@paydlux/agent 0.1.22 → 0.1.24

package/dist/portal.js

@@ -19,12 +19,108 @@ export function portalPage(records, vault, network, qs = "") {
 <title>Paydlux — approvals</title>
 <link rel="stylesheet" href="portal.css"></head><body>
 <h1>Paydlux — approvals</h1>
-<div class="sub">vault ${esc(vault)} · ${esc(network)} · refreshed <span id="t">now</span></div>
+<div class="sub"><a class="nav" href="/${qs}">approvals</a> · <a class="nav" href="/rules${qs}">spending rules</a><br>
+vault ${esc(vault)} · ${esc(network)} · refreshed <span id="t">now</span></div>
 <table><thead><tr><th>when</th><th>what</th><th>cost</th><th>status</th><th></th></tr></thead>
 <tbody>${rows}</tbody></table>
 <div class="foot">Approving signs a Stellar transaction with your key. The vault needs two signatures, so this device alone cannot release funds.</div>
 <script src="portal.js"></script></body></html>`;
 }
+/**
+ * The spending rules, as a form the owner can read and edit.
+ *
+ * This is the surface the "customizable approval policy" request is really
+ * about: limits, approved wallets, and categories in one place, instead of
+ * command-line flags nobody outside a terminal can see.
+ *
+ * What it does NOT do is approve anything. Every payment still needs a human
+ * signature; these rules only decide what a human gets asked to sign. A rule
+ * set here can narrow the agent's reach, never widen what the ledger will
+ * accept, and the page says so in the same words the code enforces.
+ */
+export function rulesPage(policy, spent, vault, network, qs = "", saved = false) {
+    const cats = Object.entries(policy.categories ?? {});
+    const catRows = cats.length
+        ? cats.map(([name, rule]) => categoryRow(name, rule, policy, spent.byCategory[name] ?? 0)).join("\n")
+        : `<tr><td colspan="5" class="empty">no categories — every seller shares the daily budget</td></tr>`;
+    const mapped = Object.entries(policy.payeeCategory ?? {});
+    return `<!doctype html><html><head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Paydlux — spending rules</title>
+<link rel="stylesheet" href="portal.css"></head><body>
+<h1>Paydlux — spending rules</h1>
+<div class="sub"><a class="nav" href="/${qs}">approvals</a> · <a class="nav" href="/rules${qs}">spending rules</a><br>
+vault ${esc(vault)} · ${esc(network)}${saved ? ` · <span class="saved">saved</span>` : ""}</div>
+
+<form id="rules" method="post" action="/rules${qs}">
+<h2>Every payment</h2>
+<div class="grid">
+  <label>Most for one payment
+    <input name="maxPerPayment" type="number" min="0.0000001" step="0.0000001" value="${esc(policy.maxPerPayment)}"></label>
+  <label>Daily budget
+    <input name="dailyBudget" type="number" min="0.0000001" step="0.0000001" value="${esc(policy.dailyBudget)}"></label>
+</div>
+<p class="note">Spent today: <b>${esc(spent.total.toFixed(7))}</b> of ${esc(policy.dailyBudget)}. The day resets at 00:00 UTC.</p>
+
+<h2>Wallets the agent may pay</h2>
+<div class="grid">
+  <label>Allowed (one account per line, blank = any)
+    <textarea name="allowlist" rows="3" spellcheck="false" autocomplete="off">${esc((policy.allowlist ?? []).join("\n"))}</textarea></label>
+  <label>Never allowed, even if listed above
+    <textarea name="denylist" rows="3" spellcheck="false" autocomplete="off">${esc((policy.denylist ?? []).join("\n"))}</textarea></label>
+</div>
+
+<h2>Categories</h2>
+<p class="note">Split the daily budget by what the money is for. A category can only be
+tighter than the limits above — it can never raise them.</p>
+<table class="cats"><thead><tr><th>name</th><th>max / payment</th><th>daily</th><th>spent today</th><th></th></tr></thead>
+<tbody id="catbody">${catRows}</tbody></table>
+<div class="addcat">
+  <input name="newcat" placeholder="name (a-z, 0-9)" maxlength="32" spellcheck="false" autocomplete="off">
+  <input name="newcat_max" type="number" min="0.0000001" step="0.0000001" placeholder="max / payment">
+  <input name="newcat_daily" type="number" min="0.0000001" step="0.0000001" placeholder="daily">
+  <button class="yes" type="submit" name="action" value="add">Add category</button>
+</div>
+
+<h2>Which wallet is in which category</h2>
+${mapped.length
+        ? `<table class="map"><thead><tr><th>wallet</th><th>category</th></tr></thead><tbody>
+${mapped.map(([payee, name]) => `<tr><td class="tx">${esc(payee)}</td><td>${esc(name)}`
+            + ` <button class="no mini" data-del="${esc(payee)}" data-map="1">Remove</button></td></tr>`).join("\n")}
+</tbody></table>`
+        : `<p class="note">Nothing categorised yet. Add a wallet below to cap it on its own.</p>`}
+<div class="addcat">
+  <input name="newpayee" placeholder="G… wallet address" maxlength="56" spellcheck="false" autocomplete="off">
+  <input name="newpayee_cat" placeholder="category" maxlength="32" spellcheck="false" autocomplete="off">
+  <button class="yes" type="submit" name="action" value="map">Add</button>
+</div>
+
+<div class="save">
+  <button class="yes" type="submit" name="action" value="save">Save rules</button>
+</div>
+</form>
+
+<div class="foot">These rules decide what you are <i>asked</i> to approve. They never approve
+anything themselves: every payment still needs your signature, and the vault needs two.</div>
+<script src="rules.js"></script></body></html>`;
+}
+function categoryRow(name, rule, policy, spent) {
+    // Names go in both a hidden value and the delete button's data-*, so they are
+    // escaped like any other attacker-chosen string — even though update() already
+    // reduced them to [a-z0-9_-].
+    //
+    // The name is deliberately NOT an editable input. Renaming a bucket would
+    // orphan every wallet mapped to it, and an orphaned wallet stops having a
+    // category ceiling — a rename would silently loosen the rules while looking
+    // like a cosmetic edit. Renaming is therefore remove + add, which forces the
+    // human to re-map the wallets and see what they are doing.
+    return `<tr>
+  <td><span class="catname">${esc(name)}</span><input type="hidden" name="cat_${esc(name)}_name" value="${esc(name)}"></td>
+  <td><input name="cat_${esc(name)}_max" type="number" min="0.0000001" step="0.0000001" value="${esc(rule.maxPerPayment ?? "")}" placeholder="${esc(policy.maxPerPayment)}"></td>
+  <td><input name="cat_${esc(name)}_daily" type="number" min="0.0000001" step="0.0000001" value="${esc(rule.dailyBudget ?? "")}" placeholder="${esc(policy.dailyBudget)}"></td>
+  <td class="amt">${esc(spent.toFixed(7))}</td>
+  <td><button class="no" data-del="${esc(name)}">Remove</button></td></tr>`;
+}
 function render(r, qs = "") {
     // qs is the portal key query string ("?k=..."). The approver link has to carry
     // it, because the desk answers 403 for anything without it.

package/dist/showcase.d.ts

@@ -42,6 +42,20 @@ export interface DemoConfig {
     donateHost?: string;
     /** Called whenever a key is enrolled, so the gateway's accepted set follows. */
     onKeys?: (pubs: string[]) => void;
+    /**
+     * The route the showcase sells (e.g. "/market/data"). /demo/last only reports
+     * settled payments for THIS route, so a seller's private sales never appear
+     * on a public page — a settled demo payment is the proof being shown, not the
+     * seller's order book.
+     */
+    route?: string;
+    /**
+     * The address the seller gets paid at. /demo/last uses it to read the last
+     * real settlement straight off the ledger, so the proof survives a restart of
+     * the demo process — an investor visiting at 3am, with the seller asleep,
+     * still gets a hash that exists on a public explorer.
+     */
+    payee?: string;
 }
 /**
  * Serve the showcase in front of a running gateway.

package/dist/showcase.js

@@ -103,6 +103,43 @@ function demoPayload(cfg) {
         proof: cfg.explorer,
     }, null, 2);
 }
+/**
+ * The last payment this vault really made to the seller, read off the public
+ * ledger. The in-memory desk forgets on restart; the ledger does not, so an
+ * investor who visits while the seller is asleep still reaches a hash they can
+ * open on an explorer instead of a spinner. Cached — one page load should not
+ * hammer horizon, and the answer only moves when a payment settles.
+ */
+let ledgerProof = null;
+let ledgerProofAt = 0;
+async function lastSettledOnLedger(cfg) {
+    if (!cfg.payee)
+        return null;
+    if (ledgerProof && Date.now() - ledgerProofAt < 5 * 60 * 1000)
+        return ledgerProof;
+    const host = cfg.network === "public" ? "horizon.stellar.org" : "horizon-testnet.stellar.org";
+    try {
+        const r = await fetch(`https://${host}/accounts/${cfg.vault}/payments?order=desc&limit=25`, { signal: AbortSignal.timeout(4000) });
+        if (!r.ok)
+            return null;
+        const records = ((await r.json())?._embedded?.records) ?? [];
+        for (const p of records) {
+            // horizon calls the hash `transaction_hash`; a record without one is not a
+            // proof, so it is skipped rather than printed as "undefined".
+            if (p?.to !== cfg.payee || !(Number(p.amount) > 0) || !p.transaction_hash)
+                continue;
+            ledgerProof = {
+                at: Date.parse(p.created_at) || 0,
+                price: String(p.amount),
+                tx: String(p.transaction_hash),
+            };
+            ledgerProofAt = Date.now();
+            return ledgerProof;
+        }
+    }
+    catch { /* no ledger reachable: the page still works, just without the extra proof */ }
+    return null;
+}
 /**
  * Serve the showcase in front of a running gateway.
  *
@@ -193,10 +230,32 @@ export function startDemo(cfg) {
             res.end(JSON.stringify({ ok: true, until: ok.until, vault: cfg.vault }));
             return;
         }
+        // A visitor watching alone cannot finish step 4 — the seller's phone is the
+        // only thing that can sign it, and the seller may be asleep. The loop is
+        // worthless as a demo if it ends at "waiting", so hand them the most recent
+        // payment this route actually settled: a hash they can open on the explorer
+        // without trusting this page. Nothing else about the payment is returned —
+        // a tx hash is already public on the ledger, the buyer and the content are
+        // not.
+        if (p === "/demo/last") {
+            const done = cfg.gateway.desk.list()
+                .filter((r) => r.status === "settled" && r.tx && (!cfg.route || r.uri === cfg.route))
+                .sort((a, b) => b.at - a.at)[0];
+            const proof = done
+                ? { at: done.at, price: done.price, tx: done.tx }
+                : await lastSettledOnLedger(cfg);
+            res.writeHead(200, {
+                "content-type": "application/json",
+                "cache-control": "no-store",
+                "x-content-type-options": "nosniff",
+            });
+            res.end(JSON.stringify(proof ?? { none: true }));
+            return;
+        }
         // Everything else belongs to the gateway: the paid route, /pay/status.
         // Only demo paths are exposed here, so pointing the tunnel at this port
         // cannot reach a seller's private routes by guessing a URI.
-        if (!(p === DEMO_ROUTE || p === "/pay/status" || p === "/demo/terms")) {
+        if (!(p === DEMO_ROUTE || p === "/pay/status" || p === "/demo/terms" || p === "/demo/last")) {
             res.writeHead(404, { "content-type": "application/json" });
             res.end(JSON.stringify({ error: "not found", routes: [DEMO_ROUTE] }));
             return;
@@ -244,6 +303,7 @@ h1{font-size:30px;margin:0 0 6px;letter-spacing:-.01em}
 pre{margin:10px 0 0;padding:10px 12px;background:#0f1213;border:1px solid var(--line);border-radius:8px;font:12.5px/1.5 ui-monospace,SFMono-Regular,Menlo,monospace;white-space:pre-wrap;word-break:break-word;color:#cfd6d0}
 button{font:inherit;padding:11px 18px;border-radius:9px;border:1px solid var(--gold);background:var(--gold);color:#1a1408;font-weight:600;cursor:pointer;margin:22px 0 0}
 button[disabled]{opacity:.45;cursor:default}
+.note{margin:12px 0 0;color:var(--dim);font-size:14px}
 .door{margin:30px 0 0;border:1px solid var(--line);border-left:3px solid var(--gold);background:#1a1f21;border-radius:10px;padding:18px 20px}
 .door .q{margin:0 0 6px;font-weight:600}
 .door .a{margin:0;color:var(--dim);font-size:15px}
@@ -275,8 +335,8 @@ on a phone, and the ledger settles it. You are about to drive that loop.</p>
   <div class="step" id="s3"><h3><span class="n">3</span>Request the payment</h3>
     <p>The browser signs the request — not the payment — and sends it. The seller parks it for a human.</p>
     <pre id="o3">not run</pre></div>
-  <div class="step" id="s4"><h3><span class="n">4</span>A human decides</h3>
-    <p>The seller sees the exact payment on their phone and holds for 1.2 seconds to approve. Nothing here can skip that.</p>
+  <div class="step" id="s4"><h3><span class="n">4</span>A human decides — and it isn't you</h3>
+    <p>The buyer half ends at step 3. From here the <b>seller</b> decides: the parked payment appears on their phone with the amount, the payee and the deadline, and a person holds the button for 1.2 seconds. The key that signs it never leaves that device, so no code — including this page — can do it for them. The app only checks the queue while it is open on the screen, so a phone in a pocket signs nothing: if nobody is holding it, this step waits. That is the product, not a bug.</p>
     <pre id="o4">not run</pre></div>
   <div class="step" id="s5"><h3><span class="n">5</span>The ledger proves it</h3>
     <p>Same request, now served. The transaction hash is public and verifiable without trusting this page.</p>
@@ -284,6 +344,9 @@ on a phone, and the ledger settles it. You are about to drive that loop.</p>
 </div>
 
 <button id="go">Run the loop</button>
+<p class="note">You are the <b>buyer</b> here. Steps 1–3 happen in your browser. Step 4 happens on the
+seller's phone — if nobody is holding it, this page will show you the last payment this exact loop
+settled, with a hash you can open on the explorer.</p>
 
 <div class="door">
   <p class="q">That was practice. Nothing you just did cost anything.</p>
@@ -312,6 +375,8 @@ function demoScript() {
   const el = (id) => document.getElementById(id);
   const say = (n, txt) => { el("o" + n).textContent = txt; el("s" + n).classList.add("done"); };
   const PAY = "x-payment";
+  let NET = "testnet";   // which explorer the proof links point at
+  let TOKEN = "";        // the token the demo is priced in, for readable amounts
 
   async function main() {
     const btn = el("go"); btn.disabled = true;
@@ -321,6 +386,8 @@ function demoScript() {
     try {
       const r = await fetch(ROUTE, { cache: "no-store" });
       terms = JSON.parse(r.headers.get(PAY) || "null");
+      NET = String((terms && terms.network) || "testnet").replace("stellar:", "");
+      TOKEN = String((terms && terms.token && terms.token.code) || "");
       say(1, "HTTP " + r.status + "\\n" + JSON.stringify(terms, null, 2));
       if (r.status !== 402) { say(1, "HTTP " + r.status + " — this showcase is not asking for payment right now"); return; }
     } catch (e) { say(1, "request failed: " + e); return; }
@@ -352,8 +419,18 @@ function demoScript() {
     say(3, "HTTP 202 — parked as " + (parked.handle || "?") + "\\n" + (parked.reason || ""));
 
     // 4 — wait for a person. The page polls the seller's own status route.
-    say(4, "waiting for the seller's phone…");
+    // Say plainly what is happening: the seller's phone is the only thing that
+    // can sign this, and a visitor on their own laptop cannot make that happen.
+    // Bare silence here reads as a broken demo.
+    say(4, "parked. Now the seller's phone decides — that signature cannot come from this browser.\\nwaiting…");
     const seen = await poll(parked.statusUrl);
+    if (seen.status === "timed out waiting for a human") {
+      el("o4").textContent = "nobody signed, so nothing was paid — exactly as designed.\\n"
+        + "Run the loop again when the seller is at their phone.";
+      await showLast();
+      btn.disabled = false;
+      return;
+    }
     say(4, "status: " + seen.status + (seen.reason ? "\\n" + seen.reason : ""));
     if (seen.status !== "settled" && seen.status !== "paid") { btn.disabled = false; return; }
 
@@ -375,11 +452,29 @@ function demoScript() {
     for (let i = 0; i < 150; i++) {
       const j = await (await fetch(u, { cache: "no-store" })).json();
       if (j.status && j.status !== "pending" && j.status !== "awaiting_phone") return j;
+      // ~16 s with nobody at the phone: show that this loop does settle, instead
+      // of letting a visitor sit on a spinner and conclude the product is fake.
+      if (i === 8) await showLast();
       await new Promise((r) => setTimeout(r, 2000));
     }
     return { status: "timed out waiting for a human" };
   }
 
+  /**
+   * The most recent payment THIS route settled, as a public hash. It is not a
+   * substitute for the live approval — it is labelled as a different payment —
+   * it is the answer to "okay, but has this ever actually happened?".
+   */
+  async function showLast() {
+    try {
+      const last = await (await fetch("/demo/last", { cache: "no-store" })).json();
+      if (!last || !last.tx) return;
+      el("o4").textContent += "\\n\\nthe same loop, settled for real on " + new Date(last.at).toLocaleString()
+        + " (" + Number(last.price) + (TOKEN ? " " + TOKEN : "") + ") — verify it without this page:\\nhttps://stellar.expert/explorer/"
+        + NET + "/transaction/" + last.tx;
+    } catch { /* the demo still works without the extra proof */ }
+  }
+
   el("go").addEventListener("click", main);
 })();`;
 }

package/dist/vault.d.ts

@@ -171,6 +171,19 @@ export declare class StellarVault {
      * so a stolen agent key cannot use it and a stolen phone cannot use it alone.
      */
     release(payee: string, amount: Amount, principal: Keypair, approver: Keypair, memo?: string): Promise<Horizon.HorizonApi.SubmitTransactionResponse>;
+    /**
+     * Create an account that does not exist yet, with a starting balance. Same two
+     * signatures as release(), because it is the vault's money moving.
+     *
+     * This exists because a plain payment to an address that has never been
+     * funded is refused by the ledger (`op_no_destination`) — proven on the mainnet
+     * vault when topping up the demo's agent account. So "send XLM to a brand new
+     * wallet" (the demo agent, a seller's fresh payee, an owner's new cold
+     * account) needs createAccount, not payment. Only XLM can do this: a token
+     * payment to an unfunded account can never work, because that account would
+     * also need a trustline.
+     */
+    fund(destination: string, amount: Amount, principal: Keypair, approver: Keypair, memo?: string): Promise<Horizon.HorizonApi.SubmitTransactionResponse>;
     /**
      * Kill every outstanding mandate at once. Any accepted transaction bumps the
      * vault's sequence, which invalidates all pre-authorized hashes pointing at a

package/dist/vault.js

@@ -395,6 +395,28 @@ export class StellarVault {
             b.addMemo(Memo.text(memo));
         return sub(this.horizon, PASSPHRASE[this.network], b.build(), principal, approver);
     }
+    /**
+     * Create an account that does not exist yet, with a starting balance. Same two
+     * signatures as release(), because it is the vault's money moving.
+     *
+     * This exists because a plain payment to an address that has never been
+     * funded is refused by the ledger (`op_no_destination`) — proven on the mainnet
+     * vault when topping up the demo's agent account. So "send XLM to a brand new
+     * wallet" (the demo agent, a seller's fresh payee, an owner's new cold
+     * account) needs createAccount, not payment. Only XLM can do this: a token
+     * payment to an unfunded account can never work, because that account would
+     * also need a trustline.
+     */
+    async fund(destination, amount, principal, approver, memo) {
+        if (!this.isNative)
+            throw new Error("only XLM can create an account; a token needs a trustline first");
+        const b = (await this.tb(this.address))
+            .addOperation(Operation.createAccount({ destination, startingBalance: amount }))
+            .setTimeout(300);
+        if (memo)
+            b.addMemo(Memo.text(memo));
+        return sub(this.horizon, PASSPHRASE[this.network], b.build(), principal, approver);
+    }
     /**
      * Kill every outstanding mandate at once. Any accepted transaction bumps the
      * vault's sequence, which invalidates all pre-authorized hashes pointing at a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paydlux/agent",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "Payments for AI agents that a human approves. Spending mandates enforced on the Stellar ledger: 2-of-2 vault, pre-authorised transaction envelopes, HTTP 402, USDC.",
   "type": "module",
   "main": "./dist/index.js",
@@ -24,6 +24,7 @@
     "phone-app/icon-512.png",
     "portal-app/portal.js",
     "portal-app/portal.css",
+    "portal-app/rules.js",
     "README.md",
     "LICENSE"
   ],
@@ -32,7 +33,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "tsc -p tsconfig.build.json && chmod +x dist/cli.js dist/mcp.js",
     "test:dist": "npm run build && tsx stellar/dist-check.ts",
     "demo": "node sdk/demo.ts",
     "demo:stellar": "tsx stellar/demo.ts",
@@ -44,12 +45,15 @@
     "test:stellar": "tsx stellar/demo.ts",
     "test:portal": "tsx stellar/xss-check.ts",
     "test:mandate": "tsx stellar/mandate-check.ts",
+    "test:policy": "tsx stellar/policy-check.ts",
     "test:phone": "tsx stellar/phone-check.ts && tsx stellar/desk-split-check.ts && tsx stellar/mandate-check.ts && tsx stellar/e2e-phone.ts && tsx phone-app/xdr-check.ts && tsx phone-app/app-check.ts && tsx phone-app/desk-app-check.ts && tsx ios/bridge-check.ts && tsx phone-app/ui-check.ts",
     "test:ios": "tsx ios/bridge-check.ts",
     "test:link": "swiftc ios/PaydluxApprover/LinkResolver.swift ios/Checks/linkcheck/main.swift -o \"$TMPDIR/linkcheck\" && \"$TMPDIR/linkcheck\"",
     "test:seed": "DEVELOPER_DIR=/Library/Developer/CommandLineTools /usr/bin/swiftc -target arm64-apple-macosx14.0 ios/PaydluxApprover/Seed.swift ios/PaydluxApprover/Hex.swift ios/Checks/main.swift -o \"$TMPDIR/seedcheck\" && \"$TMPDIR/seedcheck\"",
     "typecheck": "tsc --noEmit",
     "app": "tsx stellar/cli.ts",
+    "mcp": "tsx stellar/mcp.ts",
+    "test:mcp": "tsx stellar/mcp-check.ts",
     "app:mainnet": "tsx stellar/cli.ts setup --mainnet --file paydlux-mainnet.json --token XLM --max 2 --daily 20",
     "fund:check": "tsx stellar/check-address.ts GARPB3CO3JMMED3ETFRSSZXCH2X7UTXW4FNUP3Z7HDMBKAC2H355W4SA",
     "test:showcase": "tsx stellar/showcase-check.ts",
@@ -59,7 +63,13 @@
     "test:donate": "tsx stellar/donate-check.ts",
     "donate:live": "tsx stellar/donate-live.ts",
     "app:mainnet:sell": "tsx stellar/cli.ts sell --file paydlux-mainnet.json --split --tls --price 1 --route /market/data --max 2 --daily 20",
+    "app:mainnet:fund": "bash tools/fund-demo-wallet.sh",
+    "loop:check": "tsx stellar/mainnet-loop-check.ts",
     "app:testnet:sell": "tsx stellar/cli.ts sell --split --tls --showcase --price 1 --route /market/data --max 10 --daily 50",
+    "app:demo": "tsx stellar/cli.ts demo",
+    "app:demo:build": "bash tools/make-demo-app.sh",
+    "app:mainnet:build": "bash tools/make-demo-app.sh --mainnet",
+    "tunnel:service": "bash tools/install-tunnel-service.sh",
     "app:donate": "tsx stellar/cli.ts donate --file paydlux-mainnet.json --tls --price 1",
     "site:qr": "tsx stellar/make-site-qr.ts paydlux-mainnet.json site/qr.svg",
     "address:check": "tsx stellar/check-address.ts",
@@ -91,18 +101,23 @@
     "access": "public"
   },
   "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.32.2",
     "@stellar/stellar-sdk": "^17.4.0",
-    "qrcode-generator": "^2.0.4"
+    "qrcode-generator": "^2.0.4",
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/node": "^26.6.6",
     "jsqr": "^1.4.0",
+    "qrcode": "^1.5.4",
     "tsx": "^4.23.15",
     "typescript": "^7.0.2",
     "viem": "^2.57.13",
+    "wrangler": "^4.158.0",
     "xrpl": "^5.3.0"
   },
   "bin": {
-    "paydlux": "dist/cli.js"
+    "paydlux": "dist/cli.js",
+    "paydlux-mcp": "dist/mcp.js"
   }
 }

package/portal-app/portal.css

@@ -19,4 +19,26 @@ button{border:0;border-radius:10px;padding:12px 18px;font-size:15px;font-weight:
 details summary{cursor:pointer}
 .phlink{color:var(--gold);text-decoration:underline;font-size:12px}
 .foot{margin-top:28px;color:var(--muted);font-size:12px}
+
+/* --- spending rules page --- */
+h2{font-size:13px;color:var(--muted);text-transform:uppercase;letter-spacing:.06em;margin:28px 0 10px}
+.grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}
+label{display:block;color:var(--muted);font-size:12px}
+input,textarea{display:block;width:100%;margin-top:6px;background:#141715;color:var(--text);
+  border:1px solid var(--line);border-radius:10px;padding:11px 12px;font:15px/1.4 ui-monospace,monospace}
+textarea{resize:vertical}
+input:focus,textarea:focus{outline:none;border-color:var(--gold)}
+.note{color:var(--muted);font-size:13px;margin:10px 0}
+.note b{color:var(--gold)}
+table.cats,table.map{margin-top:6px}
+table.cats td{padding:8px 6px}
+.addcat{display:flex;gap:10px;align-items:end;margin-top:10px;flex-wrap:wrap}
+.addcat input{flex:1;min-width:140px}
+.addcat button{width:auto;flex:0 0 auto}
+.save{margin-top:26px}
+.save button{width:auto;min-width:180px}
+button.mini{display:inline;width:auto;padding:4px 10px;font-size:12px;margin:0}
+.nav{color:var(--gold);text-decoration:underline}
+.saved{color:var(--green);font-weight:700}
+@media(max-width:640px){.grid{grid-template-columns:1fr}}
 @media(max-width:640px){.body{max-width:180px}}

package/portal-app/rules.js

@@ -0,0 +1,62 @@
+// The spending-rules page's client half. Served by the desk at /rules.js.
+//
+// The page is a plain HTML form, so it works with JavaScript off. This file
+// only adds the two things a form cannot do by itself: a Remove button that
+// queues the row for deletion and submits, and a confirm before a rule that
+// gates money is loosened.
+//
+// No inline handlers, so the page's CSP keeps script-src 'self'. Category names
+// arrive from the server already reduced to [a-z0-9_-]; they are still read
+// through dataset, never interpolated into markup, so nothing here can be
+// turned into HTML by a name.
+const form = document.getElementById("rules");
+if (!form) throw new Error("rules page has no #rules form");
+
+// Hidden fields the server reads as "delete these". Accumulating rather than
+// replacing means a human can remove three rows before pressing Save.
+const hidden = (name) => {
+  let el = form.querySelector(`input[name="${name}"]`);
+  if (!el) {
+    el = document.createElement("input");
+    el.type = "hidden";
+    el.name = name;
+    form.appendChild(el);
+  }
+  return el;
+};
+
+document.addEventListener("click", (e) => {
+  const b = e.target.closest("button[data-del]");
+  if (!b) return;
+  e.preventDefault();
+  const field = b.dataset.map ? "delmap" : "delcat";
+  const el = hidden(field);
+  const val = b.dataset.del;
+  const have = el.value ? el.value.split(",") : [];
+  if (!have.includes(val)) have.push(val);
+  el.value = have.join(",");
+  // The row goes immediately: the human sees the rule stop protecting them
+  // before they press Save, which is the point of the confirm.
+  b.closest("tr")?.remove();
+  form.requestSubmit();
+});
+
+// A wider ceiling is the one edit that can only hurt. The ledger still caps a
+// single payment at the mandate amount, but the daily budget and the seller
+// list are ours to count, so raising them is a real loosening. Ask once.
+const limits = ["maxPerPayment", "dailyBudget"];
+const start = Object.fromEntries(
+  limits.map((n) => [n, form.querySelector(`[name="${n}"]`)?.value ?? ""]));
+
+form.addEventListener("submit", (e) => {
+  const raised = limits.filter((n) => {
+    const now = Number(form.querySelector(`[name="${n}"]`)?.value);
+    const was = Number(start[n]);
+    return Number.isFinite(now) && Number.isFinite(was) && now > was;
+  });
+  if (!raised.length) return;
+  const ok = confirm(
+    `This raises ${raised.join(" and ")}. Higher limits mean the agent may ask you for ` +
+    `more money, more often. Continue?`);
+  if (!ok) e.preventDefault();
+});