@paydlux/agent 0.1.17 → 0.1.19

package/dist/donate.js

@@ -0,0 +1,232 @@
+// The donation page: a stranger's agent pays us from THEIR vault.
+//
+// This is the other half of the seller door (stellar/receive.ts). The showcase
+// on demo.paydlux.com spends the SELLER's money to show the loop. A donation
+// spends the VISITOR's money, which is the whole point of the product: an
+// agent that can pay, with a human holding the brake on the payer's side.
+//
+// Why the payer approves and the seller does not:
+//   the seller's risk is "I served content and never got paid". The ledger
+//   answers that with a public read, so no seller signature is needed.
+//   the payer's risk is "an agent spent my money". That needs a human, and it
+//   has to be *their* human, on *their* phone, against *their* mandate.
+//
+// Nothing here holds a buyer key. We publish terms; they sign at home; the
+// ledger is the only witness we accept.
+import { startReceive } from "./receive";
+import { qrSvg } from "./qr";
+export const DONATE_HOST = "donate.paydlux.com";
+export const DONATE_PORT = 4024;
+/**
+ * The page. No inline script and nothing visitor-controlled is interpolated, so
+ * the strict CSP is real rather than decorative — the same rule the showcase
+ * follows, because this port is public.
+ */
+export function donatePage(cfg) {
+    const asset = cfg.asset === "XLM" ? "XLM (Stellar's own currency)" : cfg.asset;
+    return `<!doctype html>
+<html lang="en"><head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Fund Paydlux — an agent pays, a human decides</title>
+<meta name="description" content="Pay Paydlux from your own Stellar vault. Your agent asks, your phone approves, the ledger proves it. No seller key touches your money.">
+<style>
+ :root{color-scheme:dark}
+ body{margin:0;background:#14181a;color:#e8ecee;font:16px/1.6 Georgia,serif}
+ main{max-width:760px;margin:0 auto;padding:48px 24px 80px}
+ h1{font-size:34px;line-height:1.25;margin:0 0 10px}
+ .sub{color:#9fb0b6;margin:0 0 34px}
+ .card{background:#1b2124;border:1px solid #2b3338;border-radius:12px;padding:20px 22px;margin:0 0 18px}
+ .price{font-size:30px;margin:0}
+ .muted{color:#8fa0a6;font-size:14px}
+ code,pre{font:13px/1.7 Menlo,monospace;background:#0f1315;border-radius:8px;padding:2px 6px;color:#cfe3ea;overflow-x:auto}
+ pre{padding:14px 16px;white-space:pre-wrap;word-break:break-word}
+ ol{padding-left:22px} li{margin:0 0 12px}
+ a{color:#7fd1c8}
+ .row{display:flex;gap:10px;flex-wrap:wrap;align-items:center;margin:22px 0}
+ button{background:#2f6f66;color:#fff;border:0;border-radius:9px;padding:13px 22px;font-size:16px;cursor:pointer}
+ button:disabled{opacity:.5;cursor:default}
+ #out{white-space:pre-wrap;word-break:break-word;font:13px/1.7 Menlo,monospace;background:#0f1315;border-radius:10px;padding:16px;margin-top:16px;display:none}
+ .ok{color:#8fe3b0}.bad{color:#e8a09a}
+ .qrrow{display:flex;gap:18px;align-items:center;flex-wrap:wrap;margin:14px 0 4px}
+ .qr img{background:#fff;border-radius:10px;padding:8px;width:188px;height:188px;display:block}
+ pre.addr{flex:1;min-width:260px;margin:0;font-size:12px;word-break:break-all;white-space:pre-wrap}
+ .warn{border-left:3px solid #6b5a2f;padding-left:12px;margin:14px 0 0}
+ #copy.done{background:#24524b}
+ footer{margin-top:40px;color:#7f8f95;font-size:13px}
+</style></head>
+<body><main>
+ <h1>An agent can pay.<br>Whether it <em>may</em> is a human decision.</h1>
+ <p class="sub">This page takes a real payment drawn on <strong>your</strong> vault. We never
+ hold your key, your seed, or your approval. The money moves because your phone said so.</p>
+
+ <div class="card">
+  <p class="price">${cfg.price} ${asset}</p>
+  <p class="muted">one payment, one order, one memo. The memo is what ties your payment to
+  the thing you asked for, so it cannot be reused for anyone else's order.</p>
+ </div>
+
+ <div class="row">
+  <button id="go">Ask my agent to pay</button>
+  <span class="muted">never paid with an agent before? <a href="https://demo.paydlux.com/">run the loop free on testnet first</a> — same mechanics, costs nothing</span>
+ </div>
+ <pre id="cmd">curl -s -X POST https://${DONATE_HOST}/donate \
+     -d '{"vault":"G…your vault…"}'
+# → 402 with: order, memo, payTo, maxAmountRequired
+# the order is now bound to YOUR vault: a payment from anyone else's account
+# is refused, so nobody can pay for your order and take the goods
+# pay it from your vault with a mandate carrying that memo, then:
+curl -s "https://${DONATE_HOST}/donate?order=ORDER&amp;tx=TXHASH"</pre>
+ <div id="out"></div>
+
+ <div class="card qr">
+  <p><strong>Or just send it yourself</strong></p>
+  <p class="muted">No agent, no order, no memo. Scan or copy the address and send XLM
+  from any wallet or exchange that supports Stellar. This is the front door for a
+  human; the 402 loop above is the door for an agent.</p>
+  <div class="qrrow">
+   <img src="/qr.svg" width="188" height="188" alt="QR code for the Paydlux receiving address">
+   <div>
+    <pre class="addr">${cfg.payee}</pre>
+    <div class="row">
+     <button id="copy" type="button">Copy address</button>
+     <a class="muted" href="${cfg.explorer}/${cfg.payee}">watch it on the public ledger</a>
+    </div>
+   </div>
+  </div>
+  <p class="muted">${cfg.payee === cfg.vault
+        ? "That address is the <strong>vault itself</strong> — a 2-of-2 account. Money sent here cannot be moved by one key, including ours: spending it needs the founder's key <em>and</em> a phone, against a daily ceiling, and every payment out is public."
+        : `Money lands in our operating account and is swept into the <a href="${cfg.explorer}/${cfg.vault}">2-of-2 vault</a>. Spending it needs the founder's key <em>and</em> a phone, against a daily ceiling, and every payment out is public.`}</p>
+  <p class="muted warn"><strong>Network: Stellar</strong>, asset <strong>${asset}</strong>.
+  Not Ethereum, not BSC, not Tron. Sending on the wrong chain loses the money — there is
+  no recovery for that. No memo is needed for this address.</p>
+ </div>
+
+ <div class="card">
+  <p><strong>What actually happens</strong></p>
+  <ol>
+   <li>Your agent asks for an order. We answer <code>402</code> with the price, our
+       account, and a one-time memo. Nothing is paid yet.</li>
+   <li>Your agent builds a <em>mandate</em> on your own Stellar vault: this amount, this
+       payee, this memo, expiring if you never answer.</li>
+   <li>Your vault needs <strong>two signatures</strong>. Your agent holds one. The other is on
+       your phone, and you hold it down for a second to give it. Without that second
+       signature the ledger refuses — not our server, the ledger.</li>
+   <li>We read the public ledger. If the payment really landed, in full, naming this
+       order, we serve the thing. If it did not, we serve nothing, and say why.</li>
+  </ol>
+  <p class="muted">We cannot see your seed. We cannot approve for you. You cannot pay more
+  than your own mandate allows, even if the agent asks twice.</p>
+ </div>
+
+ <div class="card">
+  <p><strong>Where the money goes</strong></p>
+  <p class="muted">Straight into the Paydlux operating vault, which is itself a 2-of-2
+  account: the founder's key and a phone key. Development spend has to be approved by a
+  human on that same phone, against a daily ceiling, and every payment is public.</p>
+  <p class="muted">vault <a href="${cfg.explorer}/${cfg.vault}">${cfg.vault}</a> ·
+  payments land in <a href="${cfg.explorer}/${cfg.payee}">${cfg.payee}</a> ·
+  network <code>${cfg.network === "public" ? "mainnet" : "testnet"}</code></p>
+ </div>
+
+ <div class="card">
+  <p><strong>What it funds</strong></p>
+  <p class="muted">The protocol is built, it runs, and it is public — every refusal this
+  page makes is covered by a test that forges a payment and checks that it is rejected.
+  What funding pays for next:</p>
+  <ul class="muted">
+   <li><strong>Production infrastructure.</strong> Always-on gateways and approval desks,
+       monitored, with no single machine in the path.</li>
+   <li><strong>Settlement capital.</strong> A payment rail needs money moving through it.
+       Stellar pays grants in XLM — the same asset this settles in, which is why this is a
+       Stellar project and not an EVM one.</li>
+   <li><strong>An installable approver app.</strong> The money-critical half of this product
+       is a signing app on your phone, not a browser tab.</li>
+   <li><strong>An external audit.</strong> The whole promise is that a human authorises the
+       money. If the signing path has a bug, the promise is worth less than nothing, and we
+       should not be the only people who looked.</li>
+  </ul>
+  <p class="muted">None of this changes what the door does: it verifies your payment on the
+  ledger and serves the receipt, or serves nothing and says why.</p>
+ </div>
+
+ <footer>Paydlux · HTTP 402 for agents, a thumb for humans · <a href="https://paydlux.com">paydlux.com</a></footer>
+</main>
+<script src="/donate.js"></script>
+</body></html>`;
+}
+/**
+ * The browser half. It does NOT sign anything — it cannot, and that is the
+ * design. It fetches an order, prints the exact command your agent runs, and
+ * then polls until the ledger says the money landed.
+ */
+export function donateScript() {
+    return `// no signing here on purpose. The browser's job is to show you the order and
+// wait. The signature happens on your phone, against your own vault.
+var out = document.getElementById("out"), btn = document.getElementById("go");
+function say(t, cls) { out.style.display = "block"; out.textContent += (out.textContent ? "\\n" : "") + t; if (cls) out.className = cls; }
+
+// Copy the receiving address. The address is read from the page rather than
+// baked into this script, so there is exactly one copy of it and the two can
+// never disagree. A 56-character base32 address with B/8, I/1, O/0 in it is not
+// something to retype.
+var cp = document.getElementById("copy");
+if (cp) cp.onclick = async function () {
+  var addr = (document.querySelector("pre.addr") || {}).textContent || "";
+  var done = function (msg) { cp.textContent = msg; cp.classList.add("done"); setTimeout(function () { cp.textContent = "Copy address"; cp.classList.remove("done"); }, 2500); };
+  try {
+    await navigator.clipboard.writeText(addr.trim());
+    done("copied");
+  } catch (e) {
+    // No clipboard permission (http, or a browser that refuses). Fall back to a
+    // selection the person can copy by hand rather than failing silently.
+    var sel = document.createRange(); sel.selectNodeContents(document.querySelector("pre.addr"));
+    var s = getSelection(); s.removeAllRanges(); s.addRange(sel);
+    done("selected — copy it");
+  }
+};
+
+btn.onclick = async function () {
+  btn.disabled = true; out.textContent = "";
+  try {
+    var r = await fetch("/donate", { method: "POST", headers: { "content-type": "application/json" }, body: "{}" });
+    var j = await r.json();
+    if (!j.order) { say("no order: " + (j.error || r.status), "bad"); btn.disabled = false; return; }
+    say("order " + j.order + "\\nmemo " + j.memo + "\\npay " + j.maxAmountRequired + " " + (j.token && j.token.code) + "\\nto   " + j.payTo, "");
+    document.getElementById("cmd").textContent =
+      "curl -s \"" + location.origin + "/donate?order=" + j.order + "&tx=TXHASH\"";
+    say("\\nnow run that command, or pay from your own agent with this memo.", "");
+    say("\\nwhen your agent has the tx hash, the page confirms it here:", "");\n    var h = prompt("tx hash");\n    if (!h) { say("no hash given — check yourself with the curl above", ""); return; }\n    var v = await (await fetch("/donate?order=" + j.order + "&tx=" + encodeURIComponent(h))).json();\n    if (v.data) { say("\\nPAID — ledger " + v.proof.tx + "\\nledger #" + v.proof.ledger + " at " + v.proof.paidAt, "ok"); }\n    else { say("not served: " + (v.reason || v.error), "bad"); }
+  } catch (e) { say("network error: " + e.message, "bad"); }
+  btn.disabled = false;
+};`;
+}
+/**
+ * Start the donation endpoint: the seller door plus a page a human can read.
+ */
+export function startDonate(cfg) {
+    const explorer = cfg.explorer ?? `https://stellar.expert/explorer/${cfg.network === "public" ? "account" : "testnet/account"}`;
+    const page = donatePage({
+        price: cfg.price, asset: cfg.asset.code, network: cfg.network,
+        payee: cfg.payee, vault: cfg.vault, explorer,
+    });
+    const r = startReceive({
+        port: cfg.port, hostname: cfg.hostname, payee: cfg.payee, network: cfg.network,
+        price: cfg.price, asset: cfg.asset, page: () => page, script: () => donateScript(),
+        // The QR encodes the payee account this server actually verifies payments
+        // into — not a constant. If the vault or network ever changes, the picture
+        // changes with it, because there is only one source for the address.
+        qr: () => qrSvg(cfg.payee),
+        fetchJson: cfg.fetchJson,
+        deliver: (order) => ({
+            content: {
+                served: new Date().toISOString(),
+                order: order.id,
+                note: "served because the ledger says your own vault paid us for this order",
+                thank_you: "this funds development. every payment out of the vault needs a human thumb too",
+            },
+            receipt: `paydlux donation ${order.id} — paid by ${order.buyer} in ${order.amount} ${order.asset.code}`,
+        }),
+    });
+    return r;
+}

package/dist/phone.d.ts

@@ -30,6 +30,13 @@ export declare function createApprovalChallenge(opts: {
     amount: string;
     tokenCode: string;
     tokenIssuer: string;
+    /**
+     * Set explicitly when the settlement asset is the ledger's own XLM. Without
+     * it the code falls back to "named XLM and has no issuer", which is right for
+     * every caller today but is a name-based guess, and a name is something an
+     * attacker controls.
+     */
+    native?: boolean;
     network: Network;
     horizon: import("@stellar/stellar-sdk").Horizon.Server;
     id: string;

package/dist/phone.js

@@ -27,7 +27,13 @@ import { passphrase, StellarTxError, txResultName } from "./vault.js";
 export async function createApprovalChallenge(opts) {
     const pass = passphrase(opts.network);
     const acc = await opts.horizon.loadAccount(opts.vaultAddress);
-    const asset = opts.tokenCode === "XLM" ? Asset.native() : new Asset(opts.tokenCode, opts.tokenIssuer);
+    // Do not decide the asset from its NAME. Anyone can issue a token and call it
+    // XLM; if the name alone chose the asset, that token would be built here as
+    // native XLM and the human would sign a different payment than the one the
+    // seller described. The caller states the asset type; the name is only a
+    // fallback for callers that predate the flag.
+    const native = opts.native ?? (opts.tokenCode === "XLM" && !opts.tokenIssuer);
+    const asset = native ? Asset.native() : new Asset(opts.tokenCode, opts.tokenIssuer);
     const built = new TransactionBuilder(acc, { fee: "100", networkPassphrase: pass })
         .addOperation(Operation.payment({ destination: opts.payee, asset, amount: opts.amount }))
         .setTimeout(opts.decideWithinSeconds ?? 1800);

package/dist/policy.d.ts

@@ -36,6 +36,15 @@ export declare class PolicyEngine {
     policy: Policy;
     constructor(policy?: Partial<Policy>);
     record(e: SpendEvent): void;
+    /**
+     * Seed the day's total from the ledger instead of from this process's memory.
+     *
+     * `events` starts empty, so a fresh seller process believes it has spent
+     * nothing today. The mandate printed in the banner ("20 per day") then only
+     * holds until the next restart. Seeding from the ledger makes the budget a
+     * property of the vault, not of the uptime of whichever machine ran `sell`.
+     */
+    seedFromLedger(amount: number): void;
     /** Everything spent in the current UTC day. */
     spentToday(): number;
     today(): SpendEvent[];

package/dist/policy.js

@@ -13,6 +13,23 @@ export class PolicyEngine {
         this.policy = { ...DEFAULT_POLICY, ...policy };
     }
     record(e) { this.events.push(e); }
+    /**
+     * Seed the day's total from the ledger instead of from this process's memory.
+     *
+     * `events` starts empty, so a fresh seller process believes it has spent
+     * nothing today. The mandate printed in the banner ("20 per day") then only
+     * holds until the next restart. Seeding from the ledger makes the budget a
+     * property of the vault, not of the uptime of whichever machine ran `sell`.
+     */
+    seedFromLedger(amount) {
+        if (!(amount > 0))
+            return;
+        // One synthetic event at the start of the day: it counts toward the total
+        // without pretending to be a payment this process can re-enact.
+        const start = new Date();
+        start.setUTCHours(0, 0, 0, 0);
+        this.record({ at: start.getTime(), amount, payee: "ledger" });
+    }
     /** Everything spent in the current UTC day. */
     spentToday() {
         const start = new Date();

package/dist/qr.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Render `text` as a standalone SVG QR code.
+ *
+ * `dark`/`light` follow the page it sits on. A QR on a dark background needs a
+ * light quiet zone or some scanners struggle with the contrast inversion, so
+ * the module colour stays dark and the background stays light by default.
+ */
+export declare function qrSvg(text: string, opts?: {
+    cell?: number;
+    dark?: string;
+    light?: string;
+}): string;

package/dist/qr.js

@@ -0,0 +1,52 @@
+// A QR code for a Stellar address, as SVG.
+//
+// Why this exists: a Stellar account address is 56 characters of base32
+// (A–Z and 2–7). Asking a human to retype one is how money gets lost. Most
+// typos fail the account's own checksum and get rejected, but not all of them:
+// enough wrong characters can land on a different account that is perfectly
+// valid and belongs to someone else. A scanned code removes the transcription
+// step entirely, which is also what fixed the "exchange says this address is
+// invalid" problem — the paste was never the issue, the exchange's address
+// field was.
+//
+// SVG rather than PNG: it stays crisp at any size, it is a fraction of the
+// bytes, and it can be served as its own route so the page keeps a strict CSP
+// (img-src 'self') instead of a giant inline data URI.
+import qrcode from "qrcode-generator";
+/**
+ * Render `text` as a standalone SVG QR code.
+ *
+ * `dark`/`light` follow the page it sits on. A QR on a dark background needs a
+ * light quiet zone or some scanners struggle with the contrast inversion, so
+ * the module colour stays dark and the background stays light by default.
+ */
+export function qrSvg(text, opts = {}) {
+    const qr = qrcode(0, "M");
+    qr.addData(text);
+    qr.make();
+    const cell = opts.cell ?? 4;
+    const dark = opts.dark ?? "#0f1315";
+    const light = opts.light ?? "#ffffff";
+    const n = qr.getModuleCount();
+    const size = n * cell;
+    // One path of rectangles rather than n^2 <rect> elements: a 33x33 code is
+    // ~1k path commands instead of ~110k bytes of markup.
+    let d = "";
+    for (let r = 0; r < n; r++) {
+        for (let c = 0; c < n; c++) {
+            if (!qr.isDark(r, c))
+                continue;
+            // Extend right while the run stays dark: fewer path segments.
+            let w = 1;
+            while (c + w < n && qr.isDark(r, c + w))
+                w++;
+            d += `M${c * cell} ${r * cell}h${w * cell}v${cell}h-${w * cell}z`;
+            c += w - 1;
+        }
+    }
+    return `<svg xmlns="http://www.w3.org/2000/svg" width="${size}" height="${size}" `
+        + `viewBox="0 0 ${size} ${size}" shape-rendering="crispEdges" role="img" `
+        + `aria-label="QR code for ${text}">`
+        + `<rect width="${size}" height="${size}" fill="${light}"/>`
+        + `<path d="${d}" fill="${dark}"/></svg>`;
+}

package/dist/receive.d.ts

@@ -0,0 +1,147 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+export type Network = "testnet" | "public";
+export type Want = {
+    /** the account the money must land in */
+    payee: string;
+    /** minimum amount, as a decimal string */
+    amount: string;
+    /** "XLM" for native, otherwise a code+issuer pair */
+    asset: {
+        code: string;
+        issuer?: string;
+    };
+    /** the order the payment must name in its memo */
+    memo: string;
+    /** the vault the payment must come from (bound when the order was issued) */
+    from?: string;
+    /** how old a payment may be and still count */
+    maxAgeSeconds?: number;
+    /** which network to read */
+    network?: Network;
+};
+export type Verdict = {
+    ok: true;
+    tx: string;
+    amount: string;
+    paidAt: string;
+    from: string;
+    ledger: number;
+} | {
+    ok: false;
+    reason: string;
+};
+type FetchJson = (url: string) => Promise<{
+    status: number;
+    body: any;
+} | null>;
+/**
+ * Has this transaction really paid us, in full, for this order?
+ *
+ * Every field below is a separate forgery attempt, so each is checked against
+ * the ledger's own answer rather than the caller's:
+ *
+ *   hash unknown / tx failed        → nothing happened
+ *   pays a different account        → not our money
+ *   underpays                       → partial payment is not payment
+ *   a fake token called "XLM"       → anyone can name a token anything; only
+ *                                     native XLM, or an exact code+issuer pair,
+ *                                     is the asset we priced the order in
+ *   wrong or missing memo           → cannot be tied to this order, so one
+ *                                     real payment could be reused for many
+ *   pays us for someone else's order→ same reason, from the other side
+ *   ancient payment                 → a payment from last year is not this one
+ *   from a vault we never issued    → the order binds its buyer at 402 time
+ *
+ * Amounts are compared as numbers because Stellar normalises to 7 decimals.
+ */
+export declare function verifyIncomingPayment(hash: string, want: Want, fetchJson?: FetchJson): Promise<Verdict>;
+type Order = {
+    id: string;
+    memo: string;
+    amount: string;
+    asset: {
+        code: string;
+        issuer?: string;
+    };
+    buyer?: string;
+    createdAt: number;
+    /** set once a payment has been matched, so one payment buys one order */
+    redeemedTx?: string;
+};
+/**
+ * Orders live in memory on purpose. An unpaid order is worth nothing to anyone,
+ * and a redeemed one is recorded on the ledger forever — the durable record is
+ * the payment, not our book. A restart loses pending orders, which is correct:
+ * the buyer just asks again.
+ */
+export declare class OrderBook {
+    private ttlSeconds;
+    private orders;
+    private byMemo;
+    /** tx hashes already spent, so one payment can never buy two orders */
+    private spent;
+    constructor(ttlSeconds?: number);
+    issue(amount: string, asset: {
+        code: string;
+        issuer?: string;
+    }, buyer?: string): Order;
+    get(id: string): Order | undefined;
+    isSpent(tx: string): boolean;
+    markSpent(tx: string, id: string): void;
+    get size(): number;
+    private sweep;
+}
+export type ReceiveConfig = {
+    port: number;
+    host?: string;
+    hostname: string;
+    payee: string;
+    network: Network;
+    price: string;
+    asset: {
+        code: string;
+        issuer?: string;
+    };
+    /** what the buyer gets once the ledger confirms they paid */
+    deliver: (order: Order) => {
+        content: any;
+        receipt: string;
+    };
+    explorer?: string;
+    fetchJson?: FetchJson;
+    /**
+     * Optional human-readable page for `/`. The /donate routes speak JSON to
+     * agents; a person who opens the link in a browser would otherwise see a
+     * 404 and leave. The page interpolates nothing a visitor controls, so it
+     * cannot be a way in.
+     */
+    page?: () => string;
+    /** Served at /donate.js so the page can keep a strict script-src 'self'. */
+    script?: () => string;
+    /**
+     * Served at /qr.svg. A Stellar address is 56 base32 characters whose alphabet
+     * contains B/8, I/1, O/0 and U/2 — retyping one is how money is lost. The QR
+     * is its own route rather than an inline data URI so the page can keep
+     * img-src 'self' instead of widening the CSP.
+     */
+    qr?: () => string;
+};
+/**
+ * A public seller endpoint. Two routes only:
+ *
+ *   GET  /donate            → 402 with the price and how to pay
+ *   POST /donate             → same, and issues an order to name in the memo
+ *   GET  /donate?tx=HASH     → verify on the ledger, then deliver
+ *
+ * Nothing else is reachable: no queue, no keys, no admin. The worst this port
+ * can do is hand out content we were actually paid for.
+ */
+export declare function startReceive(cfg: ReceiveConfig): {
+    server: import("node:http").Server<typeof IncomingMessage, typeof ServerResponse>;
+    book: OrderBook;
+    /** Loopback only: the public path is the named tunnel, never this port. */
+    listen: (port: number) => Promise<void>;
+};
+/** Stable, non-secret id for an order, used in logs. */
+export declare function orderTag(id: string): string;
+export {};