npm - spendos - Versions diffs - 0.1.0 - Mend

spendos 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (90) hide show

package/.dockerignore +4 -0
package/.env.example +30 -0
package/AGENTS.md +212 -0
package/BOOTSTRAP.md +55 -0
package/Dockerfile +52 -0
package/HEARTBEAT.md +7 -0
package/IDENTITY.md +23 -0
package/LICENSE +21 -0
package/README.md +162 -0
package/SOUL.md +202 -0
package/SUBMISSION.md +128 -0
package/TOOLS.md +40 -0
package/USER.md +17 -0
package/acp-seller/bin/acp.ts +807 -0
package/acp-seller/config.json +34 -0
package/acp-seller/package.json +55 -0
package/acp-seller/src/commands/agent.ts +328 -0
package/acp-seller/src/commands/bounty.ts +1189 -0
package/acp-seller/src/commands/deploy.ts +414 -0
package/acp-seller/src/commands/job.ts +217 -0
package/acp-seller/src/commands/profile.ts +71 -0
package/acp-seller/src/commands/resource.ts +91 -0
package/acp-seller/src/commands/search.ts +327 -0
package/acp-seller/src/commands/sell.ts +883 -0
package/acp-seller/src/commands/serve.ts +258 -0
package/acp-seller/src/commands/setup.ts +399 -0
package/acp-seller/src/commands/token.ts +88 -0
package/acp-seller/src/commands/wallet.ts +123 -0
package/acp-seller/src/lib/api.ts +118 -0
package/acp-seller/src/lib/auth.ts +291 -0
package/acp-seller/src/lib/bounty.ts +257 -0
package/acp-seller/src/lib/client.ts +42 -0
package/acp-seller/src/lib/config.ts +240 -0
package/acp-seller/src/lib/open.ts +41 -0
package/acp-seller/src/lib/openclawCron.ts +138 -0
package/acp-seller/src/lib/output.ts +104 -0
package/acp-seller/src/lib/wallet.ts +81 -0
package/acp-seller/src/seller/offerings/_shared/preTransactionScan.ts +127 -0
package/acp-seller/src/seller/offerings/canonical-catalog.ts +221 -0
package/acp-seller/src/seller/offerings/spendos/spendos_summarize_url/handlers.ts +20 -0
package/acp-seller/src/seller/offerings/spendos/spendos_summarize_url/offering.json +18 -0
package/acp-seller/src/seller/offerings/spendos/spendos_translate/handlers.ts +21 -0
package/acp-seller/src/seller/offerings/spendos/spendos_translate/offering.json +22 -0
package/acp-seller/src/seller/offerings/spendos/spendos_tweet_gen/handlers.ts +20 -0
package/acp-seller/src/seller/offerings/spendos/spendos_tweet_gen/offering.json +18 -0
package/acp-seller/src/seller/runtime/acpSocket.ts +413 -0
package/acp-seller/src/seller/runtime/logger.ts +36 -0
package/acp-seller/src/seller/runtime/offeringTypes.ts +52 -0
package/acp-seller/src/seller/runtime/offerings.ts +277 -0
package/acp-seller/src/seller/runtime/paymentVerification.test.ts +207 -0
package/acp-seller/src/seller/runtime/paymentVerification.ts +363 -0
package/acp-seller/src/seller/runtime/seller.onchain.test.ts +220 -0
package/acp-seller/src/seller/runtime/seller.test.ts +823 -0
package/acp-seller/src/seller/runtime/seller.ts +1041 -0
package/acp-seller/src/seller/runtime/sellerApi.ts +71 -0
package/acp-seller/src/seller/runtime/startup.ts +270 -0
package/acp-seller/src/seller/runtime/types.ts +62 -0
package/acp-seller/tsconfig.json +20 -0
package/bin/spendos.js +23 -0
package/contracts/SpendOSAudit.sol +29 -0
package/dist/mcp-server.mjs +153 -0
package/jobs/translate.json +7 -0
package/jobs/tweet-gen.json +7 -0
package/openclaw.json +41 -0
package/package.json +49 -0
package/plugins/spendos-events/index.ts +78 -0
package/plugins/spendos-events/package.json +14 -0
package/policies/enforce-bounds.mjs +71 -0
package/public/index.html +509 -0
package/public/landing.html +241 -0
package/railway.json +12 -0
package/railway.toml +12 -0
package/scripts/deploy.ts +48 -0
package/scripts/test-x402-mainnet.ts +30 -0
package/scripts/xmtp-listener.ts +61 -0
package/setup.sh +278 -0
package/skills/spendos/skill.md +26 -0
package/src/agent.ts +152 -0
package/src/audit.ts +166 -0
package/src/governance.ts +367 -0
package/src/job-registry.ts +306 -0
package/src/mcp-public.ts +145 -0
package/src/mcp-server.ts +171 -0
package/src/opportunity-scanner.ts +138 -0
package/src/server.ts +870 -0
package/src/venice-x402.ts +234 -0
package/src/xmtp.ts +109 -0
package/src/zerion.ts +58 -0
package/start.sh +168 -0
package/tsconfig.json +14 -0

package/public/index.html ADDED Viewed

@@ -0,0 +1,509 @@
+<!DOCTYPE html>
+<html lang="en" class="dark">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>SpendOS</title>
+  <script src="https://cdn.tailwindcss.com"></script>
+  <script>
+    tailwind.config = {
+      darkMode: 'class',
+      theme: { extend: { colors: {
+        bg: '#0a0a0a', surface: '#141414', border: '#262626',
+        accent: '#22c55e', danger: '#ef4444', warn: '#f59e0b',
+      }}}
+    }
+  </script>
+  <style>
+    body { font-family: 'SF Mono', 'Fira Code', monospace; }
+    .countdown { font-variant-numeric: tabular-nums; }
+    @keyframes pulse-dot { 0%,100% { opacity:1 } 50% { opacity:0.4 } }
+    .pulse-dot { animation: pulse-dot 2s infinite; }
+  </style>
+</head>
+<body class="bg-bg text-gray-200 min-h-screen">
+  <!-- Header -->
+  <header class="border-b border-border px-6 py-4 flex items-center justify-between">
+    <div class="flex items-center gap-3">
+      <div class="w-3 h-3 rounded-full bg-accent pulse-dot"></div>
+      <h1 class="text-xl font-bold text-white tracking-tight">SpendOS</h1>
+      <span class="text-xs text-gray-500">agent spend governance</span>
+    </div>
+    <div id="wallet-badge" class="text-xs text-gray-500 font-mono"></div>
+  </header>
+  <main class="max-w-5xl mx-auto px-6 py-6 space-y-6">
+    <!-- P&L Panel -->
+    <section class="bg-surface border border-border rounded-lg p-5">
+      <h2 class="text-sm font-semibold text-gray-400 mb-3 uppercase tracking-wider">Agent P&L</h2>
+      <div class="grid grid-cols-2 md:grid-cols-5 gap-4">
+        <div>
+          <div class="text-xs text-gray-500">Earned</div>
+          <div id="pnl-earned" class="text-lg font-bold text-accent">$0.00</div>
+        </div>
+        <div>
+          <div class="text-xs text-gray-500">Spent</div>
+          <div id="pnl-spent" class="text-lg font-bold text-danger">$0.00</div>
+        </div>
+        <div>
+          <div class="text-xs text-gray-500">Profit</div>
+          <div id="pnl-profit" class="text-lg font-bold text-white">$0.00</div>
+        </div>
+        <div>
+          <div class="text-xs text-gray-500">Queries</div>
+          <div id="pnl-queries" class="text-lg font-bold text-white">0</div>
+        </div>
+        <div>
+          <div class="text-xs text-gray-500">Margin</div>
+          <div id="pnl-margin" class="text-lg font-bold text-gray-400">—</div>
+        </div>
+      </div>
+    </section>
+    <!-- Pending Delegations -->
+    <section>
+      <h2 class="text-sm font-semibold text-gray-400 mb-3 uppercase tracking-wider">Delegation Requests</h2>
+      <div id="pending-cards" class="space-y-4">
+        <div class="text-gray-600 text-sm">No pending requests</div>
+      </div>
+    </section>
+    <!-- Active Delegations -->
+    <section>
+      <h2 class="text-sm font-semibold text-gray-400 mb-3 uppercase tracking-wider">Active Delegations</h2>
+      <div id="active-table" class="text-gray-600 text-sm">No active delegations</div>
+    </section>
+    <!-- Audit Log -->
+    <section>
+      <h2 class="text-sm font-semibold text-gray-400 mb-3 uppercase tracking-wider">Audit Log</h2>
+      <div id="audit-log" class="bg-surface border border-border rounded-lg overflow-hidden">
+        <table class="w-full text-xs">
+          <thead class="bg-bg">
+            <tr class="text-gray-500">
+              <th class="text-left px-3 py-2">Time</th>
+              <th class="text-left px-3 py-2">Action</th>
+              <th class="text-left px-3 py-2">Details</th>
+              <th class="text-right px-3 py-2">Amount</th>
+              <th class="text-right px-3 py-2">Tx</th>
+            </tr>
+          </thead>
+          <tbody id="audit-tbody"></tbody>
+        </table>
+      </div>
+    </section>
+    <!-- Agent Chat -->
+    <section>
+      <h2 class="text-sm font-semibold text-gray-400 mb-3 uppercase tracking-wider">Chat with Agent</h2>
+      <div class="bg-surface border border-border rounded-lg overflow-hidden">
+        <div id="chat-messages" class="p-4 h-48 overflow-y-auto text-sm space-y-2">
+          <div class="text-gray-600">Send a message to talk to the SpendOS agent...</div>
+        </div>
+        <div class="border-t border-border p-3 flex gap-2">
+          <input id="chat-input" type="text" placeholder="Ask the agent anything..."
+            class="flex-1 bg-bg border border-border rounded px-3 py-2 text-sm text-white focus:outline-none focus:border-accent"
+            onkeydown="if(event.key==='Enter')sendChat()">
+          <button onclick="sendChat()"
+            class="px-4 py-2 bg-accent/20 text-accent rounded text-sm font-semibold hover:bg-accent/30 cursor-pointer">
+            Send
+          </button>
+        </div>
+      </div>
+    </section>
+  </main>
+  <script>
+    // Load persistent chat history on page load
+    async function loadHistory() {
+      try {
+        const res = await fetch(`${API}/api/chat/history`);
+        const history = await res.json();
+        const msgs = document.getElementById('chat-messages');
+        for (const msg of history.slice(-30)) { // show last 30 on load
+          if (msg.role === 'user') {
+            msgs.innerHTML += `<div class="text-white"><span class="text-accent font-bold">You:</span> ${esc(msg.content)}</div>`;
+          } else if (msg.role === 'assistant') {
+            msgs.innerHTML += `<div><span class="text-warn font-bold">Agent:</span> <span class="text-gray-300">${esc(msg.content.slice(0, 500))}${msg.content.length > 500 ? '...' : ''}</span></div>`;
+          }
+        }
+        msgs.scrollTop = msgs.scrollHeight;
+      } catch {}
+    }
+    loadHistory();
+    async function sendChat() {
+      const input = document.getElementById('chat-input');
+      const msg = input.value.trim();
+      if (!msg) return;
+      input.value = '';
+      const msgs = document.getElementById('chat-messages');
+      msgs.innerHTML += `<div class="text-white"><span class="text-accent font-bold">You:</span> ${esc(msg)}</div>`;
+      const agentDiv = document.createElement('div');
+      agentDiv.innerHTML = '<span class="text-warn font-bold">Agent:</span> <span class="agent-reply text-gray-300"><span class="text-gray-600 italic">thinking...</span></span>';
+      msgs.appendChild(agentDiv);
+      msgs.scrollTop = msgs.scrollHeight;
+      const replySpan = agentDiv.querySelector('.agent-reply');
+      let gotContent = false;
+      // Timeout: if no content after 30s, show error
+      const timeout = setTimeout(() => {
+        if (!gotContent) replySpan.textContent = 'Connection lost (server may be restarting). Try again.';
+      }, 30000);
+      try {
+        // Route through /api/chat which goes to OpenClaw (has MCP tools, memory, SOUL.md)
+        const res = await fetch(`${API}/api/chat`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${TOKEN}` },
+          body: JSON.stringify({ message: msg })
+        });
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = '';
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          buffer += decoder.decode(value, { stream: true });
+          const lines = buffer.split('\n');
+          buffer = lines.pop();
+          for (const line of lines) {
+            if (!line.startsWith('data: ')) continue;
+            const data = line.slice(6);
+            if (data === '[DONE]') continue;
+            try {
+              const chunk = JSON.parse(data);
+              const content = chunk.choices?.[0]?.delta?.content;
+              if (content) {
+                if (!gotContent) { replySpan.textContent = ''; gotContent = true; clearTimeout(timeout); }
+                replySpan.textContent += content;
+                msgs.scrollTop = msgs.scrollHeight;
+              }
+            } catch {}
+          }
+        }
+      } catch (err) {
+        replySpan.textContent = 'Error: ' + err.message;
+      }
+    }
+  </script>
+  <script>
+    const API = '';
+    // Admin token from URL param: ?token=xxx
+    const TOKEN = new URLSearchParams(window.location.search).get('token') || '';
+    let USER_ROLE = 'none'; // 'admin', 'demo', or 'none'
+    // Check auth level on load
+    fetch(`${API}/api/auth`, { headers: { 'Authorization': `Bearer ${TOKEN}` } })
+      .then(r => r.json()).then(d => { USER_ROLE = d.role || 'none'; })
+      .catch(() => {});
+    // ── Polling ──────────────────────────────────────
+    const authHeaders = TOKEN ? { 'Authorization': `Bearer ${TOKEN}` } : {};
+    async function poll() {
+      try {
+        const [pnl, requests, audit, wallet] = await Promise.all([
+          fetch(`${API}/api/pnl`).then(r => r.json()),
+          fetch(`${API}/api/requests`, { headers: authHeaders }).then(r => r.ok ? r.json() : []),
+          fetch(`${API}/api/audit`).then(r => r.json()),
+          fetch(`${API}/api/wallet`).then(r => r.json()),
+        ]);
+        renderPnL(pnl);
+        renderRequests(requests);
+        renderAudit(audit);
+        renderWallet(wallet);
+      } catch (err) {
+        console.error('Poll error:', err);
+      }
+    }
+    let lastPendingCount = 0;
+    setInterval(poll, 1500);
+    poll();
+    // ── Renderers ────────────────────────────────────
+    function renderPnL(pnl) {
+      document.getElementById('pnl-earned').textContent = `$${pnl.totalEarned.toFixed(3)}`;
+      document.getElementById('pnl-spent').textContent = `$${pnl.totalSpent.toFixed(3)}`;
+      document.getElementById('pnl-profit').textContent = `$${pnl.profit.toFixed(3)}`;
+      document.getElementById('pnl-queries').textContent = pnl.queryCount;
+      const margin = pnl.totalEarned > 0
+        ? ((pnl.profit / pnl.totalEarned) * 100).toFixed(0) + '%'
+        : '—';
+      document.getElementById('pnl-margin').textContent = margin;
+    }
+    function renderWallet(wallet) {
+      const addr = wallet.address;
+      const short = addr ? `${addr.slice(0, 6)}...${addr.slice(-4)}` : 'loading...';
+      const mode = wallet.inferenceMode === 'x402' ? 'x402 wallet' : wallet.inferenceMode === 'api_key' ? 'API key' : 'none';
+      const bal = wallet.veniceBalance;
+      const balText = bal ? ` · Venice: $${bal.balanceUsd.toFixed(2)}` : '';
+      document.getElementById('wallet-badge').innerHTML =
+        `<span class="text-white">${short}</span>` +
+        `<span class="text-gray-600 mx-1">·</span>` +
+        `<span class="text-accent text-[10px]">${mode}</span>` +
+        `<span class="text-gray-500">${balText}</span>`;
+    }
+    function renderRequests(requests) {
+      const pending = requests.filter(r => r.status === 'pending');
+      const active = requests.filter(r => r.status === 'approved');
+      const decided = requests.filter(r => ['rejected', 'expired', 'revoked'].includes(r.status));
+      // Pending cards — flash if new delegation arrived
+      const pendingEl = document.getElementById('pending-cards');
+      if (pending.length > lastPendingCount && lastPendingCount >= 0) {
+        pendingEl.style.transition = 'none';
+        pendingEl.style.boxShadow = '0 0 30px #22c55e44';
+        setTimeout(() => { pendingEl.style.transition = 'box-shadow 2s'; pendingEl.style.boxShadow = 'none'; }, 100);
+      }
+      lastPendingCount = pending.length;
+      if (pending.length === 0) {
+        pendingEl.innerHTML = '<div class="text-gray-600 text-sm">No pending requests</div>';
+      } else {
+        pendingEl.innerHTML = pending.map(d => renderCard(d)).join('');
+      }
+      // Active table
+      const activeEl = document.getElementById('active-table');
+      if (active.length === 0) {
+        activeEl.innerHTML = '<div class="text-gray-600 text-sm">No active delegations</div>';
+      } else {
+        activeEl.innerHTML = `
+          <div class="bg-surface border border-border rounded-lg overflow-hidden">
+            <table class="w-full text-xs">
+              <thead class="bg-bg">
+                <tr class="text-gray-500">
+                  <th class="text-left px-3 py-2">Agent</th>
+                  <th class="text-left px-3 py-2">Reason</th>
+                  <th class="text-left px-3 py-2">Chains</th>
+                  <th class="text-right px-3 py-2">Budget</th>
+                  <th class="text-right px-3 py-2">Expires</th>
+                  <th class="text-right px-3 py-2">Actions</th>
+                </tr>
+              </thead>
+              <tbody>
+                ${active.map(d => `
+                  <tr class="border-t border-border">
+                    <td class="px-3 py-2 font-mono">${shortAddr(d.agentAddress)}</td>
+                    <td class="px-3 py-2">${esc(d.reason)}</td>
+                    <td class="px-3 py-2">${d.chains.join(', ')}</td>
+                    <td class="px-3 py-2 text-right">$${d.totalBudget}</td>
+                    <td class="px-3 py-2 text-right countdown">${countdown(d.expiresAt)}</td>
+                    <td class="px-3 py-2 text-right">
+                      <button onclick="revokeD('${d.id}')"
+                        class="px-2 py-1 bg-danger/20 text-danger rounded text-xs hover:bg-danger/30 cursor-pointer">
+                        Revoke
+                      </button>
+                    </td>
+                  </tr>
+                `).join('')}
+              </tbody>
+            </table>
+          </div>
+        `;
+      }
+    }
+    function renderCard(d) {
+      return `
+        <div class="bg-surface border border-border rounded-lg p-5">
+          <div class="flex items-center justify-between mb-3">
+            <span class="text-xs font-semibold text-warn uppercase tracking-wider">Delegation Request</span>
+            <span class="text-xs text-gray-500 countdown">${countdown(d.expiresAt)}</span>
+          </div>
+          <div class="space-y-2 text-sm mb-4">
+            <div class="flex justify-between">
+              <span class="text-gray-500">Agent</span>
+              <span class="font-mono text-white">${shortAddr(d.agentAddress)}</span>
+            </div>
+            <div class="flex justify-between">
+              <span class="text-gray-500">Reason</span>
+              <span class="text-white">${esc(d.reason)}</span>
+            </div>
+          </div>
+          ${d.aiInterpretation ? `
+          <div class="bg-bg border border-border rounded p-3 mb-4 text-xs">
+            <div class="flex items-center gap-2 mb-2">
+              <span class="text-gray-500 font-semibold uppercase tracking-wider">AI Assessment</span>
+              <span class="px-1.5 py-0.5 rounded text-[10px] font-bold ${
+                d.aiInterpretation.riskLevel === 'high' ? 'bg-danger/20 text-danger' :
+                d.aiInterpretation.riskLevel === 'medium' ? 'bg-warn/20 text-warn' :
+                'bg-accent/20 text-accent'
+              }">${d.aiInterpretation.riskLevel.toUpperCase()}</span>
+            </div>
+            <p class="text-gray-300 mb-1">${esc(d.aiInterpretation.summary)}</p>
+            ${d.aiInterpretation.warnings.length ? `
+              <div class="mt-2 space-y-1">
+                ${d.aiInterpretation.warnings.map(w => `
+                  <div class="text-warn">⚠ ${esc(w)}</div>
+                `).join('')}
+              </div>
+            ` : ''}
+          </div>
+          ` : ''}
+          <div class="bg-bg border border-border rounded p-3 mb-4 space-y-1 text-xs">
+            <div class="text-gray-500 font-semibold uppercase tracking-wider mb-1">Policy Bounds</div>
+            <div class="flex justify-between">
+              <span class="text-gray-500">Chains</span>
+              <span>${d.chains.join(', ')}</span>
+            </div>
+            <div class="flex justify-between">
+              <span class="text-gray-500">Operations</span>
+              <span>${d.operations.join(', ')}</span>
+            </div>
+            <div class="flex justify-between">
+              <span class="text-gray-500">Max / Action</span>
+              <span>$${d.maxAmountPerAction}</span>
+            </div>
+            <div class="flex justify-between">
+              <span class="text-gray-500">Total Budget</span>
+              <span>$${d.totalBudget}</span>
+            </div>
+            ${d.allowedRecipients?.length ? `
+            <div class="flex justify-between">
+              <span class="text-gray-500">Vendors</span>
+              <span>${d.allowedRecipients.map(r => r.slice(0,6)+'...'+r.slice(-4)).join(', ')}</span>
+            </div>
+            ` : ''}
+            <div class="flex justify-between">
+              <span class="text-gray-500">Expires</span>
+              <span class="countdown">${countdown(d.expiresAt)}</span>
+            </div>
+          </div>
+          ${USER_ROLE === 'admin' ? `
+          <div class="flex gap-3">
+            <button onclick="approveD('${d.id}')"
+              class="flex-1 py-2 bg-accent/20 text-accent rounded font-semibold text-sm hover:bg-accent/30 cursor-pointer">
+              Approve Delegation
+            </button>
+            <button onclick="rejectD('${d.id}')"
+              class="flex-1 py-2 bg-danger/20 text-danger rounded font-semibold text-sm hover:bg-danger/30 cursor-pointer">
+              Reject
+            </button>
+          </div>
+          ` : `
+          <a href="https://github.com/consensus-hq/spendos" target="_blank"
+            class="block text-center py-2 text-gray-500 text-xs border border-border rounded hover:border-accent hover:text-accent transition cursor-pointer">
+            Demo mode — <span class="underline">deploy your own SpendOS</span> to approve delegations
+          </a>
+          `}
+        </div>
+      `;
+    }
+    function renderAudit(entries) {
+      const tbody = document.getElementById('audit-tbody');
+      if (!entries.length) {
+        tbody.innerHTML = '<tr><td colspan="5" class="px-3 py-4 text-center text-gray-600">No audit events yet</td></tr>';
+        return;
+      }
+      const showAll = tbody.dataset.showAll === 'true';
+      // Filter out noisy "requested" entries — show governance decisions + earnings
+      const meaningful = entries.filter(e => e.action !== 'requested');
+      const visible = showAll ? meaningful : meaningful.slice(0, 10);
+      tbody.innerHTML = visible.map(e => {
+        const actionColor = {
+          earned: 'text-accent', approved: 'text-accent',
+          rejected: 'text-danger', revoked: 'text-danger',
+          expired: 'text-warn', spent: 'text-warn',
+          requested: 'text-gray-400',
+        }[e.action] ?? 'text-gray-400';
+        const txLink = e.txHash
+          ? `<a href="https://basescan.org/tx/${e.txHash}" target="_blank" class="text-blue-400 hover:underline">${e.txHash.slice(0, 8)}...</a>`
+          : '<span class="text-gray-600">local</span>';
+        return `
+          <tr class="border-t border-border hover:bg-bg/50">
+            <td class="px-3 py-2 text-gray-500">${new Date(e.timestamp).toLocaleTimeString()}</td>
+            <td class="px-3 py-2 ${actionColor} font-semibold">${e.action}</td>
+            <td class="px-3 py-2 truncate max-w-[200px]">${esc(e.details)}</td>
+            <td class="px-3 py-2 text-right">${e.amount > 0 ? '$' + e.amount.toFixed(3) : '—'}</td>
+            <td class="px-3 py-2 text-right">${txLink}</td>
+          </tr>
+        `;
+      }).join('');
+      if (meaningful.length > 10 && !showAll) {
+        tbody.innerHTML += `<tr><td colspan="5" class="px-3 py-2 text-center">
+          <button onclick="document.getElementById('audit-tbody').dataset.showAll='true'; poll();"
+            class="text-accent hover:underline cursor-pointer text-xs">Show all ${meaningful.length} entries</button>
+        </td></tr>`;
+      }
+    }
+    // ── Actions ──────────────────────────────────────
+    const pendingActions = new Set();
+    async function approveD(id) {
+      if (pendingActions.has(id)) return;
+      pendingActions.add(id);
+      document.querySelectorAll(`[onclick*="${id}"]`).forEach(b => { b.disabled = true; b.textContent = 'Approving...'; b.classList.add('opacity-50'); });
+      await fetch(`${API}/api/requests/${id}/approve?token=${TOKEN}`, { method: 'POST' });
+      pendingActions.delete(id);
+      poll();
+    }
+    async function rejectD(id) {
+      if (pendingActions.has(id)) return;
+      pendingActions.add(id);
+      document.querySelectorAll(`[onclick*="${id}"]`).forEach(b => { b.disabled = true; b.classList.add('opacity-50'); });
+      await fetch(`${API}/api/requests/${id}/reject?token=${TOKEN}`, { method: 'POST' });
+      pendingActions.delete(id);
+      poll();
+    }
+    async function revokeD(id) {
+      if (pendingActions.has(id)) return;
+      pendingActions.add(id);
+      await fetch(`${API}/api/requests/${id}/revoke`, {
+        method: 'POST',
+        headers: { 'Authorization': `Bearer ${TOKEN}` },
+      });
+      pendingActions.delete(id);
+      poll();
+    }
+    // ── Helpers ──────────────────────────────────────
+    function shortAddr(addr) {
+      if (!addr) return '—';
+      return addr.slice(0, 6) + '...' + addr.slice(-4);
+    }
+    function esc(s) {
+      const d = document.createElement('div');
+      d.textContent = s ?? '';
+      return d.innerHTML;
+    }
+    function countdown(iso) {
+      const diff = new Date(iso) - Date.now();
+      if (diff <= 0) return 'expired';
+      const m = Math.floor(diff / 60000);
+      const s = Math.floor((diff % 60000) / 1000);
+      return `${m}m ${s}s`;
+    }
+  </script>
+</body>
+</html>