[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","cleitoncosta","name","payana-binance-agent-os","path","index.ts","project",{"_22":46,"_11":12,"_33":47,"_48":-5,"_49":42,"_50":51,"_52":51,"_53":54,"_55":-5,"_56":57,"_58":25,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_13":45},"permalink","https://www.val.town/x/cleitoncosta/payana-binance-agent-os/code/index.ts","extension","id","5b650b49-db1b-4a5f-8472-8c1d27016962","fileId","01a07d8b-9306-748f-a55c-5a7124e2c8be","parentId","branchId","182c3c5a-4b2f-4ec3-8cf6-a4632f8ec886","branchVersion",52,"latest",true,"createdAt",["D",1788827566539],"version",6,"fileType","http","content","import { immutableFileUrl, parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { Hono } from \"npm:hono\";\nimport { Root } from \"./frontend/root.tsx\";\nimport { analyzeMarket, normalizeSymbol, supportedSymbols } from \"./lib/market.ts\";\nimport {\n AGENT_OS,\n clientMetadata,\n consumeAuthorizationState,\n createAuthorizationRequest,\n exchangeAuthorizationCode,\n probeAuthorizedAgentOs,\n} from \"./lib/agent_os_oauth.ts\";\n\nconst app = new Hono();\nconst buckets = new Map();\nconst RATE_WINDOW_MS = 60_000;\nconst RATE_MAX = 30;\n\nfunction clientKey(c: any) {\n return String(c.req.header(\"cf-connecting-ip\") || c.req.header(\"x-forwarded-for\") || \"unknown\").split(\",\")[0].trim().slice(0, 80);\n}\nfunction rateAllowed(key: string) {\n const now = Date.now();\n const bucket = buckets.get(key);\n if (!bucket || now - bucket.startedAt >= RATE_WINDOW_MS) {\n buckets.set(key, { startedAt: now, count: 1 });\n return true;\n }\n if (bucket.count >= RATE_MAX) return false;\n bucket.count += 1;\n if (buckets.size > 1000) {\n for (const [k, v] of buckets) if (now - v.startedAt >= RATE_WINDOW_MS) buckets.delete(k);\n }\n return true;\n}\n\nfunction escapeHtml(value: unknown) {\n return String(value ?? \"\")\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\\\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n\nasync function sha256Hex(value: string) {\n const digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value)));\n return [...digest].map(byte => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction oauthReceiptPage(title: string, state: \"PASS\" | \"FAIL\", details: { label: string; value: unknown }[], note: string) {\n const rows = details.map(({ label, value }) => `${escapeHtml(label)}${escapeHtml(value)}`).join(\"\");\n const tools = details.find(x => x.label === \"Safe market tools\")?.value;\n const toolPills = Array.isArray(tools)\n ? `

${tools.map(x => `${escapeHtml(x)}`).join(\"\")}

`\n : \"\";\n const styleUrl = immutableFileUrl(\"/frontend/styles.css\");\n return `${escapeHtml(title)} · PayAna

AUTHORIZED MCP VERIFICATION

${escapeHtml(title)}

${escapeHtml(note)}

TOKEN NOT PERSISTEDNO TOOL CALLNO TRADE

Connection receipt

sanitized runtime evidence

${rows}

${toolPills}

Return to market cockpit

`;\n}\n\n\napp.use(\"*\", async (c, next) => {\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n c.header(\"Referrer-Policy\", \"no-referrer\");\n c.header(\"X-Frame-Options\", \"DENY\");\n c.header(\"Permissions-Policy\", \"camera=(), microphone=(), geolocation=(), payment=()\");\n c.header(\"Content-Security-Policy\", \"default-src 'self'; script-src 'self' https://esm.town https://esm.sh; style-src 'self'; connect-src 'self' https://esm.sh; img-src 'self' data:; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'\");\n await next();\n});\n\n\napp.use(\"/api/*\", async (c, next) => {\n c.header(\"Cache-Control\", \"no-store\");\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n c.header(\"Referrer-Policy\", \"no-referrer\");\n if (!rateAllowed(clientKey(c))) return c.json({ status: \"BLOCKED\", error: \"RATE_LIMITED\", retryAfterSeconds: 60 }, 429);\n await next();\n});\n\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.get(\"/oauth/client-metadata.json\", (c) => {\n c.header(\"Cache-Control\", \"public, max-age=300\");\n return c.json(clientMetadata());\n});\n\napp.get(\"/oauth/status\", (c) => {\n c.header(\"Cache-Control\", \"no-store\");\n return c.json({\n status: \"READY_FOR_USER_AUTHORIZATION\",\n issuer: AGENT_OS.issuer,\n resource: AGENT_OS.resource,\n clientId: AGENT_OS.clientId,\n redirectUri: AGENT_OS.redirectUri,\n flow: \"authorization_code_pkce_s256_cimd\",\n tokenPersistence: \"NONE\",\n automaticToolCall: false,\n boundary: \"OAUTH_FLOW_READY != USER_AUTHORIZED_SESSION\",\n });\n});\n\napp.get(\"/oauth/start\", async (c) => {\n if (!rateAllowed(`oauth:${clientKey(c)}`)) return c.json({ status: \"BLOCKED\", error: \"RATE_LIMITED\", retryAfterSeconds: 60 }, 429);\n const request = await createAuthorizationRequest();\n c.header(\"Cache-Control\", \"no-store\");\n return c.redirect(request.url, 302);\n});\n\napp.get(\"/oauth/callback\", async (c) => {\n c.header(\"Cache-Control\", \"no-store\");\n const errorParam = c.req.query(\"error\");\n if (errorParam) {\n return c.html(oauthReceiptPage(\n \"Authorization not completed\",\n \"FAIL\",\n [{ label: \"State\", value: \"USER_OR_PROVIDER_DECLINED\" }],\n \"Binance returned an OAuth error. The callback deliberately does not echo provider error text into the page.\",\n ), 400);\n }\n\n const state = c.req.query(\"state\") ?? \"\";\n const code = c.req.query(\"code\") ?? \"\";\n const issuer = c.req.query(\"iss\") ?? \"\";\n if (!/^[A-Za-z0-9_-]{30,200}$/.test(state) || code.length < 8 || code.length > 5000) {\n return c.html(oauthReceiptPage(\n \"Invalid OAuth callback\",\n \"FAIL\",\n [{ label: \"Validation\", value: \"MISSING_OR_INVALID_STATE_OR_CODE\" }],\n \"The callback failed local input validation before any token request was made.\",\n ), 400);\n }\n if (issuer && issuer !== AGENT_OS.issuer) {\n return c.html(oauthReceiptPage(\n \"Issuer validation failed\",\n \"FAIL\",\n [{ label: \"Validation\", value: \"RFC9207_ISSUER_MISMATCH\" }],\n \"The authorization response issuer did not match the discovered Binance Agent OS authorization server. No token request was made.\",\n ), 400);\n }\n\n const pending = await consumeAuthorizationState(state);\n if (!pending) {\n return c.html(oauthReceiptPage(\n \"OAuth state expired or already used\",\n \"FAIL\",\n [{ label: \"Validation\", value: \"STATE_NOT_FOUND_OR_EXPIRED\" }],\n \"OAuth state is one-time-use and expires after ten minutes. Start a new verification flow.\",\n ), 400);\n }\n\n const token = await exchangeAuthorizationCode(code, pending.verifier);\n if (!token.ok) {\n return c.html(oauthReceiptPage(\n \"Token exchange failed\",\n \"FAIL\",\n [\n { label: \"HTTP status\", value: token.status },\n { label: \"OAuth result\", value: token.error },\n ],\n \"The one-time authorization code could not be exchanged. No token was persisted.\",\n ), 502);\n }\n\n let probe: any;\n try {\n probe = await probeAuthorizedAgentOs(token.accessToken);\n } catch (error) {\n probe = {\n connected: false,\n protocolEra: \"UNRESOLVED\",\n toolCount: 0,\n allToolNames: [],\n safeMarketToolNames: [],\n error: error instanceof Error ? error.message.slice(0, 180) : \"MCP_PROBE_FAILED\",\n };\n }\n\n const connected = probe.connected === true;\n return c.html(oauthReceiptPage(\n connected ? \"Binance Agent OS authorized\" : \"OAuth succeeded; MCP catalog not verified\",\n connected ? \"PASS\" : \"FAIL\",\n [\n { label: \"OAuth code flow\", value: \"PASS\" },\n { label: \"Issuer\", value: issuer || `${AGENT_OS.issuer} (callback omitted iss; server metadata did not advertise mandatory response-iss support)` },\n { label: \"Token persistence\", value: \"NONE\" },\n { label: \"Refresh token persisted\", value: \"NO\" },\n { label: \"Token endpoint scope\", value: token.scope ?? \"NOT_RETURNED\" },\n { label: \"MCP catalog connected\", value: connected ? \"YES\" : \"NO\" },\n { label: \"Protocol era\", value: probe.protocolEra ?? \"UNRESOLVED\" },\n { label: \"Tool count\", value: probe.toolCount ?? 0 },\n { label: \"Safe market tools\", value: probe.safeMarketToolNames ?? [] },\n { label: \"Automatic tool call\", value: \"NO\" },\n ],\n connected\n ? \"The callback used the ephemeral access token only to read the MCP tool catalog. No MCP tool was called and no Binance token or refresh token was persisted.\"\n : \"The OAuth code exchange succeeded, but the MCP tool catalog could not be proven in this callback. The access token was still discarded.\",\n ), connected ? 200 : 502);\n});\n\n\n\napp.get(\"/api/health\", (c) => c.json({\n status: \"PASS\",\n service: \"PayAna Market Sentinel\",\n version: \"1.2.0-rc1\",\n mode: \"READ_ONLY_MARKET_EVIDENCE_WITH_OPTIONAL_EPHEMERAL_MCP_AUTH_PROBE\",\n boundary: \"MARKET_DATA_READ != TRADING_AUTH\",\n supportedSymbols: supportedSymbols(),\n agentOsMcp: {\n endpointKnown: true,\n oauthFlowReady: true,\n oauthStartPath: \"/oauth/start\",\n runtimeProbeState: \"READY_FOR_USER_AUTHORIZATION\",\n liveAuthorizedSession: false,\n tokenPersistence: \"NONE\",\n automaticToolCall: false,\n },\n marketData: {\n provider: \"Binance public market-data surface\",\n runtimeChampion: \"data-api.binance.vision\",\n directApiBinanceComFromValTown: \"HTTP_451_RESTRICTED_LOCATION\",\n },\n generatedAt: new Date().toISOString(),\n}));\n\napp.get(\"/api/submission-evidence\", async (c) => {\n const core = {\n schema: \"payana-submission-evidence-1.0.0\",\n status: \"PASS\",\n project: \"PayAna — Falsifier Agent for Binance Agent OS\",\n track: \"A\",\n release: \"payana-market-sentinel-1.2.0-rc1\",\n releaseAudit: {\n assertions: 189,\n mutationSteps: 35,\n totalExecutedChecks: 224,\n pass: true,\n releaseAuditBaselineAt: \"2026-09-07T22:31:20.817Z\",\n concurrencyRegression: \"SQLITE_BUSY_CONCURRENT_OAUTH_STATE_CONSUMPTION_FIXED_AND_RETESTED_5X\",\n },\n boundaries: [\n \"MARKET_DATA_READ != TRADING_AUTH\",\n \"MISSING_EVIDENCE != ZERO\",\n \"CURRENT_PRESSURE != FUTURE_PRICE\",\n \"MODEL_SCORE != CALIBRATED_PROBABILITY\",\n \"MCP_ENDPOINT_KNOWN != MCP_SESSION_AUTHORIZED\",\n \"AUTHORIZED_TOOL_CATALOG != TOOL_CALL\",\n \"NO_TRADE_DECISION\",\n ],\n officialHackathon: {\n deadlineUtc: \"2026-09-08T23:59:00Z\",\n announcement: \"https://www.binance.com/en/blog/community/8802181509900814931\",\n agentOs: \"https://www.binance.com/en/agent-os\",\n mcpDocs: \"https://developers.binance.com/en/docs/agent-native/mcp-server/agentic\",\n },\n proofPaths: {\n health: \"/api/health\",\n liveBtcEvidence: \"/api/analyze?symbol=BTCUSDT\",\n oauthStatus: \"/oauth/status\",\n source: \"https://www.val.town/x/cleitoncosta/payana-binance-agent-os/code/\",\n },\n supplementalEvidence: {\n binanceChatGPTPublicMarketData: \"PASS\",\n classification: \"SEPARATE_PUBLIC_MARKET_DATA_INTEGRATION_NOT_AGENT_OS_MCP_AUTH_PROOF\",\n witness: \"BTCUSDT spot price and 24-hour statistics returned by the connected Binance ChatGPT integration on 2026-09-08\",\n },\n officialEntryRequirements: {\n followAndRepostBinance: \"UNVERIFIED\",\n replyOrQuoteSubmission: \"UNVERIFIED\",\n surveyCompletion: \"UNVERIFIED\",\n trackASubmissionArtifact: \"LIVE_DEMO_ALREADY_AVAILABLE\",\n videoRequirement: \"NOT_REQUIRED_WHEN_DEMO_IS_USED\",\n githubRequirement: \"IF_APPLICABLE\",\n },\n qualificationEvidenceOpen: [\n \"PARTICIPANT_ACCOUNT_ELIGIBILITY\",\n \"SUPPORTED_CLIENT_AGENT_OS_MCP_MARKET_DATA_WITNESS\",\n ],\n optionalEnhancements: [\n \"FINAL_VIDEO_OR_SCREEN_RECORDING\",\n \"DEDICATED_GITHUB_MIRROR_IF_USEFUL\",\n ],\n externalGatesNotClaimedComplete: [\n \"PARTICIPANT_ACCOUNT_ELIGIBILITY\",\n \"SUPPORTED_CLIENT_AGENT_OS_MCP_MARKET_DATA_WITNESS\",\n \"X_FOLLOW_AND_REPOST\",\n \"X_TRACK_A_SUBMISSION\",\n \"BINANCE_SURVEY_COMPLETION\",\n ],\n };\n const manifestSha256 = await sha256Hex(JSON.stringify(core));\n return c.json({ ...core, manifestSha256, generatedAt: new Date().toISOString() });\n});\n\napp.get(\"/api/symbols\", (c) => c.json({ status: \"PASS\", symbols: supportedSymbols() }));\n\napp.get(\"/api/analyze\", async (c) => {\n try {\n const symbol = normalizeSymbol(c.req.query(\"symbol\") ?? \"BTCUSDT\");\n const result = await analyzeMarket(symbol);\n const httpStatus = result.evidenceState === \"FAIL\" ? 503 : 200;\n return c.json(result, httpStatus);\n } catch (error) {\n const message = error instanceof Error ? error.message : String(error);\n const status = message === \"INVALID_SYMBOL_FORMAT\" || message === \"SYMBOL_NOT_ALLOWLISTED\" ? 400 : 500;\n return c.json({ status: \"FAIL\", error: message.slice(0, 180), boundary: \"NO_UNVALIDATED_SYMBOL_FORWARDING\" }, status);\n }\n});\n\napp.notFound((c) => c.json({ status: \"FAIL\", error: \"NOT_FOUND\" }, 404));\napp.onError((err) => {\n console.error(\"UNHANDLED\", err instanceof Error ? err.message : String(err));\n return new Response(JSON.stringify({ status: \"FAIL\", error: \"INTERNAL_ERROR\" }), { status: 500, headers: { \"content-type\": \"application/json\" } });\n});\n\nexport default app.fetch;\n","deleted",false,"label","payana-agent-os",[14],"71ad8a44-f36c-41e9-a978-0707deb4f71b",["D",1788812694161],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","PayAna Falsifier Agent — evidence-first Binance market audit","imageUrl","userId","6cc24525-830b-4db3-9c9c-fd19fb50e91f","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0773d-9d6b-7580-a53a-683363c351c8","tursoName","71ad8a44f36c41e9a9780707deb4f71b","tursoHostname","71ad8a44f36c41e9a9780707deb4f71b-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789509043237],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":101},"org",{"_9":10,"_98":99,"_100":101,"_56":57,"_102":103,"_104":42},"branch",{"_35":30,"_11":89,"_22":28,"_90":46,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Cleiton Costa","avatar","https://lh3.googleusercontent.com/a/ACg8ocIgWisWQiXts_2fy5iRiRgl8A6c7Ef94eqE3ur-4mlyUrpCBmQ=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":63,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":89,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]