@shield-agent/kya 0.1.41 → 0.1.42

package/dist/receipt/enrich.js

@@ -8,9 +8,7 @@ import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve, sep } from "node:path";
 import { CONNECT_REGISTRY } from "../commands/connect.js";
-import { readFileConfig } from "../config.js";
 import { hostReload, hostRunning, listProcessNames, } from "../host-reload.js";
-import { loadSandboxState } from "../sandbox/runtime.js";
 import { buildShowback, } from "../showback/cost-per-task.js";
 import { MAX_USAGE_FILE_BYTES, parseUsageFilePayload, } from "../showback/usage-file.js";
 const MAX_ORR_REPORT_BYTES = 256 * 1024;
@@ -38,35 +36,46 @@ function confinedFile(file, root) {
         return undefined;
     }
 }
-/** Local identity from .kya/config.json; config.json never holds the API key.
- * Only string fields pass through; baseUrl is inert display text (never a link). */
-export function loadIdentity(cwd) {
+const MAX_CWD_STATE_BYTES = 1024 * 1024;
+/**
+ * Parse a JSON file strictly inside cwd: symlink refusal, realpath jail,
+ * regular-file check, size cap. Returns undefined on any failure.
+ */
+function readConfinedJsonFile(cwd, relPath, maxBytes) {
+    const path = confinedFile(join(cwd, relPath), cwd);
+    if (!path)
+        return undefined;
     try {
-        const raw = readFileConfig(cwd);
-        const out = {};
-        for (const key of ["agentId", "agentName", "host", "baseUrl"]) {
-            const v = raw[key];
-            if (typeof v !== "string" || !v.trim())
-                continue;
-            if (key === "host" && v !== "ide" && v !== "runtime")
-                continue;
-            out[key] = v;
-        }
-        return Object.keys(out).length > 0 ? out : undefined;
+        if (statSync(path).size > maxBytes)
+            return undefined;
+        return JSON.parse(readFileSync(path, "utf8"));
     }
     catch {
         return undefined;
     }
 }
+/** Local identity from .kya/config.json; config.json never holds the API key.
+ * Only string fields pass through; baseUrl is inert display text (never a link). */
+export function loadIdentity(cwd) {
+    const raw = readConfinedJsonFile(cwd, join(".kya", "config.json"), MAX_CWD_STATE_BYTES);
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const source = raw;
+    const out = {};
+    for (const key of ["agentId", "agentName", "host", "baseUrl"]) {
+        const v = source[key];
+        if (typeof v !== "string" || !v.trim())
+            continue;
+        if (key === "host" && v !== "ide" && v !== "runtime")
+            continue;
+        out[key] = v;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
 export function loadSandboxes(cwd, env = process.env) {
     const backend = env.KYA_SANDBOX?.trim().toLowerCase() || undefined;
-    let sandboxes = [];
-    try {
-        sandboxes = loadSandboxState(cwd);
-    }
-    catch {
-        sandboxes = [];
-    }
+    const raw = readConfinedJsonFile(cwd, join(".kya", "sandboxes.json"), MAX_CWD_STATE_BYTES);
+    const sandboxes = Array.isArray(raw) ? raw : [];
     return { backend, sandboxes };
 }
 const ORR_RATINGS = new Set(["green", "amber", "red"]);
@@ -76,67 +85,54 @@ function strOr(v) {
 }
 /** Slim ORR card from <cwd>/orr-report/report.json (default orr --out). */
 export function loadOrrCard(cwd) {
-    const path = confinedFile(join(cwd, "orr-report", "report.json"), cwd);
-    if (!path)
+    const raw = readConfinedJsonFile(cwd, join("orr-report", "report.json"), MAX_ORR_REPORT_BYTES);
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
         return undefined;
-    try {
-        if (statSync(path).size > MAX_ORR_REPORT_BYTES)
-            return undefined;
-        const raw = JSON.parse(readFileSync(path, "utf8"));
-        if (!raw || typeof raw !== "object" || Array.isArray(raw))
-            return undefined;
-        const report = raw;
-        if (typeof report.overall !== "string" ||
-            !ORR_RATINGS.has(report.overall) ||
-            typeof report.disposition !== "string" ||
-            !ORR_DISPOSITIONS.has(report.disposition)) {
-            return undefined;
-        }
-        const counts = { pass: 0, fail: 0, partial: 0, notEvaluated: 0 };
-        if (Array.isArray(report.scorecards)) {
-            for (const card of report.scorecards) {
-                switch (card?.result) {
-                    case "pass":
-                        counts.pass += 1;
-                        break;
-                    case "fail":
-                        counts.fail += 1;
-                        break;
-                    case "partial":
-                        counts.partial += 1;
-                        break;
-                    case "not_evaluated":
-                        counts.notEvaluated += 1;
-                        break;
-                }
+    const report = raw;
+    if (typeof report.overall !== "string" ||
+        !ORR_RATINGS.has(report.overall) ||
+        typeof report.disposition !== "string" ||
+        !ORR_DISPOSITIONS.has(report.disposition)) {
+        return undefined;
+    }
+    const counts = { pass: 0, fail: 0, partial: 0, notEvaluated: 0 };
+    if (Array.isArray(report.scorecards)) {
+        for (const card of report.scorecards) {
+            switch (card?.result) {
+                case "pass":
+                    counts.pass += 1;
+                    break;
+                case "fail":
+                    counts.fail += 1;
+                    break;
+                case "partial":
+                    counts.partial += 1;
+                    break;
+                case "not_evaluated":
+                    counts.notEvaluated += 1;
+                    break;
             }
         }
-        const targetName = report.target && typeof report.target.name === "string"
-            ? report.target.name.slice(0, MAX_ORR_TEXT_CHARS)
-            : undefined;
-        return {
-            overall: report.overall,
-            disposition: report.disposition,
-            primaryFailureMode: strOr(report.primary_failure_mode).slice(0, MAX_ORR_TEXT_CHARS),
-            mostUrgentFix: strOr(report.most_urgent_fix).slice(0, MAX_ORR_TEXT_CHARS),
-            generatedAt: strOr(report.generated_at),
-            targetName,
-            scorecards: counts,
-        };
-    }
-    catch {
-        return undefined;
     }
+    const targetName = report.target && typeof report.target.name === "string"
+        ? report.target.name.slice(0, MAX_ORR_TEXT_CHARS)
+        : undefined;
+    return {
+        overall: report.overall,
+        disposition: report.disposition,
+        primaryFailureMode: strOr(report.primary_failure_mode).slice(0, MAX_ORR_TEXT_CHARS),
+        mostUrgentFix: strOr(report.most_urgent_fix).slice(0, MAX_ORR_TEXT_CHARS),
+        generatedAt: strOr(report.generated_at),
+        targetName,
+        scorecards: counts,
+    };
 }
 /** Observe-only showback from .kya/usage.json inside cwd. */
 export function loadShowbackCard(cwd) {
-    const path = confinedFile(join(cwd, ".kya", "usage.json"), cwd);
-    if (!path)
+    const raw = readConfinedJsonFile(cwd, join(".kya", "usage.json"), MAX_USAGE_FILE_BYTES);
+    if (raw === undefined)
         return undefined;
     try {
-        if (statSync(path).size > MAX_USAGE_FILE_BYTES)
-            return undefined;
-        const raw = JSON.parse(readFileSync(path, "utf8"));
         const records = parseUsageFilePayload(raw);
         if (records.length === 0)
             return undefined;
@@ -148,7 +144,11 @@ export function loadShowbackCard(cwd) {
 }
 function hasWiredEntry(path, rootKey) {
     try {
-        if (statSync(path).size > MAX_HOST_CONFIG_BYTES)
+        // statSync follows symlinks on purpose (dotfile setups symlink host
+        // configs) — but only regular files are ever read: FIFOs, devices and
+        // sockets would block or stream forever.
+        const st = statSync(path);
+        if (!st.isFile() || st.size > MAX_HOST_CONFIG_BYTES)
             return false;
         const raw = JSON.parse(readFileSync(path, "utf8"));
         if (!raw || typeof raw !== "object" || Array.isArray(raw))

package/dist/receipt/enrich.js.map

@@ -1 +1 @@
-{"version":3,"file":"enrich.js","sourceRoot":"","sources":["../../src/receipt/enrich.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAsB,MAAM,cAAc,CAAC;AAClE,OAAO,EACL,UAAU,EACV,WAAW,EACX,gBAAgB,GAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EACL,aAAa,GAEd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,CAAC;AACxC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IAC7C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;oFACoF;AACpF,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAA4B,CAAC;QAC3D,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAU,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;gBAAE,SAAS;YACjD,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,SAAS;gBAAE,SAAS;YAC/D,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;IACnE,IAAI,SAAS,GAAoB,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAmBD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAEzE,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IACvE,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,oBAAoB;YAAE,OAAO,SAAS,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;QAC9D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5E,MAAM,MAAM,GAAG,GAAyB,CAAC;QACzC,IACE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAClC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;YAChC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EACzC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACrC,QAAS,IAAoC,EAAE,MAAM,EAAE,CAAC;oBACtD,KAAK,MAAM;wBACT,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;wBACjB,MAAM;oBACR,KAAK,MAAM;wBACT,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;wBACjB,MAAM;oBACR,KAAK,SAAS;wBACZ,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;wBACpB,MAAM;oBACR,KAAK,eAAe;wBAClB,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;wBACzB,MAAM;gBACV,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;YACrD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;YACjD,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;YACnF,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;YACzE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;YACvC,UAAU;YACV,UAAU,EAAE,MAAM;SACnB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,oBAAoB;YAAE,OAAO,SAAS,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;QAC9D,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAcD,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe;IAClD,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,qBAAqB;YAAE,OAAO,KAAK,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;QAC9D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,MAAM,OAAO,GAAI,GAA+B,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,OAAO,CAAE,OAAmC,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,OAAe,OAAO,EAAE,EACxB,KAA2B;IAE3B,MAAM,OAAO,GAAG,KAAK,IAAI,gBAAgB,EAAE,CAAC;IAC5C,OAAO,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAgB,EAAE;QACvE,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAChE,uEAAuE;QACvE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO;gBACL,EAAE;gBACF,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,MAAM;gBACb,MAAM;gBACN,OAAO,EAAE,SAAS;gBAClB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU;YACjC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC;YACpD,CAAC,CAAC,KAAK,CAAC;QACV,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW;YACnC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC;YACpD,CAAC,CAAC,KAAK,CAAC;QACV,MAAM,KAAK,GACT,WAAW,IAAI,YAAY;YACzB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,WAAW;gBACX,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,YAAY;oBACZ,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,MAAM,CAAC;QACjB,OAAO;YACL,EAAE;YACF,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK;YACL,MAAM;YACN,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"enrich.js","sourceRoot":"","sources":["../../src/receipt/enrich.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,OAAO,EACL,UAAU,EACV,WAAW,EACX,gBAAgB,GAEjB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,aAAa,GAEd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,CAAC;AACxC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IAC7C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,GAAW,EACX,OAAe,EACf,QAAgB;IAEhB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,QAAQ;YAAE,OAAO,SAAS,CAAC;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;oFACoF;AACpF,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACxF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAU,EAAE,CAAC;QACvE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,SAAS;QACjD,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC/D,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAQD,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;IACnE,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAoB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAmBD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAEzE,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,GAAG,GAAG,oBAAoB,CAC9B,GAAG,EACH,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,EACjC,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,GAAyB,CAAC;IACzC,IACE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;QAChC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EACzC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACrC,QAAS,IAAoC,EAAE,MAAM,EAAE,CAAC;gBACtD,KAAK,MAAM;oBACT,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;oBACjB,MAAM;gBACR,KAAK,MAAM;oBACT,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;oBACjB,MAAM;gBACR,KAAK,SAAS;oBACZ,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;oBACpB,MAAM;gBACR,KAAK,eAAe;oBAClB,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;oBACzB,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;QACrD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;QACjD,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;QACnF,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;QACzE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QACvC,UAAU;QACV,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACxF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAcD,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe;IAClD,IAAI,CAAC;QACH,oEAAoE;QACpE,sEAAsE;QACtE,yCAAyC;QACzC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,qBAAqB;YAAE,OAAO,KAAK,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;QAC9D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,MAAM,OAAO,GAAI,GAA+B,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,OAAO,CAAE,OAAmC,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,OAAe,OAAO,EAAE,EACxB,KAA2B;IAE3B,MAAM,OAAO,GAAG,KAAK,IAAI,gBAAgB,EAAE,CAAC;IAC5C,OAAO,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAgB,EAAE;QACvE,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAChE,uEAAuE;QACvE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO;gBACL,EAAE;gBACF,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,MAAM;gBACb,MAAM;gBACN,OAAO,EAAE,SAAS;gBAClB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU;YACjC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC;YACpD,CAAC,CAAC,KAAK,CAAC;QACV,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW;YACnC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC;YACpD,CAAC,CAAC,KAAK,CAAC;QACV,MAAM,KAAK,GACT,WAAW,IAAI,YAAY;YACzB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,WAAW;gBACX,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,YAAY;oBACZ,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,MAAM,CAAC;QACjB,OAAO;YACL,EAAE;YACF,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK;YACL,MAAM;YACN,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/receipt/live-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-server.d.ts","sourceRoot":"","sources":["../../src/receipt/live-server.ts"],"names":[],"mappings":"AAQA,OAAO,EAAa,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAO9D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAmBD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAyK5B"}
+{"version":3,"file":"live-server.d.ts","sourceRoot":"","sources":["../../src/receipt/live-server.ts"],"names":[],"mappings":"AAQA,OAAO,EAAa,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAO9D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAmBD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CA8K5B"}

package/dist/receipt/live-server.js

@@ -63,6 +63,13 @@ export function startLiveReceiptServer(options) {
             if (!tokenOk(url, req, token)) {
                 return unauthorized(res);
             }
+            if (req.method === "GET" && url.pathname === "/healthz") {
+                // Cheap liveness handshake for daemon reuse — never renders, so a
+                // render-time failure (e.g. assertNoSecrets) cannot wedge it.
+                res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
+                res.end("ok\n");
+                return;
+            }
             if (req.method === "GET" && url.pathname === "/events") {
                 if (clients.size >= MAX_SSE_CLIENTS) {
                     res.writeHead(503, { "Content-Type": "text/plain; charset=utf-8" });
@@ -90,6 +97,9 @@ export function startLiveReceiptServer(options) {
                         sessionId: options.sessionId,
                         days: options.days,
                         live: true,
+                        // Token rides the model into the script tag — never a post-hoc
+                        // string replace on rendered HTML (attacker text could anchor it).
+                        liveToken: token,
                     }));
                 }
                 catch {
@@ -97,8 +107,6 @@ export function startLiveReceiptServer(options) {
                     res.end("receipt render failed\n");
                     return;
                 }
-                // Inject token into EventSource so the browser can auth without a second prompt.
-                html = html.replace("EventSource('/events')", `EventSource('/events?t=${token}')`);
                 res.writeHead(200, {
                     "Content-Type": "text/html; charset=utf-8",
                     "Cache-Control": "no-store",

package/dist/receipt/live-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"live-server.js","sourceRoot":"","sources":["../../src/receipt/live-server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAkB,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAoC,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAuB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,QAAQ,GAAG,WAAW,CAAC;AAC7B,MAAM,eAAe,GAAG,CAAC,CAAC;AAkB1B,SAAS,UAAU,CAAC,OAA4B,EAAE,GAAmB;IACnE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,MAAW,EAAE,GAA4C,EAAE,KAAa;IACvF,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC7C,IAAI,IAAI,KAAK,UAAU,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAA2B;IAE3B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;IAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,IAAI,OAA8B,CAAC;IACnC,IAAI,QAAmD,CAAC;IACxD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,QAAkC,CAAC;IAEvC,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,GAAS,EAAE;QACnC,IAAI,QAAQ;YAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,GAAmB,EAAQ,EAAE;QACjD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACvD,IAAI,OAAO,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;oBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;oBACpE,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;oBACnC,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,kCAAkC;oBAClD,eAAe,EAAE,wBAAwB;oBACzC,UAAU,EAAE,YAAY;iBACzB,CAAC,CAAC;gBACH,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACjB,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBACnD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACvB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACvB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC,EAAE,CAAC;gBACrF,IAAI,IAAY,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,GAAG,iBAAiB,CACtB,gBAAgB,CAAC;wBACf,GAAG;wBACH,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,IAAI,EAAE,IAAI;qBACX,CAAC,CACH,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;oBACpE,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;oBACnC,OAAO;gBACT,CAAC;gBACD,iFAAiF;gBACjF,IAAI,GAAG,IAAI,CAAC,OAAO,CACjB,wBAAwB,EACxB,0BAA0B,KAAK,IAAI,CACpC,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,0BAA0B;oBAC1C,eAAe,EAAE,UAAU;iBAC5B,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,GAAkB,EAAE,CACnC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,QAAQ;YAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC5C,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;YAClC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,KAAK,GAAI,MAAwD;aACpE,mBAAmB,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEL,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE;YAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,UAAU,QAAQ,IAAI,IAAI,OAAO,KAAK,EAAE,CAAC;YAErD,IAAI,CAAC;gBACH,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/C,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;oBACxE,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;wBAC1D,iBAAiB,EAAE,CAAC;oBACtB,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACvB,oDAAoD;gBACtD,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;YAED,MAAM,eAAe,GAAG,IAAI,OAAO,CAAO,CAAC,WAAW,EAAE,EAAE;gBACxD,QAAQ,GAAG,GAAS,EAAE;oBACpB,KAAK,QAAQ,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACpC,CAAC,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC;gBACN,GAAG;gBACH,IAAI;gBACJ,KAAK;gBACL,eAAe;gBACf,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"live-server.js","sourceRoot":"","sources":["../../src/receipt/live-server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAkB,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAoC,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAuB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,QAAQ,GAAG,WAAW,CAAC;AAC7B,MAAM,eAAe,GAAG,CAAC,CAAC;AAkB1B,SAAS,UAAU,CAAC,OAA4B,EAAE,GAAmB;IACnE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,MAAW,EAAE,GAA4C,EAAE,KAAa;IACvF,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC7C,IAAI,IAAI,KAAK,UAAU,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAA2B;IAE3B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;IAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,IAAI,OAA8B,CAAC;IACnC,IAAI,QAAmD,CAAC;IACxD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,QAAkC,CAAC;IAEvC,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,GAAS,EAAE;QACnC,IAAI,QAAQ;YAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,GAAmB,EAAQ,EAAE;QACjD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACxD,kEAAkE;gBAClE,8DAA8D;gBAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACvD,IAAI,OAAO,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;oBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;oBACpE,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;oBACnC,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,kCAAkC;oBAClD,eAAe,EAAE,wBAAwB;oBACzC,UAAU,EAAE,YAAY;iBACzB,CAAC,CAAC;gBACH,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACjB,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBACnD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACvB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACvB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC,EAAE,CAAC;gBACrF,IAAI,IAAY,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,GAAG,iBAAiB,CACtB,gBAAgB,CAAC;wBACf,GAAG;wBACH,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,IAAI,EAAE,IAAI;wBACV,+DAA+D;wBAC/D,mEAAmE;wBACnE,SAAS,EAAE,KAAK;qBACjB,CAAC,CACH,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;oBACpE,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;oBACnC,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,0BAA0B;oBAC1C,eAAe,EAAE,UAAU;iBAC5B,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,GAAkB,EAAE,CACnC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,QAAQ;YAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC5C,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;YAClC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,KAAK,GAAI,MAAwD;aACpE,mBAAmB,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEL,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE;YAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,UAAU,QAAQ,IAAI,IAAI,OAAO,KAAK,EAAE,CAAC;YAErD,IAAI,CAAC;gBACH,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/C,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;oBACxE,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;wBAC1D,iBAAiB,EAAE,CAAC;oBACtB,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACvB,oDAAoD;gBACtD,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;YAED,MAAM,eAAe,GAAG,IAAI,OAAO,CAAO,CAAC,WAAW,EAAE,EAAE;gBACxD,QAAQ,GAAG,GAAS,EAAE;oBACpB,KAAK,QAAQ,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACpC,CAAC,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC;gBACN,GAAG;gBACH,IAAI;gBACJ,KAAK;gBACL,eAAe;gBACf,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/receipt/render-receipt.d.ts

@@ -17,6 +17,8 @@ export interface ReceiptModel {
     }[];
     /** When true, page connects to /events SSE for live refresh. */
     readonly live?: boolean;
+    /** Loopback SSE token — set only by the live server, never in static renders. */
+    readonly liveToken?: string;
     /** Local identity from .kya/config.json (inert text; never a link). */
     readonly identity?: KyaFileConfig;
     /** Sandbox state + configured KYA_SANDBOX backend. */
@@ -70,6 +72,7 @@ export declare function loadReceiptModel(input: {
     readonly sessionId?: string;
     readonly days: number;
     readonly live?: boolean;
+    readonly liveToken?: string;
 }): ReceiptModel;
 export declare function renderReceiptHtml(model: ReceiptModel): string;
 export declare function renderReceiptMarkdown(model: ReceiptModel): string;

package/dist/receipt/render-receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-receipt.d.ts","sourceRoot":"","sources":["../../src/receipt/render-receipt.ts"],"names":[],"mappings":"AAKA,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAML,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACpF,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C,iDAAiD;IACjD,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACpC;AAyED,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9F,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC/C,mCAAmC;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;CACxC;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,eAAe,CA2D9E;AAED,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,YAAY,CAAC,CAAC,GACtF,YAAY,CAgBd;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,YAAY,CAAC,CAAC,GACtF,YAAY,CAgBd;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,YAAY,CAsBf;AAsOD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAgY7D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CA8IjE"}
+{"version":3,"file":"render-receipt.d.ts","sourceRoot":"","sources":["../../src/receipt/render-receipt.ts"],"names":[],"mappings":"AAKA,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAML,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACpF,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C,iDAAiD;IACjD,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACpC;AAsGD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9F,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC/C,mCAAmC;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;CACxC;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,eAAe,CA2D9E;AAED,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,YAAY,CAAC,CAAC,GACtF,YAAY,CAiBd;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,YAAY,CAAC,CAAC,GACtF,YAAY,CAiBd;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,YAAY,CAuBf;AAsOD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAmY7D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAmJjE"}

package/dist/receipt/render-receipt.js

@@ -1,18 +1,44 @@
 /**
  * Activity feed HTML/MD for local trail events.
  */
-import { assertNoSecrets, clip } from "../dash/render.js";
+import { assertNoSecrets, clip, stripEscapes } from "../dash/render.js";
 import { clipMultiline, DIFF_MAX_TOTAL_CHARS } from "../diff-preview.js";
 import { productLabel, readTrail, readTrailSince } from "../trail.js";
 import { loadIdentity, loadOrrCard, loadSandboxes, loadShowbackCard, loadWiredHosts, } from "./enrich.js";
 import { SHOWBACK_DISCLAIMER, } from "../showback/cost-per-task.js";
 function esc(s) {
-    return s
+    return stripEscapes(s)
         .replace(/&/g, "&")
         .replace(/</g, "&lt;")
         .replace(/>/g, "&gt;")
         .replace(/"/g, "&quot;");
 }
+/**
+ * Sanitize untrusted text for the Markdown artifact: strip ANSI/control and
+ * bidi/zero-width chars (stripEscapes), then escape the MD/HTML-significant
+ * characters so values cannot break formatting or inject raw HTML/links.
+ */
+function mdText(s) {
+    return stripEscapes(s)
+        .replace(/`/g, "\\`")
+        .replace(/([[\]<>])/g, "\\$1");
+}
+/** Fence one tilde longer than the longest run in content (min 4). */
+function mdFence(content) {
+    let longest = 0;
+    for (const m of content.matchAll(/~+/g)) {
+        longest = Math.max(longest, m[0].length);
+    }
+    return "~".repeat(Math.max(4, longest + 1));
+}
+/**
+ * Sanitize a value for an inline `code span`: backslash-escapes are literal
+ * inside code spans, so backticks are replaced outright (they would still
+ * terminate the span); brackets/angles need no escaping inside a span.
+ */
+function mdInline(s) {
+    return stripEscapes(s).replace(/`/g, "'");
+}
 function countVerdicts(events) {
     let allow = 0;
     let deny = 0;
@@ -157,6 +183,7 @@ export function buildReceiptModel(sessionId, events, extras) {
         spend: extras?.spend,
         mcpSeen: extras?.mcpSeen,
         live: extras?.live,
+        liveToken: extras?.liveToken,
         identity: extras?.identity,
         sandboxes: extras?.sandboxes,
         wiredHosts: extras?.wiredHosts,
@@ -174,6 +201,7 @@ export function buildWindowReceiptModel(events, days, extras) {
         spend: extras?.spend,
         mcpSeen: extras?.mcpSeen,
         live: extras?.live,
+        liveToken: extras?.liveToken,
         identity: extras?.identity,
         sandboxes: extras?.sandboxes,
         wiredHosts: extras?.wiredHosts,
@@ -187,6 +215,7 @@ export function loadReceiptModel(input) {
     const showback = loadShowbackCard(input.cwd);
     const extras = {
         live: input.live,
+        liveToken: input.liveToken,
         identity: loadIdentity(input.cwd),
         sandboxes: loadSandboxes(input.cwd),
         wiredHosts: loadWiredHosts(input.cwd),
@@ -445,11 +474,14 @@ export function renderReceiptHtml(model) {
   <span class="label">Tools</span>
   ${tools.map((t) => `<code>${esc(t)}</code>`).join("")}
 </footer>`;
+    // liveToken is minted base64url by the live server — safe in a JS string
+    // literal; static renders omit it. No post-hoc html.replace (spoofable).
+    const eventsUrl = model.liveToken ? `/events?t=${model.liveToken}` : "/events";
     const liveScript = model.live
         ? `<script>
 (function(){
   var pill = document.querySelector('.live');
-  var es = new EventSource('/events');
+  var es = new EventSource('${eventsUrl}');
   es.onmessage = function(){ location.reload(); };
   es.onerror = function(){
     if (pill) { pill.textContent = 'Offline'; pill.classList.add('off'); }
@@ -796,9 +828,9 @@ export function renderReceiptMarkdown(model) {
     const agg = aggregateEvents(model.events);
     const nowMs = Date.now();
     const lines = [
-        `# ${model.title}`,
+        `# ${mdText(model.title)}`,
         "",
-        model.rangeLabel,
+        mdText(model.rangeLabel),
         "",
         `Allow ${c.allow} | Deny ${c.deny} | Hold ${c.require} | Never ${c.never}`,
         "",
@@ -810,7 +842,7 @@ export function renderReceiptMarkdown(model) {
             : (id.agentName ?? id.agentId);
         const bits = [nameId, id.host, id.baseUrl].filter((b) => typeof b === "string" && b.trim().length > 0);
         if (bits.length > 0) {
-            lines.push(bits.join(" · "), "");
+            lines.push(mdText(bits.join(" · ")), "");
         }
     }
     const modeBits = [
@@ -826,36 +858,41 @@ export function renderReceiptMarkdown(model) {
         lines.push(`Modes: ${modeBits.join(" | ") || "-"} · Planes: ${planeBits.join(" | ") || "-"}`, "");
     }
     if (agg.products.length >= 2) {
-        lines.push("## Products", ...agg.products.map((p) => `- ${p.label} × ${p.count}`), "");
+        lines.push("## Products", ...agg.products.map((p) => `- ${mdText(p.label)} × ${p.count}`), "");
     }
     lines.push("## Feed", ...[...model.events]
         .sort((a, b) => b.ts.localeCompare(a.ts))
         .flatMap((e) => {
-        const sum = e.summary?.trim() ? ` - ${e.summary.trim()}` : "";
-        const head = `- **${verdictWord(e.verdict)}** \`${e.toolId}\`${sum} - ${productLabel(e.product)} - ${e.reasonCode}`;
+        const sum = e.summary?.trim() ? ` - ${mdText(e.summary.trim())}` : "";
+        const head = `- **${mdText(verdictWord(e.verdict))}** \`${mdInline(e.toolId)}\`${sum} - ${productLabel(e.product)} - ${mdText(e.reasonCode)}`;
         if (!e.diffPreview?.trim())
             return [head];
-        return [head, "", "```", e.diffPreview.trim(), "```", ""];
+        // Fenced content is verbatim (stripEscapes only — backslash escapes
+        // are literal in code fences); the dynamically sized tilde fence
+        // prevents breakout and backticks cannot close a tilde fence.
+        const diff = stripEscapes(e.diffPreview.trim());
+        const fence = mdFence(diff);
+        return [head, "", fence, diff, fence, ""];
     }), "");
     if (agg.sessions.length > 0) {
-        lines.push("## Sessions", ...agg.sessions.map((s) => `- \`${s.sessionId}\` — ${s.events} event${s.events === 1 ? "" : "s"}, worst: ${s.worst}, last ${relativeTime(s.lastTs, nowMs)}`), "");
+        lines.push("## Sessions", ...agg.sessions.map((s) => `- \`${mdInline(s.sessionId)}\` — ${s.events} event${s.events === 1 ? "" : "s"}, worst: ${s.worst}, last ${relativeTime(s.lastTs, nowMs)}`), "");
     }
     if (agg.reasons.length > 0) {
-        lines.push("## Reasons", ...agg.reasons.map((r) => `- ${r.label} × ${r.count}`), "");
+        lines.push("## Reasons", ...agg.reasons.map((r) => `- ${mdText(r.label)} × ${r.count}`), "");
     }
     const hosts = model.wiredHosts ?? [];
     if (hosts.some((h) => h.wired !== "none")) {
         lines.push("## Wired hosts");
         for (const h of hosts) {
             if (h.recipeOnly) {
-                lines.push(`- ${h.label} — manual setup (docs recipe)`);
+                lines.push(`- ${mdText(h.label)} — manual setup (docs recipe)`);
             }
             else if (h.wired === "none") {
-                lines.push(`- ${h.label} — not wired`);
+                lines.push(`- ${mdText(h.label)} — not wired`);
             }
             else {
-                const reload = h.reload ? ` · ${h.reload.reload}` : "";
-                lines.push(`- ${h.label} — wired (${h.wired})${reload} · ${h.running ? "running" : "not running"}`);
+                const reload = h.reload ? ` · ${mdText(h.reload.reload)}` : "";
+                lines.push(`- ${mdText(h.label)} — wired (${h.wired})${reload} · ${h.running ? "running" : "not running"}`);
             }
         }
         lines.push("");
@@ -864,19 +901,19 @@ export function renderReceiptMarkdown(model) {
         const sb = model.sandboxes;
         lines.push("## Sandboxes");
         if (sb.backend)
-            lines.push(`Configured backend: ${sb.backend}`);
+            lines.push(`Configured backend: ${mdText(sb.backend)}`);
         for (const s of sb.sandboxes) {
-            lines.push(`- \`${s.sandboxId}\` — ${s.backend} · ${s.status} · created ${relativeTime(s.createdAt, nowMs)}`);
+            lines.push(`- \`${mdInline(s.sandboxId)}\` — ${mdText(s.backend)} · ${mdText(s.status)} · created ${relativeTime(s.createdAt, nowMs)}`);
         }
         lines.push("");
     }
     if (model.orr) {
         const orr = model.orr;
-        lines.push("## Operational readiness", `overall: ${orr.overall} · disposition: ${orr.disposition.replace(/_/g, " ")}${orr.targetName ? ` · target ${orr.targetName}` : ""}`);
+        lines.push("## Operational readiness", `overall: ${orr.overall} · disposition: ${orr.disposition.replace(/_/g, " ")}${orr.targetName ? ` · target ${mdText(orr.targetName)}` : ""}`);
         if (orr.primaryFailureMode)
-            lines.push(`Primary failure mode: ${orr.primaryFailureMode}`);
+            lines.push(`Primary failure mode: ${mdText(orr.primaryFailureMode)}`);
         if (orr.mostUrgentFix)
-            lines.push(`Most urgent fix: ${orr.mostUrgentFix}`);
+            lines.push(`Most urgent fix: ${mdText(orr.mostUrgentFix)}`);
         lines.push(`scorecards: ${orr.scorecards.pass} pass · ${orr.scorecards.fail} fail · ${orr.scorecards.partial} partial · ${orr.scorecards.notEvaluated} n/e${orr.generatedAt ? ` · ${relativeTime(orr.generatedAt, nowMs)}` : ""}`, "");
     }
     if (model.showback) {
@@ -886,7 +923,7 @@ export function renderReceiptMarkdown(model) {
             .sort((a, b) => (b.estimatedUsd ?? -1) - (a.estimatedUsd ?? -1))
             .slice(0, 5);
         for (const r of topRuns) {
-            lines.push(`- \`${r.runId}\` — ${r.steps} step${r.steps === 1 ? "" : "s"} · ${usdText(r.estimatedUsd)}`);
+            lines.push(`- \`${mdInline(r.runId)}\` — ${r.steps} step${r.steps === 1 ? "" : "s"} · ${usdText(r.estimatedUsd)}`);
         }
         lines.push(SHOWBACK_DISCLAIMER, "");
     }