@polderlabs/bizar 9.0.0 → 10.0.5

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes/voice.mjs

@@ -1,167 +0,0 @@
-/**
- * src/server/routes/voice.mjs
- *
- * v5.0.0 — Voice notes REST API.
- * v5.2   — Upload now saves audio immediately and enqueues background
- *           transcription instead of blocking the request on Whisper.
- *
- * Endpoints:
- *   POST   /api/voice/upload            — multipart upload, enqueue transcription
- *   GET    /api/voice/list?vaultPath=   — list notes (optionally filtered)
- *   GET    /api/voice/:id              — get note details
- *   DELETE /api/voice/:id              — delete note + audio + transcript
- *   GET    /api/voice/:id/audio        — stream audio file
- */
-
-import { Router } from 'express';
-import { createReadStream, existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { info, warn, child } from '../logger.mjs';
-import { saveVoiceNote, listVoiceNotes, getVoiceNote, deleteVoiceNote } from '../voice-store.mjs';
-import { enqueueTranscription } from '../workers/transcription-worker.mjs';
-import { wrap } from './_shared.mjs';
-import formidable from 'formidable';
-
-const log = child({ module: 'voice-routes' });
-
-/**
- * @param {object} _deps
- * @returns {import('express').Router}
- */
-export function createVoiceRouter(_deps) {
-  const router = Router();
-
-  /**
-   * Whether Whisper is configured. When false, the worker is skipped
-   * entirely — uploads still succeed, just without transcripts.
-   */
-  function whisperAvailable() {
-    return Boolean(process.env.OPENAI_API_KEY) || Boolean(process.env.BIZAR_WHISPER_ENDPOINT);
-  }
-
-  // POST /api/voice/upload — multipart: audio file + vaultPath field
-  router.post('/voice/upload', wrap(async (req, res) => {
-    const form = formidable({ maxFileSize: 50 * 1024 * 1024 }); // 50 MB limit
-    form.parse(req, async (err, fields, files) => {
-      if (err) {
-        warn('voice upload: parse error', { err: err.message });
-        res.status(400).json({ error: 'upload_error', message: err.message });
-        return;
-      }
-
-      const vaultPath = Array.isArray(fields.vaultPath)
-        ? fields.vaultPath[0]
-        : fields.vaultPath || null;
-
-      const audioFile = files.audio?.[0];
-      if (!audioFile) {
-        res.status(400).json({ error: 'missing_audio', message: 'No audio file in upload' });
-        return;
-      }
-
-      // Read audio bytes
-      let audioBuffer;
-      try {
-        const { readFileSync } = await import('node:fs');
-        audioBuffer = readFileSync(audioFile.filepath);
-      } catch (readErr) {
-        warn('voice upload: failed to read audio file', { err: readErr.message });
-        res.status(500).json({ error: 'read_error', message: 'Could not read audio file' });
-        return;
-      }
-
-      // v5.2 — Transcription is now asynchronous. Save the audio first;
-      // the worker fills in the transcript when Whisper (or a local
-      // proxy) responds. Clients can poll GET /api/voice/:id or watch
-      // the `voice:updated` WS event for the transcript to appear.
-      const transcript = null;
-
-      // Duration from audioFile (formidable provides size but not duration — we
-      // store null and the frontmatter will show '?')
-      const durationSec = null;
-
-      // Save
-      let saved;
-      try {
-        saved = await saveVoiceNote({ audioBuffer, transcript, durationSec, vaultPath });
-      } catch (saveErr) {
-        warn('voice upload: save failed', { err: saveErr.message });
-        res.status(500).json({ error: 'save_error', message: saveErr.message });
-        return;
-      }
-
-      // Kick the background worker ONLY when we have a place to send
-      // the audio. Without credentials the worker would just return
-      // null forever and waste an open file descriptor.
-      let transcriptionPending = false;
-      if (whisperAvailable()) {
-        try {
-          enqueueTranscription(saved.id);
-          transcriptionPending = true;
-        } catch (enqErr) {
-          warn('transcription enqueue failed', { id: saved.id, err: enqErr.message });
-        }
-      }
-
-      log.info('voice note saved via upload', {
-        id: saved.id,
-        transcriptionPending,
-        transcriptLength: 0,
-      });
-      res.json({
-        notePath: saved.notePath,
-        audioPath: saved.audioPath,
-        id: saved.id,
-        transcription: null,
-        transcriptionPending,
-      });
-    });
-  }));
-
-  // GET /api/voice/list?vaultPath=
-  router.get('/voice/list', wrap(async (req, res) => {
-    const vaultPath = req.query.vaultPath || null;
-    const limit = Math.min(200, Math.max(1, parseInt(req.query.limit || '50', 10) || 50));
-    const notes = listVoiceNotes({ vaultPath, limit });
-    res.json({ notes });
-  }));
-
-  // GET /api/voice/:id
-  router.get('/voice/:id', wrap(async (req, res) => {
-    const note = getVoiceNote(req.params.id);
-    if (!note) {
-      res.status(404).json({ error: 'not_found' });
-      return;
-    }
-    res.json({ note });
-  }));
-
-  // DELETE /api/voice/:id
-  router.delete('/voice/:id', wrap(async (req, res) => {
-    const ok = deleteVoiceNote(req.params.id);
-    if (!ok) {
-      res.status(404).json({ error: 'not_found' });
-      return;
-    }
-    res.status(204).end();
-  }));
-
-  // GET /api/voice/:id/audio — stream audio file
-  router.get('/voice/:id/audio', wrap(async (req, res) => {
-    const note = getVoiceNote(req.params.id);
-    if (!note) {
-      res.status(404).json({ error: 'not_found' });
-      return;
-    }
-    if (!existsSync(note.audioPath)) {
-      warn('voice audio file missing', { id: req.params.id, path: note.audioPath });
-      res.status(404).json({ error: 'audio_missing' });
-      return;
-    }
-    res.setHeader('Content-Type', 'audio/webm');
-    res.setHeader('Cache-Control', 'no-cache');
-    createReadStream(note.audioPath).pipe(res);
-  }));
-
-  return router;
-}

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes/workspaces.mjs

@@ -1,299 +0,0 @@
-/**
- * src/server/routes/workspaces.mjs
- *
- * v5.0.0 — Workspace management REST API.
- *
- * Endpoints:
- *   GET    /api/workspaces                    — list user's workspaces
- *   POST   /api/workspaces                    — create workspace
- *   GET    /api/workspaces/:id                — get workspace details
- *   DELETE /api/workspaces/:id                 — delete workspace (admin only)
- *   POST   /api/workspaces/:id/invites        — create invite
- *   GET    /api/workspaces/:id/invites        — list pending invites
- *   DELETE /api/workspaces/:id/invites/:token — revoke invite
- *   POST   /api/workspaces/:id/members/:userId — update member role
- *   DELETE /api/workspaces/:id/members/:userId — remove member
- *   POST   /api/invites/:token/accept         — accept invite
- */
-import { Router } from 'express';
-import {
-  createWorkspace,
-  getWorkspace,
-  listWorkspacesWithRoles,
-  deleteWorkspace,
-  createInvite,
-  listInvites,
-  revokeInvite,
-  addMember,
-  removeMember,
-  updateMemberRole,
-  acceptInvite,
-  checkPermission,
-  listMembers,
-  ROLES,
-} from '../workspaces.mjs';
-import { getCurrentUserId, getCurrentWorkspaceId } from '../auth.mjs';
-import { withSpan, setCommonAttributes } from '../otel.mjs';
-import { recordTrace } from '../metrics.mjs';
-import { wrap } from './_shared.mjs';
-
-/**
- * Common scope helper: extract userId/workspaceId from the request
- * and bind them to the active span. Returns `null` (and lets the
- * caller emit a 401) when no user is attached to the request.
- * Callers decide whether to short-circuit by checking the return
- * value.
- *
- * @param {import('@opentelemetry/api').Span} span
- * @param {import('express').Request} req
- * @returns {string|null}
- */
-function bindUserScope(span, req) {
-  const userId = getCurrentUserId(req);
-  const workspaceId = getCurrentWorkspaceId(req) || null;
-  const ip = req.ip || req.socket?.remoteAddress;
-  const userAgent = req.headers?.['user-agent'];
-  setCommonAttributes(span, { userId, workspaceId, ip, userAgent });
-  return userId || null;
-}
-
-/**
- * @returns {import('express').Router}
- */
-export function createWorkspacesRouter() {
-  const router = Router();
-
-  // GET /api/workspaces — list user's workspaces
-  router.get('/workspaces', wrap(withSpan('workspace.list', async (span, req, res) => {
-    const userId = bindUserScope(span, req);
-    if (!userId) {
-      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
-      recordTrace('workspace.list', { outcome: 'unauthorized' });
-      return;
-    }
-    const workspaces = await listWorkspacesWithRoles(userId);
-    span.setAttribute('workspace.count', workspaces.length);
-    res.json({ workspaces });
-    recordTrace('workspace.list', { outcome: 'ok', count_bucket: workspaces.length === 0 ? '0' : workspaces.length < 5 ? '1-4' : '5+' });
-  })));
-
-  // POST /api/workspaces — create workspace
-  router.post('/workspaces', wrap(withSpan('workspace.create', async (span, req, res) => {
-    const userId = bindUserScope(span, req);
-    if (!userId) {
-      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
-      recordTrace('workspace.create', { outcome: 'unauthorized' });
-      return;
-    }
-    const { name } = req.body || {};
-    if (!name || typeof name !== 'string' || !name.trim()) {
-      res.status(400).json({ error: 'bad_request', message: 'Workspace name is required' });
-      recordTrace('workspace.create', { outcome: 'missing_name' });
-      return;
-    }
-    const workspace = await createWorkspace({ name: name.trim(), ownerId: userId });
-    span.setAttribute('workspace.id', workspace.id);
-    res.status(201).json({ workspace });
-    recordTrace('workspace.create', { outcome: 'created' });
-  })));
-
-  // GET /api/workspaces/:id — get workspace details
-  router.get('/workspaces/:id', wrap(withSpan('workspace.get', async (span, req, res) => {
-    const userId = bindUserScope(span, req);
-    const { id } = req.params;
-    span.setAttribute('workspace.id', id);
-    if (!userId) {
-      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
-      recordTrace('workspace.get', { outcome: 'unauthorized' });
-      return;
-    }
-    const workspace = await getWorkspace(id);
-    if (!workspace) {
-      res.status(404).json({ error: 'not_found', message: 'Workspace not found' });
-      recordTrace('workspace.get', { outcome: 'not_found' });
-      return;
-    }
-    const hasAccess = await checkPermission(id, userId, ROLES.VIEWER);
-    if (!hasAccess) {
-      res.status(403).json({ error: 'forbidden', message: 'Not a member of this workspace' });
-      recordTrace('workspace.get', { outcome: 'forbidden' });
-      return;
-    }
-    const members = await listMembers(id);
-    span.setAttribute('workspace.member_count', members.length);
-    res.json({ workspace, members });
-    recordTrace('workspace.get', { outcome: 'ok' });
-  })));
-
-  // DELETE /api/workspaces/:id — delete workspace (admin only)
-  router.delete('/workspaces/:id', wrap(withSpan('workspace.delete', async (span, req, res) => {
-    const userId = bindUserScope(span, req);
-    const { id } = req.params;
-    span.setAttribute('workspace.id', id);
-    if (!userId) {
-      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
-      recordTrace('workspace.delete', { outcome: 'unauthorized' });
-      return;
-    }
-    const canDelete = await checkPermission(id, userId, ROLES.ADMIN);
-    if (!canDelete) {
-      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
-      recordTrace('workspace.delete', { outcome: 'forbidden' });
-      return;
-    }
-    await deleteWorkspace(id);
-    res.json({ ok: true });
-    recordTrace('workspace.delete', { outcome: 'ok' });
-  })));
-
-  // POST /api/workspaces/:id/invites — create invite
-  router.post('/workspaces/:id/invites', wrap(withSpan('workspace.invite.create', async (span, req, res) => {
-    const userId = bindUserScope(span, req);
-    const { id } = req.params;
-    span.setAttribute('workspace.id', id);
-    if (!userId) {
-      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
-      recordTrace('workspace.invite.create', { outcome: 'unauthorized' });
-      return;
-    }
-    const { email, role } = req.body || {};
-    if (!email || typeof email !== 'string') {
-      res.status(400).json({ error: 'bad_request', message: 'Email is required' });
-      recordTrace('workspace.invite.create', { outcome: 'missing_email' });
-      return;
-    }
-    if (!role || !Object.values(ROLES).includes(role)) {
-      res.status(400).json({ error: 'bad_request', message: 'Valid role is required' });
-      recordTrace('workspace.invite.create', { outcome: 'invalid_role' });
-      return;
-    }
-    const canInvite = await checkPermission(id, userId, ROLES.ADMIN);
-    if (!canInvite) {
-      res.status(403).json({ error: 'forbidden', message: 'Admin role required to invite' });
-      recordTrace('workspace.invite.create', { outcome: 'forbidden' });
-      return;
-    }
-    span.setAttribute('workspace.invite.role', role);
-    const result = await createInvite(id, email, role, userId);
-    res.status(201).json(result);
-    recordTrace('workspace.invite.create', { outcome: 'created', role });
-  })));
-
-  // GET /api/workspaces/:id/invites — list pending invites
-  router.get('/workspaces/:id/invites', wrap(withSpan('workspace.invite.list', async (span, req, res) => {
-    const userId = bindUserScope(span, req);
-    const { id } = req.params;
-    span.setAttribute('workspace.id', id);
-    if (!userId) {
-      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
-      recordTrace('workspace.invite.list', { outcome: 'unauthorized' });
-      return;
-    }
-    const canView = await checkPermission(id, userId, ROLES.ADMIN);
-    if (!canView) {
-      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
-      recordTrace('workspace.invite.list', { outcome: 'forbidden' });
-      return;
-    }
-    const invites = await listInvites(id);
-    span.setAttribute('workspace.invite.count', invites.length);
-    res.json({ invites });
-    recordTrace('workspace.invite.list', { outcome: 'ok', count_bucket: invites.length === 0 ? '0' : '1+' });
-  })));
-
-  // DELETE /api/workspaces/:id/invites/:token — revoke invite
-  router.delete('/workspaces/:id/invites/:token', wrap(withSpan('workspace.invite.revoke', async (span, req, res) => {
-    const userId = bindUserScope(span, req);
-    const { id, token } = req.params;
-    span.setAttribute('workspace.id', id);
-    if (!userId) {
-      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
-      recordTrace('workspace.invite.revoke', { outcome: 'unauthorized' });
-      return;
-    }
-    const canRevoke = await checkPermission(id, userId, ROLES.ADMIN);
-    if (!canRevoke) {
-      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
-      recordTrace('workspace.invite.revoke', { outcome: 'forbidden' });
-      return;
-    }
-    await revokeInvite(id, token);
-    res.json({ ok: true });
-    recordTrace('workspace.invite.revoke', { outcome: 'ok' });
-  })));
-
-  // POST /api/workspaces/:id/members/:userId — update member role
-  router.post('/workspaces/:id/members/:userId', wrap(withSpan('workspace.member.update', async (span, req, res) => {
-    const userId = bindUserScope(span, req);
-    const { id, userId: targetUserId } = req.params;
-    span.setAttribute('workspace.id', id);
-    span.setAttribute('workspace.target_user_id', targetUserId);
-    if (!userId) {
-      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
-      recordTrace('workspace.member.update', { outcome: 'unauthorized' });
-      return;
-    }
-    const { role } = req.body || {};
-    if (!role || !Object.values(ROLES).includes(role)) {
-      res.status(400).json({ error: 'bad_request', message: 'Valid role is required' });
-      recordTrace('workspace.member.update', { outcome: 'invalid_role' });
-      return;
-    }
-    const canUpdate = await checkPermission(id, userId, ROLES.ADMIN);
-    if (!canUpdate) {
-      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
-      recordTrace('workspace.member.update', { outcome: 'forbidden' });
-      return;
-    }
-    span.setAttribute('workspace.member.new_role', role);
-    await updateMemberRole(id, targetUserId, role);
-    res.json({ ok: true, role });
-    recordTrace('workspace.member.update', { outcome: 'ok', role });
-  })));
-
-  // DELETE /api/workspaces/:id/members/:userId — remove member
-  router.delete('/workspaces/:id/members/:userId', wrap(withSpan('workspace.member.remove', async (span, req, res) => {
-    const userId = bindUserScope(span, req);
-    const { id, userId: targetUserId } = req.params;
-    span.setAttribute('workspace.id', id);
-    span.setAttribute('workspace.target_user_id', targetUserId);
-    if (!userId) {
-      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
-      recordTrace('workspace.member.remove', { outcome: 'unauthorized' });
-      return;
-    }
-    const canRemove = await checkPermission(id, userId, ROLES.ADMIN);
-    if (!canRemove) {
-      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
-      recordTrace('workspace.member.remove', { outcome: 'forbidden' });
-      return;
-    }
-    await removeMember(id, targetUserId);
-    res.json({ ok: true });
-    recordTrace('workspace.member.remove', { outcome: 'ok' });
-  })));
-
-  // POST /api/invites/:token/accept — accept invite
-  router.post('/invites/:token/accept', wrap(withSpan('workspace.invite.accept', async (span, req, res) => {
-    const userId = bindUserScope(span, req);
-    const { token } = req.params;
-    if (!userId) {
-      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
-      recordTrace('workspace.invite.accept', { outcome: 'unauthorized' });
-      return;
-    }
-    const { email, name } = req.body || {};
-    if (!email || !name) {
-      res.status(400).json({ error: 'bad_request', message: 'Email and name are required' });
-      recordTrace('workspace.invite.accept', { outcome: 'missing_fields' });
-      return;
-    }
-    const result = await acceptInvite(token, userId, email, name);
-    if (result?.workspace?.id) span.setAttribute('workspace.id', result.workspace.id);
-    if (result?.role) span.setAttribute('workspace.member.role', result.role);
-    res.json({ ok: true, workspace: result.workspace, role: result.role });
-    recordTrace('workspace.invite.accept', { outcome: 'ok' });
-  })));
-
-  return router;
-}

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes-v2/auth.mjs

@@ -1,59 +0,0 @@
-/**
- * src/server/routes-v2/auth.mjs
- *
- * v0.7.0-alpha.1 — HTTP Basic auth middleware for /api/v2/* routes.
- *
- * Username: `cline` (per cline convention used elsewhere in Bizar).
- * Password: the dashboard-generated secret in ~/.cache/bizarharness/dash-auth.json.
- */
-
-import { Buffer } from 'node:buffer';
-
-export const V2_AUTH_REALM = 'Bizar Dashboard v2';
-
-export function v2BasicAuth(getPassword) {
-  return function (req, res, next) {
-    const header = req.headers?.authorization ?? req.headers?.Authorization;
-    if (!header || typeof header !== 'string' || !header.startsWith('Basic ')) {
-      res.setHeader('WWW-Authenticate', `Basic realm="${V2_AUTH_REALM}"`);
-      return res.status(401).json({
-        name: 'DashboardError',
-        data: { statusCode: 401, message: 'Missing Authorization header' },
-      });
-    }
-
-    const expected = getPassword();
-    if (typeof expected !== 'string' || expected.length === 0) {
-      return res.status(500).json({
-        name: 'DashboardError',
-        data: { statusCode: 500, message: 'Dashboard auth not initialized' },
-      });
-    }
-
-    let decoded;
-    try {
-      const b64 = header.slice('Basic '.length);
-      decoded = Buffer.from(b64, 'base64').toString('utf-8');
-    } catch {
-      res.setHeader('WWW-Authenticate', `Basic realm="${V2_AUTH_REALM}"`);
-      return res.status(401).json({
-        name: 'DashboardError',
-        data: { statusCode: 401, message: 'Malformed Authorization header' },
-      });
-    }
-
-    const colonIdx = decoded.indexOf(':');
-    const user = colonIdx === -1 ? decoded : decoded.slice(0, colonIdx);
-    const pass = colonIdx === -1 ? '' : decoded.slice(colonIdx + 1);
-
-    if (user !== 'cline' || pass !== expected) {
-      res.setHeader('WWW-Authenticate', `Basic realm="${V2_AUTH_REALM}"`);
-      return res.status(401).json({
-        name: 'DashboardError',
-        data: { statusCode: 401, message: 'Invalid credentials' },
-      });
-    }
-
-    return next();
-  };
-}

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes-v2/events.mjs

@@ -1,121 +0,0 @@
-/**
- * src/server/routes-v2/events.mjs
- *
- * v0.7.0-alpha.1 — SSE event stream + publish endpoint.
- *
- * GET  /api/v2/event  — subscribe (text/event-stream, sends dashboard.connected first)
- * POST /api/v2/event  — publish (returns 204)
- *
- * Matches the cline SSE wire format:
- *   event: <type>
- *   data: {"type": "<type>", "properties": {...}}
- *
- * Replay buffer: last 100 events, accessible via `?since=<seq>`.
- */
-
-import express from 'express';
-import { createRateLimiter } from '../lib/rate-limit.mjs';
-
-export function createV2EventsRouter({ eventBus }) {
-  const router = express.Router();
-
-  // v4.8.0 — Per-IP token bucket. The v2 event endpoint accepts
-  // arbitrary publishes from the cline plugin, so we cap it
-  // higher than chat to keep automation pipelines flowing under
-  // burst. Defaults: 120 requests / minute / IP, 2 tokens/sec refill.
-  // Operators can tune via BIZAR_RATE_LIMIT_EVENT_CAPACITY /
-  // BIZAR_RATE_LIMIT_EVENT_REFILL.
-  const eventLimiter = createRateLimiter({
-    capacity: parseInt(process.env.BIZAR_RATE_LIMIT_EVENT_CAPACITY || '120', 10),
-    refillPerSecond: parseFloat(process.env.BIZAR_RATE_LIMIT_EVENT_REFILL || '2'),
-    scope: 'event',
-  });
-  router.use(eventLimiter);
-
-  router.get('/event', (req, res) => {
-    res.status(200);
-    res.setHeader('Content-Type', 'text/event-stream');
-    res.setHeader('Cache-Control', 'no-cache');
-    res.setHeader('Connection', 'keep-alive');
-    res.setHeader('X-Accel-Buffering', 'no'); // disable nginx buffering
-    res.flushHeaders?.();
-
-    // First event: dashboard.connected.
-    writeSseEvent(res, { type: 'dashboard.connected', properties: {} });
-
-    const sinceRaw = req.query?.since;
-    const since = typeof sinceRaw === 'string' ? Number.parseInt(sinceRaw, 10) : undefined;
-    const validSince = Number.isFinite(since) ? since : undefined;
-
-    const sub = eventBus.subscribe({ since: validSince });
-
-    // Async pump: pull events from sub.events and write them to res.
-    const pump = (async () => {
-      try {
-        for await (const record of sub.events) {
-          if (res.writableEnded || res.destroyed) break;
-          writeSseEvent(res, record);
-        }
-      } catch (err) {
-        if (!res.writableEnded) {
-          try {
-            res.end();
-          } catch {
-            /* ignore */
-          }
-        }
-      }
-    })();
-
-    // Heartbeat every 25s to keep the connection alive through proxies.
-    const heartbeat = setInterval(() => {
-      if (res.writableEnded || res.destroyed) {
-        clearInterval(heartbeat);
-        return;
-      }
-      try {
-        res.write(': keepalive\n\n');
-      } catch {
-        clearInterval(heartbeat);
-      }
-    }, 25_000);
-
-    req.on('close', () => {
-      clearInterval(heartbeat);
-      sub.close();
-    });
-
-    // Don't await pump — it's a long-lived stream.
-    void pump;
-  });
-
-  router.post('/event', (req, res) => {
-    const body = req.body;
-    if (!body || typeof body !== 'object' || typeof body.type !== 'string') {
-      return res.status(400).json({
-        name: 'DashboardError',
-        data: { statusCode: 400, message: 'Event must have a string `type` field' },
-      });
-    }
-    try {
-      eventBus.publish({ type: body.type, properties: body.properties ?? {} });
-    } catch (err) {
-      return res.status(400).json({
-        name: 'DashboardError',
-        data: { statusCode: 400, message: err instanceof Error ? err.message : String(err) },
-      });
-    }
-    return res.status(204).end();
-  });
-
-  return router;
-}
-
-function writeSseEvent(res, record) {
-  const payload = JSON.stringify({
-    type: record.type,
-    properties: record.properties ?? {},
-  });
-  res.write(`event: ${record.type}\n`);
-  res.write(`data: ${payload}\n\n`);
-}

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes-v2/health.mjs

@@ -1,21 +0,0 @@
-/**
- * src/server/routes-v2/health.mjs
- *
- * v0.7.0-alpha.1 — Public health endpoint (no auth required).
- */
-
-import express from 'express';
-
-export function createV2HealthRouter({ version, startedAt }) {
-  const router = express.Router();
-
-  router.get('/health', (_req, res) => {
-    res.status(200).json({
-      status: 'ok',
-      uptime: Math.max(0, Math.floor((Date.now() - startedAt) / 1000)),
-      version,
-    });
-  });
-
-  return router;
-}