@paydlux/agent 0.1.22 → 0.1.23

package/README.md

@@ -242,6 +242,31 @@ too, because a budget that silently reads as unspent is worse than no budget.
 The banner shows what is left: `policy: max 10 per payment, 50 per day (27.50
 left today)`.
 
+### Spend it by category, and edit the rules in a browser
+
+One vault, several pockets. Open **spending rules** on the approvals page (or
+`/rules` on the desk) and set, per named category, its own per-payment ceiling and
+daily budget — then say which seller wallet belongs to which category:
+
+```
+data-api    max 3 / payment    6 / day     ← api.example.com wallet
+coding      max 1 / payment    2 / day     ← assistant wallet
+```
+
+A category can only be **tighter** than the limits above it; it can never raise
+them, because the base ceilings are checked first. That asymmetry is the security
+property, and `npm run test:policy` proves it, along with the queue counting
+inside a category and the fact that a form posted from another site cannot raise
+your budget.
+
+Edits are saved to the vault's config file, so they survive a restart. Once you
+have edited them there, the saved numbers win over `--max`/`--daily` on the next
+start, and the seller prints which it is using — a rule that quietly reverts by
+morning is worse than no rule.
+
+`stellar/policy.ts` is the engine; the page is a plain HTML form, so it works with
+JavaScript off.
+
 ### What is enforced where (said honestly)
 
 | enforced by Stellar | enforced by the desk (`policy.ts`) |

package/dist/cli.js

@@ -221,7 +221,26 @@ async function sell() {
     // desk is even built.
     const maxPer = Number(arg("max") ?? data.policy?.maxPerPayment ?? 2);
     const daily = Number(arg("daily") ?? data.policy?.dailyBudget ?? 10);
-    const policy = new PolicyEngine({ maxPerPayment: maxPer, dailyBudget: daily });
+    // Categories and the wallet map come from the config file only: they are set
+    // at the desk (/rules), not from the command line. A flag for them would be a
+    // second, easier way to say the same thing, and the page would drift from it.
+    //
+    // The same is true of the two ceilings once an owner edits them at the desk:
+    // the saved file wins over the flags, because the app scripts pass --max and
+    // --daily on every start and would otherwise silently undo whatever was set in
+    // the browser. The line printed below is what keeps that from being a
+    // surprise — a rule that quietly reverts is worse than no rule at all.
+    const saved = data.policy?.savedByOwner === true;
+    const maxPerFinal = saved ? Number(data.policy.maxPerPayment ?? maxPer) : maxPer;
+    const dailyFinal = saved ? Number(data.policy.dailyBudget ?? daily) : daily;
+    if (saved && (maxPerFinal !== maxPer || dailyFinal !== daily)) {
+        log(`using the rules you saved at the desk (max ${maxPerFinal}, daily ${dailyFinal}) instead of the command line (${maxPer}/${daily}).\n  to change them: open the approvals link and press "spending rules".`);
+    }
+    const policy = new PolicyEngine({
+        maxPerPayment: maxPerFinal, dailyBudget: dailyFinal,
+        allowlist: data.policy?.allowlist, denylist: data.policy?.denylist,
+        categories: data.policy?.categories, payeeCategory: data.policy?.payeeCategory,
+    });
     // A ceiling below the price blocks every payment, and the failure looks like
     // a bug in the desk: the buyer waits, the human never sees an approvable
     // item, and the log says "mandate refused". Say it now, before anything is
@@ -233,16 +252,16 @@ async function sell() {
     // takes money IN from the buyer, so the ceiling does not apply to it — and
     // applying it would refuse a perfectly good escrow price for no reason.
     if (mode === "escrow") {
-        if (priceNum > maxPer) {
-            log(`note: --escrow price ${price} is above --max ${maxPer}. That is fine here — escrow money comes FROM the buyer, so your spending mandate never touches it.`);
+        if (priceNum > maxPerFinal) {
+            log(`note: --escrow price ${price} is above --max ${maxPerFinal}. That is fine here — escrow money comes FROM the buyer, so your spending mandate never touches it.`);
         }
     }
     else {
-        if (priceNum > maxPer) {
-            bad(`--price ${price} is above --max ${maxPer}, so every payment would be refused by your own mandate.\n  raise --max to at least ${price} (for example --max ${price}) or lower --price.`);
+        if (priceNum > maxPerFinal) {
+            bad(`--price ${price} is above --max ${maxPerFinal}, so every payment would be refused by your own mandate.\n  raise --max to at least ${price} (for example --max ${price}) or lower --price.`);
         }
-        if (priceNum > daily) {
-            bad(`--price ${price} is above --daily ${daily}: one payment would spend the whole day's budget and the second would be refused.\n  set --daily to at least ${price}.`);
+        if (priceNum > dailyFinal) {
+            bad(`--price ${price} is above --daily ${dailyFinal}: one payment would spend the whole day's budget and the second would be refused.\n  set --daily to at least ${price}.`);
         }
     }
     const vault = await StellarVault.load(data.vault, data.token.code, data.token.issuer, { principal: pub(keys.principal), approver: keys.approver ? pub(keys.approver) : undefined, agent: pub(keys.agent) }, network);
@@ -267,20 +286,31 @@ async function sell() {
             + `the daily budget of ${daily} cannot be enforced without it, so nothing was started. `
             + `Check the network and try again.`);
     }
-    policy.seedFromLedger(alreadyPaid);
+    policy.seedFromLedger(alreadyPaid, policy.categoryOf(payee));
     if (alreadyPaid > 0) {
-        log(`ledger says ${alreadyPaid.toFixed(2)} of the ${daily} daily budget is already spent today`);
-        if (alreadyPaid >= daily) {
-            bad(`today's budget is already gone: ${alreadyPaid.toFixed(2)} paid, ${daily} allowed.\n  `
+        log(`ledger says ${alreadyPaid.toFixed(2)} of the ${dailyFinal} daily budget is already spent today`);
+        if (alreadyPaid >= dailyFinal) {
+            bad(`today's budget is already gone: ${alreadyPaid.toFixed(2)} paid, ${dailyFinal} allowed.\n  `
                 + `the mandate would refuse every payment. Raise --daily or wait for the UTC day to roll over.`);
         }
     }
+    // Say out loud what the rules are, including the categories, so the numbers
+    // an owner set in a browser are visible to whoever starts the seller. A rule
+    // nobody can see is a rule nobody trusts.
+    const catNames = Object.keys(policy.policy.categories ?? {});
+    if (catNames.length) {
+        const mapped = Object.entries(policy.policy.payeeCategory ?? {});
+        log(`spending categories: ${catNames.map((c) => {
+            const r = policy.policy.categories[c];
+            return `${c} (${r.maxPerPayment ?? policy.policy.maxPerPayment}/payment, ${r.dailyBudget ?? dailyFinal}/day)`;
+        }).join(", ")}${mapped.length ? ` · ${mapped.length} wallet(s) mapped` : ""}`);
+    }
     if (network === "public") {
         console.log(`
   MAINNET — real money.
     token            ${data.token.code}
-    max per payment  ${maxPer}
-    daily budget     ${daily}
+    max per payment  ${maxPerFinal}
+    daily budget     ${dailyFinal}
     vault            ${vault.address}
     balance          ${await vault.balance()} ${data.token.code}
 `);
@@ -337,6 +367,25 @@ async function sell() {
         ],
         // The banner prints these numbers. This line is what makes them true.
         policy,
+        // Rules edited at the desk must survive the next restart, or the mandate in
+        // the banner is a promise that lasts until ctrl-c. Written back to the same
+        // config file, with the same 0600 as everywhere else in this file, because
+        // it also holds key material.
+        onPolicyChange: (p) => {
+            data.policy = {
+                ...(data.policy ?? {}),
+                // The marker that says "a human set these in a browser". Without it the
+                // app scripts' --max/--daily flags win on every restart and the edit is
+                // lost by morning.
+                savedByOwner: true,
+                maxPerPayment: p.maxPerPayment, dailyBudget: p.dailyBudget,
+                allowlist: p.allowlist ?? [], denylist: p.denylist ?? [],
+                categories: p.categories ?? {}, payeeCategory: p.payeeCategory ?? {},
+            };
+            writeFileSync(path, JSON.stringify(data, null, 2));
+            chmodSync(path, 0o600);
+            log(`rules saved to ${path}`);
+        },
     });
     let tunnel = null;
     if (tls) {

package/dist/desk.d.ts

@@ -1,6 +1,6 @@
 import { type IncomingMessage, type ServerResponse } from "node:http";
 import type { StellarVault } from "./vault.ts";
-import type { PolicyEngine } from "./policy.ts";
+import type { PolicyEngine, Policy } from "./policy.ts";
 import { type ApprovalChallenge } from "./phone.ts";
 /** A portal link is a capability: whoever holds it can approve. So it is long,
  *  random, and compared without leaking timing. */
@@ -96,10 +96,22 @@ export type DeskConfig = {
      * ceiling can actually hold.
      */
     policy?: PolicyEngine;
+    /**
+     * Called when the human edits the spending rules from the portal. The CLI
+     * wires this to the config file, so a rule set at the desk survives the next
+     * restart instead of resetting to the command-line defaults.
+     *
+     * A callback rather than a path: the desk must not know where secrets live.
+     * The config file also holds key material, so the writer stays with the code
+     * that already handles it (0600, same serialisation).
+     */
+    onPolicyChange?: (policy: Policy) => void;
 };
 export declare class ApprovalDesk {
     private records;
     private seq;
+    /** when /rules last saved, so the page can say "saved" without a query flag */
+    private rulesSavedAt;
     private server?;
     cfg: DeskConfig;
     constructor(cfg: DeskConfig);
@@ -168,6 +180,35 @@ export declare class ApprovalDesk {
     private mandateBlock;
     /** The mandate has been satisfied: count the money as spent. */
     private recordSpend;
+    /** The rules as they stand, for the /rules page. */
+    policyView(): Policy;
+    /** What today's counters read, per category, for the /rules page. */
+    private spentView;
+    /**
+     * The cross-origin gate used by every route that changes money or the rules
+     * that gate it. A cross-origin fetch POST is a CORS *simple request*: no
+     * preflight, so the attacker's page never sees the reply but the action still
+     * happens. Browsers always send Origin on POST and Sec-Fetch-Site on every
+     * request, so checking both closes that path while leaving local automation
+     * (curl, tests, the phone app on its own origin) alone.
+     *
+     * Returns a reason string when the request must be refused, null when it may
+     * proceed.
+     */
+    private crossOriginGate;
+    /**
+     * Apply an edit from the /rules form.
+     *
+     * The form carries the whole rule set, so this rebuilds rather than patches:
+     * what you see on the page is what gets saved, and a stale field cannot
+     * survive an edit. Names and numbers are validated inside PolicyEngine.update
+     * — this function only decides which fields the form is allowed to touch.
+     *
+     * Deliberately absent: maxMandateTtl and maxLiveMandates. Those are ledger
+     * constraints (sequence binding), not owner preferences, and a form field for
+     * them would be an invitation to configure a mandate the chain will refuse.
+     */
+    private applyRules;
     approve(id: string): Promise<DeskRecord>;
     /** Split mode step 1: ask the phone to sign. Nothing is submitted yet. */
     private requestPhoneSignature;

package/dist/desk.js

@@ -17,7 +17,8 @@ import { randomBytes, timingSafeEqual } from "node:crypto";
 import { Keypair } from "@stellar/stellar-sdk";
 import { TransactionBuilder } from "@stellar/stellar-sdk";
 import { passphrase } from "./vault.js";
-import { portalPage } from "./portal.js";
+import { DEFAULT_POLICY, normalizeCategory } from "./policy.js";
+import { portalPage, rulesPage } from "./portal.js";
 import { createApprovalChallenge, submitApproved, challengeQrPayload, } from "./phone.js";
 import { claimEscrow, prepareEscrowRelease } from "./escrow.js";
 /**
@@ -181,6 +182,30 @@ function cookieOf(req, name) {
     }
     return null;
 }
+/**
+ * Form-field readers for /rules. A form is untrusted input arriving on a route
+ * that gates money, so each reader narrows to one type instead of trusting the
+ * field name. Empty means "not supplied", which lets a blank input fall back to
+ * the engine's default rather than becoming a zero.
+ */
+function numField(v) {
+    const s = String(v ?? "").trim();
+    if (!s)
+        return undefined;
+    const n = Number(s);
+    return Number.isFinite(n) && n > 0 ? n : undefined;
+}
+/** One account id per line. Anything that is not G…56 is dropped, not warned. */
+function linesField(v) {
+    return String(v ?? "").split(/[\s,]+/).map((s) => s.trim().toUpperCase())
+        .filter((s) => /^G[A-Z2-7]{55}$/.test(s));
+}
+/** A Stellar account id, and nothing else. Same shape the policy engine accepts. */
+const isAccountId = (s) => /^G[A-Z2-7]{55}$/.test(s);
+/** A comma-separated list of ids carried by a hidden field. */
+function listField(v) {
+    return String(v ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+}
 function same(a, b) {
     const x = Buffer.from(a), y = Buffer.from(b);
     return x.length === y.length && timingSafeEqual(x, y);
@@ -188,6 +213,8 @@ function same(a, b) {
 export class ApprovalDesk {
     records = new Map();
     seq = 0;
+    /** when /rules last saved, so the page can say "saved" without a query flag */
+    rulesSavedAt = 0;
     server;
     cfg;
     constructor(cfg) { this.cfg = cfg; }
@@ -325,13 +352,20 @@ export class ApprovalDesk {
         // `pending` deliberately does NOT count: that is a request nobody has
         // approved, and counting the whole queue would refuse the first approval
         // just because more requests exist than the budget can cover.
-        const committed = this.list().reduce((sum, r) => (r.id !== rec.id && (r.status === "awaiting_phone" || r.status === "approved"))
-            ? sum + Number(r.price) : sum, 0);
+        const waiting = this.list().filter((r) => r.id !== rec.id && (r.status === "awaiting_phone" || r.status === "approved"));
+        const committed = waiting.reduce((sum, r) => sum + Number(r.price), 0);
+        // The same promise, counted inside the payee's category. A category budget
+        // that ignored the queue would let the human approve five payments and have
+        // the fifth fail at submission. This desk pays one payee, so every waiting
+        // record belongs to that payee's bucket — no per-record lookup needed.
+        const category = policy.categoryOf(this.cfg.payee);
+        const committedInCategory = category ? committed : undefined;
         const verdict = policy.check({
             amount: Number(rec.price),
             payee: this.cfg.payee,
             ttl: this.cfg.decideWithinSeconds,
             committed,
+            committedInCategory,
         });
         if (verdict.ok)
             return null;
@@ -350,6 +384,136 @@ export class ApprovalDesk {
             uri: rec.uri, mandateHash: tx,
         });
     }
+    /** The rules as they stand, for the /rules page. */
+    policyView() {
+        return this.cfg.policy?.policy ?? { ...DEFAULT_POLICY };
+    }
+    /** What today's counters read, per category, for the /rules page. */
+    spentView() {
+        const p = this.cfg.policy;
+        if (!p)
+            return { total: 0, byCategory: {} };
+        const byCategory = {};
+        for (const name of Object.keys(p.policy.categories ?? {}))
+            byCategory[name] = p.spentInCategory(name);
+        return { total: p.spentToday(), byCategory };
+    }
+    /**
+     * The cross-origin gate used by every route that changes money or the rules
+     * that gate it. A cross-origin fetch POST is a CORS *simple request*: no
+     * preflight, so the attacker's page never sees the reply but the action still
+     * happens. Browsers always send Origin on POST and Sec-Fetch-Site on every
+     * request, so checking both closes that path while leaving local automation
+     * (curl, tests, the phone app on its own origin) alone.
+     *
+     * Returns a reason string when the request must be refused, null when it may
+     * proceed.
+     */
+    crossOriginGate(req) {
+        const origin = String(req.headers.origin ?? "");
+        if (origin) {
+            const here = String(req.headers.host ?? "").toLowerCase();
+            let oh;
+            try {
+                oh = new URL(origin).host.toLowerCase();
+            }
+            catch {
+                oh = "";
+            }
+            if (oh !== here)
+                return `this desk only accepts actions from itself, not from ${origin}`;
+        }
+        const site = String(req.headers["sec-fetch-site"] ?? "").toLowerCase();
+        if (site && site !== "same-origin" && site !== "none") {
+            return `this desk only accepts same-site actions (got ${site})`;
+        }
+        return null;
+    }
+    /**
+     * Apply an edit from the /rules form.
+     *
+     * The form carries the whole rule set, so this rebuilds rather than patches:
+     * what you see on the page is what gets saved, and a stale field cannot
+     * survive an edit. Names and numbers are validated inside PolicyEngine.update
+     * — this function only decides which fields the form is allowed to touch.
+     *
+     * Deliberately absent: maxMandateTtl and maxLiveMandates. Those are ledger
+     * constraints (sequence binding), not owner preferences, and a form field for
+     * them would be an invitation to configure a mandate the chain will refuse.
+     */
+    applyRules(action, form) {
+        const engine = this.cfg.policy;
+        if (!engine)
+            return { ...DEFAULT_POLICY };
+        const current = engine.policy;
+        const dropped = new Set(listField(form.get("delcat")));
+        // A category whose name was edited, old -> new. The page renders the name as
+        // a hidden field, so this only fires for a hand-crafted POST; keeping the
+        // mapping rather than dropping it means a rename never silently removes a
+        // wallet's ceiling.
+        const renamed = new Map();
+        const next = {};
+        const maxPer = numField(form.get("maxPerPayment"));
+        const daily = numField(form.get("dailyBudget"));
+        if (maxPer !== undefined)
+            next.maxPerPayment = maxPer;
+        if (daily !== undefined)
+            next.dailyBudget = daily;
+        next.allowlist = linesField(form.get("allowlist"));
+        next.denylist = linesField(form.get("denylist"));
+        // Categories: rebuilt from the rows the page shows, minus the ones the
+        // human removed, plus the one they just typed.
+        const categories = {};
+        for (const [key, value] of form) {
+            const m = /^cat_(.{1,32})_name$/.exec(key);
+            if (!m)
+                continue;
+            const was = m[1];
+            const name = normalizeCategory(value || was);
+            if (!name || dropped.has(was) || dropped.has(name))
+                continue;
+            if (name !== was)
+                renamed.set(was, name);
+            categories[name] = {
+                maxPerPayment: numField(form.get(`cat_${was}_max`)),
+                dailyBudget: numField(form.get(`cat_${was}_daily`)),
+            };
+        }
+        // Both "add" boxes are processed whenever they are filled, not only when
+        // their own button was pressed. The alternative is a form where typing a
+        // wallet and pressing the wrong button silently discards what was typed —
+        // and a rule that vanishes without an error is worse than a strict one.
+        const addCat = normalizeCategory(form.get("newcat"));
+        if (addCat && !dropped.has(addCat)) {
+            categories[addCat] = {
+                maxPerPayment: numField(form.get("newcat_max")),
+                dailyBudget: numField(form.get("newcat_daily")),
+            };
+        }
+        next.categories = categories;
+        // Wallet → category map: keep what is there, drop what was removed, add the
+        // new one. Rebuilt from the engine rather than the form, because a form
+        // field for the whole map would let a POST invent mappings for accounts
+        // nobody typed. A renamed bucket carries its wallets with it, so a rename
+        // can never quietly drop a ceiling.
+        const droppedMap = new Set(listField(form.get("delmap")));
+        const payeeCategory = {};
+        for (const [payee, name] of Object.entries(current.payeeCategory ?? {})) {
+            if (droppedMap.has(payee))
+                continue;
+            payeeCategory[payee] = renamed.get(name) ?? name;
+        }
+        const addWallet = String(form.get("newpayee") ?? "").trim().toUpperCase();
+        const addCatForWallet = normalizeCategory(form.get("newpayee_cat"));
+        if (isAccountId(addWallet) && addCatForWallet && categories[addCatForWallet]) {
+            payeeCategory[addWallet] = addCatForWallet;
+        }
+        next.payeeCategory = payeeCategory;
+        const policy = engine.update(next);
+        console.log(`[desk] spending rules updated (${action}): max ${policy.maxPerPayment}, daily ${policy.dailyBudget}, `
+            + `${Object.keys(policy.categories ?? {}).length} categories, ${Object.keys(policy.payeeCategory ?? {}).length} wallets mapped`);
+        return policy;
+    }
     async approve(id) {
         this.sweepExpired();
         const rec = this.records.get(id);
@@ -765,6 +929,43 @@ export class ApprovalDesk {
                 }
                 if (url.pathname === "/list")
                     return send(200, this.list());
+                // The spending rules. Read-only view of the mandate the desk enforces,
+                // plus the form that edits it. Key-gated like everything else: these
+                // numbers decide what money leaves the vault, so an unauthenticated
+                // /rules would be an open "raise the budget" endpoint.
+                if (url.pathname === "/rules" && req.method === "GET") {
+                    res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+                    res.end(rulesPage(this.policyView(), this.spentView(), this.cfg.vault.address, this.cfg.vault.network, qs, Date.now() - this.rulesSavedAt < 15_000));
+                    return;
+                }
+                if (url.pathname === "/rules.js") {
+                    const body = readPortalFile("rules.js");
+                    if (body === null)
+                        return notFound(res);
+                    res.writeHead(200, {
+                        "content-type": "text/javascript; charset=utf-8",
+                        "x-content-type-options": "nosniff",
+                    });
+                    res.end(body);
+                    return;
+                }
+                if (url.pathname === "/rules" && req.method === "POST") {
+                    // Editing the rules moves money indirectly, so it gets the same
+                    // cross-origin gate as /approve: a page on another site must not be
+                    // able to POST a form that raises your daily budget.
+                    const gate = this.crossOriginGate(req);
+                    if (gate)
+                        return send(403, { error: "cross_origin", reason: gate });
+                    const body = await readBody(req);
+                    const form = new URLSearchParams(body);
+                    const action = form.get("action") ?? "save";
+                    const policy = this.applyRules(action, form);
+                    this.rulesSavedAt = Date.now();
+                    this.cfg.onPolicyChange?.(policy);
+                    res.writeHead(303, { location: "/rules" + (this.cfg.portalKey ? `?k=${encodeURIComponent(this.cfg.portalKey)}` : "") });
+                    res.end();
+                    return;
+                }
                 // The approver app's list view. Key-gated like everything else, and it
                 // carries no paid content and no challenge XDR.
                 if (url.pathname === "/queue")
@@ -831,31 +1032,10 @@ export class ApprovalDesk {
                 const m = url.pathname.match(/^\/(approve|deny|signed)\/([\w-]+)$/);
                 if (m && req.method === "POST") {
                     // These routes move money, so they must not be reachable from another
-                    // page. A cross-origin fetch POST is a CORS *simple request*: no
-                    // preflight, so the attacker's page never sees the reply but the
-                    // approval still happens. Verified end to end: a page on another port
-                    // settled a parked payment and paid the seller. Browsers always send
-                    // Origin on POST and Sec-Fetch-Site on every request, so checking both
-                    // closes that path while leaving local automation (curl, tests, the
-                    // phone app on its own origin) alone.
-                    const origin = String(req.headers.origin ?? "");
-                    if (origin) {
-                        const here = String(req.headers.host ?? "").toLowerCase();
-                        let oh;
-                        try {
-                            oh = new URL(origin).host.toLowerCase();
-                        }
-                        catch {
-                            oh = "";
-                        }
-                        if (oh !== here) {
-                            return send(403, { error: "cross_origin", reason: `this desk only accepts actions from itself, not from ${origin}` });
-                        }
-                    }
-                    const site = String(req.headers["sec-fetch-site"] ?? "").toLowerCase();
-                    if (site && site !== "same-origin" && site !== "none") {
-                        return send(403, { error: "cross_origin", reason: `this desk only accepts same-site actions (got ${site})` });
-                    }
+                    // page — same gate as /rules, see crossOriginGate.
+                    const gate = this.crossOriginGate(req);
+                    if (gate)
+                        return send(403, { error: "cross_origin", reason: gate });
                     if (m[1] === "signed") {
                         const body = await readBody(req);
                         const { signedXdr } = JSON.parse(body || "{}");

package/dist/gateway.d.ts

@@ -2,7 +2,7 @@ import { type IncomingMessage, type Server, type ServerResponse } from "node:htt
 import { Keypair, Transaction } from "@stellar/stellar-sdk";
 import { StellarVault, StellarTxError, type Amount, type Mandate, type Network } from "./vault.ts";
 import { ApprovalDesk, type DeskStore } from "./desk.ts";
-import type { PolicyEngine } from "./policy.ts";
+import type { PolicyEngine, Policy } from "./policy.ts";
 import { claimEscrow } from "./escrow.ts";
 export declare const PAY_HEADER = "x-payment";
 export type Route = {
@@ -71,6 +71,11 @@ export type GatewayConfig = {
      * enforced — see DeskConfig.policy for why the gateway is the wrong place.
      */
     policy?: PolicyEngine;
+    /**
+     * Persist an edited spending policy. Passed straight to the desk; see
+     * DeskConfig.onPolicyChange for why it is a callback.
+     */
+    onPolicyChange?: (policy: Policy) => void;
 };
 export type PaymentProof = {
     /** pre-authorised envelope, base64 XDR, as issued by the vault */

package/dist/gateway.js

@@ -49,6 +49,7 @@ export class Gateway {
             publicHost: cfg.publicHost,
             decideWithinSeconds: cfg.decideWithinSeconds,
             policy: cfg.policy,
+            onPolicyChange: cfg.onPolicyChange,
         });
     }
     /** Mandates the vault currently holds, so the gateway can hand them out. */

package/dist/policy.d.ts

@@ -1,3 +1,22 @@
+/**
+ * A named bucket of spending with its own ceilings.
+ *
+ * This is the "transaction categories" idea: the same mandate, sliced by what
+ * the money is for. A vault can say "data APIs cost me $5 a day, my coding
+ * assistant costs $50 a month" without two vaults or two mandates.
+ *
+ * A category can only TIGHTEN the base mandate. It has no floor of its own:
+ * a category ceiling above the base ceiling is a number that can never bind,
+ * because the base ceiling already refused the payment. That asymmetry is the
+ * security property — adding a category can never widen what the agent may
+ * spend, only narrow it.
+ */
+export type CategoryRule = {
+    /** ceiling on any single payment in this category */
+    maxPerPayment?: number;
+    /** total across a calendar day for this category */
+    dailyBudget?: number;
+};
 export type Policy = {
     /** hard ceiling on any single payment */
     maxPerPayment: number;
@@ -15,14 +34,23 @@ export type Policy = {
      * matches what the ledger will actually honour.
      */
     maxLiveMandates: number;
+    /** named spend buckets, keyed by category name */
+    categories?: Record<string, CategoryRule>;
+    /** which category a seller's account falls into */
+    payeeCategory?: Record<string, string>;
 };
 export declare const DEFAULT_POLICY: Policy;
+/** A category name is rendered into HTML and stored in a config file, so it is
+ *  reduced to a safe alphabet here rather than escaped at every use site. */
+export declare function normalizeCategory(name: unknown): string;
 export type SpendEvent = {
     at: number;
     amount: number;
     payee: string;
     uri?: string;
     mandateHash?: string;
+    /** the bucket this spend counts against, when the payee is categorised */
+    category?: string;
 };
 export type Verdict = {
     ok: true;
@@ -36,6 +64,20 @@ export declare class PolicyEngine {
     policy: Policy;
     constructor(policy?: Partial<Policy>);
     record(e: SpendEvent): void;
+    /** Which bucket a seller's account belongs to, or undefined if uncategorised. */
+    categoryOf(payee: string): string | undefined;
+    /**
+     * Replace the policy from an untrusted source (the rules editor, a config
+     * file). Names are normalised and numbers validated here, so a bad value
+     * cannot smuggle markup or a negative ceiling into the engine.
+     *
+     * The owner may widen the counters this file keeps — the daily total and the
+     * allowlist are ours to count. What this cannot touch is the per-payment
+     * ceiling baked into the mandate's transaction hash: raise it here and the
+     * ledger still refuses above the mandate amount. `effectiveMaxPerPayment()`
+     * reports the number that actually binds so the UI can say so honestly.
+     */
+    update(next: Partial<Policy>): Policy;
     /**
      * Seed the day's total from the ledger instead of from this process's memory.
      *
@@ -44,9 +86,11 @@ export declare class PolicyEngine {
      * holds until the next restart. Seeding from the ledger makes the budget a
      * property of the vault, not of the uptime of whichever machine ran `sell`.
      */
-    seedFromLedger(amount: number): void;
+    seedFromLedger(amount: number, category?: string): void;
     /** Everything spent in the current UTC day. */
     spentToday(): number;
+    /** Everything spent in one category in the current UTC day. */
+    spentInCategory(category: string): number;
     today(): SpendEvent[];
     /**
      * Check a request BEFORE any transaction is built. Returns the reason a
@@ -66,5 +110,11 @@ export declare class PolicyEngine {
          * instead, which is the point of having a human in the loop.
          */
         committed?: number;
+        /**
+         * Same, per category. A category budget that ignores the queue has the same
+         * hole the daily budget had: the human approves five payments, the fifth
+         * fails, and the approval gesture was wasted.
+         */
+        committedInCategory?: number;
     }): Verdict;
 }

package/dist/policy.js

@@ -5,14 +5,81 @@ export const DEFAULT_POLICY = {
     denylist: [],
     maxMandateTtl: 3600,
     maxLiveMandates: 1,
+    categories: {},
+    payeeCategory: {},
 };
+/** A category name is rendered into HTML and stored in a config file, so it is
+ *  reduced to a safe alphabet here rather than escaped at every use site. */
+export function normalizeCategory(name) {
+    return String(name ?? "").trim().toLowerCase().replace(/[^a-z0-9_-]/g, "").slice(0, 32);
+}
 export class PolicyEngine {
     events = [];
     policy;
     constructor(policy = {}) {
         this.policy = { ...DEFAULT_POLICY, ...policy };
     }
-    record(e) { this.events.push(e); }
+    record(e) {
+        if (!e.category) {
+            const named = this.categoryOf(e.payee);
+            if (named)
+                e = { ...e, category: named };
+        }
+        this.events.push(e);
+    }
+    /** Which bucket a seller's account belongs to, or undefined if uncategorised. */
+    categoryOf(payee) {
+        const named = this.policy.payeeCategory?.[payee];
+        return named ? normalizeCategory(named) : undefined;
+    }
+    /**
+     * Replace the policy from an untrusted source (the rules editor, a config
+     * file). Names are normalised and numbers validated here, so a bad value
+     * cannot smuggle markup or a negative ceiling into the engine.
+     *
+     * The owner may widen the counters this file keeps — the daily total and the
+     * allowlist are ours to count. What this cannot touch is the per-payment
+     * ceiling baked into the mandate's transaction hash: raise it here and the
+     * ledger still refuses above the mandate amount. `effectiveMaxPerPayment()`
+     * reports the number that actually binds so the UI can say so honestly.
+     */
+    update(next) {
+        const merged = { ...this.policy, ...next };
+        // A garbage or blank number falls back to the rule that was in force a
+        // moment ago, NOT to DEFAULT_POLICY. Falling back to the default would make
+        // a malformed edit silently LOOSEN the mandate — an empty maxPerPayment on
+        // a form would turn a 2 into the default 50. Keeping the previous value
+        // means a bad field is a no-op, which is the only safe reading of a form
+        // that gates money.
+        merged.maxPerPayment = positive(merged.maxPerPayment, this.policy.maxPerPayment);
+        merged.dailyBudget = positive(merged.dailyBudget, this.policy.dailyBudget);
+        merged.maxMandateTtl = positive(merged.maxMandateTtl, this.policy.maxMandateTtl);
+        merged.maxLiveMandates = 1; // Stellar sequence binding: see Policy.maxLiveMandates
+        merged.allowlist = (merged.allowlist ?? []).filter(isAccount);
+        merged.denylist = (merged.denylist ?? []).filter(isAccount);
+        const cats = {};
+        for (const [name, rule] of Object.entries(merged.categories ?? {})) {
+            const key = normalizeCategory(name);
+            if (!key)
+                continue;
+            cats[key] = {
+                maxPerPayment: rule?.maxPerPayment === undefined ? undefined : positive(rule.maxPerPayment, merged.maxPerPayment),
+                dailyBudget: rule?.dailyBudget === undefined ? undefined : positive(rule.dailyBudget, merged.dailyBudget),
+            };
+        }
+        merged.categories = cats;
+        const map = {};
+        for (const [payee, name] of Object.entries(merged.payeeCategory ?? {})) {
+            if (!isAccount(payee))
+                continue;
+            const key = normalizeCategory(name);
+            if (key && cats[key])
+                map[payee] = key;
+        }
+        merged.payeeCategory = map;
+        this.policy = merged;
+        return this.policy;
+    }
     /**
      * Seed the day's total from the ledger instead of from this process's memory.
      *
@@ -21,14 +88,14 @@ export class PolicyEngine {
      * holds until the next restart. Seeding from the ledger makes the budget a
      * property of the vault, not of the uptime of whichever machine ran `sell`.
      */
-    seedFromLedger(amount) {
+    seedFromLedger(amount, category) {
         if (!(amount > 0))
             return;
         // One synthetic event at the start of the day: it counts toward the total
         // without pretending to be a payment this process can re-enact.
         const start = new Date();
         start.setUTCHours(0, 0, 0, 0);
-        this.record({ at: start.getTime(), amount, payee: "ledger" });
+        this.record({ at: start.getTime(), amount, payee: "ledger", category });
     }
     /** Everything spent in the current UTC day. */
     spentToday() {
@@ -37,6 +104,15 @@ export class PolicyEngine {
         const t = start.getTime();
         return this.events.filter((e) => e.at >= t).reduce((a, b) => a + b.amount, 0);
     }
+    /** Everything spent in one category in the current UTC day. */
+    spentInCategory(category) {
+        const start = new Date();
+        start.setUTCHours(0, 0, 0, 0);
+        const t = start.getTime();
+        return this.events
+            .filter((e) => e.at >= t && e.category === category)
+            .reduce((a, b) => a + b.amount, 0);
+    }
     today() {
         const start = new Date();
         start.setUTCHours(0, 0, 0, 0);
@@ -62,6 +138,22 @@ export class PolicyEngine {
         if (p.allowlist?.length && !p.allowlist.includes(req.payee)) {
             return no("allowlist", `${short(req.payee)} is not on the approved seller list`);
         }
+        // Category ceilings, checked last so a refusal names the narrowest rule it
+        // actually broke. A category can only tighten the base mandate: the base
+        // ceilings above already ran, so a category limit above them is inert.
+        const category = this.categoryOf(req.payee);
+        if (category) {
+            const rule = p.categories?.[category];
+            if (rule?.maxPerPayment !== undefined && req.amount > rule.maxPerPayment) {
+                return no("category_max_per_payment", `${req.amount} exceeds the ${category} per-payment ceiling of ${rule.maxPerPayment}`);
+            }
+            if (rule?.dailyBudget !== undefined) {
+                const inCat = this.spentInCategory(category) + (req.committedInCategory ?? 0);
+                if (inCat + req.amount > rule.dailyBudget) {
+                    return no("category_daily_budget", `${req.amount} would take the ${category} budget to ${(inCat + req.amount).toFixed(2)}, over its ${rule.dailyBudget} limit (${this.spentInCategory(category).toFixed(2)} paid${req.committedInCategory ? ` + ${req.committedInCategory.toFixed(2)} already approved and waiting` : ""})`);
+                }
+            }
+        }
         if (req.ttl !== undefined && req.ttl > p.maxMandateTtl) {
             return no("max_ttl", `mandate would live ${req.ttl}s, longer than the ${p.maxMandateTtl}s limit`);
         }
@@ -73,3 +165,10 @@ export class PolicyEngine {
 }
 const no = (rule, detail) => ({ ok: false, rule, detail });
 const short = (k) => k.slice(0, 6) + "…" + k.slice(-4);
+/** A Stellar account id, and nothing else. */
+const isAccount = (s) => /^G[A-Z2-7]{55}$/.test(String(s ?? ""));
+/** Coerce to a usable positive number, falling back to the default. */
+function positive(v, fallback) {
+    const n = Number(v);
+    return Number.isFinite(n) && n > 0 ? n : fallback;
+}

package/dist/portal.d.ts

@@ -1,9 +1,26 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { DeskRecord } from "./desk.ts";
+import type { Policy } from "./policy.ts";
 /**
  * HTML escaping. Not optional: the request path and body are attacker-chosen
  * text that lands inside the one page that can authorise a payment.
  */
 export declare function esc(v: unknown): string;
 export declare function portalPage(records: DeskRecord[], vault: string, network: string, qs?: string): string;
+/**
+ * The spending rules, as a form the owner can read and edit.
+ *
+ * This is the surface the "customizable approval policy" request is really
+ * about: limits, approved wallets, and categories in one place, instead of
+ * command-line flags nobody outside a terminal can see.
+ *
+ * What it does NOT do is approve anything. Every payment still needs a human
+ * signature; these rules only decide what a human gets asked to sign. A rule
+ * set here can narrow the agent's reach, never widen what the ledger will
+ * accept, and the page says so in the same words the code enforces.
+ */
+export declare function rulesPage(policy: Policy, spent: {
+    total: number;
+    byCategory: Record<string, number>;
+}, vault: string, network: string, qs?: string, saved?: boolean): string;
 export declare function servePortal(req: IncomingMessage, res: ServerResponse, html: string): void;

package/dist/portal.js

@@ -19,12 +19,108 @@ export function portalPage(records, vault, network, qs = "") {
 <title>Paydlux — approvals</title>
 <link rel="stylesheet" href="portal.css"></head><body>
 <h1>Paydlux — approvals</h1>
-<div class="sub">vault ${esc(vault)} · ${esc(network)} · refreshed <span id="t">now</span></div>
+<div class="sub"><a class="nav" href="/${qs}">approvals</a> · <a class="nav" href="/rules${qs}">spending rules</a><br>
+vault ${esc(vault)} · ${esc(network)} · refreshed <span id="t">now</span></div>
 <table><thead><tr><th>when</th><th>what</th><th>cost</th><th>status</th><th></th></tr></thead>
 <tbody>${rows}</tbody></table>
 <div class="foot">Approving signs a Stellar transaction with your key. The vault needs two signatures, so this device alone cannot release funds.</div>
 <script src="portal.js"></script></body></html>`;
 }
+/**
+ * The spending rules, as a form the owner can read and edit.
+ *
+ * This is the surface the "customizable approval policy" request is really
+ * about: limits, approved wallets, and categories in one place, instead of
+ * command-line flags nobody outside a terminal can see.
+ *
+ * What it does NOT do is approve anything. Every payment still needs a human
+ * signature; these rules only decide what a human gets asked to sign. A rule
+ * set here can narrow the agent's reach, never widen what the ledger will
+ * accept, and the page says so in the same words the code enforces.
+ */
+export function rulesPage(policy, spent, vault, network, qs = "", saved = false) {
+    const cats = Object.entries(policy.categories ?? {});
+    const catRows = cats.length
+        ? cats.map(([name, rule]) => categoryRow(name, rule, policy, spent.byCategory[name] ?? 0)).join("\n")
+        : `<tr><td colspan="5" class="empty">no categories — every seller shares the daily budget</td></tr>`;
+    const mapped = Object.entries(policy.payeeCategory ?? {});
+    return `<!doctype html><html><head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Paydlux — spending rules</title>
+<link rel="stylesheet" href="portal.css"></head><body>
+<h1>Paydlux — spending rules</h1>
+<div class="sub"><a class="nav" href="/${qs}">approvals</a> · <a class="nav" href="/rules${qs}">spending rules</a><br>
+vault ${esc(vault)} · ${esc(network)}${saved ? ` · <span class="saved">saved</span>` : ""}</div>
+
+<form id="rules" method="post" action="/rules${qs}">
+<h2>Every payment</h2>
+<div class="grid">
+  <label>Most for one payment
+    <input name="maxPerPayment" type="number" min="0.0000001" step="0.0000001" value="${esc(policy.maxPerPayment)}"></label>
+  <label>Daily budget
+    <input name="dailyBudget" type="number" min="0.0000001" step="0.0000001" value="${esc(policy.dailyBudget)}"></label>
+</div>
+<p class="note">Spent today: <b>${esc(spent.total.toFixed(7))}</b> of ${esc(policy.dailyBudget)}. The day resets at 00:00 UTC.</p>
+
+<h2>Wallets the agent may pay</h2>
+<div class="grid">
+  <label>Allowed (one account per line, blank = any)
+    <textarea name="allowlist" rows="3" spellcheck="false" autocomplete="off">${esc((policy.allowlist ?? []).join("\n"))}</textarea></label>
+  <label>Never allowed, even if listed above
+    <textarea name="denylist" rows="3" spellcheck="false" autocomplete="off">${esc((policy.denylist ?? []).join("\n"))}</textarea></label>
+</div>
+
+<h2>Categories</h2>
+<p class="note">Split the daily budget by what the money is for. A category can only be
+tighter than the limits above — it can never raise them.</p>
+<table class="cats"><thead><tr><th>name</th><th>max / payment</th><th>daily</th><th>spent today</th><th></th></tr></thead>
+<tbody id="catbody">${catRows}</tbody></table>
+<div class="addcat">
+  <input name="newcat" placeholder="name (a-z, 0-9)" maxlength="32" spellcheck="false" autocomplete="off">
+  <input name="newcat_max" type="number" min="0.0000001" step="0.0000001" placeholder="max / payment">
+  <input name="newcat_daily" type="number" min="0.0000001" step="0.0000001" placeholder="daily">
+  <button class="yes" type="submit" name="action" value="add">Add category</button>
+</div>
+
+<h2>Which wallet is in which category</h2>
+${mapped.length
+        ? `<table class="map"><thead><tr><th>wallet</th><th>category</th></tr></thead><tbody>
+${mapped.map(([payee, name]) => `<tr><td class="tx">${esc(payee)}</td><td>${esc(name)}`
+            + ` <button class="no mini" data-del="${esc(payee)}" data-map="1">Remove</button></td></tr>`).join("\n")}
+</tbody></table>`
+        : `<p class="note">Nothing categorised yet. Add a wallet below to cap it on its own.</p>`}
+<div class="addcat">
+  <input name="newpayee" placeholder="G… wallet address" maxlength="56" spellcheck="false" autocomplete="off">
+  <input name="newpayee_cat" placeholder="category" maxlength="32" spellcheck="false" autocomplete="off">
+  <button class="yes" type="submit" name="action" value="map">Add</button>
+</div>
+
+<div class="save">
+  <button class="yes" type="submit" name="action" value="save">Save rules</button>
+</div>
+</form>
+
+<div class="foot">These rules decide what you are <i>asked</i> to approve. They never approve
+anything themselves: every payment still needs your signature, and the vault needs two.</div>
+<script src="rules.js"></script></body></html>`;
+}
+function categoryRow(name, rule, policy, spent) {
+    // Names go in both a hidden value and the delete button's data-*, so they are
+    // escaped like any other attacker-chosen string — even though update() already
+    // reduced them to [a-z0-9_-].
+    //
+    // The name is deliberately NOT an editable input. Renaming a bucket would
+    // orphan every wallet mapped to it, and an orphaned wallet stops having a
+    // category ceiling — a rename would silently loosen the rules while looking
+    // like a cosmetic edit. Renaming is therefore remove + add, which forces the
+    // human to re-map the wallets and see what they are doing.
+    return `<tr>
+  <td><span class="catname">${esc(name)}</span><input type="hidden" name="cat_${esc(name)}_name" value="${esc(name)}"></td>
+  <td><input name="cat_${esc(name)}_max" type="number" min="0.0000001" step="0.0000001" value="${esc(rule.maxPerPayment ?? "")}" placeholder="${esc(policy.maxPerPayment)}"></td>
+  <td><input name="cat_${esc(name)}_daily" type="number" min="0.0000001" step="0.0000001" value="${esc(rule.dailyBudget ?? "")}" placeholder="${esc(policy.dailyBudget)}"></td>
+  <td class="amt">${esc(spent.toFixed(7))}</td>
+  <td><button class="no" data-del="${esc(name)}">Remove</button></td></tr>`;
+}
 function render(r, qs = "") {
     // qs is the portal key query string ("?k=..."). The approver link has to carry
     // it, because the desk answers 403 for anything without it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paydlux/agent",
-  "version": "0.1.22",
+  "version": "0.1.23",
   "description": "Payments for AI agents that a human approves. Spending mandates enforced on the Stellar ledger: 2-of-2 vault, pre-authorised transaction envelopes, HTTP 402, USDC.",
   "type": "module",
   "main": "./dist/index.js",
@@ -24,6 +24,7 @@
     "phone-app/icon-512.png",
     "portal-app/portal.js",
     "portal-app/portal.css",
+    "portal-app/rules.js",
     "README.md",
     "LICENSE"
   ],
@@ -44,6 +45,7 @@
     "test:stellar": "tsx stellar/demo.ts",
     "test:portal": "tsx stellar/xss-check.ts",
     "test:mandate": "tsx stellar/mandate-check.ts",
+    "test:policy": "tsx stellar/policy-check.ts",
     "test:phone": "tsx stellar/phone-check.ts && tsx stellar/desk-split-check.ts && tsx stellar/mandate-check.ts && tsx stellar/e2e-phone.ts && tsx phone-app/xdr-check.ts && tsx phone-app/app-check.ts && tsx phone-app/desk-app-check.ts && tsx ios/bridge-check.ts && tsx phone-app/ui-check.ts",
     "test:ios": "tsx ios/bridge-check.ts",
     "test:link": "swiftc ios/PaydluxApprover/LinkResolver.swift ios/Checks/linkcheck/main.swift -o \"$TMPDIR/linkcheck\" && \"$TMPDIR/linkcheck\"",

package/portal-app/portal.css

@@ -19,4 +19,26 @@ button{border:0;border-radius:10px;padding:12px 18px;font-size:15px;font-weight:
 details summary{cursor:pointer}
 .phlink{color:var(--gold);text-decoration:underline;font-size:12px}
 .foot{margin-top:28px;color:var(--muted);font-size:12px}
+
+/* --- spending rules page --- */
+h2{font-size:13px;color:var(--muted);text-transform:uppercase;letter-spacing:.06em;margin:28px 0 10px}
+.grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}
+label{display:block;color:var(--muted);font-size:12px}
+input,textarea{display:block;width:100%;margin-top:6px;background:#141715;color:var(--text);
+  border:1px solid var(--line);border-radius:10px;padding:11px 12px;font:15px/1.4 ui-monospace,monospace}
+textarea{resize:vertical}
+input:focus,textarea:focus{outline:none;border-color:var(--gold)}
+.note{color:var(--muted);font-size:13px;margin:10px 0}
+.note b{color:var(--gold)}
+table.cats,table.map{margin-top:6px}
+table.cats td{padding:8px 6px}
+.addcat{display:flex;gap:10px;align-items:end;margin-top:10px;flex-wrap:wrap}
+.addcat input{flex:1;min-width:140px}
+.addcat button{width:auto;flex:0 0 auto}
+.save{margin-top:26px}
+.save button{width:auto;min-width:180px}
+button.mini{display:inline;width:auto;padding:4px 10px;font-size:12px;margin:0}
+.nav{color:var(--gold);text-decoration:underline}
+.saved{color:var(--green);font-weight:700}
+@media(max-width:640px){.grid{grid-template-columns:1fr}}
 @media(max-width:640px){.body{max-width:180px}}

package/portal-app/rules.js

@@ -0,0 +1,62 @@
+// The spending-rules page's client half. Served by the desk at /rules.js.
+//
+// The page is a plain HTML form, so it works with JavaScript off. This file
+// only adds the two things a form cannot do by itself: a Remove button that
+// queues the row for deletion and submits, and a confirm before a rule that
+// gates money is loosened.
+//
+// No inline handlers, so the page's CSP keeps script-src 'self'. Category names
+// arrive from the server already reduced to [a-z0-9_-]; they are still read
+// through dataset, never interpolated into markup, so nothing here can be
+// turned into HTML by a name.
+const form = document.getElementById("rules");
+if (!form) throw new Error("rules page has no #rules form");
+
+// Hidden fields the server reads as "delete these". Accumulating rather than
+// replacing means a human can remove three rows before pressing Save.
+const hidden = (name) => {
+  let el = form.querySelector(`input[name="${name}"]`);
+  if (!el) {
+    el = document.createElement("input");
+    el.type = "hidden";
+    el.name = name;
+    form.appendChild(el);
+  }
+  return el;
+};
+
+document.addEventListener("click", (e) => {
+  const b = e.target.closest("button[data-del]");
+  if (!b) return;
+  e.preventDefault();
+  const field = b.dataset.map ? "delmap" : "delcat";
+  const el = hidden(field);
+  const val = b.dataset.del;
+  const have = el.value ? el.value.split(",") : [];
+  if (!have.includes(val)) have.push(val);
+  el.value = have.join(",");
+  // The row goes immediately: the human sees the rule stop protecting them
+  // before they press Save, which is the point of the confirm.
+  b.closest("tr")?.remove();
+  form.requestSubmit();
+});
+
+// A wider ceiling is the one edit that can only hurt. The ledger still caps a
+// single payment at the mandate amount, but the daily budget and the seller
+// list are ours to count, so raising them is a real loosening. Ask once.
+const limits = ["maxPerPayment", "dailyBudget"];
+const start = Object.fromEntries(
+  limits.map((n) => [n, form.querySelector(`[name="${n}"]`)?.value ?? ""]));
+
+form.addEventListener("submit", (e) => {
+  const raised = limits.filter((n) => {
+    const now = Number(form.querySelector(`[name="${n}"]`)?.value);
+    const was = Number(start[n]);
+    return Number.isFinite(now) && Number.isFinite(was) && now > was;
+  });
+  if (!raised.length) return;
+  const ok = confirm(
+    `This raises ${raised.join(" and ")}. Higher limits mean the agent may ask you for ` +
+    `more money, more often. Continue?`);
+  if (!ok) e.preventDefault();
+});