[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_107":108,"_109":110},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","cleitoncosta","name","payana-agent-os-rc1-backup-20260907","path","index.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":36,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/cleitoncosta/payana-agent-os-rc1-backup-20260907/code/index.ts","extension","id","34e13711-991e-4cb2-aae3-c8c5679d98e5","fileId","01a07e00-e39c-71b0-8ceb-d52b43d97997","parentId","branchId","0ddaf74c-988d-44be-8506-fe4865cb31a1","branchVersion",1,"latest",true,"createdAt",["D",1788820382412],"version",0,"fileType","http","content","import { immutableFileUrl, parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { Hono } from \"npm:hono\";\nimport { Root } from \"./frontend/root.tsx\";\nimport { analyzeMarket, normalizeSymbol, supportedSymbols } from \"./lib/market.ts\";\nimport {\n AGENT_OS,\n clientMetadata,\n consumeAuthorizationState,\n createAuthorizationRequest,\n exchangeAuthorizationCode,\n probeAuthorizedAgentOs,\n} from \"./lib/agent_os_oauth.ts\";\n\nconst app = new Hono();\nconst buckets = new Map();\nconst RATE_WINDOW_MS = 60_000;\nconst RATE_MAX = 30;\n\nfunction clientKey(c: any) {\n return String(c.req.header(\"cf-connecting-ip\") || c.req.header(\"x-forwarded-for\") || \"unknown\").split(\",\")[0].trim().slice(0, 80);\n}\nfunction rateAllowed(key: string) {\n const now = Date.now();\n const bucket = buckets.get(key);\n if (!bucket || now - bucket.startedAt >= RATE_WINDOW_MS) {\n buckets.set(key, { startedAt: now, count: 1 });\n return true;\n }\n if (bucket.count >= RATE_MAX) return false;\n bucket.count += 1;\n if (buckets.size > 1000) {\n for (const [k, v] of buckets) if (now - v.startedAt >= RATE_WINDOW_MS) buckets.delete(k);\n }\n return true;\n}\n\nfunction escapeHtml(value: unknown) {\n return String(value ?? \"\")\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\\\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n\nfunction oauthReceiptPage(title: string, state: \"PASS\" | \"FAIL\", details: { label: string; value: unknown }[], note: string) {\n const rows = details.map(({ label, value }) => `${escapeHtml(label)}${escapeHtml(value)}`).join(\"\");\n const tools = details.find(x => x.label === \"Safe market tools\")?.value;\n const toolPills = Array.isArray(tools)\n ? `

${tools.map(x => `${escapeHtml(x)}`).join(\"\")}

`\n : \"\";\n const styleUrl = immutableFileUrl(\"/frontend/styles.css\");\n return `${escapeHtml(title)} · PayAna

AUTHORIZED MCP VERIFICATION

${escapeHtml(title)}

${escapeHtml(note)}

TOKEN NOT PERSISTEDNO TOOL CALLNO TRADE

Connection receipt

sanitized runtime evidence

${rows}

${toolPills}

Return to market cockpit

`;\n}\n\n\napp.use(\"*\", async (c, next) => {\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n c.header(\"Referrer-Policy\", \"no-referrer\");\n c.header(\"X-Frame-Options\", \"DENY\");\n c.header(\"Permissions-Policy\", \"camera=(), microphone=(), geolocation=(), payment=()\");\n c.header(\"Content-Security-Policy\", \"default-src 'self'; script-src 'self' https://esm.town https://esm.sh; style-src 'self'; connect-src 'self' https://esm.sh; img-src 'self' data:; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'\");\n await next();\n});\n\n\napp.use(\"/api/*\", async (c, next) => {\n c.header(\"Cache-Control\", \"no-store\");\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n c.header(\"Referrer-Policy\", \"no-referrer\");\n if (!rateAllowed(clientKey(c))) return c.json({ status: \"BLOCKED\", error: \"RATE_LIMITED\", retryAfterSeconds: 60 }, 429);\n await next();\n});\n\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.get(\"/oauth/client-metadata.json\", (c) => {\n c.header(\"Cache-Control\", \"public, max-age=300\");\n return c.json(clientMetadata());\n});\n\napp.get(\"/oauth/status\", (c) => {\n c.header(\"Cache-Control\", \"no-store\");\n return c.json({\n status: \"READY_FOR_USER_AUTHORIZATION\",\n issuer: AGENT_OS.issuer,\n resource: AGENT_OS.resource,\n clientId: AGENT_OS.clientId,\n redirectUri: AGENT_OS.redirectUri,\n flow: \"authorization_code_pkce_s256_cimd\",\n tokenPersistence: \"NONE\",\n automaticToolCall: false,\n boundary: \"OAUTH_FLOW_READY != USER_AUTHORIZED_SESSION\",\n });\n});\n\napp.get(\"/oauth/start\", async (c) => {\n if (!rateAllowed(`oauth:${clientKey(c)}`)) return c.json({ status: \"BLOCKED\", error: \"RATE_LIMITED\", retryAfterSeconds: 60 }, 429);\n const request = await createAuthorizationRequest();\n c.header(\"Cache-Control\", \"no-store\");\n return c.redirect(request.url, 302);\n});\n\napp.get(\"/oauth/callback\", async (c) => {\n c.header(\"Cache-Control\", \"no-store\");\n const errorParam = c.req.query(\"error\");\n if (errorParam) {\n return c.html(oauthReceiptPage(\n \"Authorization not completed\",\n \"FAIL\",\n [{ label: \"State\", value: \"USER_OR_PROVIDER_DECLINED\" }],\n \"Binance returned an OAuth error. The callback deliberately does not echo provider error text into the page.\",\n ), 400);\n }\n\n const state = c.req.query(\"state\") ?? \"\";\n const code = c.req.query(\"code\") ?? \"\";\n const issuer = c.req.query(\"iss\") ?? \"\";\n if (!/^[A-Za-z0-9_-]{30,200}$/.test(state) || code.length < 8 || code.length > 5000) {\n return c.html(oauthReceiptPage(\n \"Invalid OAuth callback\",\n \"FAIL\",\n [{ label: \"Validation\", value: \"MISSING_OR_INVALID_STATE_OR_CODE\" }],\n \"The callback failed local input validation before any token request was made.\",\n ), 400);\n }\n if (issuer && issuer !== AGENT_OS.issuer) {\n return c.html(oauthReceiptPage(\n \"Issuer validation failed\",\n \"FAIL\",\n [{ label: \"Validation\", value: \"RFC9207_ISSUER_MISMATCH\" }],\n \"The authorization response issuer did not match the discovered Binance Agent OS authorization server. No token request was made.\",\n ), 400);\n }\n\n const pending = await consumeAuthorizationState(state);\n if (!pending) {\n return c.html(oauthReceiptPage(\n \"OAuth state expired or already used\",\n \"FAIL\",\n [{ label: \"Validation\", value: \"STATE_NOT_FOUND_OR_EXPIRED\" }],\n \"OAuth state is one-time-use and expires after ten minutes. Start a new verification flow.\",\n ), 400);\n }\n\n const token = await exchangeAuthorizationCode(code, pending.verifier);\n if (!token.ok) {\n return c.html(oauthReceiptPage(\n \"Token exchange failed\",\n \"FAIL\",\n [\n { label: \"HTTP status\", value: token.status },\n { label: \"OAuth result\", value: token.error },\n ],\n \"The one-time authorization code could not be exchanged. No token was persisted.\",\n ), 502);\n }\n\n let probe: any;\n try {\n probe = await probeAuthorizedAgentOs(token.accessToken);\n } catch (error) {\n probe = {\n connected: false,\n protocolEra: \"UNRESOLVED\",\n toolCount: 0,\n allToolNames: [],\n safeMarketToolNames: [],\n error: error instanceof Error ? error.message.slice(0, 180) : \"MCP_PROBE_FAILED\",\n };\n }\n\n const connected = probe.connected === true;\n return c.html(oauthReceiptPage(\n connected ? \"Binance Agent OS authorized\" : \"OAuth succeeded; MCP catalog not verified\",\n connected ? \"PASS\" : \"FAIL\",\n [\n { label: \"OAuth code flow\", value: \"PASS\" },\n { label: \"Issuer\", value: issuer || `${AGENT_OS.issuer} (callback omitted iss; server metadata did not advertise mandatory response-iss support)` },\n { label: \"Token persistence\", value: \"NONE\" },\n { label: \"Refresh token persisted\", value: \"NO\" },\n { label: \"Token endpoint scope\", value: token.scope ?? \"NOT_RETURNED\" },\n { label: \"MCP catalog connected\", value: connected ? \"YES\" : \"NO\" },\n { label: \"Protocol era\", value: probe.protocolEra ?? \"UNRESOLVED\" },\n { label: \"Tool count\", value: probe.toolCount ?? 0 },\n { label: \"Safe market tools\", value: probe.safeMarketToolNames ?? [] },\n { label: \"Automatic tool call\", value: \"NO\" },\n ],\n connected\n ? \"The callback used the ephemeral access token only to read the MCP tool catalog. No MCP tool was called and no Binance token or refresh token was persisted.\"\n : \"The OAuth code exchange succeeded, but the MCP tool catalog could not be proven in this callback. The access token was still discarded.\",\n ), connected ? 200 : 502);\n});\n\n\n\napp.get(\"/api/health\", (c) => c.json({\n status: \"PASS\",\n service: \"PayAna Market Sentinel\",\n version: \"1.2.0-rc1\",\n mode: \"READ_ONLY_MARKET_EVIDENCE_WITH_OPTIONAL_EPHEMERAL_MCP_AUTH_PROBE\",\n boundary: \"MARKET_DATA_READ != TRADING_AUTH\",\n supportedSymbols: supportedSymbols(),\n agentOsMcp: {\n endpointKnown: true,\n oauthFlowReady: true,\n oauthStartPath: \"/oauth/start\",\n runtimeProbeState: \"READY_FOR_USER_AUTHORIZATION\",\n liveAuthorizedSession: false,\n tokenPersistence: \"NONE\",\n automaticToolCall: false,\n },\n marketData: {\n provider: \"Binance public market-data surface\",\n runtimeChampion: \"data-api.binance.vision\",\n directApiBinanceComFromValTown: \"HTTP_451_RESTRICTED_LOCATION\",\n },\n generatedAt: new Date().toISOString(),\n}));\n\napp.get(\"/api/symbols\", (c) => c.json({ status: \"PASS\", symbols: supportedSymbols() }));\n\napp.get(\"/api/analyze\", async (c) => {\n try {\n const symbol = normalizeSymbol(c.req.query(\"symbol\") ?? \"BTCUSDT\");\n const result = await analyzeMarket(symbol);\n const httpStatus = result.evidenceState === \"FAIL\" ? 503 : 200;\n return c.json(result, httpStatus);\n } catch (error) {\n const message = error instanceof Error ? error.message : String(error);\n const status = message === \"INVALID_SYMBOL_FORMAT\" || message === \"SYMBOL_NOT_ALLOWLISTED\" ? 400 : 500;\n return c.json({ status: \"FAIL\", error: message.slice(0, 180), boundary: \"NO_UNVALIDATED_SYMBOL_FORWARDING\" }, status);\n }\n});\n\napp.notFound((c) => c.json({ status: \"FAIL\", error: \"NOT_FOUND\" }, 404));\napp.onError((err) => {\n console.error(\"UNHANDLED\", err instanceof Error ? err.message : String(err));\n return new Response(JSON.stringify({ status: \"FAIL\", error: \"INTERNAL_ERROR\" }), { status: 500, headers: { \"content-type\": \"application/json\" } });\n});\n\nexport default app.fetch;\n","deleted",false,"label",[14],"dd76f3ea-9fc4-4246-b008-5e2648b67faa",["D",1788820382412],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Detached PayAna Binance Agent OS 1.2 RC1 backup","imageUrl","userId","6cc24525-830b-4db3-9c9c-fd19fb50e91f","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a0773d-9d6b-7580-a53a-683363c351c8","tursoName","dd76f3ea9fc44246b0085e2648b67faa","tursoHostname","dd76f3ea9fc44246b0085e2648b67faa-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789516253896],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_106":102},"org",{"_9":10,"_99":100,"_101":102,"_55":56,"_103":104,"_105":42},"branch",{"_35":30,"_11":87,"_22":28,"_88":45,"_89":90,"_91":92,"_93":50,"_94":95,"_96":63,"_97":12,"_98":10},"isOwned","main","projectId","forkedBranchId","182c3c5a-4b2f-4ec3-8cf6-a4632f8ec886","forkedBranchVersion",45,"forkedProjectPrivacy","forkedProjectId","71ad8a44-f36c-41e9-a978-0707deb4f71b","forkedProjectOrgId","projectName","userHandle","displayName","Cleiton Costa","avatar","https://lh3.googleusercontent.com/a/ACg8ocIgWisWQiXts_2fy5iRiRgl8A6c7Ef94eqE3ur-4mlyUrpCBmQ=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_80":-5,"_140":141,"_142":143,"_144":145,"_146":42,"_147":42,"_148":42,"_149":32,"_150":-5,"_151":-7,"_152":-7,"_153":36,"_154":42,"_155":42,"_156":-5,"_157":42,"_158":42,"_159":42,"_160":-5},"ENV",{"_111":112,"_113":114,"_115":87,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137,"_138":139},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]