@polderlabs/bizar 8.0.0 → 9.0.0

package/.claude/worktrees/kanban-overhaul/packages/sdk/src/federation/pii.ts

@@ -0,0 +1,241 @@
+/**
+ * federation/pii.ts — PII redaction pipeline with 4 compliance modes.
+ *
+ * F-038 — ported from ruflo
+ * `v3/@claude-flow/plugin-agent-federation/src/domain/services/pii-pipeline-service.ts`
+ * but simplified per spec ("For v1, focus on redact (regex-based:
+ * emails, SSNs, credit cards, IPs)") while keeping the same
+ * 4-mode surface (`soc2 | gdpr | hipaa | permissive`).
+ *
+ * Compliance modes map to the detection + action matrix:
+ *
+ *   soc2       — strict; redact emails, IPs, SSNs, credit cards.
+ *   gdpr       — strict; redact emails, IPs, names, addresses.
+ *   hipaa      — strictest; redact everything we recognise (incl. SSN).
+ *   permissive — only block the most damaging (credit cards, JWTs,
+ *                AWS keys, private keys, GitHub tokens); pass through
+ *                emails / IPs / phone numbers.
+ *
+ * The transforms are PURE: no I/O, no clocks (other than explicit
+ * `now` injection). `apply()` returns a transformed string + the
+ * list of detections + a `blocked` flag (true if a hard-blocked
+ * PII was found — the caller decides whether to drop the message).
+ *
+ * No native deps.
+ */
+
+/** 4 supported compliance modes for the skeleton. */
+export type PiiMode = "soc2" | "gdpr" | "hipaa" | "permissive";
+
+export const PII_MODES: readonly PiiMode[] = ["soc2", "gdpr", "hipaa", "permissive"] as const;
+
+export function isPiiMode(m: unknown): m is PiiMode {
+  return typeof m === "string" && (PII_MODES as readonly string[]).includes(m);
+}
+
+export type PiiAction = "redact" | "hash" | "pass" | "block";
+
+/** Internal PII categories — finer-grained than the modes. */
+export type PiiCategory =
+  | "email"
+  | "ssn"
+  | "credit_card"
+  | "ip_address"
+  | "phone"
+  | "name"
+  | "address"
+  | "jwt"
+  | "aws_key"
+  | "private_key"
+  | "github_token";
+
+export interface PiiDetection {
+  readonly category: PiiCategory;
+  readonly value: string;
+  readonly offset: number;
+  readonly confidence: number;
+}
+
+export interface PiiResult {
+  readonly transformed: string;
+  readonly detections: readonly PiiDetection[];
+  readonly actionsApplied: readonly { category: PiiCategory; action: PiiAction }[];
+  readonly blocked: boolean;
+  readonly mode: PiiMode;
+}
+
+interface RegexEntry {
+  readonly category: PiiCategory;
+  readonly pattern: RegExp;
+  readonly confidence: number;
+}
+
+/** Detection table — order matters: more-specific patterns come first
+ *  so we don't double-match. */
+const PATTERNS: readonly RegexEntry[] = [
+  // secrets/keys — block in every mode except permissive (which still blocks them)
+  { category: "aws_key",       pattern: /\bAKIA[0-9A-Z]{16}\b/g,                         confidence: 0.99 },
+  { category: "private_key",   pattern: /-----BEGIN\s+(?:RSA\s+|EC\s+|DSA\s+)?PRIVATE\s+KEY-----/g, confidence: 0.99 },
+  { category: "github_token",  pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}\b/g, confidence: 0.97 },
+  { category: "jwt",           pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, confidence: 0.95 },
+  { category: "credit_card",   pattern: /\b(?:\d{4}[-\s]?){3}\d{4}\b/g,                  confidence: 0.94 },
+  { category: "ssn",           pattern: /\b\d{3}-\d{2}-\d{4}\b/g,                          confidence: 0.93 },
+  { category: "email",         pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, confidence: 0.9 },
+  { category: "ip_address",    pattern: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g,                  confidence: 0.85 },
+  { category: "phone",         pattern: /(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g, confidence: 0.8 },
+  { category: "name",          pattern: /\b(?:Mr\.|Mrs\.|Ms\.|Dr\.)\s+[A-Z][a-z]+(?:\s+[A-Z][a-z]+)+\b/g, confidence: 0.7 },
+  { category: "address",       pattern: /\b\d{1,5}\s+(?:[A-Z][a-z]+\s+){1,3}(?:St|Ave|Blvd|Dr|Ln|Rd|Way|Ct)\b/g, confidence: 0.7 },
+];
+
+/** Per-mode action policy. `block` means the envelope is rejected
+ *  outright (caller drops it); `redact` replaces with
+ *  `[REDACTED:<category>]`; `hash` replaces with
+ *  `[HASH:<8-char-prefix>]`; `pass` lets it through unchanged. */
+const MODE_POLICY: Record<PiiMode, Record<PiiCategory, PiiAction>> = {
+  soc2: {
+    email: "redact", ssn: "redact", credit_card: "block", ip_address: "redact",
+    phone: "redact", name: "pass", address: "pass",
+    jwt: "block", aws_key: "block", private_key: "block", github_token: "block",
+  },
+  gdpr: {
+    email: "redact", ssn: "redact", credit_card: "block", ip_address: "redact",
+    phone: "redact", name: "redact", address: "redact",
+    jwt: "block", aws_key: "block", private_key: "block", github_token: "block",
+  },
+  hipaa: {
+    email: "redact", ssn: "redact", credit_card: "block", ip_address: "redact",
+    phone: "redact", name: "redact", address: "redact",
+    jwt: "block", aws_key: "block", private_key: "block", github_token: "block",
+  },
+  permissive: {
+    email: "pass", ssn: "redact", credit_card: "block", ip_address: "pass",
+    phone: "pass", name: "pass", address: "pass",
+    jwt: "block", aws_key: "block", private_key: "block", github_token: "block",
+  },
+};
+
+const REDACT_TOKEN = (cat: PiiCategory) => `[REDACTED:${cat}]`;
+const HASH_PREFIX = 8;
+
+function deterministicHash(value: string, salt: string): string {
+  // Lightweight, no-native-dep hash: FNV-1a 32-bit, hex-encoded, then
+  // salted + first-N chars. The skeleton doesn't need crypto-grade
+  // hashing here — the HMAC envelope signature already provides
+  // integrity. This is purely for irreversible string replacement.
+  let h = 0x811c9dc5;
+  for (let i = 0; i < value.length; i++) {
+    h ^= value.charCodeAt(i);
+    h = Math.imul(h, 0x01000193) >>> 0;
+  }
+  const salted = `${salt}:${h.toString(16).padStart(8, "0")}`;
+  let h2 = 0x811c9dc5;
+  for (let i = 0; i < salted.length; i++) {
+    h2 ^= salted.charCodeAt(i);
+    h2 = Math.imul(h2, 0x01000193) >>> 0;
+  }
+  return h2.toString(16).padStart(8, "0");
+}
+
+export interface ApplyOptions {
+  /** Salt for hash() actions. Defaults to "bizar". */
+  readonly salt?: string;
+}
+
+/** Pure-function PII pipeline. Walks the regex table, decides an
+ *  action per category under the chosen mode, applies the
+ *  replacement. Returns enough metadata for the audit service to
+ *  log what was stripped. */
+export function apply(
+  text: string,
+  mode: PiiMode,
+  opts: ApplyOptions = {},
+): PiiResult {
+  if (!isPiiMode(mode)) {
+    throw new Error(`apply: unknown mode '${String(mode)}'`);
+  }
+  const salt = opts.salt ?? "bizar";
+  const policy = MODE_POLICY[mode];
+  const detections: PiiDetection[] = [];
+  const actionsApplied: { category: PiiCategory; action: PiiAction }[] = [];
+  let blocked = false;
+  let transformed = text;
+
+  // Two-phase: (1) collect ALL detections across ALL categories first,
+  // (2) apply per-category actions in reverse-offset order so a
+  // `block` on one category doesn't hide detections in later ones.
+  for (const entry of PATTERNS) {
+    const regex = new RegExp(entry.pattern.source, entry.pattern.flags);
+    let m: RegExpExecArray | null;
+    while ((m = regex.exec(transformed)) !== null) {
+      detections.push({
+        category: entry.category,
+        value: m[0],
+        offset: m.index,
+        confidence: entry.confidence,
+      });
+    }
+  }
+
+  // Now compute actions per category. `block` short-circuits the
+  // whole transform but we still report every detection.
+  for (const entry of PATTERNS) {
+    const inCategory = detections.filter((d) => d.category === entry.category);
+    if (inCategory.length === 0) continue;
+
+    const action = policy[entry.category];
+    actionsApplied.push({ category: entry.category, action });
+    if (action === "block") {
+      blocked = true;
+      continue;
+    }
+    if (action === "pass") continue;
+
+    // Apply right-to-left so earlier offsets remain valid.
+    for (const hit of inCategory.reverse()) {
+      const replacement =
+        action === "redact"
+          ? REDACT_TOKEN(entry.category)
+          : `[HASH:${deterministicHash(hit.value, salt).slice(0, HASH_PREFIX)}]`;
+      transformed =
+        transformed.slice(0, hit.offset) +
+        replacement +
+        transformed.slice(hit.offset + hit.value.length);
+    }
+  }
+
+  if (blocked) transformed = "";
+
+  return {
+    transformed,
+    detections,
+    actionsApplied,
+    blocked,
+    mode,
+  };
+}
+
+/** PiiPipeline — class wrapper for parity with ruflo's
+ *  PIIPipelineService shape. Holds a default mode + salt, exposes
+ *  `process(text)` and `setMode(mode)`. */
+export class PiiPipeline {
+  private mode: PiiMode;
+  private readonly salt: string;
+
+  constructor(opts: { mode?: PiiMode; salt?: string } = {}) {
+    this.mode = opts.mode ?? "soc2";
+    this.salt = opts.salt ?? "bizar";
+  }
+
+  setMode(mode: PiiMode): void {
+    if (!isPiiMode(mode)) throw new Error(`PiiPipeline: unknown mode '${mode}'`);
+    this.mode = mode;
+  }
+
+  getMode(): PiiMode {
+    return this.mode;
+  }
+
+  process(text: string): PiiResult {
+    return apply(text, this.mode, { salt: this.salt });
+  }
+}

package/.claude/worktrees/kanban-overhaul/packages/sdk/src/federation/policy.ts

@@ -0,0 +1,112 @@
+/**
+ * federation/policy.ts — PolicyEngine: enforces per-call envelope
+ * constraints (maxHops, action allowlist, peer blocklist).
+ *
+ * F-038 — ported from ruflo
+ * `v3/@claude-flow/plugin-agent-federation/src/application/policy-engine.ts`
+ * but stripped to the three checks the skeleton needs:
+ *
+ *   1. maxHops  — envelope.hopCount must be < budget.maxHops
+ *                 (default ceiling = 3 hops).
+ *   2. message  — envelope.messageType must be in the action
+ *                 allowlist.
+ *   3. peer     — source node must NOT be in the blocklist.
+ *
+ * `enforce(envelope, budget)` returns a discriminated result so
+ * callers can map directly to an MCP error string.
+ */
+
+import {
+  FEDERATION_MESSAGE_TYPES,
+  isFederationMessageType,
+  type EnvelopeBudget,
+  type FederationEnvelope,
+  type FederationMessageType,
+} from "./envelope.js";
+
+/** Hard ceiling on hops — matches the spec's "≤ 3" rule. */
+export const DEFAULT_MAX_HOPS = 3;
+
+export type PolicyDecision =
+  | { allowed: true }
+  | {
+      allowed: false;
+      denialReason:
+        | "max_hops_exceeded"
+        | "message_type_not_allowed"
+        | "peer_blocked"
+        | "budget_missing"
+        | "budget_invalid";
+    };
+
+export interface PolicyConfig {
+  /** Set of message kinds accepted by this node. Defaults to all
+   *  16 ruflo kinds — narrow via `allowedMessageTypes`. */
+  readonly allowedMessageTypes?: readonly FederationMessageType[];
+  /** Set of sourceNodeIds that are NEVER accepted (blocklist). */
+  readonly peerBlocklist?: readonly string[];
+  /** Override the default maxHops ceiling. */
+  readonly maxHops?: number;
+}
+
+export class PolicyEngine {
+  private readonly allowed: Set<FederationMessageType>;
+  private readonly blocked: Set<string>;
+  private readonly maxHops: number;
+
+  constructor(cfg: PolicyConfig = {}) {
+    this.allowed = new Set(cfg.allowedMessageTypes ?? FEDERATION_MESSAGE_TYPES);
+    this.blocked = new Set((cfg.peerBlocklist ?? []).map((s) => String(s)));
+    this.maxHops = cfg.maxHops ?? DEFAULT_MAX_HOPS;
+  }
+
+  /** Runtime mutator — narrow the allowlist after construction. */
+  allowMessageType(t: FederationMessageType): void {
+    this.allowed.add(t);
+  }
+
+  /** Runtime mutator — narrow the allowlist after construction. */
+  denyMessageType(t: FederationMessageType): void {
+    this.allowed.delete(t);
+  }
+
+  /** Runtime mutator — block / unblock a peer at runtime. */
+  setBlocked(nodeId: string, blocked: boolean): void {
+    if (blocked) this.blocked.add(nodeId);
+    else this.blocked.delete(nodeId);
+  }
+
+  /** Admit or reject an envelope given its budget context. */
+  enforce(envelope: FederationEnvelope, budget: EnvelopeBudget | undefined): PolicyDecision {
+    // 0. The budget object must exist — without it we can't enforce
+    // the maxHops ceiling.
+    if (!budget) return { allowed: false, denialReason: "budget_missing" };
+    if (typeof budget.maxHops !== "number" || !Number.isFinite(budget.maxHops)) {
+      return { allowed: false, denialReason: "budget_invalid" };
+    }
+
+    // 1. Peer blocklist
+    if (this.blocked.has(envelope.sourceNodeId)) {
+      return { allowed: false, denialReason: "peer_blocked" };
+    }
+
+    // 2. Message type allowlist
+    if (!isFederationMessageType(envelope.messageType)) {
+      return { allowed: false, denialReason: "message_type_not_allowed" };
+    }
+    if (!this.allowed.has(envelope.messageType)) {
+      return { allowed: false, denialReason: "message_type_not_allowed" };
+    }
+
+    // 3. maxHops — current hopCount must be strictly LESS than the
+    // ceiling. A freshly-origin envelope has hopCount=0 so a
+    // maxHops=3 budget admits it.
+    const hopCount = envelope.hopCount ?? 0;
+    const effectiveCeiling = Math.min(budget.maxHops, this.maxHops);
+    if (hopCount >= effectiveCeiling) {
+      return { allowed: false, denialReason: "max_hops_exceeded" };
+    }
+
+    return { allowed: true };
+  }
+}

package/.claude/worktrees/kanban-overhaul/packages/sdk/src/federation/trust.ts

@@ -0,0 +1,146 @@
+/**
+ * federation/trust.ts — TrustEvaluator: peer allowlist + recent fail
+ * rate + envelope age → trust score.
+ *
+ * F-038 — ported from ruflo
+ * `v3/@claude-flow/plugin-agent-federation/src/application/trust-evaluator.ts`
+ * (computeScore shape), stripped down for the skeleton:
+ *
+ *   evaluate(envelope, peer) → { allowed, reason, score }
+ *
+ * Inputs:
+ *   - peer (PeerState): { nodeId, allowlisted, recentFailRate, lastSeenMs }
+ *   - envelope: FederationEnvelope
+ *
+ * Scoring (pure function):
+ *   baseScore = peer.allowlisted ? 0.6 : 0.0
+ *   freshness  = clamp(1 - ageMs / MAX_AGE_MS, 0, 1) * 0.2
+ *   reliability = clamp(1 - peer.recentFailRate, 0, 1) * 0.2
+ *   score = baseScore + freshness + reliability
+ *
+ * Decision:
+ *   allowed = peer.allowlisted AND ageMs <= MAX_AGE_MS AND score >= MIN_SCORE
+ *
+ * State — per-node recent fail rate + last-seen are tracked
+ * in a Map so repeated calls from the same peer update the
+ * picture. Failures can be recorded via `recordFailure(nodeId)`.
+ */
+
+import { envelopeAgeMs, type FederationEnvelope } from "./envelope.js";
+
+/** Maximum envelope age we'll trust (5 minutes — matches the
+ *  HMAC freshness window). Older envelopes fail freshness
+ *  independently of HMAC verification. */
+export const MAX_TRUST_AGE_MS = 5 * 60 * 1000;
+
+/** Minimum composite trust score required to admit an envelope. */
+export const MIN_TRUST_SCORE = 0.7;
+
+/** Number of recent failures tracked per peer for fail-rate calc. */
+const FAILURE_WINDOW = 20;
+
+export interface PeerState {
+  readonly nodeId: string;
+  readonly allowlisted: boolean;
+  /** Failure rate over the last `FAILURE_WINDOW` calls (0..1). */
+  readonly recentFailRate: number;
+  /** Last activity timestamp (ms epoch). Used as a tiebreaker. */
+  readonly lastSeenMs?: number;
+}
+
+export type TrustDecision =
+  | { allowed: true; score: number; reason: string }
+  | { allowed: false; score: number; reason: string };
+
+export class TrustEvaluator {
+  private readonly allowlist: Set<string>;
+  private readonly failHistory = new Map<string, { failures: boolean[]; lastSeenMs: number }>();
+
+  constructor(opts: { allowlist?: readonly string[] } = {}) {
+    this.allowlist = new Set((opts.allowlist ?? []).map((s) => String(s)));
+  }
+
+  /** Add or remove a node from the trust allowlist at runtime. */
+  setAllowlisted(nodeId: string, allowlisted: boolean): void {
+    if (allowlisted) this.allowlist.add(nodeId);
+    else this.allowlist.delete(nodeId);
+  }
+
+  isAllowlisted(nodeId: string): boolean {
+    return this.allowlist.has(nodeId);
+  }
+
+  /** Snapshot the per-peer state seen by `evaluate()`. */
+  getPeerState(nodeId: string, _now: number = Date.now()): PeerState {
+    const rec = this.failHistory.get(nodeId);
+    const total = rec?.failures.length ?? 0;
+    const failures = rec?.failures.filter((b) => b).length ?? 0;
+    return {
+      nodeId,
+      allowlisted: this.allowlist.has(nodeId),
+      recentFailRate: total === 0 ? 0 : failures / total,
+      lastSeenMs: rec?.lastSeenMs,
+    };
+  }
+
+  /** Record that an exchange with `nodeId` succeeded/failed. Sliding
+   *  window of `FAILURE_WINDOW` most-recent events. */
+  recordOutcome(nodeId: string, ok: boolean, now: number = Date.now()): void {
+    const rec = this.failHistory.get(nodeId) ?? { failures: [], lastSeenMs: now };
+    rec.failures.push(!ok);
+    if (rec.failures.length > FAILURE_WINDOW) rec.failures.shift();
+    rec.lastSeenMs = now;
+    this.failHistory.set(nodeId, rec);
+  }
+
+  /** Compute the trust score (0..1). Pure function — useful for tests
+   *  and for the orchestrator's `status` tool.
+   *
+   *   baseScore  = 0.3 if allowlisted else 0.0  (allowlist is necessary, not sufficient)
+   *   freshness  = (1 - ageMs / MAX_TRUST_AGE_MS) * 0.3  (envelope must be fresh)
+   *   reliability = (1 - peer.recentFailRate) * 0.4  (peer must be reliable)
+   *
+   *   MIN_TRUST_SCORE = 0.5 — a peer needs AT LEAST 2 of the 3 axes
+   *   in good standing to pass.
+   */
+  computeScore(envelope: FederationEnvelope, peer: PeerState, now: number = Date.now()): number {
+    if (!peer.allowlisted) return 0;
+    const baseScore = 0.3;
+    const ageMs = envelopeAgeMs(envelope, now);
+    const freshness = Math.max(0, Math.min(1, 1 - ageMs / MAX_TRUST_AGE_MS)) * 0.3;
+    const reliability = Math.max(0, Math.min(1, 1 - peer.recentFailRate)) * 0.4;
+    return Math.max(0, Math.min(1, baseScore + freshness + reliability));
+  }
+
+  /** Admit or reject an envelope based on the per-peer trust state. */
+  evaluate(envelope: FederationEnvelope, peer: PeerState, now: number = Date.now()): TrustDecision {
+    if (!peer.allowlisted) {
+      return {
+        allowed: false,
+        score: 0,
+        reason: `peer_not_allowlisted: ${peer.nodeId}`,
+      };
+    }
+    const ageMs = envelopeAgeMs(envelope, now);
+    if (ageMs > MAX_TRUST_AGE_MS) {
+      return {
+        allowed: false,
+        score: 0,
+        reason: `envelope_too_old: ${ageMs}ms`,
+      };
+    }
+    const score = this.computeScore(envelope, peer, now);
+    if (score < MIN_TRUST_SCORE) {
+      return {
+        allowed: false,
+        score,
+        reason: `score_below_floor: ${score.toFixed(3)} < ${MIN_TRUST_SCORE}`,
+      };
+    }
+    return {
+      allowed: true,
+      score,
+      reason: `score=${score.toFixed(3)} (peer_allowlisted=true, age=${ageMs}ms, fail_rate=${peer.recentFailRate.toFixed(3)})`,
+    };
+  }
+}

package/.claude/worktrees/kanban-overhaul/packages/sdk/src/index.ts

@@ -0,0 +1,114 @@
+/**
+ * Public API for @polderlabs/bizar-sdk.
+ *
+ * v0.4.0 — Claude Code-native rewrite. The legacy Cline wrappers
+ * (`createClineSdk`, `subscribeClineEvents`, `Cline*` types) have been
+ * removed because Bizar no longer integrates with the Cline runtime.
+ * The Claude Code integration is via the MCP server exported from
+ * `./mcp/server.ts` (`createBizarMcpServer`) and the in-process memory
+ * vault exported from `./memory/index.ts`.
+ */
+
+// In-process memory vault (Obsidian-compatible markdown notes).
+export {
+  readNote,
+  writeNote,
+  listNotes,
+  searchNotes,
+  parseFrontmatter,
+  serializeFrontmatter,
+  resolveVaultRoot,
+  DEFAULT_MEMORY_VAULT,
+  LEGACY_MEMORY_VAULT,
+} from "./memory/index.js";
+export type { MemoryNote } from "./memory/index.js";
+
+// Dangerous-pattern scanner.
+export {
+  checkDangerous,
+  listDangerousPatterns,
+  getDangerousPatternStats,
+} from "./dangerous-patterns.js";
+export type { ApprovalDecision, ApprovalCheck } from "./dangerous-patterns.js";
+
+// Tool-call fingerprint (stable hash for loop-guard).
+export { fingerprint } from "./fingerprint.js";
+
+// Claude Code MCP server.
+export {
+  createBizarMcpServer,
+  createBizarMcpServerConfig,
+  BIZAR_TOOLS,
+  getBizarMcpToolSummary,
+  defineTool,
+} from "./mcp/server.js";
+export type { SdkMcpToolDef, SdkMcpServerConfig } from "./mcp/server.js";
+
+// F-032 — Swarm coordination primitives.
+export {
+  BizarAgentRegistry,
+  bizarAgentRegistry,
+} from "./agent-registry.js";
+export type {
+  AgentRecord,
+  AgentStatus,
+  RegisterAgentInput,
+  RegisterAgentResult,
+  ListAgentsInput,
+  ListAgentsResult,
+  TerminateAgentInput,
+  TerminateAgentResult,
+} from "./agent-registry.js";
+
+export {
+  SwarmTopologyRegistry,
+  swarmTopologyRegistry,
+  initSwarm,
+  getSwarm,
+  listSwarms,
+  recordAgentInSwarm,
+  decommissionSwarm,
+  SWARM_TOPOLOGIES,
+  DEFAULT_TOPOLOGY,
+  DEFAULT_MAX_AGENTS,
+  DEFAULT_SWARM_ID,
+} from "./swarm-topology.js";
+export type {
+  SwarmRecord,
+  SwarmTopology,
+  InitSwarmInput,
+  InitSwarmResult,
+} from "./swarm-topology.js";
+
+// F-039 — Byzantine fault-tolerant consensus (thin PBFT port).
+export {
+  ByzantineConsensus,
+  type ByzantineConsensusOpts,
+  QueenCoordinator,
+  type QueenCoordinatorOpts,
+  createConsensus,
+  getSharedConsensus,
+  resetSharedConsensus,
+  type ConsensusHandle,
+  type CreateConsensusOpts,
+  PHASE_ORDER,
+  DEFAULT_QUORUM,
+  DEFAULT_PEER_COUNT,
+  DEFAULT_MAX_FAULTS,
+} from "./consensus/index.js";
+export type {
+  CommitResult,
+  ConsensusOpts,
+  ConsensusStatus,
+  Decision,
+  Phase,
+  ProposeResult,
+  Proposal,
+  ProposalSnapshot,
+  ProposalStatus,
+  Vote,
+  VoteResult,
+  ViewChangeResult,
+} from "./consensus/types.js";
+
+export { SDK_VERSION } from "./version.js";

package/.claude/worktrees/kanban-overhaul/packages/sdk/src/mcp/bin.ts

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+/**
+ * packages/sdk/src/mcp/bin.ts — `bizar-mcp` standalone stdio MCP server.
+ *
+ * This is the runtime entry-point that `claude mcp add` and
+ * `.mcp.json` invoke. The Claude Code CLI launches this as a child
+ * process and speaks the Model Context Protocol over stdio.
+ *
+ *     claude mcp add bizar -- npx -y @polderlabs/bizar-sdk mcp
+ *
+ * The actual server is built dynamically via
+ * `@anthropic-ai/claude-agent-sdk`'s `createSdkMcpServer()` and `tool()`
+ * helpers so we don't take a hard dependency on zod at SDK-level.
+ */
+
+import { createBizarMcpServer, BIZAR_TOOLS } from "./server.js";
+
+async function main() {
+  // We have to import the SDK lazily so the SDK package itself stays
+  // optional — if a downstream user isn't using `@anthropic-ai/claude-agent-sdk`,
+  // we don't want a missing-import crash at require-time.
+  let sdk: any;
+  try {
+    sdk = await import("@anthropic-ai/claude-agent-sdk");
+  } catch (e) {
+    process.stderr.write(
+      `bizar-mcp: cannot start — @anthropic-ai/claude-agent-sdk is not installed.\n` +
+      `Install with: npm install @anthropic-ai/claude-agent-sdk\n` +
+      `Reason: ${e instanceof Error ? e.message : String(e)}\n`,
+    );
+    process.exit(2);
+  }
+
+  // `createSdkMcpServer` returns an object the host can introspect;
+  // for stdio hosts we serialize it via `.run()` or just let the
+  // process stay alive on stdin. Claude Code's `claude mcp add`
+  // knows how to talk to this transport.
+  const server = createBizarMcpServer(sdk as Parameters<typeof createBizarMcpServer>[0]);
+  // eslint-disable-next-line no-console
+  console.error(`[bizar-mcp] started; tools: ${BIZAR_TOOLS.map((t) => t.name).join(", ")}`);
+
+  // Keep the process alive. Claude Code drives I/O via stdin/stdout;
+  // the SDK MCP server object exposes a transport handle internally.
+  void server;
+  process.stdin.resume();
+}
+
+main().catch((err) => {
+  process.stderr.write(`bizar-mcp fatal: ${err instanceof Error ? err.stack ?? err.message : String(err)}\n`);
+  process.exit(1);
+});