onEvict((id) => evicted.push(id));
-
-      store.create('sess-1', 'user-A');
-      off();
-      clock.ts += 1500;
-      store.get('sess-1');
-
-      expect(evicted).toEqual([]);
-    });
-  });
-});

package/src/modules/mcp/__tests__/mcp.routes.session.test.ts

@@ -1,226 +0,0 @@
-import type { Request as ExpressRequest, Response as ExpressResponse } from 'express';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { closeMountedRoutes, mountMcpRoutes } from './mcp-routes-harness.js';
-
-/**
- * Session routing on the MCP transport routes — how `/api/mcp` answers a
- * request whose `Mcp-Session-Id` it cannot resolve.
- *
- * The distinction is load-bearing rather than cosmetic. Streamable HTTP makes
- * HTTP 404 on a request bearing a session id the signal a client re-initializes
- * on; 400 means "you sent something malformed", which has no recovery. These
- * routes used to answer both misses — no session id, and a session id from a
- * session that no longer exists — with one 400 on POST and one 404 on
- * GET/DELETE, so a client whose session died with the server (a restart wipes
- * the in-process map) was told its request was malformed and stayed stranded.
- *
- * Locked down here:
- *   - the two misses map to distinct, spec-correct codes on every verb;
- *   - both bodies are real JSON-RPC error objects, since this router answers
- *     before the SDK transport that would otherwise have shaped them;
- *   - an `initialize` carrying a STALE session id still opens a new session —
- *     the recovery path itself, which the old "no session id" guard blocked;
- *   - the live-session and cross-user branches are untouched.
- */
-
-/** The id the FIRST session minted in a test gets; `openSession` establishes it. */
-const SESSION_ID = 'sess-1';
-
-afterEach(async () => {
-  await closeMountedRoutes();
-  vi.restoreAllMocks();
-});
-
-/**
- * A createSession stub shaped like the real one: it hands back a transport
- * whose `handleRequest` reports the session id it served, and announces the
- * session through `onSessionInitialized` from INSIDE that first call — which
- * is when the SDK transport really fires it, and the only ordering the route's
- * `active.set` closure can observe without a TDZ error.
- *
- * Each call mints a DISTINCT id (`sess-1`, `sess-2`, …) rather than a constant.
- * With a constant, a route that wrongly minted a second session answered with
- * a body identical to the correct one, so "no second session" could only ever
- * be asserted through the call count. Numbering them puts the mistake in the
- * response itself: a reply naming `sess-2` IS the extra session.
- */
-function makeMcpService() {
-  let minted = 0;
-  const createSession = vi.fn(
-    async (
-      userId: string,
-      _tokenId: string | null,
-      _bearer: string,
-      onSessionInitialized: (sessionId: string) => void,
-    ) => {
-      minted += 1;
-      const sessionId = `sess-${minted}`;
-      let announced = false;
-      const transport = {
-        sessionId,
-        onclose: undefined as undefined | (() => void),
-        handleRequest: vi.fn(async (_req: ExpressRequest, res: ExpressResponse) => {
-          if (!announced) {
-            announced = true;
-            onSessionInitialized(sessionId);
-          }
-          res.status(200).json({ forwarded: true, sessionId, userId });
-        }),
-        close: vi.fn(async () => {}),
-      };
-      const server = { connect: vi.fn(async () => {}), close: vi.fn(async () => {}) };
-      return { transport, server };
-    },
-  );
-  return { onSessionEvicted: () => {}, createSession };
-}
-
-async function mount(): Promise<{ baseUrl: string; createSession: ReturnType<typeof vi.fn> }> {
-  const mcpService = makeMcpService();
-  const baseUrl = await mountMcpRoutes({ mcpService });
-  return { baseUrl, createSession: mcpService.createSession };
-}
-
-const INITIALIZE = {
-  jsonrpc: '2.0',
-  id: 0,
-  method: 'initialize',
-  params: { protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'c', version: '0' } },
-};
-const TOOL_CALL = { jsonrpc: '2.0', id: 1, method: 'tools/list', params: {} };
-
-async function send(
-  baseUrl: string,
-  opts: { method?: string; sessionId?: string; body?: unknown; user?: string } = {},
-): Promise<Response> {
-  const { method = 'POST', sessionId, body, user } = opts;
-  return fetch(`${baseUrl}/api/mcp`, {
-    method,
-    headers: {
-      'Content-Type': 'application/json',
-      Accept: 'application/json, text/event-stream',
-      ...(sessionId ? { 'mcp-session-id': sessionId } : {}),
-      ...(user ? { 'x-test-user': user } : {}),
-    },
-    ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
-  });
-}
-
-/** Open a real session so `active` holds SESSION_ID. */
-async function openSession(baseUrl: string): Promise<void> {
-  const res = await send(baseUrl, { body: INITIALIZE });
-  expect(res.status).toBe(200);
-}
-
-describe('POST /mcp session routing', () => {
-  it('answers an unknown session id with 404 / -32001, the re-initialize signal', async () => {
-    const { baseUrl } = await mount();
-    const res = await send(baseUrl, { sessionId: 'sess-from-before-the-restart', body: TOOL_CALL });
-    expect(res.status).toBe(404);
-    await expect(res.json()).resolves.toEqual({
-      jsonrpc: '2.0',
-      error: { code: -32001, message: 'Session not found' },
-      id: null,
-    });
-  });
-
-  it('answers a missing session id with 400 / -32000 — a different code from the miss above', async () => {
-    const { baseUrl } = await mount();
-    const res = await send(baseUrl, { body: TOOL_CALL });
-    expect(res.status).toBe(400);
-    await expect(res.json()).resolves.toEqual({
-      jsonrpc: '2.0',
-      error: { code: -32000, message: 'Bad Request: Mcp-Session-Id header is required' },
-      id: null,
-    });
-  });
-
-  it('opens a new session for an initialize that still carries a STALE session id', async () => {
-    const { baseUrl, createSession } = await mount();
-    // Exactly what a client does after a server restart: it re-initializes
-    // before it has any reason to drop the id it was given last time.
-    const res = await send(baseUrl, { sessionId: 'sess-from-before-the-restart', body: INITIALIZE });
-    expect(res.status).toBe(200);
-    await expect(res.json()).resolves.toMatchObject({ forwarded: true, sessionId: SESSION_ID });
-    expect(createSession).toHaveBeenCalledTimes(1);
-  });
-
-  it('opens a new session for an initialize with no session id', async () => {
-    const { baseUrl, createSession } = await mount();
-    const res = await send(baseUrl, { body: INITIALIZE });
-    expect(res.status).toBe(200);
-    expect(createSession).toHaveBeenCalledTimes(1);
-  });
-
-  it('forwards to the live transport once a session exists', async () => {
-    const { baseUrl, createSession } = await mount();
-    await openSession(baseUrl);
-    const res = await send(baseUrl, { sessionId: SESSION_ID, body: TOOL_CALL });
-    expect(res.status).toBe(200);
-    await expect(res.json()).resolves.toMatchObject({ forwarded: true, sessionId: SESSION_ID });
-    // No second session: the live branch was taken, not the initialize branch.
-    expect(createSession).toHaveBeenCalledTimes(1);
-  });
-
-  it('routes an initialize over a LIVE session to that session, minting no second one', async () => {
-    // The guard this pins is branch ORDER, and only this change made it
-    // load-bearing: `initialize` used to be gated on `!sessionIdHeader`, so
-    // the live-session branch and the initialize branch were mutually
-    // exclusive and their order did not matter. Without that gate, an
-    // initialize check placed first would match here too — and silently mint
-    // a second session over a working one, which is the failure the route
-    // comment and the PR both promise cannot happen.
-    //
-    // What is asserted is what this ROUTER owes: the request reached the
-    // existing transport and no new session was created. Rejecting a
-    // re-initialize is the SDK transport's own job (`-32600 Server already
-    // initialized`), and asserting that here would be asserting against the
-    // stub rather than against the code under test.
-    const { baseUrl, createSession } = await mount();
-    await openSession(baseUrl); // mints sess-1
-    const res = await send(baseUrl, { sessionId: SESSION_ID, body: INITIALIZE });
-    expect(res.status).toBe(200);
-    // sess-1, not sess-2: the live transport answered, not a fresh one.
-    await expect(res.json()).resolves.toMatchObject({ forwarded: true, sessionId: SESSION_ID });
-    expect(createSession).toHaveBeenCalledTimes(1);
-  });
-
-  it('still refuses another user’s live session with 403', async () => {
-    const { baseUrl } = await mount();
-    await openSession(baseUrl); // owned by user-A
-    const res = await send(baseUrl, { sessionId: SESSION_ID, body: TOOL_CALL, user: 'user-B' });
-    expect(res.status).toBe(403);
-    // JSON-RPC like every other answer this router gives before the SDK
-    // transport — a client parsing /api/mcp bodies as JSON-RPC must not hit a
-    // bare `{ error }` on this one branch.
-    await expect(res.json()).resolves.toEqual({
-      jsonrpc: '2.0',
-      error: { code: -32003, message: 'Session does not belong to this user' },
-      id: null,
-    });
-  });
-});
-
-describe.each(['GET', 'DELETE'])('%s /mcp session routing', (method) => {
-  it('answers an unknown session id with 404 / -32001', async () => {
-    const { baseUrl } = await mount();
-    const res = await send(baseUrl, { method, sessionId: 'sess-from-before-the-restart' });
-    expect(res.status).toBe(404);
-    await expect(res.json()).resolves.toEqual({
-      jsonrpc: '2.0',
-      error: { code: -32001, message: 'Session not found' },
-      id: null,
-    });
-  });
-
-  it('answers a missing session id with 400 / -32000', async () => {
-    const { baseUrl } = await mount();
-    const res = await send(baseUrl, { method });
-    expect(res.status).toBe(400);
-    await expect(res.json()).resolves.toEqual({
-      jsonrpc: '2.0',
-      error: { code: -32000, message: 'Bad Request: Mcp-Session-Id header is required' },
-      id: null,
-    });
-  });
-});

package/src/modules/mcp/mcp-session-store.ts

@@ -1,162 +0,0 @@
-/**
- * In-memory mapping from MCP session id → { userId, tokenId }. Each entry
- * represents one MCP client connection's worth of state: the Bevel user the
- * Bearer token resolved to at `initialize`, and the connection-key id for
- * metering. Conversation continuity is the caller's own (a continuity-aware
- * tool like `ask` returns its `sessionId` in the result and the caller echoes
- * it back); thread/workspace bookkeeping lives on the REST tool surface.
- *
- * Eviction is lazy: each `get` / `touch` sweeps idle entries before the
- * lookup, and `put` enforces the size cap before insert. No background
- * timer — keeps the store cheap to construct and avoids leaking a setInterval
- * handle in tests.
- *
- * Single-replica only. If we add a second backend instance later, sessions
- * need to be persisted (see docs/mcp-remote-access.md → "Out of scope"). The
- * MCP protocol tolerates this — a 404 on an unknown session id is a defined
- * response, and clients re-initialize.
- */
-
-export interface McpSession {
-  sessionId: string;
-  userId: string;
-  /**
-   * The connection-key id this session authenticated with, or null when the
-   * session was opened with a browser JWT (no connection key). Captured at
-   * `initialize` so every `ask_bevel_agent` call in the session can be metered
-   * against that key's daily token cap.
-   */
-  tokenId: string | null;
-  createdAt: number;
-  lastTouchedAt: number;
-}
-
-export interface McpSessionStoreOptions {
-  /** Drop sessions idle for longer than this. Default: 4 hours. */
-  idleTtlMs?: number;
-  /** Hard cap on simultaneous live sessions. Oldest-touched evicted first. */
-  maxSessions?: number;
-  /** Override `Date.now` — injected only by tests. */
-  now?: () => number;
-}
-
-const DEFAULT_IDLE_TTL_MS = 4 * 60 * 60 * 1000;
-const DEFAULT_MAX_SESSIONS = 5000;
-
-export class McpSessionStore {
-  private readonly sessions = new Map<string, McpSession>();
-  private readonly idleTtlMs: number;
-  private readonly maxSessions: number;
-  private readonly now: () => number;
-  // Subscribers notified whenever a session is dropped by the store itself
-  // (idle TTL sweep or size-cap eviction). NOT fired by explicit `delete()` —
-  // the caller of `delete` already knows the session is gone, and the route
-  // layer uses `delete` *because* it's already cleaning up.
-  //
-  // Callbacks are invoked synchronously; long-running cleanup (e.g.
-  // `transport.close()`) should be fire-and-forget so a slow listener can't
-  // block the next eviction.
-  private readonly evictListeners = new Set<(sessionId: string) => void>();
-
-  constructor(opts: McpSessionStoreOptions = {}) {
-    this.idleTtlMs = opts.idleTtlMs ?? DEFAULT_IDLE_TTL_MS;
-    this.maxSessions = opts.maxSessions ?? DEFAULT_MAX_SESSIONS;
-    this.now = opts.now ?? Date.now;
-  }
-
-  /**
-   * Subscribe to eviction events. Returns an unsubscribe function so callers
-   * can clean up in test teardown. The route layer uses this to drop the
-   * transport-state entry in its `active` map and close the underlying SDK
-   * transport when the store decides a session has aged out.
-   */
-  onEvict(listener: (sessionId: string) => void): () => void {
-    this.evictListeners.add(listener);
-    return () => {
-      this.evictListeners.delete(listener);
-    };
-  }
-
-  /**
-   * Register a fresh MCP session. Caller supplies the id (generated by the
-   * SDK's transport). Evicts the oldest-touched session if the cap is hit
-   * — better than refusing the connection, since a wedged old session is
-   * the most likely cause of a full table.
-   */
-  create(sessionId: string, userId: string, tokenId: string | null = null): McpSession {
-    this.sweep();
-    if (this.sessions.size >= this.maxSessions) {
-      this.evictOldest();
-    }
-    const now = this.now();
-    const session: McpSession = {
-      sessionId,
-      userId,
-      tokenId,
-      createdAt: now,
-      lastTouchedAt: now,
-    };
-    this.sessions.set(sessionId, session);
-    return session;
-  }
-
-  /**
-   * Look up a session and bump its `lastTouchedAt`. Returns null when the
-   * session is unknown or has aged out. Sweep runs first so an aged entry
-   * is collected, not silently revived.
-   */
-  get(sessionId: string): McpSession | null {
-    this.sweep();
-    const session = this.sessions.get(sessionId);
-    if (!session) return null;
-    session.lastTouchedAt = this.now();
-    return session;
-  }
-
-  delete(sessionId: string): void {
-    this.sessions.delete(sessionId);
-  }
-
-  /** Visible size; useful for diagnostics. Does not sweep. */
-  size(): number {
-    return this.sessions.size;
-  }
-
-  private sweep(): void {
-    const cutoff = this.now() - this.idleTtlMs;
-    for (const [id, s] of this.sessions) {
-      if (s.lastTouchedAt < cutoff) {
-        this.sessions.delete(id);
-        this.emitEviction(id);
-      }
-    }
-  }
-
-  private evictOldest(): void {
-    let oldestId: string | null = null;
-    let oldestTouched = Infinity;
-    for (const [id, s] of this.sessions) {
-      if (s.lastTouchedAt < oldestTouched) {
-        oldestTouched = s.lastTouchedAt;
-        oldestId = id;
-      }
-    }
-    if (oldestId) {
-      this.sessions.delete(oldestId);
-      this.emitEviction(oldestId);
-    }
-  }
-
-  private emitEviction(sessionId: string): void {
-    for (const listener of this.evictListeners) {
-      try {
-        listener(sessionId);
-      } catch (err) {
-        // A misbehaving listener must not stop the sweep from finishing —
-        // otherwise one bad subscriber would block the rest of the eviction
-        // pass and leak more sessions.
-        console.warn('[mcp-session-store] eviction listener threw:', err);
-      }
-    }
-  }
-}

package/src/shared/__tests__/fs-walk.test.ts

@@ -1,42 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import os from 'node:os';
-import { walkFiles } from '../fs-walk.js';
-
-describe('walkFiles', () => {
-  let root: string;
-
-  beforeEach(async () => {
-    root = await fs.mkdtemp(path.join(os.tmpdir(), 'fs-walk-'));
-  });
-  afterEach(async () => {
-    await fs.rm(root, { recursive: true, force: true });
-  });
-
-  it('returns [] for a missing root', async () => {
-    expect(await walkFiles(path.join(root, 'nope'), () => true)).toEqual([]);
-  });
-
-  it('walks nested directories, filters by basename, and sorts the result', async () => {
-    await fs.mkdir(path.join(root, 'b/deep'), { recursive: true });
-    await fs.mkdir(path.join(root, 'a'), { recursive: true });
-    await fs.writeFile(path.join(root, 'b/deep/z.tool'), '');
-    await fs.writeFile(path.join(root, 'a/y.tool'), '');
-    await fs.writeFile(path.join(root, 'a/skip.md'), '');
-    await fs.writeFile(path.join(root, 'x.tool'), '');
-
-    const found = await walkFiles(root, (n) => n.endsWith('.tool'));
-    // Relative `/`-separated paths, sorted, only matching basenames.
-    expect(found).toEqual(['a/y.tool', 'b/deep/z.tool', 'x.tool']);
-  });
-
-  it('skips dot-prefixed entries — files AND whole directories (.git)', async () => {
-    await fs.mkdir(path.join(root, '.git/objects'), { recursive: true });
-    await fs.writeFile(path.join(root, '.git/objects/a.tool'), '');
-    await fs.writeFile(path.join(root, '.hidden.tool'), '');
-    await fs.writeFile(path.join(root, 'visible.tool'), '');
-
-    expect(await walkFiles(root, (n) => n.endsWith('.tool'))).toEqual(['visible.tool']);
-  });
-});

package/src/shared/fs-walk.ts

@@ -1,30 +0,0 @@
-import path from 'node:path';
-import fs from 'node:fs/promises';
-
-/**
- * The ONE recursive file walk for catalog scanners: relative (`/`-separated,
- * sorted) paths of files under `root` whose basename matches. A missing root
- * yields `[]`; dot-entries (incl. `.git`) are skipped. Scanners with different
- * semantics (the skills scanner's stop-at-skill-folder walk, the access
- * resolver's dir chains) deliberately keep their own walks.
- */
-export async function walkFiles(root: string, match: (basename: string) => boolean): Promise<string[]> {
-  const out: string[] = [];
-  const walk = async (dir: string, rel: string): Promise<void> => {
-    let entries: import('node:fs').Dirent[];
-    try {
-      entries = await fs.readdir(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (entry.name.startsWith('.')) continue;
-      const childRel = rel ? `${rel}/${entry.name}` : entry.name;
-      if (entry.isDirectory()) await walk(path.join(dir, entry.name), childRel);
-      else if (entry.isFile() && match(entry.name)) out.push(childRel);
-    }
-  };
-  await walk(root, '');
-  out.sort();
-  return out;
-}

package/src/shared/hash-email.ts

@@ -1,14 +0,0 @@
-import { createHash } from 'node:crypto';
-
-/**
- * Canonical user-identity hash: SHA-256 over the trimmed, lowercased email,
- * returned as hex. Used wherever Bevel needs a stable email-derived identifier
- * without storing the raw email — PR author-id markers, self-approval
- * detection, etc. All callers MUST use this single function; a drift in the
- * normalization (case, whitespace) would silently de-attribute every PR the
- * bot opens because the hash embedded in the PR body would no longer match
- * the hash computed at lookup time.
- */
-export function hashEmail(email: string): string {
-  return createHash('sha256').update(email.trim().toLowerCase()).digest('hex');
-}