@neurosquad/card-sdk 1.0.0

package/dist/cli.js

@@ -0,0 +1,2838 @@
+#!/usr/bin/env node
+/*! @neurosquad/card-sdk 1.0.0 | MIT */
+
+// src/version.ts
+var SDK_VERSION = "1.0.0";
+
+// src/cli/create.ts
+import {
+  copyFileSync,
+  existsSync as existsSync2,
+  mkdirSync,
+  readdirSync,
+  readFileSync as readFileSync2,
+  statSync,
+  writeFileSync
+} from "node:fs";
+import { basename, join as join2, relative, resolve } from "node:path";
+
+// src/contract/version.ts
+var CARD_PROTOCOL_VERSION = 1;
+var MANIFEST_FILE = "neurosquad-card.json";
+var MANIFEST_VERSION = 1;
+var RESERVED_PATH_PREFIX = "__ns/";
+var KiB = 1024;
+var MiB = 1024 * KiB;
+var LIMITS = {
+  // --- wire ---------------------------------------------------------------
+  /** Serialized size of one message (JSON length in UTF-16 code units, as measured by JSON.stringify). */
+  messageBytes: 1 * MiB,
+  /** Responses of fs.read / net.fetch may be this large. */
+  largeMessageBytes: 12 * MiB,
+  inFlightRequests: 64,
+  /** Token bucket per instance: refill per second / bucket size. */
+  requestsPerSecond: 200,
+  requestBurst: 400,
+  valueDepth: 64,
+  valueNodes: 2e5,
+  // --- package ------------------------------------------------------------
+  tarballBytes: 50 * MiB,
+  unpackedBytes: 100 * MiB,
+  fileBytes: 20 * MiB,
+  files: 5e3,
+  pathDepth: 20,
+  pathChars: 240,
+  manifestBytes: 256 * KiB,
+  iconBytes: 128 * KiB,
+  // --- storage ------------------------------------------------------------
+  storageKeyChars: 256,
+  storageValueBytes: 1 * MiB,
+  storageKeys: 1e4,
+  instanceStorageBytes: 5 * MiB,
+  packageStorageBytes: 20 * MiB,
+  // --- manifest content ---------------------------------------------------
+  settings: 40,
+  portsPerDirection: 16,
+  toolsPerPackage: 32,
+  permissionHosts: 32,
+  schemaNodes: 500,
+  schemaDepth: 16,
+  /** `enum` options per schema node, and their serialized size (MC-2: comparisons cost main CPU). */
+  schemaEnumOptions: 256,
+  schemaEnumBytes: 16 * KiB,
+  /** Serialized size of one `const` value in a card schema. */
+  schemaConstBytes: 4 * KiB,
+  menuItems: 12,
+  // --- network ------------------------------------------------------------
+  netRequestBodyBytes: 5 * MiB,
+  netResponseBytes: 10 * MiB,
+  netConcurrent: 6,
+  netPerMinute: 120,
+  netRedirects: 5,
+  netTimeoutMs: 3e4,
+  netMaxTimeoutMs: 12e4,
+  netStreams: 4,
+  // --- files --------------------------------------------------------------
+  fsReadBytes: 10 * MiB,
+  fsWriteBytes: 10 * MiB,
+  fsListEntries: 5e3,
+  fsWatchers: 20,
+  // --- agents / terminals -------------------------------------------------
+  promptChars: 2e4,
+  promptsPerMinute: 6,
+  terminalWriteChars: 2e4,
+  terminalRunTimeoutMs: 12e4,
+  screenLines: 500,
+  outputFlushMs: 100,
+  outputFlushBytes: 64 * KiB,
+  // --- tools --------------------------------------------------------------
+  toolResultBytes: 1 * MiB,
+  toolTimeoutMs: 3e4,
+  toolMaxTimeoutMs: 12e4,
+  // --- ports --------------------------------------------------------------
+  portMessagesPerSecond: 20,
+  retainedValueBytes: 256 * KiB,
+  portRequestTimeoutMs: 3e4,
+  // --- canvas / ui --------------------------------------------------------
+  attentionIntervalMs: 1e4,
+  focusIntervalMs: 5e3,
+  toastIntervalMs: 2e3,
+  clipboardIntervalMs: 1e3,
+  clipboardChars: 1 * MiB,
+  spawnsPerInstance: 4,
+  resizeIntervalMs: 500,
+  titleChars: 120,
+  /** card.setStatus / setBadge / setOverview per minute (the SDK client coalesces to stay under it). */
+  chromeUpdatesPerMinute: 120,
+  statusChars: 80,
+  overviewChars: 160,
+  toastChars: 280,
+  confirmChars: 1e3,
+  logLineChars: 2e3,
+  logLinesPerSecond: 50,
+  // --- frames / lifecycle -------------------------------------------------
+  /** Card frames alive at once across the app; beyond it the least recently seen offscreen/hidden ones are suspended. */
+  liveFrames: 24,
+  /** Of those, how many may be kept alive while hidden thanks to the `background` permission. */
+  backgroundFrames: 8,
+  /** A card in a hidden workspace is suspended after this long (unless `background`). */
+  hiddenSuspendMs: 6e4,
+  /** Time a card gets between `lifecycle.suspend` and its frame being unloaded. */
+  suspendGraceMs: 1e3,
+  /** Single-use document token lifetime. */
+  frameTokenTtlMs: 3e4,
+  /** From frame attach to `host.ready`; after that the card shows "not responding". */
+  readyTimeoutMs: 1e4,
+  heartbeatMs: 5e3,
+  unresponsiveMs: 15e3,
+  /** Mounting at most this many card frames per animation frame (canvas perf). */
+  frameMountsPerFrame: 2
+};
+
+// src/contract/jsonSchema.ts
+var CARD_STRING_FORMATS = ["uri", "date-time", "date", "email", "color", "uuid"];
+var ANNOTATIONS = /* @__PURE__ */ new Set([
+  "$id",
+  "$schema",
+  "$comment",
+  "title",
+  "description",
+  "default",
+  "examples",
+  "deprecated",
+  "readOnly",
+  "writeOnly"
+]);
+var KEYWORDS = /* @__PURE__ */ new Set([
+  "$ref",
+  "$defs",
+  "type",
+  "enum",
+  "const",
+  "properties",
+  "required",
+  "additionalProperties",
+  "minProperties",
+  "maxProperties",
+  "items",
+  "minItems",
+  "maxItems",
+  "uniqueItems",
+  "minLength",
+  "maxLength",
+  "pattern",
+  "format",
+  "minimum",
+  "maximum",
+  "exclusiveMinimum",
+  "exclusiveMaximum",
+  "multipleOf",
+  "anyOf",
+  "oneOf"
+]);
+var TYPES = /* @__PURE__ */ new Set([
+  "string",
+  "number",
+  "integer",
+  "boolean",
+  "object",
+  "array",
+  "null"
+]);
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function typeOf(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  switch (typeof value) {
+    case "string":
+      return "string";
+    case "boolean":
+      return "boolean";
+    case "number":
+      return Number.isFinite(value) ? Number.isInteger(value) ? "integer" : "number" : "invalid";
+    case "object":
+      return isPlainObject(value) ? "object" : "invalid";
+    default:
+      return "invalid";
+  }
+}
+function stableStringify(value) {
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  if (isPlainObject(value)) {
+    const keys = Object.keys(value).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+function codePointLength(text) {
+  let count = 0;
+  for (let i = 0; i < text.length; i++) {
+    const code = text.charCodeAt(i);
+    if (code >= 55296 && code <= 56319 && i + 1 < text.length) i++;
+    count++;
+  }
+  return count;
+}
+function pointer(path, key) {
+  return `${path}/${String(key).replace(/~/g, "~0").replace(/\//g, "~1")}`;
+}
+function checkJsonValue(value, limits = {}) {
+  const maxDepth = limits.maxDepth ?? 64;
+  let nodes = limits.maxNodes ?? 2e5;
+  const walk = (current, path, depth) => {
+    if (--nodes < 0) return { path, keyword: "json", message: "value has too many parts" };
+    if (depth > maxDepth) return { path, keyword: "json", message: "value is nested too deeply" };
+    const kind = typeOf(current);
+    if (kind === "invalid") {
+      return {
+        path,
+        keyword: "json",
+        message: "not a JSON value (NaN, Infinity, undefined, function or class instance)"
+      };
+    }
+    if (kind === "array") {
+      const list = current;
+      for (let i = 0; i < list.length; i++) {
+        const issue = walk(list[i], pointer(path, i), depth + 1);
+        if (issue) return issue;
+      }
+    } else if (kind === "object") {
+      for (const [key, child] of Object.entries(current)) {
+        const issue = walk(child, pointer(path, key), depth + 1);
+        if (issue) return issue;
+      }
+    }
+    return null;
+  };
+  return walk(value, "", 0);
+}
+var FORMAT_CHECKS = {
+  uri: (text) => /^[a-zA-Z][a-zA-Z0-9+.-]*:[^\s]*$/.test(text) && text.length <= 8192,
+  "date-time": (text) => /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,9})?(Z|[+-]\d{2}:\d{2})$/.test(text) && !Number.isNaN(Date.parse(text)),
+  date: (text) => /^\d{4}-\d{2}-\d{2}$/.test(text) && !Number.isNaN(Date.parse(`${text}T00:00:00Z`)),
+  email: (text) => /^[^\s@]{1,64}@[^\s@]{1,255}$/.test(text),
+  color: (text) => /^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/.test(text),
+  uuid: (text) => /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(text)
+};
+var regexCache = /* @__PURE__ */ new Map();
+function compiled(pattern) {
+  if (!regexCache.has(pattern)) {
+    let regex = null;
+    try {
+      regex = new RegExp(pattern, "u");
+    } catch {
+      regex = null;
+    }
+    if (regexCache.size > 500) regexCache.clear();
+    regexCache.set(pattern, regex);
+  }
+  return regexCache.get(pattern) ?? null;
+}
+var Budget = class {
+  constructor(left) {
+    this.left = left;
+  }
+};
+var CHARS_PER_UNIT = 64;
+function chargedStringify(value, budget) {
+  const text = stableStringify(value);
+  budget.left -= Math.ceil(text.length / CHARS_PER_UNIT);
+  return text;
+}
+var enumCache = /* @__PURE__ */ new WeakMap();
+var constCache = /* @__PURE__ */ new WeakMap();
+function enumOptions(schema, budget) {
+  let options = enumCache.get(schema);
+  if (!options) {
+    options = new Set((schema.enum ?? []).map((option) => chargedStringify(option, budget)));
+    enumCache.set(schema, options);
+  }
+  return options;
+}
+function constText(schema, budget) {
+  let text = constCache.get(schema);
+  if (text === void 0) {
+    text = chargedStringify(schema.const, budget);
+    constCache.set(schema, text);
+  }
+  return text;
+}
+function resolveRef(root, ref) {
+  if (ref === "#") return root;
+  const match = /^#\/\$defs\/([^/]+)$/.exec(ref);
+  if (!match) return null;
+  const name = match[1].replace(/~1/g, "/").replace(/~0/g, "~");
+  const defs = root.$defs;
+  if (!isPlainObject(defs) || !Object.prototype.hasOwnProperty.call(defs, name)) return null;
+  const found = defs[name];
+  return isPlainObject(found) ? found : null;
+}
+function validateJson(schema, value, options = {}) {
+  const issues = [];
+  const maxIssues = options.maxIssues ?? 20;
+  const budget = new Budget(options.budget ?? 2e5);
+  const base = checkJsonValue(value, { maxDepth: options.maxDepth ?? 64 });
+  if (base) return [base];
+  validateNode(schema, schema, value, "", issues, maxIssues, budget, 0);
+  return issues.slice(0, maxIssues);
+}
+function push(issues, max, issue) {
+  if (issues.length < max) issues.push(issue);
+}
+function validateNode(root, schema, value, path, issues, maxIssues, budget, refDepth) {
+  if (issues.length >= maxIssues) return;
+  if (--budget.left < 0) {
+    push(issues, maxIssues, { path, keyword: "budget", message: "schema too complex to check" });
+    return;
+  }
+  if (schema.$ref !== void 0) {
+    const target = resolveRef(root, schema.$ref);
+    if (!target || refDepth > 32) {
+      push(issues, maxIssues, {
+        path,
+        keyword: "$ref",
+        message: `unresolvable reference ${schema.$ref}`
+      });
+      return;
+    }
+    validateNode(root, target, value, path, issues, maxIssues, budget, refDepth + 1);
+    if (issues.length >= maxIssues) return;
+  }
+  const actual = typeOf(value);
+  if (schema.type !== void 0) {
+    const allowed = Array.isArray(schema.type) ? schema.type : [schema.type];
+    const ok = allowed.some(
+      (type) => type === actual || type === "number" && actual === "integer"
+    );
+    if (!ok) {
+      push(issues, maxIssues, {
+        path,
+        keyword: "type",
+        message: `expected ${allowed.join(" or ")}, got ${actual}`
+      });
+      return;
+    }
+  }
+  let valueText;
+  const serialized = () => valueText ??= chargedStringify(value, budget);
+  if (schema.const !== void 0 && constText(schema, budget) !== serialized()) {
+    push(issues, maxIssues, {
+      path,
+      keyword: "const",
+      message: `must be ${JSON.stringify(schema.const)}`.slice(0, 300)
+    });
+  }
+  if (schema.enum !== void 0 && !enumOptions(schema, budget).has(serialized())) {
+    const shown = schema.enum.slice(0, 8).map((option) => JSON.stringify(option)).join(", ");
+    push(issues, maxIssues, { path, keyword: "enum", message: `must be one of ${shown}` });
+  }
+  if (actual === "string") {
+    const text = value;
+    if (schema.maxLength !== void 0 && text.length > schema.maxLength * 2) {
+      push(issues, maxIssues, {
+        path,
+        keyword: "maxLength",
+        message: `longer than ${schema.maxLength}`
+      });
+    } else {
+      const length = schema.minLength !== void 0 || schema.maxLength !== void 0 ? codePointLength(text) : 0;
+      if (schema.minLength !== void 0 && length < schema.minLength) {
+        push(issues, maxIssues, {
+          path,
+          keyword: "minLength",
+          message: `shorter than ${schema.minLength}`
+        });
+      }
+      if (schema.maxLength !== void 0 && length > schema.maxLength) {
+        push(issues, maxIssues, {
+          path,
+          keyword: "maxLength",
+          message: `longer than ${schema.maxLength}`
+        });
+      }
+    }
+    if (schema.pattern !== void 0) {
+      const regex = compiled(schema.pattern);
+      if (!regex || !regex.test(text)) {
+        push(issues, maxIssues, {
+          path,
+          keyword: "pattern",
+          message: `does not match ${schema.pattern}`
+        });
+      }
+    }
+    if (schema.format !== void 0) {
+      const check = FORMAT_CHECKS[schema.format];
+      if (check && !check(text)) {
+        push(issues, maxIssues, {
+          path,
+          keyword: "format",
+          message: `not a valid ${schema.format}`
+        });
+      }
+    }
+  }
+  if (actual === "number" || actual === "integer") {
+    const number = value;
+    if (schema.minimum !== void 0 && number < schema.minimum) {
+      push(issues, maxIssues, { path, keyword: "minimum", message: `less than ${schema.minimum}` });
+    }
+    if (schema.maximum !== void 0 && number > schema.maximum) {
+      push(issues, maxIssues, {
+        path,
+        keyword: "maximum",
+        message: `greater than ${schema.maximum}`
+      });
+    }
+    if (schema.exclusiveMinimum !== void 0 && number <= schema.exclusiveMinimum) {
+      push(issues, maxIssues, {
+        path,
+        keyword: "exclusiveMinimum",
+        message: `must be greater than ${schema.exclusiveMinimum}`
+      });
+    }
+    if (schema.exclusiveMaximum !== void 0 && number >= schema.exclusiveMaximum) {
+      push(issues, maxIssues, {
+        path,
+        keyword: "exclusiveMaximum",
+        message: `must be less than ${schema.exclusiveMaximum}`
+      });
+    }
+    if (schema.multipleOf !== void 0 && schema.multipleOf > 0) {
+      const quotient = number / schema.multipleOf;
+      if (Math.abs(quotient - Math.round(quotient)) > 1e-9) {
+        push(issues, maxIssues, {
+          path,
+          keyword: "multipleOf",
+          message: `not a multiple of ${schema.multipleOf}`
+        });
+      }
+    }
+  }
+  if (actual === "array") {
+    const list = value;
+    if (schema.minItems !== void 0 && list.length < schema.minItems) {
+      push(issues, maxIssues, {
+        path,
+        keyword: "minItems",
+        message: `fewer than ${schema.minItems} items`
+      });
+    }
+    if (schema.maxItems !== void 0 && list.length > schema.maxItems) {
+      push(issues, maxIssues, {
+        path,
+        keyword: "maxItems",
+        message: `more than ${schema.maxItems} items`
+      });
+      return;
+    }
+    if (schema.uniqueItems) {
+      const seen = /* @__PURE__ */ new Set();
+      for (const item of list) {
+        const key = chargedStringify(item, budget);
+        if (seen.has(key)) {
+          push(issues, maxIssues, { path, keyword: "uniqueItems", message: "items must be unique" });
+          break;
+        }
+        seen.add(key);
+      }
+    }
+    if (schema.items !== void 0) {
+      for (let i = 0; i < list.length && issues.length < maxIssues; i++) {
+        validateNode(root, schema.items, list[i], pointer(path, i), issues, maxIssues, budget, 0);
+      }
+    }
+  }
+  if (actual === "object") {
+    const object = value;
+    const keys = Object.keys(object);
+    if (schema.minProperties !== void 0 && keys.length < schema.minProperties) {
+      push(issues, maxIssues, {
+        path,
+        keyword: "minProperties",
+        message: `fewer than ${schema.minProperties} properties`
+      });
+    }
+    if (schema.maxProperties !== void 0 && keys.length > schema.maxProperties) {
+      push(issues, maxIssues, {
+        path,
+        keyword: "maxProperties",
+        message: `more than ${schema.maxProperties} properties`
+      });
+      return;
+    }
+    for (const key of schema.required ?? []) {
+      if (!Object.prototype.hasOwnProperty.call(object, key)) {
+        push(issues, maxIssues, {
+          path: pointer(path, key),
+          keyword: "required",
+          message: "is required"
+        });
+      }
+    }
+    const properties = schema.properties ?? {};
+    for (const key of keys) {
+      if (issues.length >= maxIssues) return;
+      const child = Object.prototype.hasOwnProperty.call(properties, key) ? properties[key] : void 0;
+      if (child) {
+        validateNode(root, child, object[key], pointer(path, key), issues, maxIssues, budget, 0);
+      } else if (schema.additionalProperties === false) {
+        push(issues, maxIssues, {
+          path: pointer(path, key),
+          keyword: "additionalProperties",
+          message: "is not allowed"
+        });
+      } else if (typeof schema.additionalProperties === "object") {
+        validateNode(
+          root,
+          schema.additionalProperties,
+          object[key],
+          pointer(path, key),
+          issues,
+          maxIssues,
+          budget,
+          0
+        );
+      }
+    }
+  }
+  if (schema.anyOf !== void 0) {
+    const ok = schema.anyOf.some((option) => {
+      const inner = [];
+      validateNode(root, option, value, path, inner, 1, budget, refDepth);
+      return inner.length === 0;
+    });
+    if (!ok)
+      push(issues, maxIssues, {
+        path,
+        keyword: "anyOf",
+        message: "matches none of the allowed shapes"
+      });
+  }
+  if (schema.oneOf !== void 0) {
+    let matches = 0;
+    for (const option of schema.oneOf) {
+      const inner = [];
+      validateNode(root, option, value, path, inner, 1, budget, refDepth);
+      if (inner.length === 0) matches++;
+      if (matches > 1) break;
+    }
+    if (matches !== 1) {
+      push(issues, maxIssues, {
+        path,
+        keyword: "oneOf",
+        message: matches === 0 ? "matches none of the allowed shapes" : "matches more than one allowed shape"
+      });
+    }
+  }
+}
+function checkCardSchema(schema, options = {}) {
+  const issues = [];
+  const maxDepth = options.maxDepth ?? 16;
+  let nodes = options.maxNodes ?? 500;
+  const root = schema;
+  const visit = (node, path, depth) => {
+    if (issues.length >= 20) return;
+    if (--nodes < 0) {
+      if (nodes === -1) issues.push({ path, keyword: "size", message: "schema has too many parts" });
+      return;
+    }
+    if (depth > maxDepth) {
+      issues.push({ path, keyword: "depth", message: "schema is nested too deeply" });
+      return;
+    }
+    if (!isPlainObject(node)) {
+      issues.push({ path, keyword: "schema", message: "a schema must be an object" });
+      return;
+    }
+    for (const [key, child] of Object.entries(node)) {
+      const at = pointer(path, key);
+      if (ANNOTATIONS.has(key)) {
+        if ((key === "title" || key === "description" || key === "$comment") && typeof child !== "string") {
+          issues.push({ path: at, keyword: key, message: "must be a string" });
+        }
+        continue;
+      }
+      if (!KEYWORDS.has(key)) {
+        issues.push({ path: at, keyword: key, message: `unsupported keyword "${key}"` });
+        continue;
+      }
+      switch (key) {
+        case "$ref":
+          if (typeof child !== "string" || !resolveRef(root, child)) {
+            issues.push({
+              path: at,
+              keyword: key,
+              message: 'must be "#" or "#/$defs/<name>" and resolve'
+            });
+          }
+          break;
+        case "$defs":
+        case "properties":
+          if (!isPlainObject(child)) {
+            issues.push({ path: at, keyword: key, message: "must be an object of schemas" });
+          } else {
+            for (const [name, sub] of Object.entries(child))
+              visit(sub, pointer(at, name), depth + 1);
+          }
+          break;
+        case "items":
+          visit(child, at, depth + 1);
+          break;
+        case "additionalProperties":
+          if (typeof child !== "boolean") visit(child, at, depth + 1);
+          break;
+        case "anyOf":
+        case "oneOf":
+          if (!Array.isArray(child) || child.length === 0 || child.length > 16) {
+            issues.push({ path: at, keyword: key, message: "must be a list of 1\u201316 schemas" });
+          } else {
+            child.forEach((sub, i) => visit(sub, pointer(at, i), depth + 1));
+          }
+          break;
+        case "type": {
+          const list = Array.isArray(child) ? child : [child];
+          if (list.length === 0 || list.some((type) => typeof type !== "string" || !TYPES.has(type))) {
+            issues.push({ path: at, keyword: key, message: "unknown type" });
+          }
+          break;
+        }
+        case "enum":
+          if (!Array.isArray(child) || child.length === 0 || child.length > LIMITS.schemaEnumOptions || checkJsonValue(child)) {
+            issues.push({
+              path: at,
+              keyword: key,
+              message: `must be a list of 1\u2013${LIMITS.schemaEnumOptions} JSON values`
+            });
+          } else if (JSON.stringify(child).length > LIMITS.schemaEnumBytes) {
+            issues.push({
+              path: at,
+              keyword: key,
+              message: `options must total at most ${LIMITS.schemaEnumBytes / 1024} KB`
+            });
+          }
+          break;
+        case "const":
+          if (checkJsonValue(child))
+            issues.push({ path: at, keyword: key, message: "must be a JSON value" });
+          else if (JSON.stringify(child).length > LIMITS.schemaConstBytes) {
+            issues.push({
+              path: at,
+              keyword: key,
+              message: `must be at most ${LIMITS.schemaConstBytes / 1024} KB`
+            });
+          }
+          break;
+        case "required":
+          if (!Array.isArray(child) || child.some((name) => typeof name !== "string")) {
+            issues.push({ path: at, keyword: key, message: "must be a list of property names" });
+          }
+          break;
+        case "uniqueItems":
+          if (typeof child !== "boolean")
+            issues.push({ path: at, keyword: key, message: "must be true or false" });
+          break;
+        case "pattern":
+          if (!options.allowPattern) {
+            issues.push({
+              path: at,
+              keyword: key,
+              message: '"pattern" is not allowed in card schemas (use enum, format or maxLength)'
+            });
+          } else if (typeof child !== "string" || child.length > 256 || !compiled(child)) {
+            issues.push({
+              path: at,
+              keyword: key,
+              message: "must be a valid regular expression of at most 256 characters"
+            });
+          }
+          break;
+        case "format":
+          if (typeof child !== "string" || !CARD_STRING_FORMATS.includes(child)) {
+            issues.push({
+              path: at,
+              keyword: key,
+              message: `format must be one of ${CARD_STRING_FORMATS.join(", ")}`
+            });
+          }
+          break;
+        default:
+          if (typeof child !== "number" || !Number.isFinite(child)) {
+            issues.push({ path: at, keyword: key, message: "must be a finite number" });
+          } else if ([
+            "minLength",
+            "maxLength",
+            "minItems",
+            "maxItems",
+            "minProperties",
+            "maxProperties"
+          ].includes(key) && (child < 0 || !Number.isInteger(child))) {
+            issues.push({ path: at, keyword: key, message: "must be a non-negative integer" });
+          } else if (key === "multipleOf" && child <= 0) {
+            issues.push({ path: at, keyword: key, message: "must be greater than 0" });
+          }
+      }
+    }
+  };
+  visit(schema, "", 0);
+  return issues;
+}
+
+// src/contract/localized.ts
+function resolveLocalized(text, language) {
+  if (text === void 0) return "";
+  if (typeof text === "string") return text;
+  return text[language] ?? text.en;
+}
+function localizedVariants(text) {
+  return typeof text === "string" ? [text] : Object.values(text).filter((v) => typeof v === "string");
+}
+
+// src/contract/network.ts
+var LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function validHostname(host) {
+  if (host.length === 0 || host.length > 253) return false;
+  const labels = host.split(".");
+  if (labels.length < 2) return false;
+  if (!labels.every((label) => LABEL_RE.test(label))) return false;
+  return !/^[0-9]+$/.test(labels[labels.length - 1]);
+}
+function parseHostPattern(pattern) {
+  if (typeof pattern !== "string") return { ok: false, error: "not a string" };
+  const text = pattern.trim();
+  if (text !== text.toLowerCase()) return { ok: false, error: "must be lowercase" };
+  if (text.includes("/") || text.includes("@") || text.includes("[")) {
+    return { ok: false, error: "a host, not a URL (no scheme, path or IP literal)" };
+  }
+  let host = text;
+  let port2;
+  const colon = host.lastIndexOf(":");
+  if (colon !== -1) {
+    const digits = host.slice(colon + 1);
+    if (!/^[0-9]{1,5}$/.test(digits)) return { ok: false, error: "invalid port" };
+    port2 = Number(digits);
+    if (port2 < 1 || port2 > 65535) return { ok: false, error: "invalid port" };
+    host = host.slice(0, colon);
+  }
+  let wildcard = false;
+  if (host.startsWith("*.")) {
+    wildcard = true;
+    host = host.slice(2);
+    if (host.split(".").length < 2)
+      return { ok: false, error: "a wildcard needs at least two labels after it (*.example.com)" };
+  }
+  if (host.includes("*")) return { ok: false, error: 'only a leading "*." wildcard is allowed' };
+  if (host === "localhost" || host.endsWith(".localhost")) {
+    return { ok: false, error: "use the network.local permission for this computer" };
+  }
+  if (!validHostname(host)) return { ok: false, error: "invalid host name" };
+  return {
+    ok: true,
+    value: { wildcard, host, ...port2 !== void 0 && port2 !== 443 ? { port: port2 } : {} }
+  };
+}
+function formatHostPattern(pattern) {
+  return `${pattern.wildcard ? "*." : ""}${pattern.host}${pattern.port ? `:${pattern.port}` : ""}`;
+}
+
+// src/contract/permissions.ts
+var PERMISSION_IDS = [
+  "agents.read",
+  "agents.output",
+  "agents.prompt",
+  "terminals.write",
+  "cards.connected",
+  "network",
+  "network.local",
+  "fs.read",
+  "fs.write",
+  "clipboard.write",
+  "canvas.spawn",
+  "background",
+  "usage.read"
+];
+function isPermissionId(value) {
+  return typeof value === "string" && PERMISSION_IDS.includes(value);
+}
+var PERMISSION_INFO = {
+  "agents.read": { risk: "low", implies: [], needsHosts: false },
+  "agents.output": { risk: "high", implies: ["agents.read"], needsHosts: false },
+  "agents.prompt": { risk: "high", implies: ["agents.read"], needsHosts: false },
+  "terminals.write": { risk: "high", implies: ["agents.read"], needsHosts: false },
+  "cards.connected": { risk: "medium", implies: [], needsHosts: false },
+  network: { risk: "medium", implies: [], needsHosts: true },
+  "network.local": { risk: "high", implies: [], needsHosts: false },
+  "fs.read": { risk: "high", implies: [], needsHosts: false },
+  "fs.write": { risk: "high", implies: ["fs.read"], needsHosts: false },
+  "clipboard.write": { risk: "low", implies: [], needsHosts: false },
+  "canvas.spawn": { risk: "low", implies: [], needsHosts: false },
+  background: { risk: "low", implies: [], needsHosts: false },
+  "usage.read": { risk: "low", implies: [], needsHosts: false }
+};
+var PERMISSION_TEXT_EN = {
+  "agents.read": {
+    title: "See the agents on this canvas",
+    body: "Their names, which tool they run, and whether they are working, waiting for you or finished."
+  },
+  "agents.output": {
+    title: "Read what agents and terminals connected to it print",
+    body: "Everything on the screens of agent and terminal cards you connect to it with an arrow, including anything secret shown there."
+  },
+  "agents.prompt": {
+    title: "Give instructions to agents connected to it",
+    body: "Type and send prompts to AI agents you connect to it with an arrow. An agent can edit files and run commands, so this card can make it do anything the agent can do."
+  },
+  "terminals.write": {
+    title: "Run commands in terminals connected to it",
+    body: "Type and run commands in terminal cards you connect to it with an arrow \u2014 anything you could run yourself."
+  },
+  "cards.connected": {
+    title: "Read and change cards connected to it",
+    body: "Notes, checklists, task boards and stickies you connect to it with an arrow."
+  },
+  network: {
+    title: "Connect to {{hosts}}",
+    body: "Send and receive data from these internet addresses only. Anything the card can see may be sent there."
+  },
+  "network.local": {
+    title: "Connect to servers on this computer",
+    body: "Reach programs listening on localhost, such as dev servers and local databases."
+  },
+  "fs.read": {
+    title: "Read files in the workspace folder",
+    body: "Any file in this workspace\u2019s project folder, including secrets stored in files like .env."
+  },
+  "fs.write": {
+    title: "Change files in the workspace folder",
+    body: "Create, overwrite and move files to the trash in this workspace\u2019s project folder. Changed project files can run code the next time you build or run the project."
+  },
+  "clipboard.write": {
+    title: "Copy to your clipboard",
+    body: "Replace what is on your clipboard with text from the card."
+  },
+  "canvas.spawn": {
+    title: "Add cards next to itself",
+    body: `Place up to ${LIMITS.spawnsPerInstance} new cards beside it on the canvas.`
+  },
+  background: {
+    title: "Keep running when you are not looking",
+    body: "Stay active while its workspace is hidden. Uses more memory and battery."
+  },
+  "usage.read": {
+    title: "See token usage and costs",
+    body: "How many tokens the agents on this workspace used and what they cost."
+  }
+};
+function normalizePermissions(entries) {
+  const issues = [];
+  const byId = /* @__PURE__ */ new Map();
+  entries.forEach((entry, index) => {
+    const raw = typeof entry === "string" ? { id: entry } : entry;
+    if (!isPermissionId(raw.id)) {
+      issues.push({ index, message: `unknown permission "${String(raw.id)}"` });
+      return;
+    }
+    const info = PERMISSION_INFO[raw.id];
+    const hosts = [];
+    if (raw.hosts !== void 0) {
+      if (!info.needsHosts) issues.push({ index, message: `"${raw.id}" does not take hosts` });
+      for (const host of raw.hosts) {
+        const parsed = parseHostPattern(host);
+        if (!parsed.ok) issues.push({ index, message: `host "${host}": ${parsed.error}` });
+        else hosts.push(formatHostPattern(parsed.value));
+      }
+    }
+    if (info.needsHosts && hosts.length === 0 && (raw.hosts === void 0 || raw.hosts.length === 0)) {
+      issues.push({ index, message: `"${raw.id}" needs a non-empty "hosts" list` });
+    }
+    const existing = byId.get(raw.id);
+    const merged = {
+      id: raw.id,
+      optional: (existing ? existing.optional : true) && raw.optional === true,
+      ...existing?.reason ?? raw.reason ? { reason: existing?.reason ?? raw.reason } : {}
+    };
+    if (info.needsHosts) {
+      const all = [.../* @__PURE__ */ new Set([...existing?.hosts ?? [], ...hosts])].sort();
+      if (all.length > LIMITS.permissionHosts)
+        issues.push({ index, message: `at most ${LIMITS.permissionHosts} hosts` });
+      merged.hosts = all;
+    }
+    byId.set(raw.id, merged);
+  });
+  const permissions = PERMISSION_IDS.flatMap((id) => {
+    const found = byId.get(id);
+    return found ? [found] : [];
+  });
+  return { permissions, issues };
+}
+
+// src/contract/ports.ts
+var CUSTOM_PORT_TYPE_RE = /^[a-z0-9][a-z0-9-]{0,47}\/[a-z0-9][a-z0-9-]{0,47}$/;
+var PORT_ID_RE = /^[a-z][a-z0-9-]{0,31}$/;
+var TASK_STATUS = ["pending", "active", "done", "error"];
+var TASK_SCHEMA = {
+  type: "object",
+  required: ["text"],
+  additionalProperties: false,
+  properties: {
+    id: { type: "string", maxLength: 128 },
+    text: { type: "string", minLength: 1, maxLength: 500 },
+    status: { enum: TASK_STATUS },
+    column: { type: "string", maxLength: 64 },
+    assignee: { type: "string", maxLength: 128 }
+  }
+};
+var WELL_KNOWN_PORT_SCHEMAS = {
+  /** Anything JSON. As an input: accepts every output type unchanged. */
+  "ns:any": {},
+  "ns:text": { type: "string", maxLength: 1e6 },
+  "ns:markdown": { type: "string", maxLength: 1e6 },
+  "ns:number": { type: "number" },
+  "ns:boolean": { type: "boolean" },
+  "ns:json": { type: ["object", "array"] },
+  "ns:url": { type: "string", format: "uri", maxLength: 8192 },
+  /** Base64 image, ≤ ~700 KB decoded (message limit). */
+  "ns:image": {
+    type: "object",
+    required: ["mimeType", "data"],
+    additionalProperties: false,
+    properties: {
+      mimeType: { enum: ["image/png", "image/jpeg", "image/webp", "image/gif"] },
+      data: { type: "string", maxLength: 1e6 },
+      alt: { type: "string", maxLength: 500 }
+    }
+  },
+  /** A file in the workspace folder (relative path). Receiving one grants no file access. */
+  "ns:file-ref": {
+    type: "object",
+    required: ["path"],
+    additionalProperties: false,
+    properties: {
+      path: { type: "string", minLength: 1, maxLength: 1024 },
+      line: { type: "integer", minimum: 1 }
+    }
+  },
+  "ns:task": TASK_SCHEMA,
+  "ns:tasks": { type: "array", maxItems: 200, items: TASK_SCHEMA },
+  /** Change one existing task; `ref` is its id or its exact text. */
+  "ns:task-patch": {
+    type: "object",
+    required: ["ref"],
+    additionalProperties: false,
+    properties: {
+      ref: { type: "string", minLength: 1, maxLength: 500 },
+      text: { type: "string", minLength: 1, maxLength: 500 },
+      status: { enum: TASK_STATUS },
+      column: { type: "string", maxLength: 64 }
+    }
+  },
+  "ns:table": {
+    type: "object",
+    required: ["columns", "rows"],
+    additionalProperties: false,
+    properties: {
+      columns: { type: "array", maxItems: 64, items: { type: "string", maxLength: 200 } },
+      rows: {
+        type: "array",
+        maxItems: 5e3,
+        items: {
+          type: "array",
+          maxItems: 64,
+          items: { type: ["string", "number", "boolean", "null"] }
+        }
+      }
+    }
+  },
+  "ns:event": {
+    type: "object",
+    required: ["type"],
+    additionalProperties: false,
+    properties: {
+      type: { type: "string", minLength: 1, maxLength: 64 },
+      data: {},
+      at: { type: "number" }
+    }
+  },
+  /** A bare signal ("go", "refresh"). */
+  "ns:trigger": { type: ["object", "null"], maxProperties: 0 }
+};
+var WELL_KNOWN_PORT_TYPES = Object.keys(WELL_KNOWN_PORT_SCHEMAS);
+function isWellKnownPortType(type) {
+  return Object.prototype.hasOwnProperty.call(WELL_KNOWN_PORT_SCHEMAS, type);
+}
+function isValidPortType(type) {
+  return isWellKnownPortType(type) || CUSTOM_PORT_TYPE_RE.test(type);
+}
+function port(id, type, permission, label, description, extra = {}) {
+  return {
+    id,
+    type,
+    permission,
+    label,
+    description,
+    mode: "stream",
+    retain: extra.retain ?? false,
+    default: extra.default ?? false
+  };
+}
+var BUILTIN_CARD_PORTS = {
+  note: {
+    inputs: [
+      port(
+        "append",
+        "ns:markdown",
+        "cards.connected",
+        "Append",
+        "Adds a paragraph at the end of the note.",
+        { default: true }
+      ),
+      port("replace", "ns:markdown", "cards.connected", "Replace", "Replaces the whole note.")
+    ],
+    outputs: [
+      port(
+        "text",
+        "ns:markdown",
+        "cards.connected",
+        "Text",
+        "The note\u2019s Markdown text, whenever it changes.",
+        { retain: true }
+      )
+    ]
+  },
+  todo: {
+    inputs: [
+      port("add", "ns:tasks", "cards.connected", "Add items", "Adds items to the checklist.", {
+        default: true
+      }),
+      port(
+        "update",
+        "ns:task-patch",
+        "cards.connected",
+        "Update item",
+        "Changes one item\u2019s text or status."
+      )
+    ],
+    outputs: [
+      port(
+        "items",
+        "ns:tasks",
+        "cards.connected",
+        "Items",
+        "All items, whenever the list changes.",
+        { retain: true }
+      )
+    ]
+  },
+  kanban: {
+    inputs: [
+      port("add", "ns:tasks", "cards.connected", "Add tasks", "Adds tasks to the board.", {
+        default: true
+      }),
+      port("update", "ns:task-patch", "cards.connected", "Update task", "Moves or edits one task.")
+    ],
+    outputs: [
+      port(
+        "tasks",
+        "ns:tasks",
+        "cards.connected",
+        "Tasks",
+        "All tasks with their columns, whenever the board changes.",
+        { retain: true }
+      )
+    ]
+  },
+  sticky: {
+    inputs: [
+      port("title", "ns:text", "cards.connected", "Title", "Sets the sticky\u2019s title.", {
+        default: true
+      })
+    ],
+    outputs: [
+      port("title", "ns:text", "cards.connected", "Title", "The sticky\u2019s title.", { retain: true })
+    ]
+  },
+  agent: {
+    inputs: [
+      port(
+        "prompt",
+        "ns:text",
+        "agents.prompt",
+        "Prompt",
+        "Sends a prompt to the agent (queued while it works).",
+        { default: true }
+      )
+    ],
+    outputs: [
+      port(
+        "status",
+        "ns:event",
+        "agents.read",
+        "Status",
+        'working / needs-input / finished / idle / exited, as `{ type: "status", data: { status } }`.',
+        { retain: true }
+      ),
+      port(
+        "reply",
+        "ns:markdown",
+        "agents.output",
+        "Last reply",
+        "The agent\u2019s final message when a turn ends (Claude Code only).",
+        { retain: true }
+      )
+    ]
+  },
+  terminal: {
+    inputs: [
+      port(
+        "command",
+        "ns:text",
+        "terminals.write",
+        "Command",
+        "Runs one command in the terminal.",
+        { default: true }
+      )
+    ],
+    outputs: [
+      port(
+        "exit",
+        "ns:event",
+        "agents.output",
+        "Command finished",
+        '`{ type: "exit", data: { command, exitCode } }` after each command.'
+      )
+    ]
+  }
+};
+
+// src/contract/source.ts
+var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[0-9¹²³]|lpt[0-9¹²³]|conin\$|conout\$|clock\$) *(\..*)?$/i;
+var CONTROL = /[\u0000-\u001f\u007f]/;
+function checkSegments(segments) {
+  for (const segment of segments) {
+    if (segment === "" || segment === "." || segment === "..") return 'empty, "." or ".." segment';
+    if (CONTROL.test(segment)) return "control character";
+    if (/[<>:"|?*]/.test(segment)) return 'character not allowed in file names (<>:"|?*)';
+    if (/[. ]$/.test(segment)) return "segment ends with a dot or space";
+    if (WINDOWS_RESERVED.test(segment)) return `reserved device name "${segment}"`;
+  }
+  return null;
+}
+function validatePackagePath(path) {
+  if (typeof path !== "string" || path.length === 0) return { ok: false, error: "empty path" };
+  if (path.length > LIMITS.pathChars) return { ok: false, error: "path too long" };
+  if (path.includes("\\")) return { ok: false, error: "backslash in path" };
+  if (path.startsWith("/")) return { ok: false, error: "absolute path" };
+  const trimmed = path.endsWith("/") ? path.slice(0, -1) : path;
+  const segments = trimmed.split("/");
+  if (segments.length > LIMITS.pathDepth) return { ok: false, error: "path too deep" };
+  const problem = checkSegments(segments);
+  if (problem) return { ok: false, error: problem };
+  const normalized = segments.join("/");
+  const lower = normalized.toLowerCase();
+  if (lower === RESERVED_PATH_PREFIX.slice(0, -1) || lower.startsWith(RESERVED_PATH_PREFIX)) {
+    return { ok: false, error: `paths under ${RESERVED_PATH_PREFIX} are reserved` };
+  }
+  return { ok: true, value: normalized };
+}
+function treeHashInput(entries) {
+  return [...entries].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0).map((entry) => `${entry.sha256.toLowerCase()}  ${entry.path}
+`).join("");
+}
+
+// src/contract/manifest.ts
+var MANIFEST_SCHEMA_ID = "https://neurosquad.ai/schemas/neurosquad-card.v1.json";
+var CARD_NAME_RE = /^[a-z][a-z0-9-]{1,47}$/;
+var TOOL_NAME_RE = /^[a-z][a-z0-9_]{0,39}$/;
+var SETTING_KEY_RE = /^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/;
+var SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+var SIZE_BOUNDS = { minW: 200, minH: 120, maxW: 2400, maxH: 1800 };
+var DEFAULT_CARD_SIZE = { w: 420, h: 320 };
+var SETTING_TYPES = [
+  "string",
+  "text",
+  "number",
+  "boolean",
+  "select",
+  "secret",
+  "color"
+];
+var localized = (maxLength) => ({
+  anyOf: [
+    { type: "string", minLength: 1, maxLength },
+    {
+      type: "object",
+      required: ["en"],
+      additionalProperties: false,
+      properties: {
+        en: { type: "string", minLength: 1, maxLength },
+        ru: { type: "string", minLength: 1, maxLength },
+        zh: { type: "string", minLength: 1, maxLength }
+      }
+    }
+  ]
+});
+var size = {
+  type: "object",
+  required: ["w", "h"],
+  additionalProperties: false,
+  properties: {
+    w: { type: "integer", minimum: SIZE_BOUNDS.minW, maximum: SIZE_BOUNDS.maxW },
+    h: { type: "integer", minimum: SIZE_BOUNDS.minH, maximum: SIZE_BOUNDS.maxH }
+  }
+};
+var portDeclaration = {
+  type: "object",
+  required: ["id", "label", "type"],
+  additionalProperties: false,
+  properties: {
+    id: { type: "string", pattern: PORT_ID_RE.source },
+    label: { $ref: "#/$defs/localized80" },
+    description: { $ref: "#/$defs/localized500" },
+    type: { type: "string", minLength: 1, maxLength: 97 },
+    schema: { type: "object" },
+    mode: { enum: ["stream", "request"] },
+    response: {
+      type: "object",
+      required: ["type"],
+      additionalProperties: false,
+      properties: {
+        type: { type: "string", minLength: 1, maxLength: 97 },
+        schema: { type: "object" }
+      }
+    },
+    retain: { type: "boolean" },
+    default: { type: "boolean" }
+  }
+};
+var MANIFEST_SCHEMA = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: MANIFEST_SCHEMA_ID,
+  title: "NeuroSquad custom card manifest",
+  description: "neurosquad-card.json at the root of a NeuroSquad custom card package.",
+  type: "object",
+  required: ["manifestVersion", "name", "displayName", "version", "protocol"],
+  additionalProperties: false,
+  $defs: {
+    localized80: localized(80),
+    localized300: localized(300),
+    localized500: localized(500),
+    size,
+    port: portDeclaration
+  },
+  properties: {
+    $schema: { type: "string", maxLength: 500 },
+    manifestVersion: { const: MANIFEST_VERSION },
+    name: { type: "string", pattern: CARD_NAME_RE.source },
+    displayName: { $ref: "#/$defs/localized80" },
+    version: { type: "string", maxLength: 64, pattern: SEMVER_RE.source },
+    description: { $ref: "#/$defs/localized300" },
+    author: {
+      type: "object",
+      required: ["name"],
+      additionalProperties: false,
+      properties: {
+        name: { type: "string", minLength: 1, maxLength: 100 },
+        url: { type: "string", format: "uri", maxLength: 500, pattern: "^https://" }
+      }
+    },
+    license: { type: "string", minLength: 1, maxLength: 100 },
+    homepage: { type: "string", format: "uri", maxLength: 500, pattern: "^https://" },
+    icon: { type: "string", minLength: 1, maxLength: LIMITS.pathChars },
+    protocol: { type: "integer", minimum: 1, maximum: 1e3 },
+    minAppVersion: { type: "string", maxLength: 64, pattern: SEMVER_RE.source },
+    entry: { type: "string", minLength: 1, maxLength: LIMITS.pathChars },
+    card: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        defaultSize: { $ref: "#/$defs/size" },
+        minSize: { $ref: "#/$defs/size" },
+        maxSize: { $ref: "#/$defs/size" }
+      }
+    },
+    permissions: {
+      type: "array",
+      maxItems: 32,
+      items: {
+        anyOf: [
+          { type: "string", minLength: 1, maxLength: 64 },
+          {
+            type: "object",
+            required: ["id"],
+            additionalProperties: false,
+            properties: {
+              id: { type: "string", minLength: 1, maxLength: 64 },
+              hosts: {
+                type: "array",
+                maxItems: LIMITS.permissionHosts,
+                items: { type: "string", minLength: 1, maxLength: 260 }
+              },
+              reason: { $ref: "#/$defs/localized300" },
+              optional: { type: "boolean" }
+            }
+          }
+        ]
+      }
+    },
+    settings: {
+      type: "array",
+      maxItems: LIMITS.settings,
+      items: {
+        type: "object",
+        required: ["key", "type", "label"],
+        additionalProperties: false,
+        properties: {
+          key: { type: "string", pattern: SETTING_KEY_RE.source },
+          type: { enum: SETTING_TYPES },
+          label: { $ref: "#/$defs/localized80" },
+          description: { $ref: "#/$defs/localized300" },
+          default: { type: ["string", "number", "boolean"] },
+          required: { type: "boolean" },
+          scope: { enum: ["instance", "package"] },
+          placeholder: { $ref: "#/$defs/localized80" },
+          maxLength: { type: "integer", minimum: 1, maximum: 1e5 },
+          min: { type: "number" },
+          max: { type: "number" },
+          step: { type: "number", exclusiveMinimum: 0 },
+          options: {
+            type: "array",
+            minItems: 1,
+            maxItems: 50,
+            items: {
+              type: "object",
+              required: ["value", "label"],
+              additionalProperties: false,
+              properties: {
+                value: { type: "string", maxLength: 200 },
+                label: { $ref: "#/$defs/localized80" }
+              }
+            }
+          }
+        }
+      }
+    },
+    ports: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        inputs: {
+          type: "array",
+          maxItems: LIMITS.portsPerDirection,
+          items: { $ref: "#/$defs/port" }
+        },
+        outputs: {
+          type: "array",
+          maxItems: LIMITS.portsPerDirection,
+          items: { $ref: "#/$defs/port" }
+        }
+      }
+    },
+    tools: {
+      type: "array",
+      maxItems: LIMITS.toolsPerPackage,
+      items: {
+        type: "object",
+        required: ["name", "description", "inputSchema"],
+        additionalProperties: false,
+        properties: {
+          name: { type: "string", pattern: TOOL_NAME_RE.source },
+          title: { type: "string", minLength: 1, maxLength: 80 },
+          description: { type: "string", minLength: 1, maxLength: 2e3 },
+          inputSchema: { type: "object" },
+          readOnly: { type: "boolean" },
+          timeoutMs: { type: "integer", minimum: 1e3, maximum: LIMITS.toolMaxTimeoutMs }
+        }
+      }
+    },
+    keywords: {
+      type: "array",
+      maxItems: 20,
+      uniqueItems: true,
+      items: { type: "string", minLength: 1, maxLength: 40 }
+    }
+  }
+};
+var RESERVED_NAMES = /* @__PURE__ */ new Set([
+  "neurosquad",
+  "neurosquad-card",
+  "custom",
+  "canvas",
+  "browser",
+  "terminal",
+  "agent",
+  "note",
+  "todo",
+  "kanban",
+  "host",
+  "system",
+  "telegram",
+  "image",
+  "reference",
+  "ports",
+  "web-watch",
+  "watch",
+  "timer",
+  "sticky",
+  "standup",
+  "squad",
+  "mcp",
+  "skill",
+  "official"
+]);
+var BUILTIN_MCP_TOOL_NAMES = [
+  "agent_read",
+  "agent_send",
+  "agent_wait",
+  "browser_click",
+  "browser_history",
+  "browser_navigate",
+  "browser_press_key",
+  "browser_screenshot",
+  "browser_snapshot",
+  "browser_type",
+  "canvas_remove_card",
+  "canvas_spawn_card",
+  "kanban_add",
+  "kanban_move",
+  "kanban_read",
+  "kanban_remove",
+  "kanban_write",
+  "neurosquad_connections",
+  "note_append",
+  "note_read",
+  "note_write",
+  "ports_list",
+  "reference_get",
+  "reference_list",
+  "skill_load",
+  "skill_read_file",
+  "squad_status",
+  "telegram_read",
+  "telegram_send",
+  "terminal_read",
+  "terminal_run",
+  "terminal_send_keys",
+  "todo_add",
+  "todo_read",
+  "todo_remove",
+  "todo_set",
+  "todo_write",
+  "watch_check_now",
+  "watch_status"
+];
+var UNSAFE_TEXT_RE = /[\p{Cc}\p{Cf}\u2028\u2029]/u;
+var UNSAFE_MULTILINE_TEXT_RE = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f\p{Cf}\u2028\u2029]/u;
+function isSafeDisplayText(text, multiline = false) {
+  return !(multiline ? UNSAFE_MULTILINE_TEXT_RE : UNSAFE_TEXT_RE).test(text);
+}
+function impersonationIssues(manifest) {
+  const issues = [];
+  const flag2 = (path, text) => {
+    const folded = text.normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{N}]/gu, "");
+    if (/neurosquad|official|verified/.test(folded)) {
+      issues.push({
+        path,
+        message: "only official cards may call themselves NeuroSquad, official or verified",
+        code: "semantic"
+      });
+    }
+  };
+  for (const text of localizedVariants(manifest.displayName)) flag2("/displayName", text);
+  if (manifest.author) flag2("/author/name", manifest.author.name);
+  return issues;
+}
+function displayStrings(manifest) {
+  const out = [];
+  const add = (path, text, multiline = false) => {
+    if (text === void 0) return;
+    if (typeof text === "string") {
+      out.push({ path, text, multiline });
+      return;
+    }
+    for (const [lang, value] of Object.entries(text)) {
+      if (typeof value === "string") out.push({ path: `${path}/${lang}`, text: value, multiline });
+    }
+  };
+  add("/displayName", manifest.displayName);
+  add("/description", manifest.description, true);
+  add("/author/name", manifest.author?.name);
+  add("/license", manifest.license);
+  (manifest.keywords ?? []).forEach((keyword, i) => add(`/keywords/${i}`, keyword));
+  (manifest.permissions ?? []).forEach((permission, i) => {
+    if (typeof permission === "object") add(`/permissions/${i}/reason`, permission.reason, true);
+  });
+  (manifest.settings ?? []).forEach((field, i) => {
+    add(`/settings/${i}/label`, field.label);
+    add(`/settings/${i}/description`, field.description, true);
+    add(`/settings/${i}/placeholder`, field.placeholder);
+    (field.options ?? []).forEach(
+      (option, j) => add(`/settings/${i}/options/${j}/label`, option.label)
+    );
+  });
+  for (const direction of ["inputs", "outputs"]) {
+    ;
+    (manifest.ports?.[direction] ?? []).forEach((port2, i) => {
+      add(`/ports/${direction}/${i}/label`, port2.label);
+      add(`/ports/${direction}/${i}/description`, port2.description, true);
+    });
+  }
+  ;
+  (manifest.tools ?? []).forEach((tool, i) => {
+    add(`/tools/${i}/title`, tool.title);
+    add(`/tools/${i}/description`, tool.description, true);
+  });
+  return out;
+}
+function semverCompare(a, b) {
+  const pa = a.split(/[-+]/)[0].split(".").map(Number);
+  const pb = b.split(/[-+]/)[0].split(".").map(Number);
+  for (let i = 0; i < 3; i++) if (pa[i] !== pb[i]) return pa[i] - pb[i];
+  return 0;
+}
+function parseManifestText(text, appVersion) {
+  if (text.length > LIMITS.manifestBytes) {
+    return {
+      ok: false,
+      issues: [{ path: "", message: "manifest is larger than 256 KB", code: "json" }]
+    };
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text.replace(/^\uFEFF/, ""));
+  } catch (error) {
+    return {
+      ok: false,
+      issues: [{ path: "", message: `not valid JSON: ${error.message}`, code: "json" }]
+    };
+  }
+  return validateManifest(raw, appVersion);
+}
+function validateManifest(raw, appVersion) {
+  const schemaIssues = validateJson(MANIFEST_SCHEMA, raw, { maxIssues: 50 });
+  if (schemaIssues.length > 0) {
+    return {
+      ok: false,
+      issues: schemaIssues.map((issue) => ({
+        path: issue.path,
+        message: issue.message,
+        code: "schema"
+      }))
+    };
+  }
+  const manifest = raw;
+  const issues = [];
+  const warnings = [];
+  const semantic = (path, message) => void issues.push({ path, message, code: "semantic" });
+  if (manifest.protocol > CARD_PROTOCOL_VERSION) {
+    issues.push({
+      path: "/protocol",
+      message: `built for card protocol ${manifest.protocol}; this app speaks ${CARD_PROTOCOL_VERSION} \u2014 update NeuroSquad`,
+      code: "protocol"
+    });
+  }
+  if (appVersion && manifest.minAppVersion && semverCompare(appVersion, manifest.minAppVersion) < 0) {
+    issues.push({
+      path: "/minAppVersion",
+      message: `needs NeuroSquad ${manifest.minAppVersion} or newer`,
+      code: "protocol"
+    });
+  }
+  if (RESERVED_NAMES.has(manifest.name)) semantic("/name", `"${manifest.name}" is reserved`);
+  for (const { path, text, multiline } of displayStrings(manifest)) {
+    if (!isSafeDisplayText(text, multiline))
+      semantic(path, "control, bidi and invisible (zero-width, tag) characters are not allowed");
+  }
+  const entry = validatePackagePath(manifest.entry ?? "index.html");
+  if (!entry.ok) semantic("/entry", entry.error);
+  else if (!/\.html?$/i.test(entry.value)) semantic("/entry", "entry must be an .html file");
+  if (manifest.icon !== void 0) {
+    const icon = validatePackagePath(manifest.icon);
+    if (!icon.ok) semantic("/icon", icon.error);
+    else if (!/\.(png|webp)$/i.test(icon.value))
+      semantic("/icon", "icon must be a .png or .webp file");
+  }
+  const card = {
+    defaultSize: manifest.card?.defaultSize ?? DEFAULT_CARD_SIZE,
+    minSize: manifest.card?.minSize ?? { w: SIZE_BOUNDS.minW, h: SIZE_BOUNDS.minH },
+    maxSize: manifest.card?.maxSize ?? { w: SIZE_BOUNDS.maxW, h: SIZE_BOUNDS.maxH }
+  };
+  if (card.minSize.w > card.defaultSize.w || card.minSize.h > card.defaultSize.h || card.defaultSize.w > card.maxSize.w || card.defaultSize.h > card.maxSize.h) {
+    semantic("/card", "sizes must satisfy minSize \u2264 defaultSize \u2264 maxSize");
+  }
+  const { permissions, issues: permissionIssues } = normalizePermissions(manifest.permissions ?? []);
+  for (const issue of permissionIssues) semantic(`/permissions/${issue.index}`, issue.message);
+  const settingKeys = /* @__PURE__ */ new Set();
+  (manifest.settings ?? []).forEach((field, i) => {
+    const at = `/settings/${i}`;
+    if (settingKeys.has(field.key)) semantic(`${at}/key`, `duplicate setting "${field.key}"`);
+    settingKeys.add(field.key);
+    if (field.type === "secret" && field.default !== void 0)
+      semantic(`${at}/default`, "a secret cannot have a default");
+    if (field.type === "select" && !field.options)
+      semantic(`${at}/options`, "a select needs options");
+    if (field.type !== "select" && field.options)
+      semantic(`${at}/options`, "only a select has options");
+    if (field.default !== void 0) {
+      const expected = field.type === "number" ? "number" : field.type === "boolean" ? "boolean" : "string";
+      if (typeof field.default !== expected)
+        semantic(`${at}/default`, `default must be a ${expected}`);
+      if (field.type === "select" && field.options && !field.options.some((o) => o.value === field.default)) {
+        semantic(`${at}/default`, "default must be one of the options");
+      }
+      if (field.type === "color" && (typeof field.default !== "string" || !/^#[0-9a-fA-F]{6}$/.test(field.default))) {
+        semantic(`${at}/default`, "a color default is #rrggbb");
+      }
+      if (field.type === "number" && typeof field.default === "number") {
+        if (field.min !== void 0 && field.default < field.min || field.max !== void 0 && field.default > field.max) {
+          semantic(`${at}/default`, "default is outside min/max");
+        }
+      }
+    }
+    if (field.min !== void 0 && field.max !== void 0 && field.min > field.max)
+      semantic(at, "min is greater than max");
+  });
+  const checkPorts = (list, direction) => {
+    const ids = /* @__PURE__ */ new Set();
+    let defaults = 0;
+    (list ?? []).forEach((port2, i) => {
+      const at = `/ports/${direction}/${i}`;
+      if (ids.has(port2.id)) semantic(`${at}/id`, `duplicate port "${port2.id}"`);
+      ids.add(port2.id);
+      if (!isValidPortType(port2.type)) {
+        semantic(`${at}/type`, 'type must be an ns:* type or "<package-name>/<type-name>"');
+      } else if (!isWellKnownPortType(port2.type)) {
+        if (!port2.type.startsWith(`${manifest.name}/`)) {
+          warnings.push({
+            path: `${at}/type`,
+            message: `custom type of another package ("${port2.type}") \u2014 fine when you mean to interoperate`,
+            code: "semantic"
+          });
+        }
+        if (!port2.schema) semantic(`${at}/schema`, "a custom type needs a schema");
+      }
+      if (port2.schema) {
+        for (const issue of checkCardSchema(port2.schema, {
+          maxNodes: LIMITS.schemaNodes,
+          maxDepth: LIMITS.schemaDepth
+        })) {
+          semantic(`${at}/schema${issue.path}`, issue.message);
+        }
+      }
+      if (direction === "outputs") {
+        if (port2.mode !== void 0 || port2.response !== void 0 || port2.default !== void 0) {
+          semantic(at, "mode, response and default are for inputs");
+        }
+      } else {
+        if (port2.retain !== void 0) semantic(`${at}/retain`, "retain is for outputs");
+        if (port2.default) defaults++;
+        if (port2.mode === "request") {
+          if (!port2.response) semantic(`${at}/response`, "a request input needs a response type");
+          else if (!isValidPortType(port2.response.type))
+            semantic(`${at}/response/type`, "invalid response type");
+          if (port2.response?.schema) {
+            for (const issue of checkCardSchema(port2.response.schema, {
+              maxNodes: LIMITS.schemaNodes,
+              maxDepth: LIMITS.schemaDepth
+            })) {
+              semantic(`${at}/response/schema${issue.path}`, issue.message);
+            }
+          }
+        } else if (port2.response) {
+          semantic(`${at}/response`, "only a request input has a response");
+        }
+      }
+      for (const text of [port2.label, ...port2.description ? [port2.description] : []]) {
+        if (localizedVariants(text).some((variant) => variant.trim().length === 0))
+          semantic(at, "empty label or description");
+      }
+    });
+    if (defaults > 1) semantic(`/ports/${direction}`, "at most one default input");
+  };
+  checkPorts(manifest.ports?.inputs, "inputs");
+  checkPorts(manifest.ports?.outputs, "outputs");
+  const toolNames = /* @__PURE__ */ new Set();
+  (manifest.tools ?? []).forEach((tool, i) => {
+    const at = `/tools/${i}`;
+    if (toolNames.has(tool.name)) semantic(`${at}/name`, `duplicate tool "${tool.name}"`);
+    toolNames.add(tool.name);
+    const exposed = mcpToolName(manifest.name, tool.name);
+    if (BUILTIN_MCP_TOOL_NAMES.includes(exposed))
+      semantic(`${at}/name`, `"${exposed}" is a built-in NeuroSquad tool`);
+    else if (exposed.includes("__"))
+      semantic(`${at}/name`, `"${exposed}" contains "__" (reserved for installed MCP servers)`);
+    if (tool.inputSchema.type !== "object")
+      semantic(`${at}/inputSchema/type`, 'inputSchema must have type "object"');
+    if (tool.inputSchema.properties && Object.prototype.hasOwnProperty.call(tool.inputSchema.properties, "card")) {
+      semantic(
+        `${at}/inputSchema/properties/card`,
+        '"card" is reserved (the host adds it to pick among several cards)'
+      );
+    }
+    for (const issue of checkCardSchema(tool.inputSchema, {
+      maxNodes: LIMITS.schemaNodes,
+      maxDepth: LIMITS.schemaDepth
+    })) {
+      semantic(`${at}/inputSchema${issue.path}`, issue.message);
+    }
+  });
+  if (issues.length > 0) return { ok: false, issues };
+  const normalized = {
+    ...manifest,
+    entry: entry.ok ? entry.value : "index.html",
+    card,
+    permissions,
+    settings: manifest.settings ?? [],
+    ports: { inputs: manifest.ports?.inputs ?? [], outputs: manifest.ports?.outputs ?? [] },
+    tools: manifest.tools ?? []
+  };
+  return { ok: true, manifest: normalized, warnings };
+}
+function mcpToolName(packageName, tool) {
+  return `${packageName.replace(/-/g, "_")}_${tool}`.slice(0, 64);
+}
+
+// src/cli/util.ts
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+var useColor = process.stdout.isTTY === true && !("NO_COLOR" in process.env) && process.env["TERM"] !== "dumb";
+var paint = (code) => (text) => useColor ? `\x1B[${code}m${text}\x1B[0m` : text;
+var c = {
+  bold: paint(1),
+  dim: paint(2),
+  red: paint(31),
+  green: paint(32),
+  yellow: paint(33),
+  blue: paint(34),
+  magenta: paint(35),
+  cyan: paint(36)
+};
+var CliError = class extends Error {
+  constructor(message, exitCode = 1) {
+    super(message);
+    this.exitCode = exitCode;
+  }
+};
+var cachedRoot = null;
+function packageRoot() {
+  if (cachedRoot) return cachedRoot;
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 6; i++) {
+    const manifest = join(dir, "package.json");
+    if (existsSync(manifest)) {
+      try {
+        if (JSON.parse(readFileSync(manifest, "utf-8")).name === "@neurosquad/card-sdk") {
+          cachedRoot = dir;
+          return dir;
+        }
+      } catch {
+      }
+    }
+    dir = dirname(dir);
+  }
+  throw new CliError("cannot find the @neurosquad/card-sdk package folder");
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / 1024 / 1024).toFixed(2)} MB`;
+}
+function parseArgs(argv, booleans) {
+  const positionals = [];
+  const flags = /* @__PURE__ */ new Map();
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--") {
+      positionals.push(...argv.slice(i + 1));
+      break;
+    }
+    if (arg.startsWith("--")) {
+      const eq = arg.indexOf("=");
+      const name = eq === -1 ? arg.slice(2) : arg.slice(2, eq);
+      if (eq !== -1) flags.set(name, arg.slice(eq + 1));
+      else if (booleans.has(name) || i + 1 >= argv.length || argv[i + 1].startsWith("-"))
+        flags.set(name, true);
+      else flags.set(name, argv[++i]);
+    } else if (arg.startsWith("-") && arg.length === 2) {
+      flags.set(arg.slice(1), true);
+    } else positionals.push(arg);
+  }
+  return { positionals, flags };
+}
+function flag(args, name) {
+  const value = args.flags.get(name);
+  return typeof value === "string" ? value : void 0;
+}
+function safeTerminalText(text) {
+  return String(text).replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, "").replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)?/g, "").replace(/\u001b[\s\S]?/g, "").replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, " ").replace(new RegExp("\\p{Cf}", "gu"), "");
+}
+function isSecretLookingPath(path) {
+  const name = (path.split("/").pop() ?? path).toLowerCase();
+  if (name.startsWith(".env")) return !/^\.env\.(example|sample|template|dist)$/.test(name);
+  if (/\.(pem|key|p12|pfx)$/.test(name)) return true;
+  if (/^id_(rsa|ed25519|ecdsa|dsa)/.test(name)) return true;
+  return [
+    ".npmrc",
+    ".yarnrc",
+    ".yarnrc.yml",
+    ".git-credentials",
+    ".netrc",
+    "_netrc",
+    ".pypirc"
+  ].includes(name);
+}
+function isSecretLookingFile(path, read) {
+  if (!isSecretLookingPath(path)) return false;
+  const name = (path.split("/").pop() ?? path).toLowerCase();
+  if (![".npmrc", ".yarnrc", ".yarnrc.yml"].includes(name)) return true;
+  try {
+    return /(_auth|authtoken|_password|password|token|npmAuthIdent)/i.test(read());
+  } catch {
+    return true;
+  }
+}
+var GIT_NULL = process.platform === "win32" ? "NUL" : "/dev/null";
+function hardenedGit(args, env = process.env) {
+  const clean = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (!/^GIT_/i.test(key)) clean[key] = value;
+  }
+  return {
+    args: [
+      "-c",
+      "core.fsmonitor=false",
+      "-c",
+      `core.hooksPath=${GIT_NULL}`,
+      "-c",
+      "core.untrackedCache=false",
+      "-c",
+      "protocol.allow=never",
+      "--no-optional-locks",
+      ...args
+    ],
+    env: {
+      ...clean,
+      GIT_CONFIG_NOSYSTEM: "1",
+      GIT_CONFIG_GLOBAL: GIT_NULL,
+      GIT_OPTIONAL_LOCKS: "0",
+      GIT_TERMINAL_PROMPT: "0"
+    }
+  };
+}
+
+// src/cli/create.ts
+var TEMPLATES = ["vanilla", "react"];
+var TEXT_EXTENSIONS = /\.(json|html|js|mjs|ts|tsx|css|md|txt)$|^_gitignore$/;
+function slugify(name) {
+  const slug = name.toLowerCase().normalize("NFKD").replace(/[^a-z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^[^a-z]+/, "").replace(/-+$/, "").slice(0, 48).replace(/-+$/, "");
+  return CARD_NAME_RE.test(slug) ? slug : "my-card";
+}
+function titleFromName(name) {
+  const words = name.split("-").filter(Boolean).join(" ");
+  return words.charAt(0).toUpperCase() + words.slice(1);
+}
+function copyTemplate(from, to, replace, created) {
+  mkdirSync(to, { recursive: true });
+  for (const entry of readdirSync(from, { withFileTypes: true })) {
+    const source = join2(from, entry.name);
+    const targetName = entry.name === "_gitignore" ? ".gitignore" : entry.name;
+    const target = join2(to, targetName);
+    if (entry.isDirectory()) copyTemplate(source, target, replace, created);
+    else {
+      if (TEXT_EXTENSIONS.test(entry.name))
+        writeFileSync(target, replace(readFileSync2(source, "utf-8")));
+      else copyFileSync(source, target);
+      created.push(target);
+    }
+  }
+}
+function createCard(dirArg, options = {}) {
+  const template = options.template ?? "vanilla";
+  if (!TEMPLATES.includes(template)) {
+    throw new CliError(`unknown template "${template}" \u2014 use one of: ${TEMPLATES.join(", ")}`);
+  }
+  const dir = resolve(dirArg);
+  if (existsSync2(dir)) {
+    if (!statSync(dir).isDirectory()) throw new CliError(`${dir} exists and is not a folder`);
+    if (readdirSync(dir).length > 0 && !options.force) {
+      throw new CliError(`${dir} is not empty \u2014 pick a new folder or pass --force`);
+    }
+  }
+  const name = options.name ?? slugify(basename(dir));
+  if (!CARD_NAME_RE.test(name)) {
+    throw new CliError(
+      `"${name}" is not a valid card name: lowercase letters, digits and dashes, starting with a letter (2\u201348 chars)`
+    );
+  }
+  const displayName = options.displayName ?? titleFromName(name);
+  const root = packageRoot();
+  const templateDir = join2(root, "templates", template);
+  if (!existsSync2(templateDir)) throw new CliError(`template folder missing: ${templateDir}`);
+  const values = {
+    __CARD_NAME__: name,
+    __CARD_DISPLAY_NAME__: displayName.replace(/["\\]/g, ""),
+    __SDK_VERSION__: SDK_VERSION
+  };
+  const replace = (text) => text.replace(/__CARD_NAME__|__CARD_DISPLAY_NAME__|__SDK_VERSION__/g, (key) => values[key]);
+  const files = [];
+  copyTemplate(templateDir, dir, replace, files);
+  if (template === "vanilla") {
+    const vendor = join2(dir, "vendor");
+    mkdirSync(vendor, { recursive: true });
+    const assets = [
+      [join2(root, "dist", "card-sdk.js"), "card-sdk.js"],
+      [join2(root, "dist", "testing.js"), "testing.js"],
+      [join2(root, "dist", "ui.css"), "ui.css"],
+      [join2(root, "schema", "neurosquad-card.v1.json"), "neurosquad-card.schema.json"]
+    ];
+    for (const [source, target] of assets) {
+      if (!existsSync2(source))
+        throw new CliError(`missing ${source} \u2014 build the SDK first (npm run build)`);
+      copyFileSync(source, join2(vendor, target));
+      files.push(join2(vendor, target));
+    }
+  }
+  const manifest = JSON.parse(readFileSync2(join2(dir, MANIFEST_FILE), "utf-8"));
+  const check = validateManifest(manifest);
+  if (!check.ok) {
+    throw new CliError(
+      `the new manifest is invalid: ${check.issues.map((i) => `${i.path} ${i.message}`).join("; ")} \u2014 try --name`
+    );
+  }
+  return { dir, files, name };
+}
+function runCreate(dirArg, options) {
+  if (!dirArg)
+    throw new CliError("usage: neurosquad-card create <folder> [--template vanilla|react]");
+  const { dir, files, name } = createCard(dirArg, options);
+  const shown = relative(process.cwd(), dir) || ".";
+  console.log(
+    c.green(`\u2714 created ${c.bold(name)} in ${shown}`) + c.dim(` (${files.length} files, ${options.template ?? "vanilla"} template)`)
+  );
+  console.log("");
+  console.log("Next:");
+  console.log(`  cd ${shown}`);
+  if (options.template === "react") {
+    console.log("  npm install");
+    console.log(`  npm run dev            ${c.dim("# preview in the browser with a mock host")}`);
+    console.log(`  npm run build          ${c.dim("# \u2192 dist/, which the app loads (commit it)")}`);
+  }
+  const cli = options.template === "react" ? "npx neurosquad-card" : "npx @neurosquad/card-sdk";
+  console.log(
+    `  ${cli} dev ${c.dim("# live in NeuroSquad (Settings \u2192 Custom cards \u2192 Developer mode)")}`
+  );
+  console.log(`  ${cli} validate`);
+  console.log("");
+  console.log(c.dim("Share it: push the folder to GitHub; people install it with owner/repo."));
+  return 0;
+}
+
+// src/cli/dev.ts
+import { spawn } from "node:child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync4, realpathSync as realpathSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join4, resolve as resolve3 } from "node:path";
+
+// src/cli/inspect.ts
+import { spawnSync } from "node:child_process";
+import { existsSync as existsSync3, lstatSync, readdirSync as readdirSync2, readFileSync as readFileSync3, realpathSync } from "node:fs";
+import { isAbsolute, join as join3, relative as relative2, sep } from "node:path";
+
+// src/cli/images.ts
+var PNG_MAGIC = [137, 80, 78, 71, 13, 10, 26, 10];
+function readImageInfo(bytes) {
+  if (bytes.length >= 24 && PNG_MAGIC.every((b, i) => bytes[i] === b)) {
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    if (String.fromCharCode(...bytes.subarray(12, 16)) !== "IHDR") return null;
+    return { format: "png", width: view.getUint32(16), height: view.getUint32(20) };
+  }
+  const ascii = (start, end) => String.fromCharCode(...bytes.subarray(start, end));
+  if (bytes.length >= 30 && ascii(0, 4) === "RIFF" && ascii(8, 12) === "WEBP") {
+    const chunk = ascii(12, 16);
+    const u24 = (at) => bytes[at] | bytes[at + 1] << 8 | bytes[at + 2] << 16;
+    if (chunk === "VP8X") return { format: "webp", width: u24(24) + 1, height: u24(27) + 1 };
+    if (chunk === "VP8 ") {
+      const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+      return {
+        format: "webp",
+        width: view.getUint16(26, true) & 16383,
+        height: view.getUint16(28, true) & 16383
+      };
+    }
+    if (chunk === "VP8L" && bytes[20] === 47) {
+      const b = (i) => bytes[21 + i];
+      const width = 1 + ((b(1) & 63) << 8 | b(0));
+      const height = 1 + ((b(3) & 15) << 10 | b(2) << 2 | (b(1) & 192) >> 6);
+      return { format: "webp", width, height };
+    }
+    return null;
+  }
+  return null;
+}
+
+// src/cli/inspect.ts
+var ALWAYS_SKIPPED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules"]);
+function fromManifestIssue(issue) {
+  return { kind: "manifest", where: issue.path || "/", message: issue.message };
+}
+function listCandidates(dir) {
+  const hardened = hardenedGit([
+    "ls-files",
+    "-z",
+    "--cached",
+    "--others",
+    "--exclude-standard",
+    "--",
+    "."
+  ]);
+  const git = spawnSync("git", hardened.args, {
+    cwd: dir,
+    encoding: "utf-8",
+    windowsHide: true,
+    env: hardened.env
+  });
+  if (git.status === 0 && typeof git.stdout === "string") {
+    const paths2 = git.stdout.split("\0").filter((path) => path.length > 0).filter((path) => !path.split("/").some((part) => ALWAYS_SKIPPED_DIRS.has(part)));
+    return { paths: [...new Set(paths2)], source: "git" };
+  }
+  const paths = [];
+  const walk = (current, depth) => {
+    if (depth > LIMITS.pathDepth + 1 || paths.length > LIMITS.files * 2) return;
+    for (const entry of readdirSync2(current, { withFileTypes: true })) {
+      const abs = join3(current, entry.name);
+      if (entry.isDirectory()) {
+        if (!ALWAYS_SKIPPED_DIRS.has(entry.name)) walk(abs, depth + 1);
+      } else paths.push(relative2(dir, abs).split(sep).join("/"));
+    }
+  };
+  walk(dir, 0);
+  return { paths, source: "walk" };
+}
+function lintEntryHtml(html, entry, warnings) {
+  const warn = (message) => void warnings.push({ kind: "file", where: entry, message });
+  const scripts = [...html.matchAll(/<script\b([^>]*)>([\s\S]*?)<\/script>/gi)];
+  if (scripts.some(([, attrs, body]) => !/\bsrc\s*=/.test(attrs) && body.trim().length > 0)) {
+    warn("inline <script> is blocked by the card CSP \u2014 move the code into a .js file");
+  }
+  if (/\son[a-z]+\s*=\s*["']/i.test(html)) {
+    warn('inline event handlers (onclick="\u2026") are blocked by the card CSP \u2014 use addEventListener');
+  }
+  const external = [...html.matchAll(/\b(?:src|href)\s*=\s*["'](https?:)?\/\/[^"']+["']/gi)].filter(
+    (match) => !/<a\b[^>]*$/i.test(html.slice(Math.max(0, match.index - 200), match.index))
+  );
+  if (external.length > 0) {
+    warn(
+      "external scripts, styles, fonts or images are blocked \u2014 bundle them into the package (data: and blob: images work; use card.net.fetch for data)"
+    );
+  }
+}
+function inspectPackage(dir, options = {}) {
+  const report = {
+    dir,
+    manifest: null,
+    errors: [],
+    warnings: [],
+    files: [],
+    totalBytes: 0,
+    fileSource: "walk",
+    secretFiles: []
+  };
+  const error = (kind, where, message) => void report.errors.push({ kind, where, message });
+  const warn = (kind, where, message) => void report.warnings.push({ kind, where, message });
+  if (!existsSync3(dir) || !lstatSync(dir).isDirectory()) {
+    error("package", dir, "not a folder");
+    return report;
+  }
+  const manifestPath = join3(dir, MANIFEST_FILE);
+  if (!existsSync3(manifestPath)) {
+    error("package", MANIFEST_FILE, `${MANIFEST_FILE} is missing at the package root`);
+  } else {
+    const result = parseManifestText(readFileSync3(manifestPath, "utf-8"), options.appVersion);
+    if (result.ok) {
+      report.manifest = result.manifest;
+      report.warnings.push(...result.warnings.map(fromManifestIssue));
+      for (const issue of impersonationIssues(result.manifest)) {
+        report.warnings.push({
+          ...fromManifestIssue(issue),
+          message: `${issue.message} \u2014 the app refuses this unless the card comes from the official organization`
+        });
+      }
+    } else report.errors.push(...result.issues.map(fromManifestIssue));
+  }
+  const { paths, source } = listCandidates(dir);
+  report.fileSource = source;
+  const lower = /* @__PURE__ */ new Map();
+  let realDir;
+  try {
+    realDir = realpathSync.native(dir);
+  } catch {
+    realDir = dir;
+  }
+  for (const path of paths.sort()) {
+    const abs = join3(dir, ...path.split("/"));
+    let stat;
+    try {
+      stat = lstatSync(abs);
+    } catch {
+      continue;
+    }
+    if (stat.isSymbolicLink()) {
+      warn("file", path, "symbolic link \u2014 the installer skips links; copy the file instead");
+      continue;
+    }
+    let real;
+    try {
+      real = realpathSync.native(abs);
+    } catch {
+      continue;
+    }
+    const inside = relative2(realDir, real);
+    if (inside === "" || inside.startsWith("..") || isAbsolute(inside) || inside.split(sep).join("/").toLowerCase() !== path.toLowerCase()) {
+      warn(
+        "file",
+        path,
+        "reached through a symbolic link or junction \u2014 skipped (it would be read from outside the card folder)"
+      );
+      continue;
+    }
+    if (isSecretLookingFile(path, () => readFileSync3(abs, "utf-8"))) {
+      report.secretFiles.push(path);
+      warn(
+        "file",
+        path,
+        "looks like a credential file \u2014 `pack` refuses it (add it to .gitignore, or pass --allow-secret-files)"
+      );
+    }
+    if (!stat.isFile()) continue;
+    const checked = validatePackagePath(path);
+    if (!checked.ok) {
+      error("file", path, `the installer refuses this path: ${checked.error}`);
+      continue;
+    }
+    if (stat.size > LIMITS.fileBytes) {
+      error("file", path, `larger than ${LIMITS.fileBytes / 1024 / 1024} MB`);
+      continue;
+    }
+    if (!path.includes("/") && path.endsWith(".tgz")) {
+      warn(
+        "file",
+        path,
+        "a packed archive inside the card folder would be installed too \u2014 delete or .gitignore it"
+      );
+    }
+    const clash = lower.get(path.toLowerCase());
+    if (clash)
+      warn("file", path, `differs from "${clash}" only by case \u2014 breaks on Windows and macOS`);
+    lower.set(path.toLowerCase(), path);
+    report.files.push({ path: checked.value, abs, size: stat.size });
+    report.totalBytes += stat.size;
+  }
+  if (report.files.length > LIMITS.files)
+    error("package", "", `more than ${LIMITS.files} files (${report.files.length})`);
+  if (report.totalBytes > LIMITS.unpackedBytes) {
+    error("package", "", `more than ${LIMITS.unpackedBytes / 1024 / 1024} MB of files`);
+  }
+  const manifest = report.manifest;
+  if (manifest) {
+    const byPath = new Map(report.files.map((file) => [file.path, file]));
+    const entry = byPath.get(manifest.entry);
+    if (!entry) {
+      const built = existsSync3(join3(dir, ...manifest.entry.split("/")));
+      error(
+        "manifest",
+        "/entry",
+        built ? `"${manifest.entry}" exists but would not be in the package (ignored by git?) \u2014 commit your build output` : `"${manifest.entry}" does not exist${manifest.entry.includes("/") ? " \u2014 run your build first (npm run build)" : ""}`
+      );
+    } else {
+      lintEntryHtml(readFileSync3(entry.abs, "utf-8"), entry.path, report.warnings);
+    }
+    if (manifest.icon !== void 0) {
+      const icon = byPath.get(manifest.icon);
+      if (!icon) error("manifest", "/icon", `"${manifest.icon}" does not exist in the package`);
+      else if (icon.size > LIMITS.iconBytes) {
+        error("manifest", "/icon", `icon is larger than ${LIMITS.iconBytes / 1024} KB`);
+      } else {
+        const info = readImageInfo(readFileSync3(icon.abs));
+        if (!info)
+          error("manifest", "/icon", "icon is not a PNG or WebP image (checked by its bytes)");
+        else if (info.width !== info.height) {
+          error("manifest", "/icon", `icon must be square (it is ${info.width}\xD7${info.height})`);
+        } else if (info.width < 64) {
+          warn(
+            "manifest",
+            "/icon",
+            `icon is ${info.width}\xD7${info.height}; 128\xD7128 or larger looks sharper`
+          );
+        }
+      }
+    } else warn("manifest", "/icon", "no icon \u2014 the card shows a generic puzzle piece");
+    if (!manifest.license)
+      warn("manifest", "/license", "no license \u2014 say how others may use your card");
+    if (!manifest.description)
+      warn("manifest", "/description", "no description \u2014 shown in the install dialog");
+  }
+  return report;
+}
+
+// src/cli/validate.ts
+import { resolve as resolve2 } from "node:path";
+var RISK_ORDER = ["high", "medium", "low"];
+function consentSummary(manifest) {
+  const lines = [];
+  const t = safeTerminalText;
+  const required = manifest.permissions.filter((p) => !p.optional);
+  const optional = manifest.permissions.filter((p) => p.optional);
+  const describe = (id, hosts) => PERMISSION_TEXT_EN[id].title.replace("{{hosts}}", t((hosts ?? []).join(", ")));
+  const riskLabel = (risk) => risk === "high" ? c.red("high  ") : risk === "medium" ? c.yellow("medium") : c.green("low   ");
+  lines.push(
+    `${c.bold(t(resolveLocalized(manifest.displayName, "en")))} ${c.dim(`(${manifest.name} ${t(manifest.version)})`)}`
+  );
+  if (manifest.author) lines.push(`  by ${t(manifest.author.name)} ${c.dim("(self-declared)")}`);
+  lines.push(c.dim("  Community code, not made or checked by NeuroSquad."));
+  if (required.length === 0) lines.push("  Asks for no permissions.");
+  else {
+    lines.push("  It will be able to:");
+    for (const risk of RISK_ORDER) {
+      for (const permission of required.filter((p) => PERMISSION_INFO[p.id].risk === risk)) {
+        lines.push(`   ${riskLabel(risk)}  ${describe(permission.id, permission.hosts)}`);
+        lines.push(`           ${c.dim(PERMISSION_TEXT_EN[permission.id].body)}`);
+        if (permission.reason)
+          lines.push(`           ${c.cyan(`Why: ${t(resolveLocalized(permission.reason, "en"))}`)}`);
+      }
+    }
+  }
+  if (optional.length > 0) {
+    lines.push("  May ask later for:");
+    for (const permission of optional)
+      lines.push(`   - ${describe(permission.id, permission.hosts)}`);
+  }
+  if (manifest.tools.length > 0) {
+    lines.push(
+      `  Tools for connected agents: ${manifest.tools.map((tool) => mcpToolName(manifest.name, tool.name)).join(", ")}`
+    );
+  }
+  const { inputs, outputs } = manifest.ports;
+  if (inputs.length + outputs.length > 0) {
+    lines.push(
+      `  Ports: ${inputs.length} in (${inputs.map((p) => t(`${p.id}:${p.type}`)).join(", ") || "\u2014"}), ${outputs.length} out (${outputs.map((p) => t(`${p.id}:${p.type}`)).join(", ") || "\u2014"})`
+    );
+  }
+  return lines;
+}
+function formatIssue(issue) {
+  const where = issue.kind === "manifest" ? `neurosquad-card.json ${issue.where}` : issue.kind === "file" ? issue.where : issue.where || "package";
+  return `${c.bold(safeTerminalText(where))}: ${safeTerminalText(issue.message)}`;
+}
+function printReport(report, options = {}) {
+  for (const issue of report.errors) console.log(`${c.red("\u2716 error")}   ${formatIssue(issue)}`);
+  for (const issue of report.warnings) console.log(`${c.yellow("\u25B2 warning")} ${formatIssue(issue)}`);
+  if (report.manifest && options.consent !== false) {
+    console.log("");
+    console.log(c.dim("Install dialog preview:"));
+    for (const line of consentSummary(report.manifest)) console.log(line);
+  }
+  console.log("");
+  console.log(
+    c.dim(
+      `${report.files.length} files, ${formatBytes(report.totalBytes)} (file list from ${report.fileSource === "git" ? "git: tracked + not ignored" : "the folder"})`
+    )
+  );
+  const ok = report.errors.length === 0;
+  console.log(
+    ok ? c.green(
+      `\u2714 valid${report.warnings.length ? ` with ${report.warnings.length} warning(s)` : ""}`
+    ) : c.red(`\u2716 ${report.errors.length} error(s) \u2014 NeuroSquad would refuse to install this card`)
+  );
+  return ok;
+}
+function reportJson(report) {
+  return {
+    ok: report.errors.length === 0,
+    dir: report.dir,
+    name: report.manifest?.name ?? null,
+    version: report.manifest?.version ?? null,
+    errors: report.errors,
+    warnings: report.warnings,
+    files: report.files.map(({ path, size: size2 }) => ({ path, size: size2 })),
+    totalBytes: report.totalBytes
+  };
+}
+function runValidate(dirArg, options) {
+  const dir = resolve2(dirArg ?? ".");
+  const report = inspectPackage(dir, options.appVersion ? { appVersion: options.appVersion } : {});
+  if (options.json) {
+    console.log(JSON.stringify(reportJson(report), null, 2));
+    return report.errors.length === 0 ? 0 : 1;
+  }
+  console.log(c.dim(`Validating ${safeTerminalText(dir)}`));
+  return printReport(report) ? 0 : 1;
+}
+
+// src/cli/dev.ts
+function defaultUserDataDir() {
+  const fromEnv = process.env["NEUROSQUAD_USER_DATA_DIR"];
+  if (fromEnv) return fromEnv;
+  if (process.platform === "win32") {
+    return join4(process.env["APPDATA"] ?? join4(homedir(), "AppData", "Roaming"), "NeuroSquad");
+  }
+  if (process.platform === "darwin")
+    return join4(homedir(), "Library", "Application Support", "NeuroSquad");
+  return join4(process.env["XDG_CONFIG_HOME"] ?? join4(homedir(), ".config"), "NeuroSquad");
+}
+function readHandshake(userDataDir) {
+  const file = join4(userDataDir, "card-dev.json");
+  if (!existsSync4(file)) {
+    throw new CliError(
+      `NeuroSquad developer mode is off (no ${file}).
+  Turn it on in NeuroSquad: Settings \u2192 Custom cards \u2192 Developer mode.
+  Using another profile? Pass --user-data-dir <folder>.`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync4(file, "utf-8"));
+  } catch {
+    throw new CliError(`${file} is not valid JSON \u2014 toggle developer mode off and on`);
+  }
+  if (typeof parsed.port !== "number" || typeof parsed.token !== "string" || !/^[0-9a-f]{16,}$/i.test(parsed.token)) {
+    throw new CliError(`${file} is incomplete \u2014 toggle developer mode off and on`);
+  }
+  if (typeof parsed.pid === "number" && !processAlive(parsed.pid)) {
+    throw new CliError(
+      `NeuroSquad (pid ${parsed.pid}) is not running \u2014 start the app with developer mode on`
+    );
+  }
+  return {
+    port: parsed.port,
+    token: parsed.token,
+    pid: parsed.pid ?? 0,
+    appVersion: parsed.appVersion ?? ""
+  };
+}
+function processAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+var DevLinkClient = class {
+  base;
+  constructor(handshake, host = "127.0.0.1") {
+    this.base = `http://${host}:${handshake.port}/carddev/${handshake.token}`;
+  }
+  async json(path, init) {
+    let response;
+    try {
+      response = await fetch(`${this.base}${path}`, init);
+    } catch (error) {
+      throw new CliError(
+        `cannot reach NeuroSquad's dev link server (${error.message}) \u2014 is the app running with developer mode on?`
+      );
+    }
+    const text = await response.text();
+    if (!response.ok) {
+      throw new CliError(
+        `the app refused ${path} (${response.status}${text ? `: ${text.slice(0, 300)}` : ""})`
+      );
+    }
+    return text ? JSON.parse(text) : null;
+  }
+  /** Asks the app to link a folder; the user confirms in the app. */
+  link(folder) {
+    return this.json("/link", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ folder })
+    });
+  }
+  status() {
+    return this.json("/status");
+  }
+  reload(packageId) {
+    return this.json("/reload", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ packageId })
+    });
+  }
+  /** Streams log lines (SSE) until the signal aborts or the app closes the stream. */
+  async logs(packageId, onLine, signal) {
+    const response = await fetch(`${this.base}/logs?packageId=${encodeURIComponent(packageId)}`, {
+      headers: { accept: "text/event-stream" },
+      signal
+    });
+    if (!response.ok || !response.body) throw new Error(`log stream refused (${response.status})`);
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    for (; ; ) {
+      const { value, done } = await reader.read();
+      if (done) return;
+      buffer += decoder.decode(value, { stream: true });
+      let index;
+      while ((index = buffer.indexOf("\n\n")) !== -1) {
+        const event = buffer.slice(0, index);
+        buffer = buffer.slice(index + 2);
+        const data = event.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n");
+        if (!data) continue;
+        try {
+          onLine(JSON.parse(data));
+        } catch {
+        }
+      }
+    }
+  }
+};
+function sameFolder(a, b) {
+  const norm = (path) => {
+    const clean = path.replace(/\\/g, "/").replace(/\/+$/, "");
+    return process.platform === "linux" ? clean : clean.toLowerCase();
+  };
+  return norm(a) === norm(b);
+}
+async function waitForLink(client, folder, options = {}) {
+  const deadline = Date.now() + (options.timeoutMs ?? 5 * 6e4);
+  for (; ; ) {
+    const status = await client.status();
+    const found = status.linked.find((entry) => sameFolder(entry.folder, folder));
+    if (found) return found;
+    if (Date.now() > deadline)
+      throw new CliError("the link was not confirmed in the app in time \u2014 run the command again");
+    await new Promise((r) => setTimeout(r, options.intervalMs ?? 1e3));
+  }
+}
+function formatLog(line) {
+  const time = new Date(line.at).toLocaleTimeString();
+  const level = line.level === "error" ? c.red("error") : line.level === "warn" ? c.yellow("warn ") : line.level === "info" ? c.cyan("info ") : c.dim("debug");
+  return `${c.dim(time)} ${level} ${c.dim(safeTerminalText(String(line.instanceId).slice(0, 8)))} ${safeTerminalText(line.message)}`;
+}
+function buildCommand(dir) {
+  const file = join4(dir, "package.json");
+  if (!existsSync4(file)) return null;
+  try {
+    const scripts = JSON.parse(readFileSync4(file, "utf-8")).scripts ?? {};
+    if (scripts["watch"]) return ["run", "watch"];
+    if (scripts["build"]) return ["run", "build", "--", "--watch"];
+  } catch {
+  }
+  return null;
+}
+async function runDev(dirArg, options) {
+  const dir = realpathSync2(resolve3(dirArg ?? "."));
+  const report = inspectPackage(dir);
+  if (!report.manifest) {
+    printReport(report, { consent: false });
+    throw new CliError("fix the manifest before linking");
+  }
+  if (report.errors.length > 0) {
+    printReport(report, { consent: false });
+    console.log(
+      c.yellow("Linking anyway \u2014 the card will show these problems until they are fixed.")
+    );
+  }
+  const children = [];
+  const command = options.build === false ? null : buildCommand(dir);
+  if (command) {
+    console.log(c.dim(`$ npm ${command.join(" ")}`));
+    const child = spawn(`npm ${command.join(" ")}`, {
+      cwd: dir,
+      stdio: ["ignore", "inherit", "inherit"],
+      shell: true
+    });
+    children.push(child);
+  }
+  const handshake = readHandshake(options.userDataDir ?? defaultUserDataDir());
+  const client = new DevLinkClient(handshake);
+  const already = (await client.status()).linked.find((entry) => sameFolder(entry.folder, dir));
+  let linked = already;
+  if (!linked) {
+    await client.link(dir);
+    console.log(c.bold("Confirm the link in NeuroSquad") + c.dim(` \u2014 ${dir}`));
+    linked = await waitForLink(client, dir);
+  }
+  console.log(
+    c.green(`\u2714 linked as ${safeTerminalText(linked.packageId)}`) + c.dim(` (revision ${linked.revision})`)
+  );
+  console.log(c.dim("Saving a file reloads the card. Add it from the canvas: + \u2192 Custom card\u2026"));
+  if (process.stdin.isTTY) console.log(c.dim("Press r to reload the card, q to quit."));
+  const controller = new AbortController();
+  const stop = () => {
+    controller.abort();
+    for (const child of children) child.kill();
+    if (process.stdin.isTTY) process.stdin.setRawMode(false);
+    process.stdin.pause();
+  };
+  process.once("SIGINT", () => {
+    stop();
+    process.exit(0);
+  });
+  const packageId = linked.packageId;
+  if (process.stdin.isTTY) {
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.on("data", (data) => {
+      const key = data.toString();
+      if (key === "q" || key === "") {
+        stop();
+        process.exit(0);
+      }
+      if (key === "r") {
+        client.reload(packageId).then(
+          (result) => console.log(c.dim(`reloaded (revision ${result.revision})`)),
+          (error) => console.log(c.red(safeTerminalText(error.message)))
+        );
+      }
+    });
+  }
+  if (options.logs === false) {
+    await new Promise(
+      (resolveWait) => controller.signal.addEventListener("abort", () => resolveWait())
+    );
+    return 0;
+  }
+  let delay = 1e3;
+  while (!controller.signal.aborted) {
+    try {
+      await client.logs(packageId, (line) => console.log(formatLog(line)), controller.signal);
+      delay = 1e3;
+    } catch (error) {
+      if (controller.signal.aborted) break;
+      console.log(c.dim(`log stream: ${safeTerminalText(error.message)}; retrying\u2026`));
+    }
+    await new Promise((r) => setTimeout(r, delay));
+    delay = Math.min(delay * 2, 15e3);
+  }
+  return 0;
+}
+
+// src/cli/pack.ts
+import { createHash } from "node:crypto";
+import { readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { resolve as resolve4 } from "node:path";
+
+// src/cli/tar.ts
+import { gunzipSync, gzipSync } from "node:zlib";
+var BLOCK = 512;
+var FIXED_MTIME = 1577836800;
+function octal(value, length) {
+  return value.toString(8).padStart(length - 1, "0") + "\0";
+}
+function header(name, size2, type, prefix = "") {
+  const block = new Uint8Array(BLOCK);
+  const encoder = new TextEncoder();
+  const write = (text, offset, length) => {
+    block.set(encoder.encode(text).subarray(0, length), offset);
+  };
+  write(name, 0, 100);
+  write(octal(type === "5" ? 493 : 420, 8), 100, 8);
+  write(octal(0, 8), 108, 8);
+  write(octal(0, 8), 116, 8);
+  write(octal(size2, 12), 124, 12);
+  write(octal(FIXED_MTIME, 12), 136, 12);
+  write("        ", 148, 8);
+  write(type, 156, 1);
+  write("ustar\0", 257, 6);
+  write("00", 263, 2);
+  write(prefix, 345, 155);
+  let sum = 0;
+  for (const byte of block) sum += byte;
+  write(octal(sum, 7) + " ", 148, 8);
+  return block;
+}
+function padded(data) {
+  const rest = data.length % BLOCK;
+  return rest === 0 ? [data] : [data, new Uint8Array(BLOCK - rest)];
+}
+function splitUstar(path) {
+  const bytes = new TextEncoder().encode(path);
+  if (bytes.length <= 100 && bytes.length === path.length) return { name: path, prefix: "" };
+  if (bytes.length !== path.length) return null;
+  for (let i = path.length - 1; i > 0; i--) {
+    if (path[i] !== "/") continue;
+    const prefix = path.slice(0, i);
+    const name = path.slice(i + 1);
+    if (prefix.length <= 155 && name.length <= 100 && name.length > 0) return { name, prefix };
+  }
+  return null;
+}
+function paxRecord(key, value) {
+  const body = ` ${key}=${value}
+`;
+  let length = body.length + 1;
+  while (`${length}${body}`.length !== length) length = `${length}${body}`.length;
+  return `${length}${body}`;
+}
+function createTarGz(files, root) {
+  const parts = [];
+  const sorted = [...files].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  parts.push(header(`${root}/`, 0, "5"));
+  for (const file of sorted) {
+    const full = `${root}/${file.path}`;
+    const split = splitUstar(full);
+    if (split) parts.push(header(split.name, file.data.length, "0", split.prefix));
+    else {
+      const pax = new TextEncoder().encode(paxRecord("path", full));
+      parts.push(header("PaxHeader", pax.length, "x"), ...padded(pax));
+      parts.push(header(full.slice(0, 99), file.data.length, "0"));
+    }
+    parts.push(...padded(file.data));
+  }
+  parts.push(new Uint8Array(BLOCK * 2));
+  const total = parts.reduce((n, part) => n + part.length, 0);
+  const tar = new Uint8Array(total);
+  let offset = 0;
+  for (const part of parts) {
+    tar.set(part, offset);
+    offset += part.length;
+  }
+  return new Uint8Array(gzipSync(tar, { level: 9 }));
+}
+
+// src/cli/pack.ts
+function packPackage(dir, options = {}) {
+  const report = inspectPackage(dir, options.appVersion ? { appVersion: options.appVersion } : {});
+  if (report.errors.length > 0 || !report.manifest) {
+    const error = new CliError(
+      "the package has errors \u2014 fix them first (see `neurosquad-card validate`)"
+    );
+    error.report = report;
+    throw error;
+  }
+  if (report.secretFiles.length > 0 && !options.allowSecretFiles) {
+    throw new CliError(
+      `refusing to pack files that look like credentials: ${report.secretFiles.map(safeTerminalText).join(", ")} \u2014 add them to .gitignore, or pass --allow-secret-files if they are meant to ship`
+    );
+  }
+  const out = resolve4(options.out ?? `${report.manifest.name}-${report.manifest.version}.tgz`);
+  const entries = report.files.filter((file) => resolve4(file.abs) !== out).map((file) => {
+    const data = readFileSync5(file.abs);
+    return {
+      path: file.path,
+      size: data.length,
+      data: new Uint8Array(data),
+      sha256: createHash("sha256").update(data).digest("hex")
+    };
+  });
+  const treeHash = createHash("sha256").update(treeHashInput(entries), "utf8").digest("hex");
+  const archive = createTarGz(entries, report.manifest.name);
+  if (archive.length > LIMITS.tarballBytes) {
+    throw new CliError(
+      `the archive is ${formatBytes(archive.length)}; the app accepts at most ${formatBytes(LIMITS.tarballBytes)}`
+    );
+  }
+  let written = null;
+  if (!options.dryRun) {
+    try {
+      writeFileSync2(out, archive);
+      written = out;
+    } catch (error) {
+      rmSync(out, { force: true });
+      throw new CliError(`could not write ${out}: ${error.message}`);
+    }
+  }
+  return {
+    report,
+    treeHash,
+    out: written,
+    archiveBytes: archive.length,
+    files: entries.map(({ path, size: size2, sha256 }) => ({ path, size: size2, sha256 }))
+  };
+}
+function runPack(dirArg, options) {
+  const dir = resolve4(dirArg ?? ".");
+  let result;
+  try {
+    result = packPackage(dir, options);
+  } catch (error) {
+    const report = error.report;
+    if (report) {
+      if (options.json) console.log(JSON.stringify(reportJson(report), null, 2));
+      else printReport(report, { consent: false });
+    }
+    throw error;
+  }
+  if (options.json) {
+    console.log(
+      JSON.stringify(
+        {
+          ...reportJson(result.report),
+          treeHash: result.treeHash,
+          out: result.out,
+          archiveBytes: result.archiveBytes,
+          files: result.files
+        },
+        null,
+        2
+      )
+    );
+    return 0;
+  }
+  for (const warning of result.report.warnings)
+    console.log(
+      `${c.yellow("\u25B2 warning")} ${safeTerminalText(warning.where)}: ${safeTerminalText(warning.message)}`
+    );
+  const width = Math.max(...result.files.map((file) => file.path.length), 4);
+  console.log(c.dim(`${"file".padEnd(width)}  size`));
+  for (const file of result.files)
+    console.log(`${safeTerminalText(file.path).padEnd(width)}  ${c.dim(formatBytes(file.size))}`);
+  console.log("");
+  console.log(
+    `${result.files.length} files, ${formatBytes(result.report.totalBytes)} unpacked, ${formatBytes(result.archiveBytes)} packed`
+  );
+  console.log(`tree hash  ${c.bold(result.treeHash)}`);
+  console.log(
+    result.out ? c.green(`\u2714 wrote ${result.out}`) : c.green("\u2714 dry run: the installer would accept this package")
+  );
+  return 0;
+}
+
+// src/cli/index.ts
+var HELP = `${c.bold("neurosquad-card")} ${c.dim(SDK_VERSION)} \u2014 build custom cards for NeuroSquad
+
+${c.bold("Usage")}
+  neurosquad-card create <folder> [--template vanilla|react] [--name <slug>] [--display-name <text>] [--force]
+      New card from a template. vanilla: no build step. react: React + Vite.
+  neurosquad-card dev [folder] [--user-data-dir <dir>] [--no-build] [--no-logs]
+      Link the folder into the running app (developer mode on), hot reload on save,
+      stream the card's log. Runs "npm run watch" (or "build -- --watch") when present:
+      that runs the folder's own scripts, so only use dev on folders you trust (or --no-build).
+  neurosquad-card validate [folder] [--json] [--app-version <x.y.z>]
+      Check the manifest and files with the app's own rules; preview the install dialog.
+  neurosquad-card pack [folder] [--out <file.tgz>] [--dry-run] [--json] [--allow-secret-files]
+      Apply the installer's archive rules, print files and the tree hash, write a .tgz.
+      Refuses files that look like credentials (.env, *.pem, *.key, id_rsa, .npmrc\u2026).
+
+${c.bold("Options")}
+  -h, --help       this help
+  -v, --version    the SDK version
+
+Without installing: npx @neurosquad/card-sdk <command>`;
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
+  "force",
+  "json",
+  "dry-run",
+  "allow-secret-files",
+  "no-build",
+  "no-logs",
+  "help",
+  "version",
+  "h",
+  "v"
+]);
+async function main(argv) {
+  const [command, ...rest] = argv;
+  const args = parseArgs(rest, BOOLEAN_FLAGS);
+  if (!command || command === "help" || command === "--help" || command === "-h") {
+    console.log(HELP);
+    return 0;
+  }
+  if (command === "--version" || command === "-v" || command === "version") {
+    console.log(SDK_VERSION);
+    return 0;
+  }
+  if (args.flags.has("help") || args.flags.has("h")) {
+    console.log(HELP);
+    return 0;
+  }
+  const dir = args.positionals[0];
+  switch (command) {
+    case "create": {
+      const template = flag(args, "template") ?? "vanilla";
+      if (!TEMPLATES.includes(template)) {
+        throw new CliError(`unknown template "${template}" \u2014 use one of: ${TEMPLATES.join(", ")}`);
+      }
+      return runCreate(dir, {
+        template,
+        ...flag(args, "name") ? { name: flag(args, "name") } : {},
+        ...flag(args, "display-name") ? { displayName: flag(args, "display-name") } : {},
+        force: args.flags.has("force")
+      });
+    }
+    case "validate":
+      return runValidate(dir, {
+        json: args.flags.has("json"),
+        ...flag(args, "app-version") ? { appVersion: flag(args, "app-version") } : {}
+      });
+    case "pack":
+      return runPack(dir, {
+        json: args.flags.has("json"),
+        dryRun: args.flags.has("dry-run"),
+        allowSecretFiles: args.flags.has("allow-secret-files"),
+        ...flag(args, "out") ? { out: flag(args, "out") } : {},
+        ...flag(args, "app-version") ? { appVersion: flag(args, "app-version") } : {}
+      });
+    case "dev":
+      return runDev(dir, {
+        ...flag(args, "user-data-dir") ? { userDataDir: flag(args, "user-data-dir") } : {},
+        build: !args.flags.has("no-build"),
+        logs: !args.flags.has("no-logs")
+      });
+    default:
+      throw new CliError(`unknown command "${command}" \u2014 run neurosquad-card --help`);
+  }
+}
+function run() {
+  main(process.argv.slice(2)).then(
+    (code) => {
+      process.exitCode = code;
+    },
+    (error) => {
+      if (error instanceof CliError) {
+        console.error(c.red(`\u2716 ${error.message}`));
+        process.exitCode = error.exitCode;
+      } else {
+        console.error(error);
+        process.exitCode = 1;
+      }
+    }
+  );
+}
+
+// src/cli/bin.ts
+run();