@shield-agent/kya 0.28.0 → 0.30.0

package/dist/receipt/openshell-card.js

@@ -0,0 +1,219 @@
+/**
+ * OpenShell card for the live Agent-activity report (NVIDIA OpenShell,
+ * github.com/NVIDIA/OpenShell). One dedicated panel aggregating the three
+ * places OpenShell shows up today: imported openshell trail events
+ * (reasonCode OPENSHELL_POLICY, toolId openshell.network / openshell.http),
+ * openshell-backend sandbox rows in .kya/sandboxes.json, and the locally
+ * detected openshell CLI / openshell-prover binaries.
+ *
+ * Fail-safe like every enrich loader: the pure rollup never throws, every
+ * runtime probe degrades to a "not detected" row on a missing binary, a
+ * failing --version, or a missing file, and the loader returns undefined
+ * (panel omitted entirely) when no OpenShell signal exists at all - fresh
+ * installs must not see the panel. The SAFE-06 certify outcome is reused
+ * from the already-computed certify card, never recomputed here.
+ */
+import { execFileSync } from "node:child_process";
+import { accessSync, constants, existsSync } from "node:fs";
+import { basename, join } from "node:path";
+import { OPENSHELL_MIN_VERSION } from "../sandbox/openshell-driver.js";
+import { openshellPolicyPath } from "../sandbox/openshell-policy.js";
+import { resolveOpenshellProver } from "../certify/openshell-prover.js";
+import { loadSandboxState } from "../sandbox/runtime.js";
+const OPENSHELL_TOOLS = new Set(["openshell.network", "openshell.http"]);
+const MAX_DST_LEN = 80;
+const TOP_DESTINATIONS = 5;
+/** One report panel signal: an openshell tool or the OPENSHELL_POLICY reason. */
+export function isOpenshellEvent(e) {
+    return OPENSHELL_TOOLS.has(e.toolId) || e.reasonCode === "OPENSHELL_POLICY";
+}
+/**
+ * The importer writes a redacted `dst: host:port` rendering into the event
+ * summary; parse it defensively - summaries are user-editable trail data.
+ */
+function destinationFromSummary(summary) {
+    if (!summary)
+        return undefined;
+    const dst = /(?:^|\s)dst:\s*(\S+)/i.exec(summary.trim())?.[1]?.trim();
+    if (!dst)
+        return undefined;
+    return dst.length <= MAX_DST_LEN ? dst : dst.slice(0, MAX_DST_LEN);
+}
+/** Pure rollup of openshell events for the panel's Policy activity card. */
+export function aggregateOpenshellEvents(events) {
+    let total = 0;
+    let deny = 0;
+    let allow = 0;
+    let network = 0;
+    let http = 0;
+    let lastTs = "";
+    const dstCounts = new Map();
+    for (const e of events) {
+        if (!isOpenshellEvent(e))
+            continue;
+        total++;
+        const v = e.verdict.toUpperCase();
+        if (v === "DENY")
+            deny++;
+        else if (v === "ALLOW")
+            allow++;
+        if (e.toolId === "openshell.http")
+            http++;
+        else
+            network++;
+        if (e.ts > lastTs)
+            lastTs = e.ts;
+        const dst = destinationFromSummary(e.summary);
+        if (dst)
+            dstCounts.set(dst, (dstCounts.get(dst) ?? 0) + 1);
+    }
+    if (total === 0)
+        return undefined;
+    const topDestinations = [...dstCounts.entries()]
+        .map(([dst, count]) => ({ dst, count }))
+        .sort((a, b) => b.count - a.count || a.dst.localeCompare(b.dst))
+        .slice(0, TOP_DESTINATIONS);
+    return { total, deny, allow, network, http, topDestinations, lastTs };
+}
+function executable(path) {
+    try {
+        accessSync(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Locate the openshell CLI the way the sandbox driver does: KYA_SANDBOX_OPENSHELL
+ * (absolute path, basename openshell) wins, else PATH. Never throws: a malformed
+ * env override or a missing binary yields undefined ("not detected").
+ */
+function resolveOpenshellCli(env) {
+    const fromEnv = env.KYA_SANDBOX_OPENSHELL?.trim();
+    if (fromEnv) {
+        if (!fromEnv.startsWith("/") || basename(fromEnv) !== "openshell")
+            return undefined;
+        return executable(fromEnv) ? fromEnv : undefined;
+    }
+    for (const dir of (env.PATH ?? "").split(":")) {
+        if (!dir || dir === "." || dir.startsWith("."))
+            continue;
+        const candidate = join(dir, "openshell");
+        if (!candidate.startsWith("/"))
+            continue;
+        if (executable(candidate))
+            return candidate;
+    }
+    return undefined;
+}
+/** One --version probe per resolved binary per process, never per refresh. */
+const versionCache = new Map();
+/** Test hook: drop cached `openshell --version` results. */
+export function openshellCardResetForTests() {
+    versionCache.clear();
+}
+function probeOpenshellVersion(bin, env) {
+    if (versionCache.has(bin))
+        return versionCache.get(bin);
+    let version;
+    try {
+        const out = execFileSync(bin, ["--version"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            env: { ...env, OPENSHELL_TELEMETRY_ENABLED: "false" },
+            timeout: 10_000,
+        }).trim();
+        version = /(\d+\.\d+\.\d+)/.exec(out)?.[1] ?? out.split("\n")[0]?.trim() ?? undefined;
+        if (!version)
+            version = undefined;
+    }
+    catch {
+        version = undefined;
+    }
+    versionCache.set(bin, version);
+    return version;
+}
+function containerRuntimeOnPath(env) {
+    for (const dir of (env.PATH ?? "").split(":")) {
+        if (!dir || dir === "." || dir.startsWith("."))
+            continue;
+        for (const rt of ["docker", "podman"]) {
+            const candidate = join(dir, rt);
+            if (candidate.startsWith("/") && executable(candidate))
+                return rt;
+        }
+    }
+    return undefined;
+}
+function openshellSandboxRows(cwd) {
+    let rows;
+    try {
+        rows = loadSandboxState(cwd);
+    }
+    catch {
+        return [];
+    }
+    return rows
+        .filter((r) => r.backend === "openshell")
+        .map((r) => {
+        let policyFile = false;
+        try {
+            policyFile = existsSync(openshellPolicyPath(cwd, r.sandboxId));
+        }
+        catch {
+            policyFile = false;
+        }
+        return {
+            sandboxId: r.sandboxId,
+            status: r.status,
+            createdAt: r.createdAt,
+            externalName: r.externalName,
+            policyFile,
+        };
+    });
+}
+/**
+ * An all-empty card: no activity, no sandboxes, every runtime probe negative.
+ * Used by the renderer when the model carries no card (static artifacts) so the
+ * panel can still render its self-service empty state.
+ */
+export function emptyOpenshellCard() {
+    return {
+        activity: undefined,
+        sandboxes: [],
+        runtime: {
+            cliFound: false,
+            cliVersion: undefined,
+            containerRuntime: undefined,
+            minVersion: OPENSHELL_MIN_VERSION,
+            proverFound: false,
+            safe06: undefined,
+        },
+    };
+}
+/**
+ * Build the OpenShell card. Always returns a card, even when nothing
+ * OpenShell-related exists yet (no trail events, no openshell sandboxes, no
+ * openshell CLI or prover on PATH): the report renders the panel with empty
+ * states so OpenShell support stays discoverable from the dashboard itself.
+ * See docs/report-design.md (the dashboard is self-explanatory at all times).
+ * Every probe is defensive and never throws.
+ */
+export function loadOpenshellCard(input) {
+    const env = input.env ?? process.env;
+    const activity = aggregateOpenshellEvents(input.events);
+    const sandboxes = openshellSandboxRows(input.cwd);
+    const cli = resolveOpenshellCli(env);
+    const safe06Row = input.certify?.requirements.find((r) => r.id === "SAFE-06");
+    const runtime = {
+        cliFound: cli !== undefined,
+        cliVersion: cli ? probeOpenshellVersion(cli, env) : undefined,
+        containerRuntime: containerRuntimeOnPath(env),
+        minVersion: OPENSHELL_MIN_VERSION,
+        proverFound: resolveOpenshellProver(env) !== undefined,
+        safe06: safe06Row ? { status: safe06Row.status, evidence: safe06Row.evidence } : undefined,
+    };
+    return { activity, sandboxes, runtime };
+}
+//# sourceMappingURL=openshell-card.js.map

package/dist/receipt/openshell-card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openshell-card.js","sourceRoot":"","sources":["../../src/receipt/openshell-card.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGzD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACzE,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,gBAAgB,GAAG,CAAC,CAAC;AA0D3B,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,CAAa;IAC5C,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,kBAAkB,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,OAA2B;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACtE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,GAAG,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AACrE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,wBAAwB,CACtC,MAA6B;IAE7B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAAE,SAAS;QACnC,KAAK,EAAE,CAAC;QACR,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,MAAM;YAAE,IAAI,EAAE,CAAC;aACpB,IAAI,CAAC,KAAK,OAAO;YAAE,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,MAAM,KAAK,gBAAgB;YAAE,IAAI,EAAE,CAAC;;YACrC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,EAAE,GAAG,MAAM;YAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,sBAAsB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,GAAG;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,eAAe,GAA8B,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;SACxE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;SACvC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;SAC/D,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAsB;IACjD,MAAM,OAAO,GAAG,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC;QACpF,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACzC,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;AAE3D,4DAA4D;AAC5D,MAAM,UAAU,0BAA0B;IACxC,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,GAAsB;IAChE,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE;YAC3C,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,2BAA2B,EAAE,OAAO,EAAE;YACrD,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QACtF,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,SAAS,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IACD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAsB;IACpD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACzD,KAAK,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,IAAI;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC;SACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,UAAU,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;QACD,OAAO;YACL,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,UAAU;SACX,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAmBD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,SAAS,EAAE,EAAE;QACb,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,SAAS;YACrB,gBAAgB,EAAE,SAAS;YAC3B,UAAU,EAAE,qBAAqB;YACjC,WAAW,EAAE,KAAK;YAClB,MAAM,EAAE,SAAS;SAClB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAqB;QAChC,QAAQ,EAAE,GAAG,KAAK,SAAS;QAC3B,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7D,gBAAgB,EAAE,sBAAsB,CAAC,GAAG,CAAC;QAC7C,UAAU,EAAE,qBAAqB;QACjC,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,KAAK,SAAS;QACtD,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;KAC3F,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC"}

package/dist/receipt/render-receipt.d.ts

@@ -6,6 +6,7 @@ import { type OtelStats } from "../otel/stats.js";
 import { type CertifyCard, type DiscoveryCard, type OrrCard, type SandboxCard, type WiredHostRow } from "./enrich.js";
 import { type ShowbackReport } from "../showback/cost-per-task.js";
 import { type GatePage } from "./gate-page.js";
+import { type OpenshellCard } from "./openshell-card.js";
 export declare const PAGE_SIZE = 50;
 export declare function clampPage(page: number, total: number): number;
 export interface ReceiptModel {
@@ -33,6 +34,8 @@ export interface ReceiptModel {
     readonly identity?: KyaFileConfig;
     /** Sandbox state + configured KYA_SANDBOX backend. */
     readonly sandboxes?: SandboxCard;
+    /** OpenShell rollup: trail events, openshell sandboxes, detected CLI/prover. */
+    readonly openshell?: OpenshellCard;
     /** Per-host wiring status across the connect registry. */
     readonly wiredHosts?: readonly WiredHostRow[];
     /** Local gateway state + per-server activity in the window. */

package/dist/receipt/render-receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-receipt.d.ts","sourceRoot":"","sources":["../../src/receipt/render-receipt.ts"],"names":[],"mappings":"AAUA,OAAO,EAA2C,KAAK,UAAU,EAA6C,MAAM,aAAa,CAAC;AAElI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAQL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAItC,OAAO,EAML,KAAK,QAAQ,EACd,MAAM,gBAAgB,CAAC;AAIxB,eAAO,MAAM,SAAS,KAAK,CAAC;AAE5B,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACpF,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB,iDAAiD;IACjD,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAC1C,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IACnC,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;CAC3B;AAsGD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9F,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC/C,mCAAmC;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;CACvC;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,eAAe,CA6E9E;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAWD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,GAAG,SAAS,CAsBtF;AAED,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,YAAY,CAAC,CAAC,GACtF,YAAY,CA0Bd;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,YAAY,CAAC,CAAC,GACtF,YAAY,CA0Bd;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC,GAAG,YAAY,CAsCf;AAynCD,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAqClF;AA4OD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,OAAO,EACb,KAAK,CAAC,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC1C,cAAc,CAAC,EAAE,MAAM,EAAE,GACxB,cAAc,CA+BhB;AA6BD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CA4uB7D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAuUjE"}
+{"version":3,"file":"render-receipt.d.ts","sourceRoot":"","sources":["../../src/receipt/render-receipt.ts"],"names":[],"mappings":"AAUA,OAAO,EAA2C,KAAK,UAAU,EAA6C,MAAM,aAAa,CAAC;AAElI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAQL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAItC,OAAO,EAML,KAAK,QAAQ,EACd,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAyC,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEhG,eAAO,MAAM,SAAS,KAAK,CAAC;AAE5B,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACpF,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC;IACjC,gFAAgF;IAChF,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB,iDAAiD;IACjD,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAC1C,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IACnC,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;CAC3B;AAsGD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9F,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC/C,mCAAmC;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;CACvC;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,eAAe,CA6E9E;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAWD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,GAAG,SAAS,CAsBtF;AAED,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,YAAY,CAAC,CAAC,GACtF,YAAY,CA2Bd;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,YAAY,CAAC,CAAC,GACtF,YAAY,CA2Bd;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC,GAAG,YAAY,CAyCf;AA20CD,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAqClF;AA4OD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,OAAO,EACb,KAAK,CAAC,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC1C,cAAc,CAAC,EAAE,MAAM,EAAE,GACxB,cAAc,CA+BhB;AA6BD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CA8uB7D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAuUjE"}

package/dist/receipt/render-receipt.js

@@ -17,6 +17,7 @@ import { buildChangesModel } from "./changes.js";
 import { GATE_NOT_SETUP_QUICKSTART, loadGatePage, toolNameFromToolId, toolServerPrefix, } from "./gate-page.js";
 import { receiptCss } from "./receipt-css.js";
 import { applyChipFilters, rankEvents } from "./search.js";
+import { emptyOpenshellCard, loadOpenshellCard } from "./openshell-card.js";
 export const PAGE_SIZE = 50;
 export function clampPage(page, total) {
     if (total === 0)
@@ -264,6 +265,7 @@ export function buildReceiptModel(sessionId, events, extras) {
         searchQuery: extras?.searchQuery,
         identity: extras?.identity,
         sandboxes: extras?.sandboxes,
+        openshell: extras?.openshell,
         wiredHosts: extras?.wiredHosts,
         gate: extras?.gate,
         orr: extras?.orr,
@@ -291,6 +293,7 @@ export function buildWindowReceiptModel(events, days, extras) {
         searchQuery: extras?.searchQuery,
         identity: extras?.identity,
         sandboxes: extras?.sandboxes,
+        openshell: extras?.openshell,
         wiredHosts: extras?.wiredHosts,
         gate: extras?.gate,
         orr: extras?.orr,
@@ -313,7 +316,9 @@ export function loadReceiptModel(input) {
         : readTrailSince(input.cwd, new Date(Date.now() - days * 24 * 60 * 60 * 1000), env);
     // The Import card aggregates the full trail, not just the window: imported
     // spans keep their foreign timestamps and would fall out of a short window.
+    // The OpenShell card rolls up the same full-trail view for the same reason.
     const importEvents = input.sessionId ? events : readTrail(input.cwd, env);
+    const certify = loadCertifyCard(input.cwd);
     const extras = {
         page: input.page ?? 1,
         live: input.live,
@@ -321,10 +326,11 @@ export function loadReceiptModel(input) {
         searchQuery: input.searchQuery,
         identity: loadIdentity(input.cwd),
         sandboxes: loadSandboxes(input.cwd),
+        openshell: loadOpenshellCard({ cwd: input.cwd, events: importEvents, env, certify }),
         wiredHosts: loadWiredHosts(input.cwd),
         gate: loadGatePage(events),
         orr: loadOrrCard(input.cwd),
-        certify: loadCertifyCard(input.cwd),
+        certify,
         showback,
         imports: aggregateImports(importEvents),
         discovery: loadDiscoveryCard(env),
@@ -689,6 +695,112 @@ function wiredHostsPanel(hosts) {
   </ul>
 </section>`;
 }
+/**
+ * Always-on Capabilities panel: the index of everything this kya install
+ * supports, each row showing live status (green) or availability (neutral)
+ * plus the exact command or config that turns it on. This is the dashboard
+ * half of the self-service rule in docs/report-design.md: a capability a user
+ * cannot see is a capability that does not exist, so this panel renders even
+ * on a fresh install with zero data anywhere. Status is derived only from
+ * fields already on the model; it never triggers probes or IO of its own.
+ */
+function capabilitiesPanel(model) {
+    const os = model.openshell;
+    const osLive = (os?.activity?.total ?? 0) > 0 || (os?.sandboxes.length ?? 0) > 0 || os?.runtime.cliFound === true || os?.runtime.proverFound === true;
+    const gateState = model.gate?.state;
+    const rows = [
+        {
+            name: "MCP gateway",
+            blurb: "Govern and audit tool calls to any MCP server",
+            live: gateState === "running",
+            liveLabel: gateState === "configured-stopped" ? "configured" : "running",
+            setup: "<code>kya gate init</code>",
+        },
+        {
+            name: "OpenShell sandboxing",
+            blurb: "NVIDIA OpenShell policy-enforced agent sandboxes",
+            live: osLive,
+            liveLabel: "in use",
+            setup: '<code>kya import --from openshell FILE</code> or install the openshell CLI',
+        },
+        {
+            name: "Sandboxes",
+            blurb: "Firecracker or mock isolated execution for tool calls",
+            live: (model.sandboxes?.sandboxes.length ?? 0) > 0 || !!model.sandboxes?.backend,
+            liveLabel: "in use",
+            setup: "<code>KYA_SANDBOX=mock kya sandbox spawn</code>",
+        },
+        {
+            name: "Trace imports",
+            blurb: "LangSmith, Langfuse, Phoenix, OTel, AGT, ADR Sensor, OpenShell",
+            live: (model.imports?.total ?? 0) > 0,
+            liveLabel: `${model.imports?.total ?? 0} imported`,
+            setup: "<code>kya import --from langsmith FILE</code>",
+        },
+        {
+            name: "Endpoint discovery",
+            blurb: "Inventory AI agents, IDEs, runtimes and MCP servers on this machine",
+            live: !!model.discovery,
+            liveLabel: `${model.discovery?.total ?? 0} found`,
+            setup: "<code>kya discover</code>",
+        },
+        {
+            name: "Investigation",
+            blurb: "Deterministic trail analysis with grouped incidents",
+            live: !!model.investigate,
+            liveLabel: "ran",
+            setup: "<code>kya investigate</code>",
+        },
+        {
+            name: "Alerts",
+            blurb: "Webhooks on DENY and REQUIRE_APPROVE verdicts",
+            live: !!model.alerts,
+            liveLabel: "configured",
+            setup: '<code>notify.webhooks</code> in .kya/config.json',
+        },
+        {
+            name: "OTel export",
+            blurb: "Mirror verdict events to any OTLP/HTTP collector",
+            live: !!model.otel,
+            liveLabel: "exporting",
+            setup: '<code>otlpExport.endpoint</code> in .kya/config.json',
+        },
+        {
+            name: "Certify baseline",
+            blurb: "Agent Trust Baseline gap report from local evidence",
+            live: !!model.certify,
+            liveLabel: "evaluated",
+            setup: "<code>kya certify</code>",
+        },
+        {
+            name: "ORR board",
+            blurb: "Operational readiness review across producers",
+            live: !!model.orr,
+            liveLabel: "ran",
+            setup: "<code>kya orr run</code>",
+        },
+    ];
+    const body = rows
+        .map((r) => `      <tr>
+        <td><strong>${esc(r.name)}</strong></td>
+        <td>${esc(r.blurb)}</td>
+        <td>${r.live
+        ? `<span class="pill ok">${esc(r.liveLabel)}</span>`
+        : '<span class="pill">available</span>'}</td>
+        <td class="mute small">${r.setup}</td>
+      </tr>`)
+        .join("\n");
+    return `<section class="panel" id="capabilities" aria-label="Capabilities">
+  <h2>Capabilities</h2>
+  <p class="mute small">Everything this install supports. Rows turn green as each capability is used; <span class="pill">available</span> rows name the command that activates them.</p>
+  <table class="tbl">
+    <thead><tr><th>Capability</th><th>What it does</th><th>Status</th><th>Turn it on</th></tr></thead>
+    <tbody>
+${body}
+    </tbody>
+  </table>
+</section>`;
+}
 /**
  * System-tab gateway summary: a single status row that links to the dedicated
  * Gateway section. Detail lives in the Gateway pages so the System tab stays
@@ -1063,6 +1175,89 @@ ${card.sandboxes
   ${tbl}
 </section>`;
 }
+/**
+ * System-tab OpenShell panel (NVIDIA OpenShell): policy activity from
+ * imported openshell trail events, openshell-backend sandbox rows with their
+ * on-disk policy-file status, and a runtime card probing the openshell CLI
+ * (version cached, probed once per report build), the container runtime, the
+ * pinned version floor, the openshell-prover binary, and the SAFE-06 certify
+ * outcome reused from the already-computed certify card. Always rendered: with
+ * no OpenShell signal yet the activity and sandbox blocks fall back to empty
+ * states that name the exact command to activate them, so the capability stays
+ * discoverable from the dashboard itself (docs/report-design.md).
+ */
+function openshellPanel(card, nowMs) {
+    const c = card ?? emptyOpenshellCard();
+    const activity = c.activity
+        ? `<div class="card">
+  <h3>Policy activity</h3>
+  <div class="kpi-row">
+    ${kpiTile("Events", c.activity.total)}
+    ${kpiTile("Denied", c.activity.deny, "bad")}
+    ${kpiTile("Allowed", c.activity.allow)}
+  </div>
+  <div class="orrline">
+    <span class="pill${c.activity.deny > 0 ? " bad" : ""}">DENY ${c.activity.deny}</span>
+    <span class="pill ok">ALLOW ${c.activity.allow}</span>
+    <span class="mute">network ${c.activity.network} · http ${c.activity.http}</span>
+  </div>
+  ${c.activity.topDestinations.length === 0
+            ? ""
+            : `<div class="chiprow">
+    ${c.activity.topDestinations
+                .map((d) => `<span class="chip"><code>${esc(clip(d.dst, 60))}</code> × ${d.count}</span>`)
+                .join("\n    ")}
+  </div>`}
+  <p class="mute small">last event ${c.activity.lastTs ? esc(relativeTime(c.activity.lastTs, nowMs)) : "unknown"}</p>
+</div>`
+        : `<p class="empty small">No OpenShell policy events on the trail. Import an export with <code>kya import --from openshell FILE</code>.</p>`;
+    const sandboxTbl = c.sandboxes.length === 0
+        ? `<p class="empty small">No openshell-backend sandboxes recorded. Spawn one with <code>KYA_SANDBOX=openshell kya sandbox spawn</code>.</p>`
+        : `<table class="tbl">
+    <thead><tr><th>id</th><th>status</th><th>name</th><th>created</th><th>policy</th></tr></thead>
+    <tbody>
+${c.sandboxes
+            .map((s) => `      <tr>
+        <td><code title="${esc(s.sandboxId)}">${esc(clip(s.sandboxId, 20))}</code></td>
+        <td><span class="pill ${s.status === "running" ? "ok" : "mute"}">${esc(s.status)}</span></td>
+        <td>${s.externalName ? `<code>${esc(clip(s.externalName, 40))}</code>` : '<span class="mute">-</span>'}</td>
+        <td>${esc(relativeTime(s.createdAt, nowMs))}</td>
+        <td><span class="pill ${s.policyFile ? "ok" : "mute"}">${s.policyFile ? "written" : "missing"}</span></td>
+      </tr>`)
+            .join("\n")}
+    </tbody>
+  </table>`;
+    const rt = c.runtime;
+    const cliLine = rt.cliFound
+        ? `<p class="line">openshell CLI <span class="pill ok">found</span>${rt.cliVersion
+            ? ` <code>${esc(clip(rt.cliVersion, 40))}</code>`
+            : ' <span class="mute">version probe failed</span>'}</p>`
+        : `<p class="line">openshell CLI <span class="pill">not detected</span></p>`;
+    const runtimeLine = rt.containerRuntime
+        ? `<span class="pill ok">${esc(rt.containerRuntime)}</span>`
+        : `<span class="pill">not detected</span>`;
+    const proverLine = rt.proverFound
+        ? `<p class="line">openshell-prover <span class="pill ok">found</span></p>`
+        : `<p class="line">openshell-prover <span class="pill">not detected</span></p>`;
+    const safe06Tone = rt.safe06 ? DETAIL_PILL_TONE[rt.safe06.status] ?? "" : "";
+    const safe06Line = rt.safe06
+        ? `<p class="line">SAFE-06 (openshell-prover) <span class="pill${safe06Tone ? ` ${safe06Tone}` : ""}">${esc(rt.safe06.status.replace(/_/g, " "))}</span> <span class="mute">${esc(clip(rt.safe06.evidence, 120))}</span></p>`
+        : `<p class="line">SAFE-06 (openshell-prover) <span class="mute">not evaluated by Certify yet</span></p>`;
+    const runtime = `<div class="card">
+  <h3>Runtime</h3>
+  ${cliLine}
+  <p class="line">container runtime ${runtimeLine} <span class="mute">minimum ${esc(rt.minVersion)}</span></p>
+  ${proverLine}
+  ${safe06Line}
+</div>`;
+    return `<section class="panel" aria-label="OpenShell">
+  <h2>OpenShell</h2>
+  ${activity}
+  <h3>Sandboxes</h3>
+  ${sandboxTbl}
+  ${runtime}
+</section>`;
+}
 function orrPanel(orr, nowMs) {
     if (!orr)
         return "";
@@ -1507,7 +1702,7 @@ function alertsPanel(card, nowMs, live) {
         return `<section class="panel" aria-label="Alerts">
   <h2>Alerts</h2>
   <p class="line">No alert deliveries yet. kya fires webhooks for DENY and REQUIRE_APPROVE verdicts; every delivery attempt is logged here per target.</p>
-  <p class="mute small">configure <code>notify.webhooks</code> in .kya/config.json or set <code>KYA_NOTIFY_WEBHOOK</code>, then send a test alert</p>
+  <p class="mute small">send a test alert to see the pipeline work (it uses a temporary loopback receiver until you configure <code>notify.webhooks</code> in .kya/config.json or set <code>KYA_NOTIFY_WEBHOOK</code>)</p>
   ${test}
 </section>`;
     }
@@ -1551,7 +1746,7 @@ function otelPanel(stats, nowMs, live) {
         return `<section class="panel" aria-label="OTel export">
   <h2>OTel export</h2>
   <p class="line">No spans exported yet. kya can mirror verdict events to any OTLP/HTTP collector; sent and failed counts are tracked here.</p>
-  <p class="mute small">configure <code>otlpExport.endpoint</code> in .kya/config.json or set <code>KYA_OTLP_EXPORT_ENDPOINT</code>, then test the export</p>
+  <p class="mute small">test the export now (it uses a temporary loopback collector until you configure <code>otlpExport.endpoint</code> in .kya/config.json or set <code>KYA_OTLP_EXPORT_ENDPOINT</code>)</p>
   ${test}
 </section>`;
     }
@@ -2160,7 +2355,7 @@ export function renderReceiptHtml(model) {
               : action === 'discover'
                 ? 'Done: ' + data.total + ' item(s) discovered'
                 : action === 'notify-test'
-                  ? 'Test alert sent to ' + data.targets + ' target(s)'
+                  ? (data.detail ? String(data.detail) : 'Test alert sent to ' + data.targets + ' target(s)')
                   : String(data.detail || 'ok');
             setResult(resultEl, '<p>' + esc(msg) + '</p>', false);
             if (action === 'otel-test') {
@@ -2243,9 +2438,11 @@ export function renderReceiptHtml(model) {
     const overviewBody = zoneBody([dashboardPanel(dashboard), sessionsPanel(agg, nowMs, changes), reasonsPanel(agg)], "No activity in this window yet - analytics appear once events land.");
     const certifyBody = zoneBody([model.certify ? certifyDetailPanel(model.certify.requirements) : ""], "No live evaluation yet - wrap tool calls and run kya certify to build the baseline.");
     const systemBody = zoneBody([
+        capabilitiesPanel(model),
         gatePanel(model.gate, nowMs),
         wiredHostsPanel(model.wiredHosts),
         sandboxesPanel(model.sandboxes, nowMs),
+        openshellPanel(model.openshell, nowMs),
         orrPanel(model.orr, nowMs),
         alertsPanel(model.alerts, nowMs, livePaged),
         otelPanel(model.otel, nowMs, livePaged),