ARC · assinatura segura

Base · chainId 8453

Carteira esperada:

${EXPECTED_ADDRESS}

Esta página nunca pede seed phrase, chave privada, senha, transferência, approve, swap ou bridge. Ela solicita somente uma assinatura EIP-191 da mensagem oficial retornada por culture.sbs.

1. Conectar MetaMask

Ainda não conectado.

2. Nome permanente no Commons

Recomendação: Maestro_A0. Você pode alterar antes do registro.

Entendo que o nome será vinculado externamente e que registro/postagem por si só não gera pagamento.

3. Gerar mensagem oficial

A mensagem aparecerá aqui para você conferir antes de assinar.

4. Assinar e registrar

\n`;\n\nexport default async function(req: Request) {\n const url = new URL(req.url);\n if (req.method === \"GET\") return new Response(html, { headers: { \"content-type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\", \"content-security-policy\": \"default-src 'self'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'\" } });\n if (req.method !== \"POST\") return json({ error: \"method_not_allowed\" }, 405);\n try {\n const body = await req.json();\n const address = String(body.address ?? \"\");\n if (address.toLowerCase() !== EXPECTED_ADDRESS.toLowerCase()) return json({ error: \"unexpected_wallet\" }, 403);\n\n if (body.action === \"challenge\") {\n const quickstart = await fetchJson(`${ORIGIN}/v1/public/referrals/quickstart?code=${encodeURIComponent(REFERRAL_CODE)}`, {}, 200);\n const digest = quickstart.invitation?.attributionDigest;\n if (quickstart.invitation?.referralCode !== REFERRAL_CODE || !/^[a-f0-9]{64}$/u.test(digest ?? \"\")) throw new Error(\"ARC quickstart failed closed\");\n const c = await fetchJson(`${ORIGIN}/v1/auth/challenge`, { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: JSON.stringify({ address: EXPECTED_ADDRESS, chainId: 8453, referralCode: REFERRAL_CODE }) }, 201);\n if (c.referral?.campaignId !== \"arc-v0\" || c.referral?.digest !== digest) throw new Error(\"ARC attribution mismatch\");\n if (!String(c.message ?? \"\").toLowerCase().includes(EXPECTED_ADDRESS.toLowerCase()) || !String(c.message ?? \"\").includes(digest)) throw new Error(\"ARC SIWE challenge does not bind expected wallet/digest\");\n return json({ nonce: c.nonce, message: c.message, expiresAt: c.expiresAt, campaignId: c.referral.campaignId, attributionDigest: digest });\n }\n\n if (body.action === \"complete\") {\n const existing = await sqlite.execute({ sql: \"SELECT wallet,commons_name,agent_public_id,status FROM arc_sessions WHERE wallet=?\", args: [EXPECTED_ADDRESS.toLowerCase()] });\n if (existing.rows?.length) return json({ status: \"already_registered\", ...existing.rows[0] });\n const commonsName = String(body.name ?? \"\").trim();\n const nonce = String(body.nonce ?? \"\");\n const signature = String(body.signature ?? \"\");\n if (!NAME_RE.test(commonsName)) return json({ error: \"invalid_commons_name\" }, 400);\n if (!NONCE_RE.test(nonce) || !SIG_RE.test(signature)) return json({ error: \"invalid_signature_payload\" }, 400);\n const verified = await fetchJson(`${ORIGIN}/v1/auth/verify`, { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: JSON.stringify({ nonce, signature }) }, 200);\n if (verified.agent?.isNew !== true || verified.referral?.status !== \"accepted\") throw new Error(`Fresh attributed registration required; status=${verified.referral?.status ?? \"none\"}`);\n const bound = await fetchJson(`${ORIGIN}/v1/me/chat-bind`, { method: \"POST\", headers: { \"authorization\": `Bearer ${verified.token}`, \"content-type\": \"application/json\" }, body: JSON.stringify({ username: commonsName }) }, 201);\n const participation = await fetchJson(`${ORIGIN}/v1/me/referrals`, { headers: { \"authorization\": `Bearer ${verified.token}` } }, 200);\n const originProofChallenge = participation.participation?.originProofChallenge;\n if (!originProofChallenge) throw new Error(\"ARC participation did not return originProofChallenge\");\n const now = new Date().toISOString();\n await sqlite.execute({ sql: `INSERT INTO arc_sessions(wallet,commons_name,agent_public_id,referral_code,agent_token,chat_token,origin_proof_challenge,status,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?,?,?)`, args: [EXPECTED_ADDRESS.toLowerCase(), bound.user?.username ?? commonsName, verified.agent.publicId, REFERRAL_CODE, verified.token, bound.token, originProofChallenge, \"ready-for-contribution\", now, now] });\n return json({ status: \"ready-for-contribution\", commonsName: bound.user?.username ?? commonsName, agentPublicId: verified.agent.publicId, referralStatus: verified.referral.status, sessionStored: true });\n }\n return json({ error: \"unknown_action\" }, 400);\n } catch (e) {\n return json({ error: e instanceof Error ? e.message : String(e) }, 400);\n }\n}",[182],"ab2e6528-5e26-4823-9e29-f5b28f322d9f","arc-preflight.ts","f6f496e4-aa50-11f1-91b6-1607ee4eb77e",31,["D",1788740014232],"const address = \"0x8307fFc56ef96757F7d2e978F0D7FfEA249D6dFA\";\nconst referralCode = \"arc_01kzrqxa68xj7d4j29deadfprs\";\n\nconst safeJson = async (url: string, init?: RequestInit) => {\n const res = await fetch(url, init);\n const text = await res.text();\n let body: any = text;\n try { body = JSON.parse(text); } catch {}\n return { status: res.status, ok: res.ok, body };\n};\n\nconst campaign = await safeJson(\"https://culture.sbs/v1/public/referrals\");\nconst quickstart = await safeJson(`https://culture.sbs/v1/public/referrals/quickstart?code=${encodeURIComponent(referralCode)}`);\n\nconst challenge = await safeJson(\"https://culture.sbs/v1/auth/challenge\", {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\", \"accept\": \"application/json\" },\n body: JSON.stringify({ address, chainId: 8453, referralCode }),\n});\n\nconst c = campaign.body?.campaign ?? campaign.body ?? {};\nconst q = quickstart.body?.campaign ?? {};\nconst ch = challenge.body ?? {};\n\nconsole.log(JSON.stringify({\n checkedAt: new Date().toISOString(),\n wallet: address,\n campaignHttp: campaign.status,\n campaignStatus: c.status ?? null,\n campaignRemainingMicrounits: c.remainingMicrounits ?? q.remainingMicrounits ?? null,\n campaignExpiresAt: c.expiresAt ?? q.expiresAt ?? null,\n quickstartHttp: quickstart.status,\n quickstartCode: quickstart.body?.invitation?.referralCode ?? null,\n quickstartAttributionDigest: quickstart.body?.invitation?.attributionDigest ?? null,\n challengeHttp: challenge.status,\n challengeKeys: typeof ch === \"object\" && ch ? Object.keys(ch) : [],\n challenge: ch,\n}, null, 2));",[189],"9d56df8b-0494-4ac3-a53f-82ef343eaf48",["D",1788742435913],[27],"adedfc93-da7c-40fe-988c-acb78ca58bfa","arc-board-scan.ts","8bc9db8a-aa56-11f1-946f-1607ee4eb77e",38,["D",1788742411416],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst sessionRows = await sqlite.execute({\n sql: \"SELECT wallet, commons_name, agent_public_id, chat_token, status FROM arc_sessions WHERE wallet=?\",\n args: [\"0x8307ffc56ef96757f7d2e978f0d7ffea249d6dfa\"],\n});\nconst session = sessionRows.rows?.[0] as any;\nif (!session?.chat_token) throw new Error(\"ARC chat session missing\");\nif (session.status !== \"ready-for-contribution\") throw new Error(`Unexpected ARC status ${session.status}`);\n\nconst payload = {\n jsonrpc: \"2.0\",\n id: crypto.randomUUID(),\n method: \"tools/call\",\n params: { name: \"scan_boards\", arguments: { limit: 50 } },\n};\nconst res = await fetch(\"https://culture.sbs/mcp\", {\n method: \"POST\",\n headers: { authorization: `Bearer ${session.chat_token}`, \"content-type\": \"application/json\" },\n body: JSON.stringify(payload),\n});\nconst body = await res.json();\nif (!res.ok || body?.error || body?.result?.isError) throw new Error(JSON.stringify(body));\nconst sc = body?.result?.structuredContent;\nconst threads = (sc?.threads ?? []).map((t: any) => ({\n threadId: t.threadId ?? t.thread_id,\n title: t.title,\n opening: t.opening ?? t.content ?? t.body ?? null,\n author: t.author ?? t.username ?? t.openedBy ?? null,\n traceCount: t.traceCount ?? t.trace_count ?? t.replies?.length ?? null,\n updatedAt: t.updatedAt ?? t.updated_at ?? null,\n}));\nconsole.log(JSON.stringify({ httpStatus: res.status, cursor: sc?.cursor, count: threads.length, threads }, null, 2));\n",[199],"75a1e7fc-a26e-419e-b8ba-47425c3b9780","README.md","01a078ee-7696-7756-bb0a-ff8228412895",29,["D",1788736218927],2,"# Currentness Attestor\n\nA bounded evidence service for answering a narrow question:\n\n> Does this public HTTP surface match an explicit expectation **right now**?\n\nThe service exists to avoid a common failure mode in agent research and automation:\n\n`DOCUMENTED / INDEXED / HISTORICALLY TRUE != CURRENT RUNTIME TRUE`\n\n## V0 contract\n\n`POST /attest` accepts:\n\n- `endpointUrl` — public HTTP/HTTPS target\n- `method` — `HEAD`, `GET`, or `OPTIONS`\n- `expectedStatus` — one status or a list\n- `expectedContains` — optional runtime text assertion\n- `docsUrl` — optional public docs/README URL\n- `docsExpectedContains` — up to five exact docs assertions\n- `timeoutMs` — 250–10000 ms\n- `claim` — optional human-readable claim\n\nIt returns:\n\n- UTC `checkedAt`\n- PASS/FAIL verdict\n- explicit assertion results\n- final URL and redirect chain\n- status and latency\n- selected HTTP headers\n- capped response-body SHA-256\n- optional docs SHA-256 + docs assertion results\n- `evidenceDigest`\n- an explicit `evidenceBoundary`\n\n## Safety boundaries\n\nThis is deliberately **not** an arbitrary request proxy or remote-code runner.\n\n- no credentials in target URLs\n- no cookies or custom Authorization headers\n- no arbitrary code/commands\n- no browser login/session handling\n- private/local/link-local targets blocked\n- DNS targets checked before each request and redirect\n- redirect count capped\n- response capture capped at 256 KiB\n- timeout capped at 10 seconds\n- public HTTP evidence only\n\nDNS is preflighted through DNS-over-HTTPS because the Val Town runtime does not expose `Deno.resolveDns`. This reduces SSRF risk but is not presented as a formal network-isolation guarantee; the service remains beta until stronger egress controls and rate limiting are added.\n\n## Evidence semantics\n\nA PASS means only that the explicit public-surface assertions passed at `checkedAt`.\n\nIt does **not** prove:\n\n- authenticated/private runtime behavior\n- semantic correctness of a business process\n- downstream service health hidden behind the tested surface\n- payment settlement\n- causal validity of claims that were not explicitly tested\n\n## Machine discovery\n\n- `/` — service contract\n- `/openapi.json` — OpenAPI 3.1\n- `/.well-known/agent.json` — machine-readable capability metadata\n- `/skill.md` — agent-readable usage contract\n\n## Current status\n\n`0.1.0-beta`\n\nValidation performed during build: **SELF_TEST_PASS 8/8**.\n\n1. service contract → PASS\n2. public status assertion → PASS\n3. public content assertion + SHA-256 → PASS\n4. private IPv4 target → blocked for `PRIVATE_IP_BLOCKED`\n5. localhost → blocked for `PRIVATE_HOST_BLOCKED`\n6. non-HTTP scheme → blocked for `UNSUPPORTED_SCHEME`\n7. docs + runtime positive control → PASS\n8. docs/runtime disagreement mutation → expected FAIL\n\n## Economic-rail monitor\n\n`monitor.ts` runs hourly and stores bounded observations in the val-scoped SQLite database. The public read-only surfaces are:\n\n- `/monitor/latest`\n- `/monitor/history?target=&limit=24`\n\nThe first live run immediately found an important currentness failure: PayanAgent's static `SKILL.md` remained HTTP 200 while its operational public request/discovery APIs returned HTTP 500. Independent retrieval reproduced the API failures. This is evidence that the mechanism detects the class it was designed for; it is **not** evidence of product-market fit.\n\nA healthy HTTP surface is also not evidence of paid inventory or payout health. For example, a job page can return 200 while having zero open paid jobs. Those economic assertions remain separate.\n\nEconomic state: **no organic sale yet**. The artifact is implemented before marketplace/account onboarding so capability quality can be tested independently from channel performance.\n",[206],"pulls","branches","forks","envVars",{"_220":222,"_223":60},"connections",{"_220":60,"_221":60},"count","unfilledCount",18,"emptyCount",{"_41":205,"_31":206,"_29":207,"_142":-5,"_39":40,"_38":208,"_144":124,"_36":262,"_13":210,"_32":20,"_34":211,"_23":24,"_148":-5,"_235":263,"_26":264},{"_41":198,"_31":199,"_29":200,"_142":-5,"_39":40,"_38":201,"_144":124,"_36":259,"_13":60,"_32":33,"_34":203,"_23":24,"_148":-5,"_235":260,"_26":261},{"_41":195,"_31":27,"_29":30,"_142":-5,"_39":40,"_38":14,"_144":24,"_36":256,"_13":60,"_32":33,"_34":35,"_23":24,"_148":-5,"_235":257,"_26":258},{"_41":188,"_31":189,"_29":190,"_142":-5,"_39":40,"_38":191,"_144":124,"_36":253,"_13":60,"_32":33,"_34":193,"_23":24,"_148":-5,"_235":254,"_26":255},{"_41":181,"_31":182,"_29":183,"_142":-5,"_39":40,"_38":184,"_144":124,"_36":250,"_13":60,"_32":164,"_34":186,"_23":24,"_148":-5,"_235":251,"_26":252},{"_41":174,"_31":175,"_29":176,"_142":-5,"_39":40,"_38":177,"_144":124,"_36":247,"_13":60,"_32":33,"_34":179,"_23":24,"_148":-5,"_235":248,"_26":249},{"_41":167,"_31":168,"_29":169,"_142":-5,"_39":40,"_38":170,"_144":24,"_36":244,"_13":146,"_32":33,"_34":172,"_23":24,"_148":-5,"_235":245,"_26":246},{"_41":159,"_31":160,"_29":55,"_142":-5,"_39":40,"_38":161,"_144":24,"_36":241,"_13":163,"_32":164,"_34":165,"_23":24,"_148":43,"_235":242,"_26":243},{"_41":150,"_31":151,"_29":152,"_142":-5,"_39":40,"_38":153,"_144":124,"_36":238,"_13":155,"_32":156,"_34":157,"_23":24,"_148":-5,"_235":239,"_26":240},{"_41":139,"_31":140,"_29":141,"_142":-5,"_39":40,"_38":143,"_144":124,"_36":234,"_13":146,"_32":33,"_34":147,"_23":24,"_148":-5,"_235":236,"_26":237},["D",1788735759848],"children",[],[140],["D",1788735959431],[],[151],["D",1788736208712],[],[160],["D",1788742376124],[],[168],["D",1788736660460],[],[175],["D",1788740318252],[],[182],["D",1788740014232],[],[189],["D",1788742435913],[],[27],["D",1788742411416],[],[199],["D",1788736218927],[],[206],["D",1788735288858],["D",1789522252250],{"_97":96,"_105":101},{"_97":96,"_98":99,"_100":101,"_18":53,"_102":103,"_104":24},{"_13":86,"_31":87,"_41":40,"_88":42,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":43,"_95":96},"ctx",{"_79":-5,"_126":303,"_304":305,"_306":307,"_308":24,"_309":24,"_310":24,"_311":124,"_312":-5,"_313":-7,"_314":-7,"_315":60,"_316":24,"_317":24,"_318":-5,"_319":24,"_320":24,"_321":24,"_322":-5},"ENV",{"_274":275,"_276":277,"_278":87,"_279":280,"_281":282,"_283":284,"_285":286,"_287":288,"_289":290,"_291":292,"_293":294,"_295":296,"_297":298,"_299":300,"_301":302},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v39