@paydlux/agent 0.1.2 → 0.1.4

package/dist/phone.js

@@ -0,0 +1,163 @@
+// Paydlux — the approval half that lives on a phone.
+//
+// The problem this solves: until now the human's key was a string in the
+// seller's own process. That makes "2 of 2" a lie — one machine held both
+// halves, so whoever owned that machine was the human.
+//
+// Split it the way banks and hardware wallets do:
+//
+//   laptop (seller)   builds the payment, signs with the principal key,
+//                     sends the UNSIGNED transaction out
+//   phone  (human)    decodes it, shows a person what it says, signs with the
+//                     approver key, sends the signature back
+//   laptop (seller)   submits the now-complete transaction
+//
+// The approver seed never travels to the laptop. The phone needs no network to
+// sign — it only needs the transaction, and it can refuse.
+//
+// The signature is over the transaction hash, so the phone is signing THIS
+// payment: change the amount or the payee and the signature stops counting.
+import { Asset, Keypair, Memo, Operation, StrKey, TransactionBuilder, } from "@stellar/stellar-sdk";
+import { passphrase, StellarTxError, txResultName } from "./vault.js";
+/**
+ * Build the payment and sign it with the principal key only. The result is
+ * deliberately incomplete: it reaches the vault's threshold of 2 only once the
+ * approver's signature is added.
+ */
+export async function createApprovalChallenge(opts) {
+    const pass = passphrase(opts.network);
+    const acc = await opts.horizon.loadAccount(opts.vaultAddress);
+    const asset = opts.tokenCode === "XLM" ? Asset.native() : new Asset(opts.tokenCode, opts.tokenIssuer);
+    const built = new TransactionBuilder(acc, { fee: "100", networkPassphrase: pass })
+        .addOperation(Operation.payment({ destination: opts.payee, asset, amount: opts.amount }))
+        .setTimeout(opts.decideWithinSeconds ?? 1800);
+    if (opts.memo)
+        built.addMemo(Memo.text(opts.memo));
+    const tx = built.build();
+    tx.sign(opts.principal);
+    return {
+        id: opts.id,
+        network: opts.network,
+        xdr: tx.toXDR(),
+        summary: {
+            payee: opts.payee,
+            amount: opts.amount,
+            token: opts.tokenCode,
+            tokenIssuer: opts.tokenIssuer,
+            from: opts.vaultAddress,
+            memo: opts.memo,
+            expiresAt: tx.timeBounds ? Number(tx.timeBounds.maxTime) || undefined : undefined,
+        },
+        hash: Buffer.from(tx.hash()).toString("hex"),
+    };
+}
+/**
+ * What a person (or a phone app) does with a challenge: read it, decide, sign.
+ *
+ * This function does not talk to the network. It cannot submit anything. It
+ * cannot change the amount. It either adds a valid signature or returns the
+ * challenge untouched. That is the whole point of running it on the phone.
+ */
+export function signChallenge(challenge, approverSeed) {
+    const pass = passphrase(challenge.network);
+    const tx = TransactionBuilder.fromXDR(challenge.xdr, pass);
+    const hash = Buffer.from(tx.hash()).toString("hex");
+    if (hash !== challenge.hash) {
+        throw new Error("challenge was altered in transit — hash does not match, refusing to sign");
+    }
+    tx.sign(Keypair.fromSecret(approverSeed));
+    return tx.toXDR();
+}
+/**
+ * Read a challenge without any secrets, to show a human. Deliberately separate
+ * from signing so a UI can render it on an untrusted machine.
+ */
+export function describeChallenge(challenge) {
+    const s = challenge.summary;
+    return [
+        `pay      ${s.amount} ${s.token}`,
+        `to       ${s.payee}`,
+        `from     ${s.from}`,
+        `issuer   ${s.tokenIssuer}`,
+        s.memo ? `note     ${readableMemo(s.memo)}` : null,
+        `network  ${challenge.network}`,
+        `signs    ${challenge.hash.slice(0, 16)}…`,
+    ].filter(Boolean).join("\n");
+}
+/**
+ * The seller's side: take the phone's signature back and submit. Fails loudly
+ * if the transaction is still short of the vault's threshold.
+ */
+export async function submitApproved(signedXdr, network, horizon) {
+    const pass = passphrase(network);
+    const tx = TransactionBuilder.fromXDR(signedXdr, pass);
+    if (!tx.signatures.length)
+        throw new Error("no signatures on the returned transaction");
+    try {
+        await horizon.submitTransaction(tx);
+        return { hash: Buffer.from(tx.hash()).toString("hex"), ok: true };
+    }
+    catch (e) {
+        // Horizon answers 400 with the reason buried in the result codes. Surface
+        // the ledger's own word (BAD_AUTH, OP_INNER, ...) instead of "400".
+        let codes;
+        try {
+            codes = e?.resultResultCodes?.()?.results;
+        }
+        catch { /* shape differs */ }
+        codes ??= e?.response?.data?.extras?.result_codes?.results;
+        const resultXdr = e?.response?.data?.extras?.result_xdr;
+        const detail = codes?.join(",")
+            || (resultXdr ? txResultName(resultXdr) : undefined)
+            || resultXdr
+            || e.message;
+        throw new StellarTxError(detail, e);
+    }
+}
+/**
+ * A memo can arrive as text or as raw bytes depending on how the transaction was
+ * decoded. Show a human words, never a byte list.
+ */
+function readableMemo(memo) {
+    if (typeof memo === "string")
+        return memo;
+    if (Array.isArray(memo) || memo instanceof Uint8Array) {
+        try {
+            return Buffer.from(memo).toString("utf8");
+        }
+        catch {
+            return String(memo);
+        }
+    }
+    return String(memo ?? "");
+}
+/** A stable, scannable form of a challenge — what a phone would read from a QR code. */
+export function challengeQrPayload(challenge) {
+    return `paydlux:1\n${challenge.id}\n${challenge.network}\n${challenge.hash}\n${challenge.xdr}`;
+}
+/** Parse what a QR code carried. Rejects a payload whose hash disagrees. */
+export function parseChallengeQr(payload) {
+    const [tag, id, network, hash, xdr] = payload.split("\n");
+    if (tag !== "paydlux:1")
+        throw new Error("not a paydlux approval payload");
+    if (network !== "testnet" && network !== "public")
+        throw new Error("unknown network");
+    const tx = TransactionBuilder.fromXDR(xdr, passphrase(network));
+    const actual = Buffer.from(tx.hash()).toString("hex");
+    if (actual !== hash)
+        throw new Error("payload was tampered with: hash mismatch");
+    const op = tx.operations[0];
+    const asset = op.asset;
+    return {
+        id, network: network, xdr, hash,
+        summary: {
+            payee: op.destination,
+            amount: op.amount,
+            token: asset?.getCode ? asset.getCode() : "XLM",
+            tokenIssuer: asset?.getIssuer ? (asset.getIssuer() ?? "native") : "native",
+            from: tx.source,
+            memo: readableMemo(tx.memo?.value),
+        },
+    };
+}
+export { StrKey };

package/dist/portal.js

@@ -1,6 +1,6 @@
 export function portalPage(records, vault, network, qs = "") {
     const rows = records.length
-        ? records.map(render).join("\n")
+        ? records.map((r) => render(r, qs)).join("\n")
         : `<tr><td colspan="5" class="empty">nothing waiting</td></tr>`;
     return `<!doctype html><html><head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
@@ -23,6 +23,9 @@ export function portalPage(records, vault, network, qs = "") {
  .st{font-size:12px;text-transform:uppercase;letter-spacing:.06em}
  .settled{color:var(--green)} .denied,.failed{color:#e07a6b} .pending{color:var(--gold)}
  .tx{font-family:ui-monospace,monospace;font-size:11px;color:var(--muted);word-break:break-all}
+ .qr{font-size:10px;white-space:pre-wrap;background:#141715;padding:8px;border-radius:8px;color:var(--text)}
+ details summary{cursor:pointer}
+ .phlink{color:var(--gold);text-decoration:underline;font-size:12px}
  .foot{margin-top:28px;color:var(--muted);font-size:12px}
  @media(max-width:640px){.body{max-width:180px}}
 </style></head><body>
@@ -38,17 +41,31 @@ export function portalPage(records, vault, network, qs = "") {
    document.querySelector('tbody').innerHTML=d.map(row).join('')||'<tr><td colspan="5" class="empty">nothing waiting</td></tr>';
    document.getElementById('t').textContent=new Date().toLocaleTimeString()}
  function row(x){const st='<span class="st '+x.status+'">'+x.status+'</span>'+(x.tx?'<div class="tx">'+x.tx+'</div>':'')+(x.reason?'<div class="tx">'+x.reason+'</div>':'');
-  const btns=x.status==='pending'?'<button class="yes" onclick="act(\\'approve\\',\\''+x.id+'\\')">Approve</button><button class="no" onclick="act(\\'deny\\',\\''+x.id+'\\')">Deny</button>':'';
-  return '<tr><td>'+new Date(x.at).toLocaleTimeString()+'</td><td><div class="uri">'+x.uri+'</div><div class="body">'+(x.body||'')+'</div></td><td class="amt">'+x.price+'</td><td>'+st+'</td><td style="min-width:130px">'+btns+'</td></tr>'}
+  const btns=x.status==='pending'?'<button class="yes" onclick="act(\'approve\',\''+x.id+'\')">Approve</button><button class="no" onclick="act(\'deny\',\''+x.id+'\')">Deny</button>':'';
+  const ph=x.status==='awaiting_phone'?'<div class="tx">awaiting your phone</div>':'';
+  return '<tr><td>'+new Date(x.at).toLocaleTimeString()+'</td><td><div class="uri">'+x.uri+'</div><div class="body">'+(x.body||'')+'</div></td><td class="amt">'+x.price+'</td><td>'+st+ph+'</td><td style="min-width:130px">'+btns+'</td></tr>'}
  setInterval(load,3000);
 </script></body></html>`;
 }
-function render(r) {
+function render(r, qs = "") {
+    // qs is the portal key query string ("?k=..."). The approver link has to carry
+    // it, because the desk answers 403 for anything without it.
+    const link = `phone/?id=${encodeURIComponent(r.id)}${qs.replace("?", "&")}`;
     const btns = r.status === "pending"
         ? `<button class="yes" onclick="act('approve','${r.id}')">Approve</button>
        <button class="no" onclick="act('deny','${r.id}')">Deny</button>`
         : "";
-    const meta = [r.tx && `<div class="tx">${r.tx}</div>`, r.reason && `<div class="tx">${r.reason}</div>`].filter(Boolean).join("");
+    // Split mode: the desk has no approver key, so approving hands the payment to
+    // a phone. Show the human exactly what the phone will be asked to sign.
+    // Split mode: the desk has no approver key, so approving hands the payment to
+    // a phone. Show the human exactly what the phone will be asked to sign, and
+    // give the approver app a link so nobody pastes base64 on a small screen.
+    const phone = r.status === "awaiting_phone" && r.challenge
+        ? `<div class="tx">awaiting your phone · ${r.challenge.summary.amount} ${r.challenge.summary.token} to ${r.challenge.summary.payee.slice(0, 12)}…</div>
+       <div class="tx"><a class="phlink" href="${link}">open on your phone to sign</a></div>
+       <details class="tx"><summary>approval payload for the phone</summary><pre class="qr">${r.qr}</pre></details>`
+        : "";
+    const meta = [phone, r.tx && `<div class="tx">${r.tx}</div>`, r.reason && `<div class="tx">${r.reason}</div>`].filter(Boolean).join("");
     return `<tr>
   <td>${new Date(r.at).toLocaleTimeString()}</td>
   <td><div class="uri">${r.uri}</div><div class="body">${r.body || ""}</div></td>

package/dist/vault.d.ts

@@ -8,7 +8,8 @@ export declare function hex(b: Uint8Array | string): string;
  * only these two accounts are real money. Never accept any other issuer.
  */
 export declare const USDC_ISSUER: Record<Network, string>;
-/** A rejected Stellar transaction, with the ledger's own reason code. */
+/** Turn Horizon's result_xdr into a readable code, e.g. "BAD_AUTH". */
+export declare function txResultName(resultXdr: string): string | undefined;
 export declare class StellarTxError extends Error {
     code: string;
     constructor(code: string, cause?: unknown);

package/dist/vault.js

@@ -29,6 +29,31 @@ export const USDC_ISSUER = {
     testnet: "GBBD47IF6LWK7P7MDEVSCWR7DPUWV3NY3DTQEVFL4NAT4AQH3ZLLFLA5",
 };
 /** A rejected Stellar transaction, with the ledger's own reason code. */
+// Horizon hands back the transaction result as XDR:
+//   struct TransactionResult { int64 feeCharged; TransactionResultCode resultCode; ... }
+// so the code is the signed int32 at byte offset 8, not the first 8 bytes (that
+// is the fee). -6 = txBAD_AUTH = "not enough signatures", which is exactly what
+// a half-signed vault payment looks like.
+const TX_RESULT_CODES = {
+    0: "SUCCESS", [-1]: "FAILED", [-2]: "TOO_EARLY", [-3]: "TOO_LATE",
+    [-4]: "MISSING_OPERATION", [-5]: "BAD_SEQ", [-6]: "BAD_AUTH",
+    [-7]: "INSUFFICIENT_BALANCE", [-8]: "NO_ACCOUNT", [-9]: "INSUFFICIENT_FEE",
+    [-10]: "BAD_AUTH_EXTRA", [-11]: "INTERNAL_ERROR", [-12]: "NOT_SUPPORTED",
+    [-13]: "ACCOUNT_EXISTS", [-14]: "INSUFFICIENT_REWARDS",
+};
+/** Turn Horizon's result_xdr into a readable code, e.g. "BAD_AUTH". */
+export function txResultName(resultXdr) {
+    try {
+        const b = Buffer.from(resultXdr, "base64");
+        if (b.length < 12)
+            return undefined;
+        const n = b.readInt32BE(8);
+        return TX_RESULT_CODES[n] ?? `code ${n}`;
+    }
+    catch {
+        return undefined;
+    }
+}
 export class StellarTxError extends Error {
     code;
     constructor(code, cause) {
@@ -293,7 +318,9 @@ async function sub(h, _pass, tx, ...signers) {
         }
         catch { /* shape differs */ }
         codes ??= e?.response?.data?.extras?.result_codes?.results;
-        const detail = codes?.join(",") || e?.response?.data?.extras?.result_xdr || e?.message || String(e);
+        const resultXdr = e?.response?.data?.extras?.result_xdr;
+        const named = resultXdr ? txResultName(resultXdr) : undefined;
+        const detail = codes?.join(",") || named || resultXdr || e?.message || String(e);
         throw new StellarTxError(detail, e);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paydlux/agent",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Payments for AI agents that a human approves. Spending mandates enforced on the Stellar ledger: 2-of-2 vault, pre-authorised transaction envelopes, HTTP 402, USDC.",
   "type": "module",
   "main": "./dist/index.js",
@@ -13,6 +13,9 @@
   },
   "files": [
     "dist",
+    "phone-app/index.html",
+    "phone-app/app.js",
+    "phone-app/xdr.js",
     "README.md",
     "LICENSE"
   ],
@@ -28,6 +31,7 @@
     "story:stellar": "tsx stellar/story.ts",
     "test": "cd contracts && forge test",
     "test:stellar": "tsx stellar/demo.ts",
+    "test:phone": "tsx stellar/phone-check.ts && tsx stellar/desk-split-check.ts && tsx stellar/e2e-phone.ts && tsx phone-app/xdr-check.ts && tsx phone-app/app-check.ts && tsx phone-app/desk-app-check.ts",
     "typecheck": "tsc --noEmit"
   },
   "keywords": [

package/phone-app/app.js

@@ -0,0 +1,253 @@
+// The approver app's own logic. Loaded by phone-app/index.html and served by the
+// desk at /phone/app.js. Kept in a separate file so the Content-Security-Policy
+// (script-src 'self') is real rather than defeated by an inline <script>.
+(function () {
+  "use strict";
+  const X = window.PaydluxXdr;
+  const $ = (id) => document.getElementById(id);
+  const DB = "paydlux-approver", STORE = "keys";
+
+  let signingKey = null;
+
+  function idb(mode, fn) {
+    return new Promise((res, rej) => {
+      const open = indexedDB.open(DB, 1);
+      open.onupgradeneeded = () => open.result.createObjectStore(STORE);
+      open.onerror = () => rej(open.error);
+      open.onsuccess = () => {
+        const tx = open.result.transaction(STORE, mode);
+        const req = fn(tx.objectStore(STORE));
+        req.onsuccess = () => res(req.result);
+        req.onerror = () => rej(req.error);
+      };
+    });
+  }
+  const saveKey = (k) => idb("readwrite", (s) => s.put(k, "approver"));
+  const loadKey = () => idb("readonly", (s) => s.get("approver"));
+  const dropKey = () => idb("readwrite", (s) => s.delete("approver"));
+
+  function base64urlToBytes(s) {
+    const bin = atob(s.replace(/-/g, "+").replace(/_/g, "/"));
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+    return out;
+  }
+
+  async function showReady(pub) {
+    $("who").textContent = X.encodeAccountEd25519(pub);
+    $("enrol").classList.add("hidden");
+    $("ready").classList.remove("hidden");
+  }
+
+  // ------------------------------------------------------------- enrolment
+  $("enrolBtn").addEventListener("click", async () => {
+    $("enrolErr").textContent = "";
+    const seed = $("seed").value.trim();
+    try {
+      // Imported twice on purpose: once extractable purely to read the PUBLIC
+      // half back for display, once non-extractable as the key we keep.
+      const seedBytes = X.decodeSecretSeed(seed);
+      const pkcs8 = new Uint8Array(16 + 32);
+      pkcs8.set([0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20], 0);
+      pkcs8.set(seedBytes, 16);
+
+      // "verify" is not a legal usage for a private Ed25519 key — the browser
+      // refuses the import outright. Sign only.
+      const tmp = await crypto.subtle.importKey("pkcs8", pkcs8, { name: "Ed25519" }, true, ["sign"]);
+      const jwk = await crypto.subtle.exportKey("jwk", tmp);
+      const pub = base64urlToBytes(jwk.x);
+
+      signingKey = await X.importSecretSeed(seed);      // non-extractable
+      seedBytes.fill(0); pkcs8.fill(0); $("seed").value = "";
+
+      // What is persisted is the non-extractable CryptoKey object, not the seed.
+      // Whatever backs IndexedDB can use that key to sign; no code path can read
+      // the seed out of it. Losing the database leaks nothing; stealing it leaks
+      // nothing either.
+      await saveKey({ key: signingKey, x: jwk.x });
+      await showReady(pub);
+    } catch (e) {
+      $("enrolErr").textContent = e.message;
+    }
+  });
+
+  $("forget").addEventListener("click", async () => {
+    signingKey = null;
+    await dropKey();
+    location.reload();
+  });
+
+  // --------------------------------------------------------------- review
+  let pending = null;
+
+  /**
+   * Deep link from the desk: /phone/?id=pay_0001&k=PORTALKEY
+   * The human taps a link instead of pasting 400 characters of base64 on a
+   * phone. The desk returns its own record of the challenge, so the amount the
+   * phone displays is the amount the desk recorded.
+   */
+  async function loadFromDesk() {
+    const q = new URLSearchParams(location.search);
+    const id = q.get("id"), k = q.get("k");
+    if (!id) return;
+    try {
+      const res = await fetch("/challenge/" + encodeURIComponent(id) +
+        (k ? "?k=" + encodeURIComponent(k) : ""), { cache: "no-store" });
+      if (!res.ok) throw new Error((await res.json().catch(() => ({}))).error || res.status);
+      const rec = await res.json();
+      $("xdr").value = rec.xdr;
+      pending = { fromDesk: true, id, k };
+      await renderChallenge(rec.xdr);
+      $("readErr").textContent = "";
+    } catch (e) {
+      $("readErr").textContent = "could not load " + id + ": " + e.message;
+    }
+  }
+
+  async function renderChallenge(xdrText) {
+    const env = X.parseEnvelope(xdrText);
+    const op = env.tx.ops[0];
+    const testnet = await X.transactionHash(xdrText, X.NETWORK_ID.testnet);
+    const publicNet = await X.transactionHash(xdrText, X.NETWORK_ID.public);
+    pending = Object.assign({}, pending, {
+      xdrText, env, hashes: { testnet: testnet.hash, public: publicNet.hash },
+    });
+
+    $("amount").textContent = X.formatAmount(op.amount) + " " + op.asset.code;
+    $("token").textContent = op.asset.issuer
+      ? op.asset.code + " issued by " + op.asset.issuer
+      : "XLM (native)";
+    $("payee").textContent = X.encodeAccountEd25519(op.destination.pub);
+    $("vault").textContent = X.encodeAccountEd25519(env.tx.source.pub);
+    $("memo").textContent = env.tx.memo || "(none)";
+    const max = env.tx.bounds && env.tx.bounds.maxTime;
+    $("deadline").textContent = max && max !== "0"
+      ? new Date(Number(max) * 1000).toLocaleString() + " (" + remaining(Number(max)) + ")"
+      : "none — this transaction never expires";
+
+    // Which network an envelope belongs to is NOT inside the envelope, so the
+    // human picks it. Signing for the wrong network yields a signature the
+    // ledger refuses; it cannot silently move funds somewhere else.
+    $("hash").innerHTML =
+      '<label class="tag ok"><input type="radio" name="net" value="testnet" checked> testnet</label> '
+      + testnet.hash +
+      '<br><label class="tag warn"><input type="radio" name="net" value="public"> mainnet</label> '
+      + publicNet.hash;
+    $("review").classList.remove("hidden");
+  }
+
+  function remaining(unix) {
+    const s = unix - Math.floor(Date.now() / 1000);
+    if (s <= 0) return "EXPIRED";
+    if (s < 120) return s + "s left";
+    return Math.round(s / 60) + " min left";
+  }
+
+  $("read").addEventListener("click", async () => {
+    $("readErr").textContent = "";
+    $("review").classList.add("hidden");
+    const xdrText = $("xdr").value.trim().replace(/\s+/g, "");
+    try {
+      await renderChallenge(xdrText);
+    } catch (e) {
+      $("readErr").textContent = e.message;
+    }
+  });
+
+  $("reject").addEventListener("click", () => reset());
+  $("again").addEventListener("click", () => reset());
+  function reset() {
+    pending = null;
+    $("result").classList.add("hidden");
+    $("review").classList.add("hidden");
+    $("xdr").value = "";
+  }
+
+  // ---------------------------------------------------------------- sign
+  $("approve").addEventListener("click", async () => {
+    $("signErr").textContent = "";
+    if (!signingKey) {
+      $("signErr").textContent = "Import the approver key first.";
+      return;
+    }
+    if (!pending) return;
+
+    const picked = document.querySelector("input[name=net]:checked");
+    const which = picked ? picked.value : "testnet";
+    const network = which === "testnet" ? X.NETWORK_ID.testnet : X.NETWORK_ID.public;
+
+    // A pasted transaction has no trusted source, so the human proves they were
+    // shown this exact one by typing its hash back. A transaction fetched from
+    // the desk over the portal key is already bound to the desk's own record,
+    // which the desk re-checks before submitting.
+    if (!pending.fromDesk) {
+      const quoted = prompt("Type the first 16 characters of the hash the seller quoted you:");
+      if (!quoted) return;
+      const q = quoted.trim().toLowerCase();
+      if (q !== pending.hashes.testnet.slice(0, 16) && q !== pending.hashes.public.slice(0, 16)) {
+        $("signErr").textContent = "That hash matches neither. Nothing was signed.";
+        return;
+      }
+    }
+
+    try {
+      const { hash } = await X.transactionHash(pending.xdrText, network);
+      // The signature covers the 32 raw hash bytes. sha256-ing the hex text
+      // instead yields a well-formed envelope the ledger refuses with BAD_AUTH.
+      const sig = new Uint8Array(await crypto.subtle.sign(
+        "Ed25519", signingKey, X.signaturePreimage(hash)));
+      const rec = await loadKey();
+      const signed = X.addSignature(pending.xdrText, sig, base64urlToBytes(rec.x));
+
+      if (pending.fromDesk) {
+        const res = await fetch("/signed/" + encodeURIComponent(pending.id) +
+          (pending.k ? "?k=" + encodeURIComponent(pending.k) : ""), {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ signedXdr: signed }),
+        });
+        const out = await res.json().catch(() => ({}));
+        if (out.status === "settled") {
+          // Show the ledger hash and keep the panel up: this is the only proof
+          // the human gets that the payment actually landed. reset() would hide
+          // it again, so clear the form by hand instead.
+          pending = null;
+          $("xdr").value = "";
+          $("review").classList.add("hidden");
+          $("signed").textContent = "settled on ledger\n" + (out.tx || "");
+          $("result").classList.remove("hidden");
+          return;
+        }
+        $("signErr").textContent = "the desk refused it: " +
+          (out.reason || out.error || out.status || res.status);
+        return;
+      }
+      $("signed").textContent = signed;
+      $("result").classList.remove("hidden");
+    } catch (e) {
+      $("signErr").textContent = e.message;
+    }
+  });
+
+  $("copy").addEventListener("click", async () => {
+    try {
+      await navigator.clipboard.writeText($("signed").textContent);
+      $("copy").textContent = "Copied";
+    } catch (e) {
+      $("copy").textContent = "Select the text above and copy it manually";
+    }
+  });
+
+  // On reload, pull the non-extractable CryptoKey back out of IndexedDB. It can
+  // sign; it cannot be exported. The seed itself is never stored anywhere.
+  (async () => {
+    try {
+      const rec = await loadKey();
+      if (rec && rec.key instanceof CryptoKey) {
+        signingKey = rec.key;
+        await showReady(base64urlToBytes(rec.x));
+      }
+    } catch (e) { /* enrolment UI stays up */ }
+    await loadFromDesk();
+  })();
+})();