[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_457":458,"_459":460},"routes/_app.x.$handle.$name",{"_102":101,"_32":45,"_111":90,"_27":112,"_13":14,"_113":-5,"_11":114,"_115":116,"_117":118,"_119":120,"_121":122,"_20":-5,"_123":-5,"_124":125,"_126":25,"_127":128,"_129":59,"_130":-5,"_131":-5,"_132":133},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":25},"version",3,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":20,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":33,"_34":20,"_35":36},"deleted",false,"deletedHere","path","docs/SUBMISSION_CHECKLIST.md","latestPath","fileId","01a07e13-fb44-7031-82f2-4a089510d501","name","SUBMISSION_CHECKLIST.md","fileType","content","# Binance Agent OS Mini Hackathon — Track A submission checklist\n\nCurrentness checkpoint: 2026-09-07. Official announcement: https://www.binance.com/en/blog/community/8802181509900814931\n\nOfficial X announcement: https://x.com/binance/status/2094810011557838988\n\nOfficial survey: https://www.binance.com/en/survey/2913aa200aac462c89a737779393f3d4\n\nDeadline stated by Binance: **2026-09-08 23:59 UTC** (**2026-09-08 20:59 BRT / UTC−03**).\n\n## Technical package\n\n- [x] Working hosted demo.\n- [x] Read-only Binance market-data integration.\n- [x] `SKILL.md` for an MCP-capable AI agent using Binance Agent OS Market Data.\n- [x] Explicit safety boundary: no Account / Trade / Transfer required.\n- [x] Evidence receipts.\n- [x] Competing-hypothesis / falsification methodology.\n- [x] Deterministic formulas documented.\n- [x] API input allowlist and negative controls.\n- [x] `NO_TRADE_DECISION` hard contract.\n- [x] CSP and web hardening.\n- [x] Automated release audit: 189 assertions + 35 rate-limit mutation steps = 224 checks PASS.\n- [x] Source-failure/malformed-response mutation tests (`MISSING_EVIDENCE != ZERO`).\n- [x] OAuth/CIMD/PKCE callback path implemented and locally falsified.\n- [x] OAuth state TTL, replay rejection, concurrent single-consumer behavior and 500-row pending-state cap tested.\n- [x] MCP 2026-07-28 stateless request metadata/headers tested with legacy fallback retained.\n- [x] Synthetic MCP catalog proves Account/Trade/Transfer-like tools are excluded and `tools/call` is never automatic.\n- [x] Runtime restrictions documented instead of hidden.\n- [x] Public market-data path uses Binance's documented `data-api.binance.vision` surface; no API key required for these Spot reads.\n- [x] Direct unauthenticated Agent OS transport probe classified: `server/discover` reaches server but is not implemented; `tools/list` returns OAuth 401. This proves the current MCP connection gate instead of assuming public data means anonymous tool-catalog access.\n- [ ] Real Binance Agent OS MCP connection proof in a supported MCP client, showing a Binance MCP Market Data tool returning BTCUSDT. Binance documents Market Data as public/no-auth at the capability level; keep Account, Trade and Transfer capabilities out of the PayAna demo.\n- [ ] Interactive screenshot/recording proof after final build — browser-automation providers currently require external credit/top-up; manual recording remains possible.\n\n## Official participation steps\n\nThese are external account actions and must be proven rather than inferred:\n\n- [ ] Confirm participant is eligible under the current Binance jurisdiction/account rules.\n- [ ] Follow `@Binance` on X.\n- [ ] Repost the official hackathon announcement.\n- [ ] Publish Track A reply or quote-repost containing the demo/video and GitHub link when applicable.\n- [ ] Complete the official Binance survey.\n- [ ] Preserve the resulting X post URL and survey success evidence in the project receipt log.\n\n## Suggested demo sequence\n\nTarget length: ~60–90 seconds.\n\n1. **Problem (5–8s)** — \"Most market agents optimize for producing an answer. PayAna also tries to prove its own answer wrong.\"\n2. **Agent OS connection (10s)** — show the Binance MCP connected with Market Data-only permission, if authorization has been completed.\n3. **Prompt (5s)** — ask PayAna to audit BTCUSDT without trading.\n4. **Evidence (15s)** — show ticker, top-20 order book, 5m candles and source receipts.\n5. **Neurônio/falsifier step (15s)** — show winning hypothesis, opposite hypothesis, alternative explanation and observable falsifiers.\n6. **Negative space (10s)** — show missing funding/account/news/on-chain context instead of pretending it exists.\n7. **Safety (8s)** — show `NO_TRADE_DECISION` and `MARKET_DATA_READ != TRADING_AUTH`.\n8. **Proof (10s)** — show automated tests and hosted demo URL.\n\n## Suggested submission copy\n\n> Built **PayAna — the Falsifier Agent** for Binance Agent OS Track A. Instead of asking an agent only “what does the market say?”, PayAna also asks “what evidence would prove this reading wrong?” It uses Binance market data to build competing hypotheses, explicit falsifiers, missing-context checks and source receipts — with a read-only, no-trade safety boundary. Demo + code: [DEMO] [GITHUB] #Binance #AgentOS #BinanceMCP\n\nDo not publish the placeholder version. Replace `[DEMO]` and `[GITHUB]` with final verified URLs first.\n\n## Evidence to preserve after submission\n\n- final Git commit / repository URL;\n- hosted demo URL;\n- final self-test output;\n- MCP Market Data authorization/connection proof if completed;\n- video/demo URL;\n- X submission URL;\n- survey completion proof;\n- UTC submission timestamp.\n","# Binance Agent OS Mini Hackathon — Track A submission checklist\n\nCurrentness checkpoint: 2026-09-07. Official announcement: https://www.binance.com/en/blog/community/8802181509900814931\n\nOfficial X announcement: https://x.com/binance/status/2094810011557838988\n\nOfficial survey: https://www.binance.com/en/survey/2913aa200aac462c89a737779393f3d4\n\nDeadline stated by Binance: **2026-09-08 23:59 UTC** (**2026-09-08 20:59 BRT / UTC−03**).\n\n## Technical package\n\n- [x] Working hosted demo.\n- [x] Read-only Binance market-data integration.\n- [x] `SKILL.md` for an MCP-capable AI agent using Binance Agent OS Market Data.\n- [x] Explicit safety boundary: no Account / Trade / Transfer required.\n- [x] Evidence receipts.\n- [x] Competing-hypothesis / falsification methodology.\n- [x] Deterministic formulas documented.\n- [x] API input allowlist and negative controls.\n- [x] `NO_TRADE_DECISION` hard contract.\n- [x] CSP and web hardening.\n- [x] Automated release audit: 189 assertions + 35 rate-limit mutation steps = 224 checks PASS.\n- [x] Source-failure/malformed-response mutation tests (`MISSING_EVIDENCE != ZERO`).\n- [x] OAuth/CIMD/PKCE callback path implemented and locally falsified.\n- [x] OAuth state TTL, replay rejection, concurrent single-consumer behavior and 500-row pending-state cap tested.\n- [x] MCP 2026-07-28 stateless request metadata/headers tested with legacy fallback retained.\n- [x] Synthetic MCP catalog proves Account/Trade/Transfer-like tools are excluded and `tools/call` is never automatic.\n- [x] Runtime restrictions documented instead of hidden.\n- [x] Public market-data path uses Binance's documented `data-api.binance.vision` surface; no API key required for these Spot reads.\n- [x] Direct unauthenticated Agent OS transport probe classified: `server/discover` reaches server but is not implemented; `tools/list` returns OAuth 401. This proves the current MCP connection gate instead of assuming public data means anonymous tool-catalog access.\n- [ ] Real Binance Agent OS MCP connection proof in a supported MCP client, showing a Binance MCP Market Data tool returning BTCUSDT. Binance documents Market Data as public/no-auth at the capability level; keep Account, Trade and Transfer capabilities out of the PayAna demo.\n- [x] Track A submission artifact requirement is already satisfied by the live hosted demo (`video OR demo` in the official rules). A final screen recording remains an optional presentation enhancement, not a mandatory entry gate. Interactive browser-QA evidence is still separate from the live demo and remains unverified while browser-automation providers are unavailable.\n\n## Official participation steps\n\nThese are external account actions and must be proven rather than inferred:\n\n- [ ] Confirm participant is eligible under the current Binance jurisdiction/account rules.\n- [ ] Follow `@Binance` on X.\n- [ ] Repost the official hackathon announcement.\n- [ ] Publish Track A reply or quote-repost containing the demo/video and GitHub link when applicable.\n- [ ] Complete the official Binance survey.\n- [ ] Preserve the resulting X post URL and survey success evidence in the project receipt log.\n\n## Suggested demo sequence\n\nTarget length: ~60–90 seconds.\n\n1. **Problem (5–8s)** — \"Most market agents optimize for producing an answer. PayAna also tries to prove its own answer wrong.\"\n2. **Agent OS connection (10s)** — show the Binance MCP connected with Market Data-only permission, if authorization has been completed.\n3. **Prompt (5s)** — ask PayAna to audit BTCUSDT without trading.\n4. **Evidence (15s)** — show ticker, top-20 order book, 5m candles and source receipts.\n5. **Neurônio/falsifier step (15s)** — show winning hypothesis, opposite hypothesis, alternative explanation and observable falsifiers.\n6. **Negative space (10s)** — show missing funding/account/news/on-chain context instead of pretending it exists.\n7. **Safety (8s)** — show `NO_TRADE_DECISION` and `MARKET_DATA_READ != TRADING_AUTH`.\n8. **Proof (10s)** — show automated tests and hosted demo URL.\n\n## Suggested submission copy\n\n> Built **PayAna — the Falsifier Agent** for Binance Agent OS Track A. Instead of asking an agent only “what does the market say?”, PayAna also asks “what evidence would prove this reading wrong?” It uses Binance market data to build competing hypotheses, explicit falsifiers, missing-context checks and source receipts — with a read-only, no-trade safety boundary. Demo + code: [DEMO] [GITHUB] #Binance #AgentOS #BinanceMCP\n\nDo not publish the placeholder version. Replace `[DEMO]` and `[GITHUB]` with final verified URLs first.\n\n## Evidence to preserve after submission\n\n- final Git commit / repository URL;\n- hosted demo URL;\n- final self-test output;\n- MCP Market Data authorization/connection proof if completed;\n- video/demo URL;\n- X submission URL;\n- survey completion proof;\n- UTC submission timestamp.\n","createdAt",["D",1788821652959],"branchVersion","branchId","a636b828-d405-4406-a3d5-f09693987706","id","71ad8a44-f36c-41e9-a978-0707deb4f71b","payana-binance-agent-os",["D",1788812694161],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","PayAna Falsifier Agent — evidence-first Binance market audit","imageUrl","6cc24525-830b-4db3-9c9c-fd19fb50e91f","pinnedFileId","01a07d8b-9306-748f-a55c-5a7124e2c8be","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0773d-9d6b-7580-a53a-683363c351c8","tursoName","71ad8a44f36c41e9a9780707deb4f71b","tursoHostname","71ad8a44f36c41e9a9780707deb4f71b-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789509043237],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_102":101,"_110":106},"org",{"_102":101,"_103":104,"_105":106,"_18":55,"_107":108,"_109":25},"branch",{"_13":89,"_32":90,"_43":42,"_91":44,"_92":93,"_94":95,"_96":50,"_97":44,"_98":65,"_99":45,"_100":101},"isOwned",9,"entry-rule-reconcile-v1","projectId","forkedBranchId","182c3c5a-4b2f-4ec3-8cf6-a4632f8ec886","forkedBranchVersion",51,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","cleitoncosta","handle","displayName","Cleiton Costa","avatar","https://lh3.googleusercontent.com/a/ACg8ocIgWisWQiXts_2fy5iRiRgl8A6c7Ef94eqE3ur-4mlyUrpCBmQ=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":452,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":453,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":454,"_84":455,"_86":456,"_88":25},"tree",[218,225,230,237,240,248,249,250,251],"files",[218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251],"counts",{"_206":63,"_207":208,"_209":210,"_211":212,"_213":214},"contents",[141,142,143,144,145,146,147,148,149],"upstreamProject","upstreamBranch",{"_43":93,"_38":134,"_135":136,"_32":137,"_91":44,"_13":138,"_92":-5,"_94":-5,"_139":140,"_47":-5,"_88":25,"_49":50,"_100":101,"_64":65,"_99":45},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1788812694161],"updatedAt",["D",1788827566539],"main",52,"lockfileKey","1788827566927-esm.town_v_cleitoncosta_payana-binance-agent-os@52-main",{"_43":201,"_32":202,"_30":203,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":204,"_13":63,"_34":184,"_35":-5,"_24":25,"_160":-5,"_27":205},{"_43":196,"_32":197,"_30":198,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":199,"_13":63,"_34":184,"_35":-5,"_24":25,"_160":-5,"_27":200},{"_43":191,"_32":192,"_30":193,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":194,"_13":63,"_34":184,"_35":-5,"_24":25,"_160":-5,"_27":195},{"_43":186,"_32":187,"_30":188,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":189,"_13":63,"_34":184,"_35":-5,"_24":25,"_160":-5,"_27":190},{"_43":180,"_32":181,"_30":182,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":183,"_13":63,"_34":184,"_35":-5,"_24":25,"_160":-5,"_27":185},{"_43":174,"_32":175,"_30":176,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":177,"_13":63,"_34":20,"_35":178,"_24":25,"_160":-5,"_27":179},{"_43":168,"_32":169,"_30":170,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":171,"_13":63,"_34":20,"_35":172,"_24":25,"_160":-5,"_27":173},{"_43":162,"_32":163,"_30":164,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":165,"_13":63,"_34":20,"_35":166,"_24":25,"_160":-5,"_27":167},{"_43":150,"_32":151,"_30":152,"_153":-5,"_41":42,"_40":154,"_155":59,"_38":156,"_13":157,"_34":158,"_35":159,"_24":25,"_160":-5,"_27":161},"b3434474-6702-4776-8129-25cc4ca32d14","index.ts","01a07e13-fb44-7031-82f2-aee5d76381f0","parentId",2,"latest",["D",1788821641807],1,"http","import { immutableFileUrl, parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { Hono } from \"npm:hono\";\nimport { Root } from \"./frontend/root.tsx\";\nimport { analyzeMarket, normalizeSymbol, supportedSymbols } from \"./lib/market.ts\";\nimport {\n AGENT_OS,\n clientMetadata,\n consumeAuthorizationState,\n createAuthorizationRequest,\n exchangeAuthorizationCode,\n probeAuthorizedAgentOs,\n} from \"./lib/agent_os_oauth.ts\";\n\nconst app = new Hono();\nconst buckets = new Map();\nconst RATE_WINDOW_MS = 60_000;\nconst RATE_MAX = 30;\n\nfunction clientKey(c: any) {\n return String(c.req.header(\"cf-connecting-ip\") || c.req.header(\"x-forwarded-for\") || \"unknown\").split(\",\")[0].trim().slice(0, 80);\n}\nfunction rateAllowed(key: string) {\n const now = Date.now();\n const bucket = buckets.get(key);\n if (!bucket || now - bucket.startedAt >= RATE_WINDOW_MS) {\n buckets.set(key, { startedAt: now, count: 1 });\n return true;\n }\n if (bucket.count >= RATE_MAX) return false;\n bucket.count += 1;\n if (buckets.size > 1000) {\n for (const [k, v] of buckets) if (now - v.startedAt >= RATE_WINDOW_MS) buckets.delete(k);\n }\n return true;\n}\n\nfunction escapeHtml(value: unknown) {\n return String(value ?? \"\")\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\\\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n\nasync function sha256Hex(value: string) {\n const digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value)));\n return [...digest].map(byte => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction oauthReceiptPage(title: string, state: \"PASS\" | \"FAIL\", details: { label: string; value: unknown }[], note: string) {\n const rows = details.map(({ label, value }) => `${escapeHtml(label)}${escapeHtml(value)}`).join(\"\");\n const tools = details.find(x => x.label === \"Safe market tools\")?.value;\n const toolPills = Array.isArray(tools)\n ? `

${tools.map(x => `${escapeHtml(x)}`).join(\"\")}

`\n : \"\";\n const styleUrl = immutableFileUrl(\"/frontend/styles.css\");\n return `${escapeHtml(title)} · PayAna

AUTHORIZED MCP VERIFICATION

${escapeHtml(title)}

${escapeHtml(note)}

TOKEN NOT PERSISTEDNO TOOL CALLNO TRADE

Connection receipt

sanitized runtime evidence

${rows}

${toolPills}

Return to market cockpit

`;\n}\n\n\napp.use(\"*\", async (c, next) => {\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n c.header(\"Referrer-Policy\", \"no-referrer\");\n c.header(\"X-Frame-Options\", \"DENY\");\n c.header(\"Permissions-Policy\", \"camera=(), microphone=(), geolocation=(), payment=()\");\n c.header(\"Content-Security-Policy\", \"default-src 'self'; script-src 'self' https://esm.town https://esm.sh; style-src 'self'; connect-src 'self' https://esm.sh; img-src 'self' data:; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'\");\n await next();\n});\n\n\napp.use(\"/api/*\", async (c, next) => {\n c.header(\"Cache-Control\", \"no-store\");\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n c.header(\"Referrer-Policy\", \"no-referrer\");\n if (!rateAllowed(clientKey(c))) return c.json({ status: \"BLOCKED\", error: \"RATE_LIMITED\", retryAfterSeconds: 60 }, 429);\n await next();\n});\n\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.get(\"/oauth/client-metadata.json\", (c) => {\n c.header(\"Cache-Control\", \"public, max-age=300\");\n return c.json(clientMetadata());\n});\n\napp.get(\"/oauth/status\", (c) => {\n c.header(\"Cache-Control\", \"no-store\");\n return c.json({\n status: \"READY_FOR_USER_AUTHORIZATION\",\n issuer: AGENT_OS.issuer,\n resource: AGENT_OS.resource,\n clientId: AGENT_OS.clientId,\n redirectUri: AGENT_OS.redirectUri,\n flow: \"authorization_code_pkce_s256_cimd\",\n tokenPersistence: \"NONE\",\n automaticToolCall: false,\n boundary: \"OAUTH_FLOW_READY != USER_AUTHORIZED_SESSION\",\n });\n});\n\napp.get(\"/oauth/start\", async (c) => {\n if (!rateAllowed(`oauth:${clientKey(c)}`)) return c.json({ status: \"BLOCKED\", error: \"RATE_LIMITED\", retryAfterSeconds: 60 }, 429);\n const request = await createAuthorizationRequest();\n c.header(\"Cache-Control\", \"no-store\");\n return c.redirect(request.url, 302);\n});\n\napp.get(\"/oauth/callback\", async (c) => {\n c.header(\"Cache-Control\", \"no-store\");\n const errorParam = c.req.query(\"error\");\n if (errorParam) {\n return c.html(oauthReceiptPage(\n \"Authorization not completed\",\n \"FAIL\",\n [{ label: \"State\", value: \"USER_OR_PROVIDER_DECLINED\" }],\n \"Binance returned an OAuth error. The callback deliberately does not echo provider error text into the page.\",\n ), 400);\n }\n\n const state = c.req.query(\"state\") ?? \"\";\n const code = c.req.query(\"code\") ?? \"\";\n const issuer = c.req.query(\"iss\") ?? \"\";\n if (!/^[A-Za-z0-9_-]{30,200}$/.test(state) || code.length < 8 || code.length > 5000) {\n return c.html(oauthReceiptPage(\n \"Invalid OAuth callback\",\n \"FAIL\",\n [{ label: \"Validation\", value: \"MISSING_OR_INVALID_STATE_OR_CODE\" }],\n \"The callback failed local input validation before any token request was made.\",\n ), 400);\n }\n if (issuer && issuer !== AGENT_OS.issuer) {\n return c.html(oauthReceiptPage(\n \"Issuer validation failed\",\n \"FAIL\",\n [{ label: \"Validation\", value: \"RFC9207_ISSUER_MISMATCH\" }],\n \"The authorization response issuer did not match the discovered Binance Agent OS authorization server. No token request was made.\",\n ), 400);\n }\n\n const pending = await consumeAuthorizationState(state);\n if (!pending) {\n return c.html(oauthReceiptPage(\n \"OAuth state expired or already used\",\n \"FAIL\",\n [{ label: \"Validation\", value: \"STATE_NOT_FOUND_OR_EXPIRED\" }],\n \"OAuth state is one-time-use and expires after ten minutes. Start a new verification flow.\",\n ), 400);\n }\n\n const token = await exchangeAuthorizationCode(code, pending.verifier);\n if (!token.ok) {\n return c.html(oauthReceiptPage(\n \"Token exchange failed\",\n \"FAIL\",\n [\n { label: \"HTTP status\", value: token.status },\n { label: \"OAuth result\", value: token.error },\n ],\n \"The one-time authorization code could not be exchanged. No token was persisted.\",\n ), 502);\n }\n\n let probe: any;\n try {\n probe = await probeAuthorizedAgentOs(token.accessToken);\n } catch (error) {\n probe = {\n connected: false,\n protocolEra: \"UNRESOLVED\",\n toolCount: 0,\n allToolNames: [],\n safeMarketToolNames: [],\n error: error instanceof Error ? error.message.slice(0, 180) : \"MCP_PROBE_FAILED\",\n };\n }\n\n const connected = probe.connected === true;\n return c.html(oauthReceiptPage(\n connected ? \"Binance Agent OS authorized\" : \"OAuth succeeded; MCP catalog not verified\",\n connected ? \"PASS\" : \"FAIL\",\n [\n { label: \"OAuth code flow\", value: \"PASS\" },\n { label: \"Issuer\", value: issuer || `${AGENT_OS.issuer} (callback omitted iss; server metadata did not advertise mandatory response-iss support)` },\n { label: \"Token persistence\", value: \"NONE\" },\n { label: \"Refresh token persisted\", value: \"NO\" },\n { label: \"Token endpoint scope\", value: token.scope ?? \"NOT_RETURNED\" },\n { label: \"MCP catalog connected\", value: connected ? \"YES\" : \"NO\" },\n { label: \"Protocol era\", value: probe.protocolEra ?? \"UNRESOLVED\" },\n { label: \"Tool count\", value: probe.toolCount ?? 0 },\n { label: \"Safe market tools\", value: probe.safeMarketToolNames ?? [] },\n { label: \"Automatic tool call\", value: \"NO\" },\n ],\n connected\n ? \"The callback used the ephemeral access token only to read the MCP tool catalog. No MCP tool was called and no Binance token or refresh token was persisted.\"\n : \"The OAuth code exchange succeeded, but the MCP tool catalog could not be proven in this callback. The access token was still discarded.\",\n ), connected ? 200 : 502);\n});\n\n\n\napp.get(\"/api/health\", (c) => c.json({\n status: \"PASS\",\n service: \"PayAna Market Sentinel\",\n version: \"1.2.0-rc1\",\n mode: \"READ_ONLY_MARKET_EVIDENCE_WITH_OPTIONAL_EPHEMERAL_MCP_AUTH_PROBE\",\n boundary: \"MARKET_DATA_READ != TRADING_AUTH\",\n supportedSymbols: supportedSymbols(),\n agentOsMcp: {\n endpointKnown: true,\n oauthFlowReady: true,\n oauthStartPath: \"/oauth/start\",\n runtimeProbeState: \"READY_FOR_USER_AUTHORIZATION\",\n liveAuthorizedSession: false,\n tokenPersistence: \"NONE\",\n automaticToolCall: false,\n },\n marketData: {\n provider: \"Binance public market-data surface\",\n runtimeChampion: \"data-api.binance.vision\",\n directApiBinanceComFromValTown: \"HTTP_451_RESTRICTED_LOCATION\",\n },\n generatedAt: new Date().toISOString(),\n}));\n\napp.get(\"/api/submission-evidence\", async (c) => {\n const core = {\n schema: \"payana-submission-evidence-1.0.0\",\n status: \"PASS\",\n project: \"PayAna — Falsifier Agent for Binance Agent OS\",\n track: \"A\",\n release: \"payana-market-sentinel-1.2.0-rc1\",\n releaseAudit: {\n assertions: 189,\n mutationSteps: 35,\n totalExecutedChecks: 224,\n pass: true,\n releaseAuditBaselineAt: \"2026-09-07T22:31:20.817Z\",\n concurrencyRegression: \"SQLITE_BUSY_CONCURRENT_OAUTH_STATE_CONSUMPTION_FIXED_AND_RETESTED_5X\",\n },\n boundaries: [\n \"MARKET_DATA_READ != TRADING_AUTH\",\n \"MISSING_EVIDENCE != ZERO\",\n \"CURRENT_PRESSURE != FUTURE_PRICE\",\n \"MODEL_SCORE != CALIBRATED_PROBABILITY\",\n \"MCP_ENDPOINT_KNOWN != MCP_SESSION_AUTHORIZED\",\n \"AUTHORIZED_TOOL_CATALOG != TOOL_CALL\",\n \"NO_TRADE_DECISION\",\n ],\n officialHackathon: {\n deadlineUtc: \"2026-09-08T23:59:00Z\",\n announcement: \"https://www.binance.com/en/blog/community/8802181509900814931\",\n agentOs: \"https://www.binance.com/en/agent-os\",\n mcpDocs: \"https://developers.binance.com/en/docs/agent-native/mcp-server/agentic\",\n },\n proofPaths: {\n health: \"/api/health\",\n liveBtcEvidence: \"/api/analyze?symbol=BTCUSDT\",\n oauthStatus: \"/oauth/status\",\n source: \"/source\",\n },\n officialEntryRequirements: {\n followAndRepostBinance: \"UNVERIFIED\",\n replyOrQuoteSubmission: \"UNVERIFIED\",\n surveyCompletion: \"UNVERIFIED\",\n trackASubmissionArtifact: \"LIVE_DEMO_ALREADY_AVAILABLE\",\n videoRequirement: \"NOT_REQUIRED_WHEN_DEMO_IS_USED\",\n githubRequirement: \"IF_APPLICABLE\",\n },\n qualificationEvidenceOpen: [\n \"PARTICIPANT_ACCOUNT_ELIGIBILITY\",\n \"SUPPORTED_CLIENT_AGENT_OS_MCP_MARKET_DATA_WITNESS\",\n ],\n optionalEnhancements: [\n \"FINAL_VIDEO_OR_SCREEN_RECORDING\",\n \"DEDICATED_GITHUB_MIRROR_IF_USEFUL\",\n ],\n externalGatesNotClaimedComplete: [\n \"PARTICIPANT_ACCOUNT_ELIGIBILITY\",\n \"SUPPORTED_CLIENT_AGENT_OS_MCP_MARKET_DATA_WITNESS\",\n \"X_FOLLOW_AND_REPOST\",\n \"X_TRACK_A_SUBMISSION\",\n \"BINANCE_SURVEY_COMPLETION\",\n ],\n };\n const manifestSha256 = await sha256Hex(JSON.stringify(core));\n return c.json({ ...core, manifestSha256, generatedAt: new Date().toISOString() });\n});\n\napp.get(\"/api/symbols\", (c) => c.json({ status: \"PASS\", symbols: supportedSymbols() }));\n\napp.get(\"/api/analyze\", async (c) => {\n try {\n const symbol = normalizeSymbol(c.req.query(\"symbol\") ?? \"BTCUSDT\");\n const result = await analyzeMarket(symbol);\n const httpStatus = result.evidenceState === \"FAIL\" ? 503 : 200;\n return c.json(result, httpStatus);\n } catch (error) {\n const message = error instanceof Error ? error.message : String(error);\n const status = message === \"INVALID_SYMBOL_FORMAT\" || message === \"SYMBOL_NOT_ALLOWLISTED\" ? 400 : 500;\n return c.json({ status: \"FAIL\", error: message.slice(0, 180), boundary: \"NO_UNVALIDATED_SYMBOL_FORWARDING\" }, status);\n }\n});\n\napp.notFound((c) => c.json({ status: \"FAIL\", error: \"NOT_FOUND\" }, 404));\napp.onError((err) => {\n console.error(\"UNHANDLED\", err instanceof Error ? err.message : String(err));\n return new Response(JSON.stringify({ status: \"FAIL\", error: \"INTERNAL_ERROR\" }), { status: 500, headers: { \"content-type\": \"application/json\" } });\n});\n\nexport default app.fetch;\n","label",[151],"452c798b-5597-459b-8cb2-d3ed2f9bf4fa","SKILL.md","01a07e13-fb44-7031-82f2-a9afd3846d11",["D",1788821633861],"# PayAna Falsifier Agent Skill\n\n## Purpose\n\nPayAna is an evidence-first market-analysis agent for Binance Agent OS. Its job is **not** to predict a guaranteed direction and **not** to place trades. It observes market evidence, constructs competing hypotheses, searches for disconfirming evidence, records what is missing, and returns a decision-quality briefing.\n\nThe skill is designed for an MCP-capable AI client connected to the official Binance Agent OS MCP endpoint:\n\n`https://agent.binance.com/mcp/agentic`\n\nUse the minimum permission set required. For this skill, **Market Data only** is sufficient. Account, Trade, Transfer and withdrawal-like capabilities are outside the skill's required scope.\n\n## Hard safety boundary\n\n- `MARKET_DATA_READ != TRADING_AUTH`\n- Never request or enable Trade, Account or Transfer merely to complete this workflow.\n- Never place, simulate-as-real, confirm or recommend an order.\n- Never claim an MCP call occurred unless the tool receipt proves it.\n- Never treat model confidence as a calibrated probability.\n- Never treat a screenshot, HTTP 200, API field named `open`, or plausible prose as economic proof.\n- If one required source fails, mark the run `PARTIAL`; if all required sources fail, mark it `FAIL`.\n\n## Supported market evidence\n\nFor the requested Binance spot symbol, retrieve when available:\n\n1. 24h ticker: last price, 24h change, high, low, quote volume, trade count.\n2. Order book: at least top 20 bid and ask levels.\n3. 5m candlesticks: at least 36 candles when available.\n4. Funding/mark price only when exposed by the connected Agent OS market-data tool. Absence must be recorded, not imputed.\n\n## Loop\n\nRun this reasoning loop once per user request or monitoring cycle:\n\n1. **OBSERVE** — collect fresh market evidence and timestamps.\n2. **VALIDATE** — verify symbol, source success, timestamps, numeric bounds and non-empty data.\n3. **MODEL** — calculate descriptive metrics.\n4. **NEURON** — create at least three branches:\n - winning hypothesis supported by current evidence;\n - opposite hypothesis;\n - alternative/non-directional explanation such as noise, liquidity effects or stale/missing context.\n5. **FALSIFY** — define observable conditions that would invalidate each hypothesis.\n6. **NEGATIVE SPACE** — explicitly list context not available to the run.\n7. **RECONCILE** — choose the best current descriptive label, not a trade direction.\n8. **RECEIPT** — return source/tool receipts and timestamp.\n9. **NEXT TEST** — state what evidence should be checked next if the user wants to continue.\n\n## Deterministic metrics\n\nUse formulas equivalent to the reference implementation when raw inputs exist:\n\n- `spread_bps = (ask - bid) / mid * 10000`\n- `bid_notional = Σ(price_i * qty_i)` over top-20 bids\n- `ask_notional = Σ(price_i * qty_i)` over top-20 asks\n- `book_imbalance = (bid_notional - ask_notional) / (bid_notional + ask_notional)`\n- `log_return_t = ln(close_t / close_(t-1))`\n- `realized_vol_5m_bps = sample_std(log_returns) * 10000`\n- `momentum_30m_pct = (latest_close / close_30m_ago - 1) * 100`\n- `momentum_3h_pct = (latest_close / first_close_in_3h_window - 1) * 100`\n- `volume_z = (latest_quote_volume - mean(prior_quote_volumes)) / sample_std(prior_quote_volumes)`\n\nReference descriptive score:\n\n`directional_score = mean(tanh(2*book_imbalance), tanh(momentum_30m_pct/0.6), tanh(momentum_3h_pct/1.5))`\n\nThis score is a heuristic descriptor, not a probability and not a price forecast.\n\n## Output contract\n\nReturn a compact object or briefing with these fields:\n\n- `symbol`\n- `evidence_state`: `PASS | PARTIAL | FAIL`\n- `fetched_at`\n- `observations`\n- `descriptive_pressure`: `BULLISH_PRESSURE | BEARISH_PRESSURE | MIXED_NEUTRAL`\n- `supporting_evidence[]`\n- `opposing_evidence[]`\n- `alternative_explanations[]`\n- `falsifiers[]`\n- `risk_flags[]`\n- `missing_context[]`\n- `source_receipts[]`\n- `recommendation`: always `NO_TRADE_DECISION` for this skill\n- `next_test`\n\n## Example request\n\n\"Use Binance Agent OS market data to audit BTCUSDT. Tell me what the current evidence supports, what argues against it, what would falsify the reading, and what is missing. Do not trade.\"\n\n## Example acceptance criteria\n\nA run passes only if:\n\n- the symbol is explicit and validated;\n- at least one live source has a timestamp/currentness signal;\n- no missing source is silently replaced by fabricated data;\n- the opposite hypothesis and at least one alternative explanation are present;\n- falsifiers are observable rather than rhetorical;\n- source receipts are listed;\n- final recommendation remains `NO_TRADE_DECISION`.\n",[163],"ad488758-39ab-4618-86d1-5bd42b5bb1ea","README.md","01a07e13-fb44-7031-82f2-a600183299af",["D",1788821633861],"# PayAna — Falsifier Agent for Binance Agent OS\n\n**Track A — Binance Agent OS Mini Hackathon**\n\nPayAna is an evidence-first market-analysis agent whose defining behavior is simple:\n\n> It does not stop after asking **“what does the market evidence support?”**. It also asks **“what would prove this reading wrong?”**\n\nThe project combines a reusable `SKILL.md` for an MCP-capable AI client with a deployed reference cockpit that computes transparent market metrics, records source receipts, exposes missing context and refuses to convert a descriptive market reading into a trade instruction.\n\n**Hard boundary:** `MARKET_DATA_READ != TRADING_AUTH`\n\n## Why this exists\n\nMany market-agent demos optimize for a polished answer or an executed action. That creates a failure mode: a coherent answer can still be based on stale data, one-sided evidence, missing context or a non-calibrated model score.\n\nPayAna instead forces a small scientific loop:\n\n```text\nOBSERVE → VALIDATE → MODEL → COMPETING HYPOTHESES\n → FALSIFY → NEGATIVE SPACE → RECONCILE → RECEIPT → NEXT TEST\n```\n\nThe result is **decision-quality evidence**, not a trade recommendation.\n\n## What the agent does\n\nFor a requested Binance market, PayAna:\n\n1. retrieves fresh market evidence;\n2. validates source state and timestamps;\n3. computes reproducible metrics;\n4. constructs a winning hypothesis, an opposite hypothesis and an alternative explanation;\n5. defines observable falsifiers;\n6. lists context that is missing instead of fabricating it;\n7. returns source receipts;\n8. ends with `NO_TRADE_DECISION`.\n\nSee [`SKILL.md`](./SKILL.md) for the agent contract.\n\n## Binance Agent OS integration\n\nOfficial MCP endpoint:\n\n```text\nhttps://agent.binance.com/mcp/agentic\n```\n\nThe skill requires only the **Market Data** capability. It does not require Account, Trade or Transfer.\n\nA runtime probe against the official endpoint correctly returned an OAuth challenge rather than pretending to be connected. The discovered authorization metadata advertises Authorization Code, PKCE `S256`, token endpoint authentication method `none`, and Client ID Metadata Document (CIMD) support.\n\nPayAna 1.2 adds an **optional, user-initiated OAuth verification flow** at `/oauth/start`. Its public client identity is `https://payana-agent-os.val.run/oauth/client-metadata.json`. The flow stores only a one-time `state` plus PKCE verifier for at most ten minutes, exchanges the authorization code in callback memory, reads the MCP tool catalog, and then discards the access token and any refresh token. It never calls an MCP tool automatically.\n\nThe boundary remains explicit:\n\n```text\nMCP_ENDPOINT_KNOWN != MCP_SESSION_AUTHORIZED\nOAUTH_FLOW_READY != USER_AUTHORIZED_SESSION\nAUTHORIZED_TOOL_CATALOG != TOOL_CALL\n```\n\nA direct unauthenticated MCP transport probe also found that the deployed Agent OS server currently returns JSON-RPC `Method not found` for modern `server/discover` and HTTP 401 + OAuth resource metadata for `tools/list`. So Binance's \"Market Data: public, no auth\" capability should not be confused with an anonymously accessible MCP tool catalog: the connection is still authorization-gated in this runtime. A real Agent OS connection receipt therefore still requires the participant to complete the supported MCP-client connection/authentication flow. Until that gate happens, the hosted reference cockpit continues to use Binance's documented public market-data API surface for the reproducible analysis layer and does not claim an authenticated MCP session.\n\nCurrent Binance Developer documentation lists supported MCP clients including ChatGPT on the web, ChatGPT/Codex Desktop, Codex CLI, Claude Code/Desktop, VS Code and Grok Bot. Its own connection witness is a read-only request for current BTCUSDT price and 24-hour change, with the Binance MCP tool attribution visibly present in the client response. PayAna uses that exact witness as the remaining MCP proof gate; Account, Trade and Transfer are not needed for the Track A read-only workflow.\n\n## Live reference cockpit\n\n**Production demo:** https://payana-agent-os.val.run/\n\nThe deployed web application provides a zero-trade demonstration of the deterministic evidence layer:\n\n- BTCUSDT\n- ETHUSDT\n- BNBUSDT\n- SOLUSDT\n- XRPUSDT\n\nFor each symbol it combines:\n\n- 24h ticker;\n- top-20 order book;\n- 36 × 5-minute candles;\n- spread;\n- top-20 bid/ask notional;\n- order-book imbalance;\n- 30m and 3h momentum;\n- 5m realized volatility;\n- volume z-score;\n- descriptive directional pressure;\n- heuristic evidence-stability score;\n- source receipts;\n- risk flags;\n- falsifiers;\n- missing context.\n\nThe stability score is explicitly **not a calibrated probability**.\n\n## Reproducible formulas\n\n```text\nspread_bps = (ask - bid) / mid * 10000\n\nbid_notional = Σ(price_i × qty_i), top 20 bids\nask_notional = Σ(price_i × qty_i), top 20 asks\n\nbook_imbalance =\n (bid_notional - ask_notional) /\n (bid_notional + ask_notional)\n\nlog_return_t = ln(close_t / close_(t-1))\n\nrealized_vol_5m_bps =\n sample_std(log_returns) × 10000\n\nmomentum_30m_pct =\n (latest_close / close_30m_ago - 1) × 100\n\nvolume_z =\n (latest_quote_volume - mean(prior_quote_volumes)) /\n sample_std(prior_quote_volumes)\n```\n\nThe API exposes its method description directly in every successful response.\n\n## HTTP API\n\n```text\nGET /api/health\nGET /api/submission-evidence # machine-readable Track A evidence manifest\nGET /api/symbols\nGET /api/analyze?symbol=BTCUSDT\nGET /oauth/status\nGET /oauth/client-metadata.json\nGET /oauth/start # explicit user action; redirects to Binance\nGET /oauth/callback # OAuth response only\n```\n\nThere is deliberately no trading endpoint. `/oauth/start` is not called by the cockpit automatically; the participant must click the verification action.\n\nExample safety fields:\n\n```json\n{\n \"readOnly\": true,\n \"boundary\": \"MARKET_DATA_READ != TRADING_AUTH\",\n \"assessment\": {\n \"recommendation\": \"NO_TRADE_DECISION\"\n }\n}\n```\n\n## Runtime discovery\n\nThe application does not assume that a documented endpoint is usable from every execution environment.\n\nDuring the 2026-09-07 Val Town runtime census:\n\n```text\napi.binance.com → HTTP 451 from this runtime\nfapi.binance.com → HTTP 451 from this runtime\ndata-api.binance.vision → HTTP 200 for public spot market data\nAgent OS MCP initialize → HTTP 401 OAuth challenge, as expected without authorization\n```\n\n`data-api.binance.vision` is therefore the current runtime champion for the hosted public-data reference layer.\n\nSee [`docs/ARCHITECTURE.md`](./docs/ARCHITECTURE.md) for the evidence and boundaries.\n\n## Validation\n\nCurrent 1.2 release-candidate audit:\n\n```text\n189 / 189 assertions PASS\n35 / 35 rate-limit mutation steps PASS\n224 total executed checks\n```\n\nThe OAuth/MCP portion contributes 34 authorization-flow checks, 25 synthetic MCP/token-boundary checks and 6 OAuth-state storage/replay checks. The aggregate runner executes suites sequentially because multiple mutation suites temporarily replace `globalThis.fetch`; this prevents false interference between independent tests.\n\nCoverage includes all five allowlisted symbols and validates:\n\n- current ticker timestamp;\n- positive market price;\n- non-negative spread;\n- order-book imbalance bounds;\n- stability-score bounds;\n- explicit non-probability language;\n- three source receipts;\n- candle-series presence;\n- `NO_TRADE_DECISION` invariant;\n- invalid symbols;\n- injection-like symbol strings;\n- nonexistent routes;\n- rejection of write-like POST access.\n\nRate-limit mutation control:\n\n```text\nrequests 1–30 → HTTP 200\nrequests 31–35 → HTTP 429\nPASS\n```\n\nRun in Val Town:\n\n```text\ntests/selftest.ts\ntests/failure_modes_selftest.ts\ntests/oauth_flow_selftest.ts\ntests/oauth_mcp_probe_selftest.ts\ntests/oauth_state_storage_selftest.ts\ntests/rate_limit_selftest.ts\ntests/release_audit.ts\n```\n\nDetailed release evidence: [`docs/TEST_EVIDENCE.md`](./docs/TEST_EVIDENCE.md).\n\nThe browser layer is validated separately from server tests. After CSP hardening, a JavaScript-rendering fetch successfully matched React-only selectors including source receipts. Full interactive/screenshot automation is tracked separately because the external browser providers currently have insufficient credit; it is not mislabeled as completed.\n\n## Web hardening\n\n- strict symbol allowlist;\n- no arbitrary upstream URL forwarding;\n- `Cache-Control: no-store` on API results;\n- CSP;\n- `X-Content-Type-Options: nosniff`;\n- `X-Frame-Options: DENY`;\n- restrictive `Permissions-Policy`;\n- no Binance account key stored in the app;\n- no Account / Trade / Transfer function;\n- best-effort per-runtime rate limiting.\n\nThe rate limiter is intentionally documented as best-effort because serverless instances do not provide a shared global bucket.\n\n## Repository structure\n\n```text\n.\n├── SKILL.md # reusable Falsifier Agent contract\n├── index.ts # Hono API + web security boundaries\n├── lib/\n│ ├── market.ts # evidence acquisition + formulas\n│ └── agent_os_oauth.ts # CIMD + PKCE + ephemeral MCP catalog probe\n├── frontend/\n│ ├── root.tsx\n│ ├── index.tsx\n│ ├── styles.css\n│ └── components/App.tsx\n├── tests/\n│ ├── selftest.ts\n│ ├── failure_modes_selftest.ts\n│ ├── oauth_flow_selftest.ts\n│ ├── oauth_mcp_probe_selftest.ts\n│ ├── oauth_state_storage_selftest.ts\n│ ├── rate_limit_selftest.ts\n│ └── release_audit.ts\n├── audits/\n│ ├── binance_mcp_probe.ts\n│ ├── binance_mcp_public_market_probe.ts\n│ ├── oauth_authorization_acceptance_probe.ts\n│ ├── oauth_metadata_probe.ts\n│ ├── market_api_probe.ts\n│ └── vision_klines_probe.ts\n└── docs/\n ├── ARCHITECTURE.md\n ├── TEST_EVIDENCE.md\n ├── SUBMISSION_CHECKLIST.md\n └── SUBMISSION_PACKAGE.md\n```\n\n## Negative controls that matter\n\n```text\nHTTP_200 != VALID_MARKET_EVIDENCE\nSCREENSHOT != BEHAVIOR_PROOF\nMARKET_DATA_READ != TRADING_AUTH\nMCP_ENDPOINT_KNOWN != MCP_SESSION_AUTHORIZED\nOAUTH_FLOW_READY != USER_AUTHORIZED_SESSION\nACCESS_TOKEN_EPHEMERAL != TOKEN_PERSISTED\nAUTHORIZED_TOOL_CATALOG != TOOL_CALL\nMODEL_SCORE != CALIBRATED_PROBABILITY\nMISSING_EVIDENCE != ZERO\nCURRENT_PRESSURE != FUTURE_PRICE\nFETCH_FAIL != ZERO\n```\n\n## Hackathon submission state\n\nThe official Binance announcement states a Track A deadline of **2026-09-08 23:59 UTC** and requires following/reposting Binance, replying or quote-reposting with the Track A submission (video/demo plus GitHub when applicable), and completing the survey.\n\nExternal account actions are intentionally tracked as unverified until they actually happen. See [`docs/SUBMISSION_CHECKLIST.md`](./docs/SUBMISSION_CHECKLIST.md) for the current gates and [`docs/SUBMISSION_PACKAGE.md`](./docs/SUBMISSION_PACKAGE.md) for the prepared video, X and survey handoff.\n\n## Design principle\n\nPayAna's thesis is not “AI can predict the market.”\n\nIt is:\n\n> **An agent becomes more trustworthy when it is required to expose the evidence against its own conclusion, the conditions that would falsify it, and the context it does not have.**\n",[169],"78e570fe-12e6-4927-9d14-76f54c36dbe7","CHANGELOG.md","01a07e13-fb44-7031-82f2-a38f7102561f",["D",1788821633861],"# Changelog\n\n## 2026-09-07 — PayAna Market Sentinel 1.2.0 RC1\n\n### Agent OS connection verification\n\n- Added stable production endpoint `https://payana-agent-os.val.run/` and CIMD client identity at `/oauth/client-metadata.json`.\n- Added user-initiated Authorization Code + PKCE S256 flow with `/oauth/start` and `/oauth/callback`.\n- Added one-time OAuth state/verifier storage with 10-minute TTL, replay rejection, concurrent single-consumer behavior and a hard 500-row pending-state cap.\n- Access tokens and refresh tokens are never durably stored; callback use is ephemeral.\n- Authorized-catalog probe reads only `server/discover` / `tools/list`; no `tools/call` is performed automatically.\n- Added MCP 2026-07-28 protocol/method headers and `_meta` protocol version, client capabilities and client identity, with legacy initialize fallback retained.\n- Added direct unauthenticated Agent OS transport probe: `server/discover` returned method-not-found while `tools/list` returned OAuth 401, proving the current connection gate.\n- Added canonical authorization-surface probe; Binance returned a JavaScript anti-robot interstitial (HTTP 202), so provider CIMD acceptance remains PARTIAL until a real browser/client flow completes.\n\n### Falsification and security\n\n- Added OAuth flow suite: 34/34 PASS.\n- Added synthetic token/MCP catalog suite: 25/25 PASS.\n- Added OAuth-state storage/replay suite: 6/6 PASS.\n- Synthetic tool catalog includes safe Market Data and dangerous order/account/transfer tools; dangerous tools are excluded and automatic tool invocation is prohibited.\n- Hardened modern MCP request metadata to current 2026-07-28 structure.\n- Bounded abandoned OAuth state growth and verified zero pending self-test states after execution.\n- Fixed a reproduced LibSQL `SQLITE_BUSY` race in concurrent OAuth-state consumption by replacing SELECT+DELETE batching with atomic `DELETE ... RETURNING`, bounded busy retry and best-effort expiry pruning.\n- OAuth-state concurrency suite passed five consecutive executions after the fix; full 224-check release audit passed again at 2026-09-07T22:31:20Z.\n\n\n### Release validation\n\n- Core/live market suite: 101/101 PASS.\n- Source failure/malformed-response suite: 23/23 PASS.\n- OAuth flow suite: 34/34 PASS.\n- OAuth token/MCP suite: 25/25 PASS.\n- OAuth state storage suite: 6/6 PASS.\n- Rate-limit mutation: 35/35 expected transitions PASS.\n- Aggregate: **189 assertions + 35 mutation steps = 224 executed checks PASS**.\n- A test-harness race was discovered when global fetch mutation suites were statically imported; aggregate execution now imports mutation suites sequentially.\n\n### Submission readiness\n\n- Updated README, architecture, evidence and submission checklist to distinguish public Market Data from MCP connection authorization.\n- Current technical blockers are external proof gates: real supported-client MCP connection, final screen recording, GitHub mirror if used, X submission and Binance survey.\n\n## 2026-09-07 — PayAna Market Sentinel 1.0 candidate\n\n### Agent / methodology\n\n- Added `SKILL.md`: evidence-first Binance Agent OS market-data workflow.\n- Added winning/opposite/alternative hypothesis branches and observable falsifiers.\n- Added explicit negative-space / missing-context reporting.\n- Added hard `NO_TRADE_DECISION` and `MARKET_DATA_READ != TRADING_AUTH` boundaries.\n- Replaced misleading \"model confidence\" language with a heuristic `stabilityScore` that explicitly states it is not a calibrated probability.\n\n### Binance runtime discovery\n\n- Probed the official Agent OS MCP endpoint.\n- Confirmed unauthenticated `initialize` produces an OAuth 401 challenge rather than a usable session.\n- Retrieved OAuth Protected Resource Metadata and Authorization Server Metadata.\n- Confirmed Authorization Code, PKCE S256, public-client token auth (`none`), and Client ID Metadata Document support.\n- Confirmed Val Town runtime receives HTTP 451 from `api.binance.com`/`fapi.binance.com`.\n- Confirmed `data-api.binance.vision` works for public spot ticker, depth and klines and promoted it as the hosted-demo runtime champion.\n\n### Evidence engine\n\n- Added five-symbol allowlist: BTCUSDT, ETHUSDT, BNBUSDT, SOLUSDT, XRPUSDT.\n- Added 24h ticker, top-20 order-book and 36 × 5m candle acquisition.\n- Added source receipts with HTTP state and duration.\n- Added PASS/PARTIAL/FAIL evidence-state classification.\n- Added spread, notional depth, order-book imbalance, realized volatility, momentum and volume-z calculations.\n- Added descriptive directional pressure and explicit falsifiers.\n- Added method/formula metadata directly to API responses.\n\n### API and security\n\n- Added `/api/health`, `/api/symbols`, `/api/analyze`.\n- Added strict symbol validation and allowlisting.\n- Added `Cache-Control: no-store` for API responses.\n- Added CSP, `nosniff`, frame denial, `Referrer-Policy` and restrictive `Permissions-Policy`.\n- Removed React inline-style dependencies so the strict `style-src 'self'` CSP remains viable.\n- Added best-effort per-runtime request limiting.\n- No trade, account, transfer, wallet or arbitrary upstream forwarding endpoint exists.\n\n### Frontend\n\n- Replaced the template UI with the PayAna dark evidence cockpit.\n- Added market metrics, short-horizon sparkline, source receipts, stability indicator, risk flags, falsifiers and blind spots.\n- Added automatic 30-second evidence refresh while the page is visible.\n- Added responsive desktop/mobile layout.\n\n### Validation\n\n- Core/live self-test: 101/101 PASS across five symbols and NEURON hypothesis fields.\n- Source-failure/malformed-response mutation suite: 23/23 PASS, including explicit proof that missing evidence is not zero-imputed.\n- Rate-limit mutation: requests 1–30 return 200; 31–35 return 429 — PASS.\n- Aggregate release audit: 124 assertions + 35 mutation steps = 159 executed checks, PASS.\n- Invalid/injection-like symbols are rejected.\n- Write-like POST access to analysis route is rejected.\n- Immutable frontend entry and App assets return 200 and compile to JavaScript.\n- Root HTTP response contains final CSP and security headers.\n- JavaScript-rendering content extraction matched React-only `.app-shell` and `.source-item` selectors after CSP hardening.\n- Interactive screenshot/browser automation was attempted but external TinyFish and Firecrawl accounts reported insufficient credit; this remains explicitly unverified instead of being promoted to PASS.\n\n### Documentation\n\n- Rebuilt README for the hackathon candidate.\n- Added `docs/ARCHITECTURE.md`.\n- Added `docs/SUBMISSION_CHECKLIST.md`.\n- Organized probes under `audits/` and executable checks under `tests/`.\n",[175],"4fd8e52e-3bb8-4eae-9463-03a4ce55754f","tests","01a07e13-fb44-7031-82f2-9fa49ecc6f0f",["D",1788821633861],"directory",[181],"edf29ac2-b362-464a-acce-771296346e93","lib","01a07e13-fb44-7031-82f2-7ff70200f292",["D",1788821633861],[187],"ca15be90-8097-48f5-9cab-9bbd6c9209fe","frontend","01a07e13-fb44-7031-82f2-73aa981ce058",["D",1788821633861],[192],"47a39c3b-fc4e-426f-b174-de6fb4460fb1","docs","01a07e13-fb44-7031-82f2-561ce6827d44",["D",1788821633861],[197],"d65d88ad-0e7b-4062-b85c-5db4743dd1fb","audits","01a07e13-fb44-7031-82f2-4019f02391e2",["D",1788821633861],[202],"pulls","branches",7,"forks",5,"envVars",{"_215":63,"_217":63},"connections",{"_215":63,"_216":63},"count","unfilledCount","emptyCount",{"_43":201,"_32":202,"_30":203,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":449,"_13":63,"_34":184,"_35":-5,"_24":25,"_160":-5,"_253":450,"_27":451},{"_43":442,"_32":443,"_30":444,"_153":203,"_41":42,"_40":157,"_155":59,"_38":445,"_13":63,"_34":269,"_35":446,"_24":25,"_160":-5,"_253":447,"_27":448},{"_43":435,"_32":436,"_30":437,"_153":203,"_41":42,"_40":157,"_155":59,"_38":438,"_13":63,"_34":269,"_35":439,"_24":25,"_160":-5,"_253":440,"_27":441},{"_43":428,"_32":429,"_30":430,"_153":203,"_41":42,"_40":157,"_155":59,"_38":431,"_13":63,"_34":269,"_35":432,"_24":25,"_160":-5,"_253":433,"_27":434},{"_43":421,"_32":422,"_30":423,"_153":203,"_41":42,"_40":157,"_155":59,"_38":424,"_13":63,"_34":269,"_35":425,"_24":25,"_160":-5,"_253":426,"_27":427},{"_43":414,"_32":415,"_30":416,"_153":203,"_41":42,"_40":157,"_155":59,"_38":417,"_13":63,"_34":269,"_35":418,"_24":25,"_160":-5,"_253":419,"_27":420},{"_43":407,"_32":408,"_30":409,"_153":203,"_41":42,"_40":157,"_155":59,"_38":410,"_13":63,"_34":269,"_35":411,"_24":25,"_160":-5,"_253":412,"_27":413},{"_43":196,"_32":197,"_30":198,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":404,"_13":63,"_34":184,"_35":-5,"_24":25,"_160":-5,"_253":405,"_27":406},{"_43":397,"_32":398,"_30":399,"_153":198,"_41":42,"_40":157,"_155":59,"_38":400,"_13":63,"_34":20,"_35":401,"_24":25,"_160":-5,"_253":402,"_27":403},{"_43":393,"_32":33,"_30":31,"_153":198,"_41":42,"_40":14,"_155":59,"_38":394,"_13":157,"_34":20,"_35":37,"_24":25,"_160":-5,"_253":395,"_27":396},{"_43":386,"_32":387,"_30":388,"_153":198,"_41":42,"_40":157,"_155":25,"_38":389,"_13":63,"_34":20,"_35":390,"_24":25,"_160":-5,"_253":391,"_27":392},{"_43":379,"_32":380,"_30":381,"_153":198,"_41":42,"_40":157,"_155":59,"_38":382,"_13":63,"_34":20,"_35":383,"_24":25,"_160":-5,"_253":384,"_27":385},{"_43":191,"_32":192,"_30":193,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":376,"_13":63,"_34":184,"_35":-5,"_24":25,"_160":-5,"_253":377,"_27":378},{"_43":372,"_32":371,"_30":366,"_153":193,"_41":42,"_40":157,"_155":59,"_38":373,"_13":63,"_34":184,"_35":-5,"_24":25,"_160":-5,"_253":374,"_27":375},{"_43":363,"_32":364,"_30":365,"_153":366,"_41":42,"_40":157,"_155":59,"_38":367,"_13":63,"_34":269,"_35":368,"_24":25,"_160":-5,"_253":369,"_27":370},{"_43":356,"_32":357,"_30":358,"_153":193,"_41":42,"_40":157,"_155":59,"_38":359,"_13":63,"_34":20,"_35":360,"_24":25,"_160":-5,"_253":361,"_27":362},{"_43":349,"_32":350,"_30":351,"_153":193,"_41":42,"_40":157,"_155":59,"_38":352,"_13":63,"_34":269,"_35":353,"_24":25,"_160":-5,"_253":354,"_27":355},{"_43":342,"_32":343,"_30":344,"_153":193,"_41":42,"_40":157,"_155":59,"_38":345,"_13":63,"_34":269,"_35":346,"_24":25,"_160":-5,"_253":347,"_27":348},{"_43":335,"_32":336,"_30":337,"_153":193,"_41":42,"_40":157,"_155":59,"_38":338,"_13":63,"_34":20,"_35":339,"_24":25,"_160":-5,"_253":340,"_27":341},{"_43":186,"_32":187,"_30":188,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":332,"_13":63,"_34":184,"_35":-5,"_24":25,"_160":-5,"_253":333,"_27":334},{"_43":325,"_32":326,"_30":327,"_153":188,"_41":42,"_40":157,"_155":59,"_38":328,"_13":63,"_34":269,"_35":329,"_24":25,"_160":-5,"_253":330,"_27":331},{"_43":318,"_32":319,"_30":320,"_153":188,"_41":42,"_40":157,"_155":59,"_38":321,"_13":63,"_34":269,"_35":322,"_24":25,"_160":-5,"_253":323,"_27":324},{"_43":180,"_32":181,"_30":182,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":315,"_13":63,"_34":184,"_35":-5,"_24":25,"_160":-5,"_253":316,"_27":317},{"_43":308,"_32":309,"_30":310,"_153":182,"_41":42,"_40":157,"_155":59,"_38":311,"_13":63,"_34":269,"_35":312,"_24":25,"_160":-5,"_253":313,"_27":314},{"_43":301,"_32":302,"_30":303,"_153":182,"_41":42,"_40":157,"_155":59,"_38":304,"_13":63,"_34":269,"_35":305,"_24":25,"_160":-5,"_253":306,"_27":307},{"_43":294,"_32":295,"_30":296,"_153":182,"_41":42,"_40":157,"_155":59,"_38":297,"_13":63,"_34":269,"_35":298,"_24":25,"_160":-5,"_253":299,"_27":300},{"_43":287,"_32":288,"_30":289,"_153":182,"_41":42,"_40":157,"_155":59,"_38":290,"_13":63,"_34":269,"_35":291,"_24":25,"_160":-5,"_253":292,"_27":293},{"_43":280,"_32":281,"_30":282,"_153":182,"_41":42,"_40":157,"_155":59,"_38":283,"_13":63,"_34":269,"_35":284,"_24":25,"_160":-5,"_253":285,"_27":286},{"_43":273,"_32":274,"_30":275,"_153":182,"_41":42,"_40":157,"_155":59,"_38":276,"_13":63,"_34":269,"_35":277,"_24":25,"_160":-5,"_253":278,"_27":279},{"_43":265,"_32":266,"_30":267,"_153":182,"_41":42,"_40":157,"_155":59,"_38":268,"_13":63,"_34":269,"_35":270,"_24":25,"_160":-5,"_253":271,"_27":272},{"_43":174,"_32":175,"_30":176,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":262,"_13":63,"_34":20,"_35":178,"_24":25,"_160":-5,"_253":263,"_27":264},{"_43":168,"_32":169,"_30":170,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":259,"_13":63,"_34":20,"_35":172,"_24":25,"_160":-5,"_253":260,"_27":261},{"_43":162,"_32":163,"_30":164,"_153":-5,"_41":42,"_40":157,"_155":59,"_38":256,"_13":63,"_34":20,"_35":166,"_24":25,"_160":-5,"_253":257,"_27":258},{"_43":150,"_32":151,"_30":152,"_153":-5,"_41":42,"_40":154,"_155":59,"_38":252,"_13":157,"_34":158,"_35":159,"_24":25,"_160":-5,"_253":254,"_27":255},["D",1788821641807],"children",[],[151],["D",1788821633861],[],[163],["D",1788821633861],[],[169],["D",1788821633861],[],[175],"4ce91d76-60f5-48d6-b920-581a4caf189d","selftest.ts","01a07e13-fb44-7031-82f2-981948661e64",["D",1788821633861],"script","import handler from \"../index.ts\";\nimport { analyzeMarket, normalizeSymbol, supportedSymbols } from \"../lib/market.ts\";\n\nconst results: any[] = [];\nfunction check(name: string, pass: boolean, details?: unknown) {\n results.push({ name, pass, details });\n if (!pass) throw new Error(`SELFTEST_FAIL:${name}`);\n}\n\nfor (const bad of [\"INVALIDXYZ\", \"BTCUSDT&foo=bar\", \"../BTCUSDT\", \"\"]) {\n let rejected = false;\n try { normalizeSymbol(bad); } catch { rejected = true; }\n if (bad === \"\") {\n // empty input normalizes to default only when nullish is not used; explicit empty must not leave allowlist.\n check(\"explicit_empty_rejected\", rejected);\n } else check(`invalid_symbol_rejected:${bad}`, rejected);\n}\n\nfor (const symbol of supportedSymbols()) {\n const r: any = await analyzeMarket(symbol);\n check(`${symbol}:evidence`, [\"PASS\", \"PARTIAL\"].includes(r.evidenceState), r.evidenceState);\n check(`${symbol}:read_only`, r.readOnly === true && r.boundary === \"MARKET_DATA_READ != TRADING_AUTH\");\n check(`${symbol}:price_positive`, Number(r.market?.lastPrice) > 0, r.market?.lastPrice);\n check(`${symbol}:spread_nonnegative`, Number(r.microstructure?.spreadBps) >= 0, r.microstructure?.spreadBps);\n check(`${symbol}:imbalance_bounded`, Math.abs(Number(r.microstructure?.orderBookImbalance)) <= 1.000001, r.microstructure?.orderBookImbalance);\n check(`${symbol}:stability_bounded`, Number(r.assessment?.stabilityScore) >= 0 && Number(r.assessment?.stabilityScore) <= 1, r.assessment?.stabilityScore);\n check(`${symbol}:stability_not_probability`, String(r.assessment?.stabilityMeaning ?? \"\").includes(\"not a calibrated probability\"));\n check(`${symbol}:winning_hypothesis`, String(r.assessment?.hypotheses?.winning ?? \"\").length > 20);\n check(`${symbol}:opposite_hypothesis`, String(r.assessment?.hypotheses?.opposite ?? \"\").length > 20);\n check(`${symbol}:alternative_hypothesis`, String(r.assessment?.hypotheses?.alternative ?? \"\").length > 20);\n check(`${symbol}:supporting_evidence`, Array.isArray(r.assessment?.supportingEvidence) && r.assessment.supportingEvidence.length >= 1);\n check(`${symbol}:opposing_evidence`, Array.isArray(r.assessment?.opposingEvidence) && r.assessment.opposingEvidence.length >= 1);\n check(`${symbol}:alternative_explanations`, Array.isArray(r.assessment?.alternativeExplanations) && r.assessment.alternativeExplanations.length >= 2);\n check(`${symbol}:falsifiers`, Array.isArray(r.assessment?.falsifiers) && r.assessment.falsifiers.length >= 2);\n check(`${symbol}:next_test`, String(r.assessment?.nextTest ?? \"\").includes(\"5m\"));\n check(`${symbol}:no_trade_recommendation`, r.assessment?.recommendation === \"NO_TRADE_DECISION\");\n check(`${symbol}:receipts_present`, Array.isArray(r.receipts) && r.receipts.length === 3, r.receipts?.length);\n check(`${symbol}:series_present`, Array.isArray(r.shortHorizon?.closeSeries) && r.shortHorizon.closeSeries.length >= 12, r.shortHorizon?.closeSeries?.length);\n const closeTime = Number(r.market?.tickerCloseTime);\n check(`${symbol}:ticker_currentness`, Number.isFinite(closeTime) && Math.abs(Date.now() - closeTime) < 5 * 60_000, { closeTime, ageMs: Date.now() - closeTime });\n}\n\nconst post = await handler(new Request(\"https://local.test/api/analyze?symbol=BTCUSDT\", { method: \"POST\" }));\ncheck(\"post_not_supported\", post.status === 404, post.status);\nconst unknown = await handler(new Request(\"https://local.test/api/does-not-exist\"));\ncheck(\"unknown_route_404\", unknown.status === 404, unknown.status);\n\nconst pass = results.every(r => r.pass);\nconsole.log(JSON.stringify({ pass, version: \"1.0.0\", tests: results.length, results }));\nexport default { pass, tests: results.length };\n",[],[181,266],"192e5936-c1f0-47ee-8ced-6c22d7fbaefe","release_audit.ts","01a07e13-fb44-7031-82f2-9503ec9e0f3d",["D",1788821633861],"const core = (await import(\"./selftest.ts\")).default;\nconst failureModes = (await import(\"./failure_modes_selftest.ts\")).default;\nconst oauthFlow = (await import(\"./oauth_flow_selftest.ts\")).default;\nconst oauthMcpProbe = (await import(\"./oauth_mcp_probe_selftest.ts\")).default;\nconst oauthStateStorage = (await import(\"./oauth_state_storage_selftest.ts\")).default;\nconst rateLimit = (await import(\"./rate_limit_selftest.ts\")).default;\n\nconst suites = {\n core,\n failureModes,\n oauthFlow,\n oauthMcpProbe,\n oauthStateStorage,\n rateLimit,\n};\nconst pass = Object.values(suites).every((suite: any) => suite?.pass === true);\nconst assertionCount = Number(core?.tests ?? 0)\n + Number(failureModes?.tests ?? 0)\n + Number(oauthFlow?.tests ?? 0)\n + Number(oauthMcpProbe?.tests ?? 0)\n + Number(oauthStateStorage?.tests ?? 0);\nconst mutationSteps = Number(rateLimit?.tests ?? 0);\nconst result = {\n pass,\n releaseCandidate: \"payana-market-sentinel-1.2.0-rc1\",\n assertionCount,\n mutationSteps,\n totalExecutedChecks: assertionCount + mutationSteps,\n suites,\n invariants: [\n \"MARKET_DATA_READ != TRADING_AUTH\",\n \"MCP_ENDPOINT_KNOWN != MCP_SESSION_AUTHORIZED\",\n \"MODEL_SCORE != CALIBRATED_PROBABILITY\",\n \"MISSING_EVIDENCE != ZERO\",\n \"CURRENT_PRESSURE != FUTURE_PRICE\",\n \"OAUTH_FLOW_READY != USER_AUTHORIZED_SESSION\",\n \"ACCESS_TOKEN_EPHEMERAL != TOKEN_PERSISTED\",\n \"AUTHORIZED_TOOL_CATALOG != TOOL_CALL\",\n ],\n auditedAt: new Date().toISOString(),\n};\nconsole.log(JSON.stringify(result));\nif (!pass) throw new Error(\"RELEASE_AUDIT_FAIL\");\nexport default result;\n",[],[181,274],"8fc0fd3c-27fb-4cd4-8526-2e1d18525694","rate_limit_selftest.ts","01a07e13-fb44-7031-82f2-905ca98fc1b4",["D",1788821633861],"import handler from \"../index.ts\";\n\nconst statuses:number[]=[];\nfor(let i=0;i<35;i++){\n const r=await handler(new Request(\"https://local.test/api/health\",{headers:{\"x-forwarded-for\":\"203.0.113.77\"}}));\n statuses.push(r.status);\n}\nconst first30=statuses.slice(0,30);\nconst tail=statuses.slice(30);\nconst pass=first30.every(s=>s===200)&&tail.every(s=>s===429);\nconsole.log(JSON.stringify({pass,statuses,rule:\"30 requests per 60s per runtime bucket\"}));\nif(!pass) throw new Error(\"RATE_LIMIT_SELFTEST_FAIL\");\nexport default {pass, tests: statuses.length};\n",[],[181,281],"10dbba8f-1d00-4329-b7f9-5abbc9d1443c","oauth_state_storage_selftest.ts","01a07e13-fb44-7031-82f2-8c0650e3532b",["D",1788821633861],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { consumeAuthorizationState, createAuthorizationRequest } from \"../lib/agent_os_oauth.ts\";\n\nconst checks: { name: string; pass: boolean; details?: unknown }[] = [];\nfunction check(name: string, pass: boolean, details?: unknown) {\n checks.push({ name, pass, details });\n if (!pass) throw new Error(`OAUTH_STATE_STORAGE_SELFTEST:${name}`);\n}\n\nconst marker = `storage-selftest-${crypto.randomUUID()}`;\nconst expiredState = `${marker}-expired`;\ntry {\n await sqlite.execute({\n sql: \"INSERT OR REPLACE INTO agent_os_oauth_states(state, code_verifier, created_at_ms) VALUES(?,?,?)\",\n args: [expiredState, \"synthetic-expired-verifier\", Date.now() - 11 * 60_000],\n });\n\n const request = await createAuthorizationRequest();\n const expired = await sqlite.execute({ sql: \"SELECT COUNT(*) AS n FROM agent_os_oauth_states WHERE state=?\", args: [expiredState] });\n check(\"expired_state_pruned_on_create\", Number((expired.rows[0] as any)?.n ?? -1) === 0, expired.rows[0]);\n\n const consumed = await consumeAuthorizationState(request.state);\n check(\"fresh_state_consumable\", Boolean(consumed?.verifier && consumed.verifier.length >= 80), consumed?.verifier.length);\n check(\"fresh_state_replay_rejected\", (await consumeAuthorizationState(request.state)) === null);\n\n const concurrent = await createAuthorizationRequest();\n const pair = await Promise.all([\n consumeAuthorizationState(concurrent.state),\n consumeAuthorizationState(concurrent.state),\n ]);\n const winners = pair.filter(Boolean).length;\n check(\"concurrent_consumption_single_winner\", winners === 1, winners);\n\n const pending = await sqlite.execute({ sql: \"SELECT COUNT(*) AS n FROM agent_os_oauth_states WHERE state IN (?,?)\", args: [request.state, concurrent.state] });\n check(\"test_states_not_left_pending\", Number((pending.rows[0] as any)?.n ?? -1) === 0, pending.rows[0]);\n\n const total = await sqlite.execute(\"SELECT COUNT(*) AS n FROM agent_os_oauth_states\");\n check(\"global_pending_state_cap_respected\", Number((total.rows[0] as any)?.n ?? 0) <= 500, total.rows[0]);\n} finally {\n await sqlite.execute({ sql: \"DELETE FROM agent_os_oauth_states WHERE state LIKE ?\", args: [`${marker}%`] });\n}\n\nconst pass = checks.every(x => x.pass);\nconsole.log(JSON.stringify({ pass, version: \"oauth-state-storage-1.0.0\", tests: checks.length, checks }));\nexport default { pass, tests: checks.length };\n",[],[181,288],"0d26ef08-3630-44b5-9308-90526b36b220","oauth_mcp_probe_selftest.ts","01a07e13-fb44-7031-82f2-8b946e5dff63",["D",1788821633861],"import { AGENT_OS, exchangeAuthorizationCode, probeAuthorizedAgentOs } from \"../lib/agent_os_oauth.ts\";\n\nconst originalFetch = globalThis.fetch;\nconst checks: { name: string; pass: boolean; details?: unknown }[] = [];\nfunction check(name: string, pass: boolean, details?: unknown) {\n checks.push({ name, pass, details });\n if (!pass) throw new Error(`OAUTH_MCP_PROBE_SELFTEST:${name}`);\n}\n\ntry {\n let tokenRequest: any = null;\n globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {\n const url = String(input);\n if (url === AGENT_OS.tokenEndpoint) {\n tokenRequest = { url, method: init?.method, headers: new Headers(init?.headers), body: String(init?.body ?? \"\") };\n return new Response(JSON.stringify({ access_token: \"synthetic-access\", refresh_token: \"synthetic-refresh\", token_type: \"Bearer\", expires_in: 900, scope: \"market-data\" }), { status: 200, headers: { \"content-type\": \"application/json\" } });\n }\n throw new Error(`UNEXPECTED_FETCH:${url}`);\n }) as typeof fetch;\n\n const token = await exchangeAuthorizationCode(\"synthetic-code\", \"synthetic-verifier\");\n check(\"token_exchange_success\", token.ok === true, token);\n if (!token.ok) throw new Error(\"UNREACHABLE_TOKEN_FAIL\");\n check(\"token_request_post\", tokenRequest?.method === \"POST\", tokenRequest?.method);\n check(\"token_request_no_authorization_header\", !tokenRequest?.headers?.has(\"authorization\"));\n const form = new URLSearchParams(tokenRequest?.body ?? \"\");\n check(\"token_request_client_id\", form.get(\"client_id\") === AGENT_OS.clientId, form.get(\"client_id\"));\n check(\"token_request_redirect\", form.get(\"redirect_uri\") === AGENT_OS.redirectUri, form.get(\"redirect_uri\"));\n check(\"token_request_resource\", form.get(\"resource\") === AGENT_OS.resource, form.get(\"resource\"));\n check(\"token_request_pkce_verifier\", form.get(\"code_verifier\") === \"synthetic-verifier\");\n check(\"token_request_no_client_secret\", !form.has(\"client_secret\"));\n check(\"refresh_token_only_booleanized\", token.refreshTokenReturned === true && !(\"refreshToken\" in token));\n\n const mcpBodies: any[] = [];\n globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {\n const url = String(input);\n if (url !== AGENT_OS.resource) throw new Error(`UNEXPECTED_MCP_URL:${url}`);\n const headers = new Headers(init?.headers);\n const body = JSON.parse(String(init?.body ?? \"{}\"));\n mcpBodies.push({ headers, body });\n if (body.method === \"server/discover\") {\n return new Response(JSON.stringify({ jsonrpc: \"2.0\", id: body.id, result: { capabilities: { tools: {} } }, _meta: { \"io.modelcontextprotocol/serverInfo\": { name: \"synthetic\", version: \"1\" } } }), { status: 200, headers: { \"content-type\": \"application/json\" } });\n }\n if (body.method === \"tools/list\") {\n return new Response(JSON.stringify({ jsonrpc: \"2.0\", id: body.id, result: { tools: [\n { name: \"get_ticker_price\", description: \"Read current ticker price market data\", inputSchema: { type: \"object\", properties: { symbol: { type: \"string\" } }, required: [\"symbol\"] } },\n { name: \"get_order_book\", description: \"Read current order book depth\", inputSchema: { type: \"object\", properties: { symbol: { type: \"string\" }, limit: { type: \"integer\", minimum: 1, maximum: 100 } }, required: [\"symbol\"] } },\n { name: \"place_order\", description: \"Place an order at a target price\", inputSchema: { type: \"object\", properties: { symbol: { type: \"string\" } }, required: [\"symbol\"] } },\n { name: \"get_account_price_alerts\", description: \"Read account-related price alerts\", inputSchema: { type: \"object\", properties: {} } },\n { name: \"transfer_wallet\", description: \"Transfer wallet assets\", inputSchema: { type: \"object\", properties: {} } }\n ] } }), { status: 200, headers: { \"content-type\": \"application/json\" } });\n }\n if (body.method === \"tools/call\") throw new Error(\"AUTOMATIC_TOOL_CALL_FORBIDDEN\");\n throw new Error(`UNEXPECTED_MCP_METHOD:${body.method}`);\n }) as typeof fetch;\n\n const probe = await probeAuthorizedAgentOs(\"synthetic-access\");\n check(\"probe_connected\", probe.connected === true, probe.connected);\n check(\"probe_modern_era\", probe.protocolEra === \"2026-07-28\", probe.protocolEra);\n check(\"probe_tool_count\", probe.toolCount === 5, probe.toolCount);\n check(\"probe_safe_ticker\", probe.safeMarketToolNames.includes(\"get_ticker_price\"), probe.safeMarketToolNames);\n check(\"probe_safe_order_book\", probe.safeMarketToolNames.includes(\"get_order_book\"), probe.safeMarketToolNames);\n check(\"probe_excludes_place_order\", !probe.safeMarketToolNames.includes(\"place_order\"), probe.safeMarketToolNames);\n check(\"probe_excludes_account\", !probe.safeMarketToolNames.includes(\"get_account_price_alerts\"), probe.safeMarketToolNames);\n check(\"probe_excludes_transfer\", !probe.safeMarketToolNames.includes(\"transfer_wallet\"), probe.safeMarketToolNames);\n check(\"probe_no_auto_tool_call\", probe.automaticToolCallPerformed === false, probe.automaticToolCallPerformed);\n check(\"probe_exactly_two_mcp_requests\", mcpBodies.length === 2, mcpBodies.map(x => x.body.method));\n check(\"probe_no_tools_call\", !mcpBodies.some(x => x.body.method === \"tools/call\"), mcpBodies.map(x => x.body.method));\n check(\"modern_headers_present\", mcpBodies.every(x => x.headers.get(\"mcp-protocol-version\") === \"2026-07-28\" && x.headers.get(\"mcp-method\") === x.body.method));\n check(\"modern_meta_protocol_version\", mcpBodies.every(x => x.body?.params?._meta?.[\"io.modelcontextprotocol/protocolVersion\"] === \"2026-07-28\"));\n check(\"modern_meta_capabilities_present\", mcpBodies.every(x => x.body?.params?._meta?.[\"io.modelcontextprotocol/clientCapabilities\"] && typeof x.body.params._meta[\"io.modelcontextprotocol/clientCapabilities\"] === \"object\"));\n check(\"modern_meta_client_info_current\", mcpBodies.every(x => x.body?.params?._meta?.[\"io.modelcontextprotocol/clientInfo\"]?.version === \"1.2.0-rc1\"));\n check(\"token_not_in_probe_output\", !JSON.stringify(probe).includes(\"synthetic-access\"));\n} finally {\n globalThis.fetch = originalFetch;\n}\n\nconst pass = checks.every(x => x.pass);\nconsole.log(JSON.stringify({ pass, version: \"oauth-mcp-probe-1.0.0\", tests: checks.length, checks }));\nexport default { pass, tests: checks.length };\n",[],[181,295],"5bfa1f37-53fc-4047-90e4-e31bb42de643","oauth_flow_selftest.ts","01a07e13-fb44-7031-82f2-85ab9691d089",["D",1788821633861],"import handler from \"../index.ts\";\nimport {\n AGENT_OS,\n clientMetadata,\n consumeAuthorizationState,\n createAuthorizationRequest,\n} from \"../lib/agent_os_oauth.ts\";\n\nconst checks: { name: string; pass: boolean; details?: unknown }[] = [];\nfunction check(name: string, pass: boolean, details?: unknown) {\n checks.push({ name, pass, details });\n if (!pass) throw new Error(`OAUTH_SELFTEST_FAIL:${name}`);\n}\n\nconst metadata = clientMetadata();\ncheck(\"client_id_https_non_root\", new URL(metadata.client_id).protocol === \"https:\" && new URL(metadata.client_id).pathname !== \"/\", metadata.client_id);\ncheck(\"client_id_exact\", metadata.client_id === AGENT_OS.clientId);\ncheck(\"metadata_client_name\", metadata.client_name === \"PayAna Falsifier Agent\");\ncheck(\"redirect_exact\", metadata.redirect_uris.length === 1 && metadata.redirect_uris[0] === AGENT_OS.redirectUri);\ncheck(\"redirect_same_origin\", new URL(metadata.redirect_uris[0]).origin === AGENT_OS.origin);\ncheck(\"auth_method_none\", metadata.token_endpoint_auth_method === \"none\");\ncheck(\"web_application\", metadata.application_type === \"web\");\ncheck(\"authorization_code_only\", metadata.grant_types.includes(\"authorization_code\") && metadata.response_types.includes(\"code\"));\n\nconst generated = await createAuthorizationRequest();\nconst authorizationUrl = new URL(generated.url);\ncheck(\"authorization_host\", authorizationUrl.origin === \"https://accounts.binance.com\", authorizationUrl.origin);\ncheck(\"authorization_path\", authorizationUrl.pathname === \"/agentic-oauth/authorize\", authorizationUrl.pathname);\ncheck(\"response_type\", authorizationUrl.searchParams.get(\"response_type\") === \"code\");\ncheck(\"authorization_client_id\", authorizationUrl.searchParams.get(\"client_id\") === AGENT_OS.clientId);\ncheck(\"authorization_redirect\", authorizationUrl.searchParams.get(\"redirect_uri\") === AGENT_OS.redirectUri);\ncheck(\"authorization_resource\", authorizationUrl.searchParams.get(\"resource\") === AGENT_OS.resource);\ncheck(\"pkce_method\", authorizationUrl.searchParams.get(\"code_challenge_method\") === \"S256\");\ncheck(\"pkce_challenge_shape\", /^[A-Za-z0-9_-]{43}$/.test(authorizationUrl.searchParams.get(\"code_challenge\") ?? \"\"), authorizationUrl.searchParams.get(\"code_challenge\"));\ncheck(\"state_shape\", /^[A-Za-z0-9_-]{40,60}$/.test(generated.state), generated.state.length);\nconst consumed = await consumeAuthorizationState(generated.state);\ncheck(\"state_consumed_once\", Boolean(consumed?.verifier && consumed.verifier.length >= 80), consumed?.verifier.length);\nconst replay = await consumeAuthorizationState(generated.state);\ncheck(\"state_replay_rejected\", replay === null, replay);\n\nconst metadataResponse = await handler(new Request(\"https://local.test/oauth/client-metadata.json\", { headers: { \"x-forwarded-for\": \"203.0.113.81\" } }));\ncheck(\"metadata_route_200\", metadataResponse.status === 200, metadataResponse.status);\nconst routeMetadata = await metadataResponse.json();\ncheck(\"metadata_route_exact_client\", routeMetadata.client_id === AGENT_OS.clientId, routeMetadata.client_id);\n\nconst statusResponse = await handler(new Request(\"https://local.test/oauth/status\", { headers: { \"x-forwarded-for\": \"203.0.113.82\" } }));\ncheck(\"status_route_200\", statusResponse.status === 200, statusResponse.status);\nconst statusBody = await statusResponse.json();\ncheck(\"status_boundary\", statusBody.boundary === \"OAUTH_FLOW_READY != USER_AUTHORIZED_SESSION\", statusBody.boundary);\ncheck(\"status_no_token_persistence\", statusBody.tokenPersistence === \"NONE\", statusBody.tokenPersistence);\ncheck(\"status_no_auto_tool_call\", statusBody.automaticToolCall === false, statusBody.automaticToolCall);\n\nconst startResponse = await handler(new Request(\"https://local.test/oauth/start\", { headers: { \"x-forwarded-for\": \"203.0.113.83\" } }));\ncheck(\"start_route_302\", startResponse.status === 302, startResponse.status);\nconst location = startResponse.headers.get(\"location\") ?? \"\";\nconst startUrl = new URL(location);\ncheck(\"start_external_binance\", startUrl.origin === \"https://accounts.binance.com\", startUrl.origin);\nconst startState = startUrl.searchParams.get(\"state\") ?? \"\";\ncheck(\"start_state_present\", /^[A-Za-z0-9_-]{40,60}$/.test(startState), startState.length);\ncheck(\"start_state_server_stored\", Boolean(await consumeAuthorizationState(startState)));\n\nconst invalidCallback = await handler(new Request(\"https://local.test/oauth/callback?state=nope&code=short\", { headers: { \"x-forwarded-for\": \"203.0.113.84\" } }));\ncheck(\"invalid_callback_400\", invalidCallback.status === 400, invalidCallback.status);\n\nconst issuerCase = await createAuthorizationRequest();\nconst badIssuerUrl = new URL(\"https://local.test/oauth/callback\");\nbadIssuerUrl.searchParams.set(\"state\", issuerCase.state);\nbadIssuerUrl.searchParams.set(\"code\", \"synthetic-code-never-exchanged\");\nbadIssuerUrl.searchParams.set(\"iss\", \"https://attacker.example\");\nconst badIssuer = await handler(new Request(badIssuerUrl, { headers: { \"x-forwarded-for\": \"203.0.113.85\" } }));\ncheck(\"issuer_mismatch_400\", badIssuer.status === 400, badIssuer.status);\ncheck(\"issuer_mismatch_does_not_consume_state\", Boolean(await consumeAuthorizationState(issuerCase.state)));\n\nconst denied = await handler(new Request(\"https://local.test/oauth/callback?error=access_denied\", { headers: { \"x-forwarded-for\": \"203.0.113.86\" } }));\ncheck(\"provider_denial_400\", denied.status === 400, denied.status);\nconst deniedHtml = await denied.text();\ncheck(\"provider_error_not_reflected\", !deniedHtml.includes(\"access_denied\"));\n\nconst pass = checks.every(c => c.pass);\nconsole.log(JSON.stringify({ pass, version: \"oauth-flow-1.0.0\", tests: checks.length, checks }));\nexport default { pass, tests: checks.length };\n",[],[181,302],"0b097617-7995-4def-92f5-de2077d8d807","failure_modes_selftest.ts","01a07e13-fb44-7031-82f2-803210cb14a4",["D",1788821633861],"import { analyzeMarket } from \"../lib/market.ts\";\n\nconst originalFetch = globalThis.fetch;\nconst now = Date.now();\nconst validTicker = {\n symbol: \"BTCUSDT\", priceChangePercent: \"1.25\", lastPrice: \"100.00\", bidPrice: \"99.99\", askPrice: \"100.01\",\n highPrice: \"105.00\", lowPrice: \"95.00\", volume: \"1000\", quoteVolume: \"100000\", closeTime: now, count: 1234,\n};\nconst validDepth = {\n lastUpdateId: 42,\n bids: [[\"99.99\", \"2\"], [\"99.98\", \"1\"]],\n asks: [[\"100.01\", \"1\"], [\"100.02\", \"1\"]],\n};\nconst validKlines = Array.from({ length: 8 }, (_, i) => {\n const open = now - (8 - i) * 300_000;\n const close = 100 + i * 0.1;\n return [open, String(close - 0.05), String(close + 0.1), String(close - 0.1), String(close), \"10\", open + 299_999, String(1000 + i * 10), 100, \"5\", \"500\", \"0\"];\n});\n\nfunction response(body: unknown, status = 200) {\n return new Response(JSON.stringify(body), { status, headers: { \"content-type\": \"application/json\" } });\n}\nfunction install(mode: \"ticker_fail\" | \"malformed_ticker\" | \"ticker_only\" | \"all_fail\" | \"malformed_depth\") {\n globalThis.fetch = (async (input: RequestInfo | URL) => {\n const url = String(input);\n if (mode === \"all_fail\") return response({ error: \"synthetic\" }, 503);\n if (url.includes(\"/ticker/24hr\")) {\n if (mode === \"ticker_fail\") return response({ error: \"synthetic\" }, 503);\n if (mode === \"malformed_ticker\") return response({ symbol: \"BTCUSDT\", lastPrice: \"0\" });\n return response(validTicker);\n }\n if (url.includes(\"/depth\")) {\n if (mode === \"ticker_only\") return response({ error: \"synthetic\" }, 503);\n if (mode === \"malformed_depth\") return response({ lastUpdateId: 42, bids: [], asks: [] });\n return response(validDepth);\n }\n if (url.includes(\"/klines\")) {\n if (mode === \"ticker_only\") return response({ error: \"synthetic\" }, 503);\n return response(validKlines);\n }\n return response({ error: \"unexpected\" }, 404);\n }) as typeof fetch;\n}\n\nconst checks: { name: string; pass: boolean; details?: unknown }[] = [];\nfunction check(name: string, pass: boolean, details?: unknown) {\n checks.push({ name, pass, details });\n if (!pass) throw new Error(`FAILURE_MODE_SELFTEST:${name}`);\n}\n\ntry {\n install(\"ticker_fail\");\n const a: any = await analyzeMarket(\"BTCUSDT\");\n check(\"ticker_fail_partial\", a.evidenceState === \"PARTIAL\", a.evidenceState);\n check(\"ticker_fail_null_price\", a.market?.lastPrice === null, a.market?.lastPrice);\n check(\"ticker_fail_source_false\", a.sourceAvailability?.ticker === false);\n check(\"ticker_fail_no_zero_imputation\", a.market?.change24hPct === null && a.market?.high24h === null && a.market?.low24h === null);\n check(\"ticker_fail_risk_flag\", a.assessment?.riskFlags?.includes(\"MISSING_TICKER_SOURCE\"));\n check(\"ticker_fail_direction_from_survivors\", Number.isFinite(Number(a.assessment?.directionalScore)) && a.assessment?.signalCount >= 2, a.assessment);\n\n install(\"malformed_ticker\");\n const b: any = await analyzeMarket(\"BTCUSDT\");\n const tickerReceipt = b.receipts?.find((r: any) => r.name === \"spot_24h_ticker\");\n check(\"malformed_ticker_partial\", b.evidenceState === \"PARTIAL\", b.evidenceState);\n check(\"malformed_ticker_rejected\", tickerReceipt?.status === \"FAIL\" && tickerReceipt?.error === \"INVALID_TICKER_SHAPE\", tickerReceipt);\n check(\"malformed_ticker_not_price_zero\", b.market?.lastPrice === null, b.market?.lastPrice);\n\n install(\"ticker_only\");\n const c: any = await analyzeMarket(\"BTCUSDT\");\n check(\"ticker_only_partial\", c.evidenceState === \"PARTIAL\", c.evidenceState);\n check(\"ticker_only_insufficient_direction\", c.assessment?.bias === \"INSUFFICIENT_EVIDENCE\", c.assessment?.bias);\n check(\"ticker_only_score_null\", c.assessment?.directionalScore === null, c.assessment?.directionalScore);\n check(\"ticker_only_micro_null\", c.microstructure?.orderBookImbalance === null && c.microstructure?.bidNotionalTop20 === null);\n check(\"ticker_only_candles_zero\", c.shortHorizon?.candles === 0 && c.shortHorizon?.momentum30mPct === null);\n check(\"ticker_only_no_trade\", c.assessment?.recommendation === \"NO_TRADE_DECISION\");\n check(\"ticker_only_recovery_next_test\", String(c.assessment?.nextTest).includes(\"Recover\"));\n\n install(\"malformed_depth\");\n const d: any = await analyzeMarket(\"BTCUSDT\");\n const depthReceipt = d.receipts?.find((r: any) => r.name === \"spot_order_book\");\n check(\"malformed_depth_partial\", d.evidenceState === \"PARTIAL\", d.evidenceState);\n check(\"malformed_depth_rejected\", depthReceipt?.status === \"FAIL\" && depthReceipt?.error === \"INVALID_DEPTH_SHAPE\", depthReceipt);\n check(\"malformed_depth_null_imbalance\", d.microstructure?.orderBookImbalance === null, d.microstructure?.orderBookImbalance);\n\n install(\"all_fail\");\n const e: any = await analyzeMarket(\"BTCUSDT\");\n check(\"all_fail_state\", e.evidenceState === \"FAIL\", e.evidenceState);\n check(\"all_fail_insufficient\", e.assessment?.bias === \"INSUFFICIENT_EVIDENCE\", e.assessment?.bias);\n check(\"all_fail_no_trade\", e.assessment?.recommendation === \"NO_TRADE_DECISION\");\n check(\"all_fail_all_receipts_fail\", e.receipts?.length === 3 && e.receipts.every((r: any) => r.status === \"FAIL\"));\n} finally {\n globalThis.fetch = originalFetch;\n}\n\nconst pass = checks.every(c => c.pass);\nconsole.log(JSON.stringify({ pass, version: \"failure-modes-1.0.0\", tests: checks.length, checks }));\nexport default { pass, tests: checks.length };\n",[],[181,309],["D",1788821633861],[241,242,243,244,245,246,247],[181],"2397e1a8-50b2-4564-8919-0fa0c7fd93c8","market.ts","01a07e13-fb44-7031-82f2-7a45cf8ca25e",["D",1788821633861],"const BASE = \"https://data-api.binance.vision\";\nconst SYMBOLS = new Set([\"BTCUSDT\", \"ETHUSDT\", \"BNBUSDT\", \"SOLUSDT\", \"XRPUSDT\"]);\nconst FETCH_TIMEOUT_MS = 7000;\n\nexport type MarketEvidenceState = \"PASS\" | \"PARTIAL\" | \"FAIL\";\n\ntype SourceReceipt = {\n name: string;\n url: string;\n status: \"PASS\" | \"FAIL\";\n httpStatus?: number;\n durationMs: number;\n error?: string;\n};\n\ntype Ticker = {\n symbol: string;\n priceChangePercent: string;\n lastPrice: string;\n bidPrice: string;\n askPrice: string;\n highPrice: string;\n lowPrice: string;\n volume: string;\n quoteVolume: string;\n closeTime: number;\n count: number;\n};\ntype Depth = { lastUpdateId: number; bids: [string, string][]; asks: [string, string][] };\ntype Kline = [number, string, string, string, string, string, number, string, number, string, string, string];\n\ntype SignalAtom = { name: string; score: number; observed: string };\n\nfunction num(value: unknown) {\n const n = Number(value);\n return Number.isFinite(n) ? n : Number.NaN;\n}\nfunction round(value: number, digits = 4) {\n if (!Number.isFinite(value)) return null;\n const p = 10 ** digits;\n return Math.round(value * p) / p;\n}\nfunction mean(xs: number[]) {\n return xs.length ? xs.reduce((a, b) => a + b, 0) / xs.length : Number.NaN;\n}\nfunction std(xs: number[]) {\n if (xs.length < 2) return Number.NaN;\n const m = mean(xs);\n return Math.sqrt(xs.reduce((s, x) => s + (x - m) ** 2, 0) / (xs.length - 1));\n}\nfunction zscore(value: number, sample: number[]) {\n const sd = std(sample);\n return Number.isFinite(sd) && sd > 0 ? (value - mean(sample)) / sd : Number.NaN;\n}\nfunction validPositive(value: unknown) {\n const n = Number(value);\n return Number.isFinite(n) && n > 0;\n}\nfunction validNonNegative(value: unknown) {\n const n = Number(value);\n return Number.isFinite(n) && n >= 0;\n}\nfunction validateTicker(value: unknown): value is Ticker {\n const v = value as any;\n return Boolean(v && typeof v === \"object\" && typeof v.symbol === \"string\" &&\n validPositive(v.lastPrice) && validPositive(v.bidPrice) && validPositive(v.askPrice) &&\n validPositive(v.highPrice) && validPositive(v.lowPrice) && validNonNegative(v.quoteVolume) &&\n Number.isFinite(Number(v.priceChangePercent)) && Number.isFinite(Number(v.closeTime)) && Number(v.closeTime) > 0 &&\n Number.isFinite(Number(v.count)) && Number(v.count) >= 0);\n}\nfunction validBookSide(side: unknown): side is [string, string][] {\n return Array.isArray(side) && side.length > 0 && side.every(level =>\n Array.isArray(level) && level.length >= 2 && validPositive(level[0]) && validNonNegative(level[1]));\n}\nfunction validateDepth(value: unknown): value is Depth {\n const v = value as any;\n return Boolean(v && typeof v === \"object\" && Number.isFinite(Number(v.lastUpdateId)) &&\n validBookSide(v.bids) && validBookSide(v.asks));\n}\nfunction validateKlines(value: unknown): value is Kline[] {\n return Array.isArray(value) && value.length >= 7 && value.every((k: any) =>\n Array.isArray(k) && k.length >= 8 && Number.isFinite(Number(k[0])) && Number(k[0]) > 0 &&\n validPositive(k[4]) && Number.isFinite(Number(k[6])) && Number(k[6]) > Number(k[0]) && validNonNegative(k[7]));\n}\nfunction failShape(receipt: SourceReceipt, error: string) {\n receipt.status = \"FAIL\";\n receipt.error = error;\n}\n\nexport function normalizeSymbol(raw: unknown) {\n const symbol = String(raw ?? \"BTCUSDT\").trim().toUpperCase();\n if (!/^[A-Z0-9]{5,20}$/.test(symbol)) throw new Error(\"INVALID_SYMBOL_FORMAT\");\n if (!SYMBOLS.has(symbol)) throw new Error(\"SYMBOL_NOT_ALLOWLISTED\");\n return symbol;\n}\n\nasync function getJson(name: string, path: string): Promise<{ value?: T; receipt: SourceReceipt }> {\n const url = `${BASE}${path}`;\n const started = performance.now();\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);\n try {\n const response = await fetch(url, {\n method: \"GET\",\n headers: { Accept: \"application/json\", \"User-Agent\": \"PayAna-Market-Sentinel/1.1\" },\n signal: controller.signal,\n });\n const durationMs = Math.round(performance.now() - started);\n if (!response.ok) {\n return { receipt: { name, url, status: \"FAIL\", httpStatus: response.status, durationMs, error: `HTTP_${response.status}` } };\n }\n const value = await response.json() as T;\n return { value, receipt: { name, url, status: \"PASS\", httpStatus: response.status, durationMs } };\n } catch (error) {\n return {\n receipt: {\n name,\n url,\n status: \"FAIL\",\n durationMs: Math.round(performance.now() - started),\n error: error instanceof Error ? error.message.slice(0, 180) : String(error).slice(0, 180),\n },\n };\n } finally {\n clearTimeout(timer);\n }\n}\n\nexport async function analyzeMarket(rawSymbol: unknown) {\n const symbol = normalizeSymbol(rawSymbol);\n const fetchedAt = new Date().toISOString();\n const [tickerResult, depthResult, klinesResult] = await Promise.all([\n getJson(\"spot_24h_ticker\", `/api/v3/ticker/24hr?symbol=${symbol}`),\n getJson(\"spot_order_book\", `/api/v3/depth?symbol=${symbol}&limit=20`),\n getJson(\"spot_5m_klines\", `/api/v3/klines?symbol=${symbol}&interval=5m&limit=36`),\n ]);\n\n if (tickerResult.receipt.status === \"PASS\" && !validateTicker(tickerResult.value)) failShape(tickerResult.receipt, \"INVALID_TICKER_SHAPE\");\n if (depthResult.receipt.status === \"PASS\" && !validateDepth(depthResult.value)) failShape(depthResult.receipt, \"INVALID_DEPTH_SHAPE\");\n if (klinesResult.receipt.status === \"PASS\" && !validateKlines(klinesResult.value)) failShape(klinesResult.receipt, \"INVALID_KLINES_SHAPE\");\n\n const ticker = tickerResult.receipt.status === \"PASS\" && validateTicker(tickerResult.value) ? tickerResult.value : undefined;\n const depth = depthResult.receipt.status === \"PASS\" && validateDepth(depthResult.value) ? depthResult.value : undefined;\n const klines = klinesResult.receipt.status === \"PASS\" && validateKlines(klinesResult.value) ? klinesResult.value : [];\n const receipts = [tickerResult.receipt, depthResult.receipt, klinesResult.receipt];\n const successes = receipts.filter(r => r.status === \"PASS\").length;\n const evidenceState: MarketEvidenceState = successes === receipts.length ? \"PASS\" : successes > 0 ? \"PARTIAL\" : \"FAIL\";\n const sourceAvailability = { ticker: Boolean(ticker), orderBook: Boolean(depth), klines: klines.length > 0 };\n\n if (evidenceState === \"FAIL\") {\n return {\n symbol,\n evidenceState,\n fetchedAt,\n readOnly: true,\n sourceAvailability,\n error: \"ALL_MARKET_SOURCES_FAILED\",\n receipts,\n boundary: \"MARKET_DATA_READ != TRADING_AUTH\",\n assessment: {\n bias: \"INSUFFICIENT_EVIDENCE\",\n recommendation: \"NO_TRADE_DECISION\",\n hypotheses: {\n winning: \"No directional hypothesis is admissible because all required market evidence sources failed.\",\n opposite: \"A directional market condition may exist, but this run has no valid evidence with which to establish it.\",\n alternative: \"The failure may be caused by provider/network/runtime conditions rather than the market itself.\",\n },\n supportingEvidence: [\"No valid source survived validation.\"],\n opposingEvidence: [\"No valid source survived validation.\"],\n alternativeExplanations: [\"Provider outage, runtime restriction, timeout or response-shape drift.\"],\n falsifiers: [\"A subsequent run with valid source receipts falsifies the all-sources-failed state.\"],\n nextTest: \"Retry the read-only sources and require at least one validated directional source before assigning market pressure.\",\n },\n };\n }\n\n const last = ticker ? num(ticker.lastPrice) : Number.NaN;\n const bid = ticker ? num(ticker.bidPrice) : Number.NaN;\n const ask = ticker ? num(ticker.askPrice) : Number.NaN;\n const mid = Number.isFinite(bid) && Number.isFinite(ask) && bid > 0 && ask > 0 ? (bid + ask) / 2 : Number.NaN;\n const spreadBps = Number.isFinite(mid) && mid > 0 ? ((ask - bid) / mid) * 10_000 : Number.NaN;\n\n const bidNotional = depth ? depth.bids.reduce((sum, [p, q]) => sum + num(p) * num(q), 0) : Number.NaN;\n const askNotional = depth ? depth.asks.reduce((sum, [p, q]) => sum + num(p) * num(q), 0) : Number.NaN;\n const bookTotal = Number.isFinite(bidNotional) && Number.isFinite(askNotional) ? bidNotional + askNotional : Number.NaN;\n const imbalance = Number.isFinite(bookTotal) && bookTotal > 0 ? (bidNotional - askNotional) / bookTotal : Number.NaN;\n\n const closes = klines.map(k => num(k[4])).filter(Number.isFinite);\n const quoteVolumes = klines.map(k => num(k[7])).filter(Number.isFinite);\n const logReturns = closes.slice(1).map((c, i) => Math.log(c / closes[i])).filter(Number.isFinite);\n const shortVolRaw = std(logReturns);\n const shortVolBps = Number.isFinite(shortVolRaw) ? shortVolRaw * 10_000 : Number.NaN;\n const momentum30mPct = closes.length >= 7 ? (closes.at(-1)! / closes.at(-7)! - 1) * 100 : Number.NaN;\n const momentum3hPct = closes.length >= 2 ? (closes.at(-1)! / closes[0] - 1) * 100 : Number.NaN;\n const lastQuoteVolume = quoteVolumes.length ? quoteVolumes.at(-1)! : Number.NaN;\n const priorVolumes = quoteVolumes.slice(0, -1);\n const volumeZ = Number.isFinite(lastQuoteVolume) && priorVolumes.length >= 4 ? zscore(lastQuoteVolume, priorVolumes) : Number.NaN;\n\n const riskFlags: string[] = [];\n if (!ticker) riskFlags.push(\"MISSING_TICKER_SOURCE\");\n if (!depth) riskFlags.push(\"MISSING_ORDER_BOOK_SOURCE\");\n if (!klines.length) riskFlags.push(\"MISSING_KLINES_SOURCE\");\n if (Number.isFinite(spreadBps) && spreadBps > 2) riskFlags.push(\"WIDE_SPREAD\");\n if (Number.isFinite(imbalance) && Math.abs(imbalance) > 0.55) riskFlags.push(imbalance > 0 ? \"BID_HEAVY_BOOK\" : \"ASK_HEAVY_BOOK\");\n if (Number.isFinite(shortVolBps) && shortVolBps > 18) riskFlags.push(\"HIGH_SHORT_HORIZON_VOLATILITY\");\n if (Number.isFinite(momentum30mPct) && Math.abs(momentum30mPct) > 0.8) riskFlags.push(\"FAST_30M_MOVE\");\n if (Number.isFinite(volumeZ) && Math.abs(volumeZ) > 2) riskFlags.push(\"VOLUME_ANOMALY\");\n\n const signalAtoms: SignalAtom[] = [];\n if (Number.isFinite(imbalance)) signalAtoms.push({ name: \"Top-20 order-book imbalance\", score: Math.tanh(imbalance * 2), observed: `imbalance=${round(imbalance, 4)}` });\n if (Number.isFinite(momentum30mPct)) signalAtoms.push({ name: \"30m momentum\", score: Math.tanh(momentum30mPct / 0.6), observed: `momentum30m=${round(momentum30mPct, 3)}%` });\n if (Number.isFinite(momentum3hPct)) signalAtoms.push({ name: \"3h momentum\", score: Math.tanh(momentum3hPct / 1.5), observed: `momentum3h=${round(momentum3hPct, 3)}%` });\n const directionalScore = signalAtoms.length ? mean(signalAtoms.map(x => x.score)) : Number.NaN;\n const polarity = Number.isFinite(directionalScore) ? (directionalScore > 0.2 ? 1 : directionalScore < -0.2 ? -1 : 0) : 0;\n const bias = !signalAtoms.length ? \"INSUFFICIENT_EVIDENCE\" : polarity > 0 ? \"BULLISH_PRESSURE\" : polarity < 0 ? \"BEARISH_PRESSURE\" : \"MIXED_NEUTRAL\";\n\n const stabilityPenalty = Math.min(0.7,\n (Number.isFinite(volumeZ) ? Math.abs(volumeZ) * 0.04 : 0) +\n (Number.isFinite(shortVolBps) ? shortVolBps * 0.012 : 0) +\n (Number.isFinite(spreadBps) ? spreadBps * 0.06 : 0) +\n (3 - successes) * 0.18);\n const stabilityScore = Math.max(0, Math.min(1, 0.72 - stabilityPenalty));\n\n const aligned = bias === \"INSUFFICIENT_EVIDENCE\"\n ? []\n : polarity === 0 ? signalAtoms.filter(x => Math.abs(x.score) < 0.35) : signalAtoms.filter(x => Math.sign(x.score) === polarity && Math.abs(x.score) >= 0.08);\n const opposed = bias === \"INSUFFICIENT_EVIDENCE\"\n ? []\n : polarity === 0 ? signalAtoms.filter(x => Math.abs(x.score) >= 0.35) : signalAtoms.filter(x => Math.sign(x.score) === -polarity && Math.abs(x.score) >= 0.08);\n\n const supportingEvidence = aligned.length\n ? aligned.map(x => `${x.name}: ${x.observed}`)\n : [bias === \"INSUFFICIENT_EVIDENCE\" ? \"No validated directional component is available.\" : polarity === 0 ? \"No directional component dominates the combined score.\" : \"Combined score is directional, but no single component clears the support threshold strongly enough.\"];\n const opposingEvidence = opposed.length\n ? opposed.map(x => `${x.name}: ${x.observed}`)\n : [bias === \"INSUFFICIENT_EVIDENCE\" ? \"No validated directional component is available to oppose or support a direction.\" : polarity === 0 ? \"No strong single component breaks the mixed/neutral classification.\" : \"No measured component currently provides strong opposite-direction evidence; this can change on the next book/candle update.\"];\n\n const hypotheses = {\n winning: bias === \"INSUFFICIENT_EVIDENCE\"\n ? \"Directional pressure is not assigned because the surviving evidence does not contain a validated directional component.\"\n : polarity > 0\n ? \"Current measured pressure leans bullish because the combined microstructure/momentum score is positive.\"\n : polarity < 0\n ? \"Current measured pressure leans bearish because the combined microstructure/momentum score is negative.\"\n : \"Current evidence is mixed/neutral because the measured directional components do not agree strongly enough.\",\n opposite: bias === \"INSUFFICIENT_EVIDENCE\"\n ? \"A directional condition may exist despite the insufficient reading; recovering a valid directional source can falsify this abstention.\"\n : polarity > 0\n ? \"The bullish-pressure reading is wrong or transient; liquidity can disappear and the next completed candle can reverse the momentum evidence.\"\n : polarity < 0\n ? \"The bearish-pressure reading is wrong or transient; liquidity can disappear and the next completed candle can reverse the momentum evidence.\"\n : \"A directional move may already be forming but is being masked by disagreement across the current short-horizon measurements.\",\n alternative: \"The observed pattern may be short-lived liquidity/noise or mean reversion rather than persistent directional information.\",\n };\n\n const alternativeExplanations = [\n \"Top-of-book liquidity is ephemeral and can change faster than the polling interval.\",\n Number.isFinite(volumeZ) && Math.abs(volumeZ) > 2\n ? \"The latest volume is statistically unusual versus the recent sample, so short-horizon metrics may reflect an event shock.\"\n : Number.isFinite(volumeZ)\n ? \"Volume is not currently extreme versus the recent sample, so the directional reading may simply reflect ordinary microstructure noise.\"\n : \"Volume anomaly could not be assessed because valid candle-volume evidence is unavailable.\",\n \"Funding, derivatives positioning, news and on-chain context are absent from this hosted runtime and could materially change interpretation.\",\n ];\n\n const nextTest = bias === \"INSUFFICIENT_EVIDENCE\"\n ? \"Recover at least one validated directional source (order book or 5m candles), then recompute without zero-imputing missing evidence.\"\n : `At the next completed 5m candle, recompute all available directional components and re-read top-20 depth; challenge the current label if the combined score crosses ${polarity > 0 ? \"below +0.20\" : polarity < 0 ? \"above -0.20\" : \"outside ±0.20\"}${Number.isFinite(imbalance) ? \" or if order-book imbalance changes sign\" : \"\"}.`;\n\n const falsifiers: string[] = [];\n if (Number.isFinite(imbalance)) falsifiers.push(imbalance > 0 ? \"Bid-heavy order book can vanish quickly; recheck if imbalance crosses below 0.\" : \"Ask-heavy order book can vanish quickly; recheck if imbalance crosses above 0.\");\n if (Number.isFinite(momentum30mPct)) falsifiers.push(momentum30mPct > 0 ? \"Bullish 30m momentum is falsified if the next completed 5m close falls below the first close of the 30m window.\" : \"Bearish 30m momentum is falsified if the next completed 5m close rises above the first close of the 30m window.\");\n if (!falsifiers.length) falsifiers.push(\"Recovering a validated directional source can falsify the current insufficient-evidence classification.\");\n falsifiers.push(\"This analysis has no account, position, liquidation, funding, news, or on-chain context.\");\n\n return {\n symbol,\n evidenceState,\n fetchedAt,\n readOnly: true,\n boundary: \"MARKET_DATA_READ != TRADING_AUTH\",\n provider: \"Binance public market-data surface via data-api.binance.vision\",\n sourceAvailability,\n method: {\n version: \"sentinel-1.1.0\",\n missingDataPolicy: \"Missing or malformed sources produce null derived fields and are excluded from directional aggregation; no zero imputation.\",\n spreadBps: \"(ask-bid)/mid*10000\",\n orderBookImbalance: \"(top20_bid_notional-top20_ask_notional)/(top20_bid_notional+top20_ask_notional)\",\n realizedVolatility: \"sample_std(log(close_t/close_t-1))*10000 over 5m candles\",\n volumeZScore: \"(latest_quote_volume-mean(prior_quote_volume))/sample_std(prior_quote_volume)\",\n directionalScore: \"mean of available validated components: tanh(2*imbalance), tanh(momentum30mPct/0.6), tanh(momentum3hPct/1.5)\",\n stabilityScore: \"heuristic 0..1; decreases with |volume z|, short volatility, spread and each missing source; not a probability\",\n },\n market: {\n lastPrice: round(last, 8),\n change24hPct: round(ticker ? num(ticker.priceChangePercent) : Number.NaN, 3),\n high24h: round(ticker ? num(ticker.highPrice) : Number.NaN, 8),\n low24h: round(ticker ? num(ticker.lowPrice) : Number.NaN, 8),\n quoteVolume24h: round(ticker ? num(ticker.quoteVolume) : Number.NaN, 2),\n tradeCount24h: ticker ? Number(ticker.count) : null,\n tickerCloseTime: ticker?.closeTime ?? null,\n },\n microstructure: {\n bid: round(bid, 8),\n ask: round(ask, 8),\n spreadBps: round(spreadBps, 4),\n bidNotionalTop20: round(bidNotional, 2),\n askNotionalTop20: round(askNotional, 2),\n orderBookImbalance: round(imbalance, 4),\n depthUpdateId: depth?.lastUpdateId ?? null,\n },\n shortHorizon: {\n interval: \"5m\",\n candles: klines.length,\n realizedVolatilityBpsPer5m: round(shortVolBps, 3),\n momentum30mPct: round(momentum30mPct, 3),\n momentum3hPct: round(momentum3hPct, 3),\n latestQuoteVolume: round(lastQuoteVolume, 2),\n volumeZScore: round(volumeZ, 3),\n lastClosedOrCurrentCandleCloseTime: klines.at(-1)?.[6] ?? null,\n closeSeries: klines.slice(-24).map(k => ({ time: k[0], close: round(num(k[4]), 8) })),\n },\n assessment: {\n bias,\n signalCount: signalAtoms.length,\n directionalScore: round(directionalScore, 4),\n stabilityScore: round(stabilityScore, 3),\n stabilityMeaning: \"Heuristic snapshot stability score, not a calibrated probability or forecast confidence.\",\n hypotheses,\n supportingEvidence,\n opposingEvidence,\n alternativeExplanations,\n riskFlags,\n recommendation: \"NO_TRADE_DECISION\",\n explanation: \"Read-only evidence synthesis. Directional pressure is descriptive, not a forecast or order recommendation.\",\n falsifiers,\n nextTest,\n },\n missingContext: [\n \"Futures funding/mark-price endpoint unavailable from current Val Town runtime due Binance regional restriction\",\n \"No authenticated Binance account context\",\n \"No portfolio/position context\",\n \"No external news/on-chain context\",\n ],\n receipts,\n };\n}\n\nexport function supportedSymbols() {\n return [...SYMBOLS];\n}\n",[],[187,319],"68eb96ed-a4cf-465d-a8dc-d652a7d7d574","agent_os_oauth.ts","01a07e13-fb44-7031-82f2-77e2047eb712",["D",1788821633861],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport const AGENT_OS = {\n issuer: \"https://agent.binance.com\",\n resource: \"https://agent.binance.com/mcp/agentic\",\n authorizationEndpoint: \"https://accounts.binance.com/agentic-oauth/authorize\",\n tokenEndpoint: \"https://accounts.binance.com/oauth-agentic/token\",\n origin: \"https://payana-agent-os.val.run\",\n clientId: \"https://payana-agent-os.val.run/oauth/client-metadata.json\",\n redirectUri: \"https://payana-agent-os.val.run/oauth/callback\",\n} as const;\n\nconst OAUTH_STATE_TTL_MS = 10 * 60_000;\nconst OAUTH_STATE_MAX_ROWS = 500;\n\nfunction base64url(bytes: Uint8Array) {\n let binary = \"\";\n for (const byte of bytes) binary += String.fromCharCode(byte);\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\n}\n\nfunction randomBase64url(bytes = 32) {\n return base64url(crypto.getRandomValues(new Uint8Array(bytes)));\n}\n\nasync function sha256Base64url(value: string) {\n return base64url(new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value))));\n}\n\nasync function ensureStateSchema() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS agent_os_oauth_states (\n state TEXT PRIMARY KEY,\n code_verifier TEXT NOT NULL,\n created_at_ms INTEGER NOT NULL\n )`);\n}\n\nexport function clientMetadata() {\n return {\n client_id: AGENT_OS.clientId,\n client_name: \"PayAna Falsifier Agent\",\n client_uri: AGENT_OS.origin,\n redirect_uris: [AGENT_OS.redirectUri],\n grant_types: [\"authorization_code\"],\n response_types: [\"code\"],\n token_endpoint_auth_method: \"none\",\n application_type: \"web\",\n };\n}\n\nexport async function createAuthorizationRequest() {\n await ensureStateSchema();\n const now = Date.now();\n const state = randomBase64url(32);\n const verifier = randomBase64url(64);\n const challenge = await sha256Base64url(verifier);\n await sqlite.batch([\n {\n sql: \"DELETE FROM agent_os_oauth_states WHERE created_at_ms < ?\",\n args: [now - OAUTH_STATE_TTL_MS],\n },\n {\n sql: \"INSERT INTO agent_os_oauth_states(state, code_verifier, created_at_ms) VALUES(?,?,?)\",\n args: [state, verifier, now],\n },\n {\n sql: \"DELETE FROM agent_os_oauth_states WHERE state NOT IN (SELECT state FROM agent_os_oauth_states ORDER BY created_at_ms DESC, state DESC LIMIT ?)\",\n args: [OAUTH_STATE_MAX_ROWS],\n },\n ]);\n\n const url = new URL(AGENT_OS.authorizationEndpoint);\n url.searchParams.set(\"response_type\", \"code\");\n url.searchParams.set(\"client_id\", AGENT_OS.clientId);\n url.searchParams.set(\"redirect_uri\", AGENT_OS.redirectUri);\n url.searchParams.set(\"code_challenge\", challenge);\n url.searchParams.set(\"code_challenge_method\", \"S256\");\n url.searchParams.set(\"state\", state);\n url.searchParams.set(\"resource\", AGENT_OS.resource);\n return { url: url.toString(), state, challenge };\n}\n\nfunction isSqliteBusy(error: unknown) {\n const anyError = error as any;\n return anyError?.code === \"SQLITE_BUSY\" || /SQLITE_BUSY|database is locked/i.test(String(anyError?.message ?? error ?? \"\"));\n}\n\nasync function pruneExpiredOAuthStatesBestEffort(now: number) {\n try {\n await sqlite.execute({\n sql: \"DELETE FROM agent_os_oauth_states WHERE created_at_ms < ?\",\n args: [now - OAUTH_STATE_TTL_MS],\n });\n } catch (error) {\n if (!isSqliteBusy(error)) console.warn(\"OAUTH_STATE_PRUNE_SKIPPED\", error instanceof Error ? error.message : String(error));\n }\n}\n\nexport async function consumeAuthorizationState(state: string) {\n await ensureStateSchema();\n const now = Date.now();\n const retryDelaysMs = [0, 12, 30, 70, 140];\n\n for (let attempt = 0; attempt < retryDelaysMs.length; attempt += 1) {\n if (retryDelaysMs[attempt] > 0) await new Promise(resolve => setTimeout(resolve, retryDelaysMs[attempt]));\n try {\n const result = await sqlite.execute({\n sql: \"DELETE FROM agent_os_oauth_states WHERE state=? AND created_at_ms>=? RETURNING code_verifier, created_at_ms\",\n args: [state, now - OAUTH_STATE_TTL_MS],\n });\n const row = result.rows?.[0] as { code_verifier?: unknown; created_at_ms?: unknown } | undefined;\n await pruneExpiredOAuthStatesBestEffort(now);\n if (!row || typeof row.code_verifier !== \"string\") return null;\n return { verifier: row.code_verifier, createdAtMs: Number(row.created_at_ms) };\n } catch (error) {\n if (!isSqliteBusy(error) || attempt === retryDelaysMs.length - 1) throw error;\n }\n }\n return null;\n}\n\nexport async function exchangeAuthorizationCode(code: string, verifier: string) {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), 10_000);\n try {\n const body = new URLSearchParams({\n grant_type: \"authorization_code\",\n code,\n redirect_uri: AGENT_OS.redirectUri,\n client_id: AGENT_OS.clientId,\n code_verifier: verifier,\n resource: AGENT_OS.resource,\n });\n const response = await fetch(AGENT_OS.tokenEndpoint, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\", Accept: \"application/json\" },\n body,\n signal: controller.signal,\n });\n const text = await response.text();\n let payload: any = null;\n try { payload = JSON.parse(text); } catch {}\n if (!response.ok) {\n return {\n ok: false as const,\n status: response.status,\n error: String(payload?.error ?? \"TOKEN_EXCHANGE_FAILED\").slice(0, 120),\n errorDescription: String(payload?.error_description ?? \"\").slice(0, 240) || null,\n };\n }\n const accessToken = typeof payload?.access_token === \"string\" ? payload.access_token : \"\";\n if (!accessToken) return { ok: false as const, status: response.status, error: \"TOKEN_RESPONSE_MISSING_ACCESS_TOKEN\", errorDescription: null };\n return {\n ok: true as const,\n accessToken,\n tokenType: String(payload?.token_type ?? \"Bearer\").slice(0, 40),\n expiresIn: Number.isFinite(Number(payload?.expires_in)) ? Number(payload.expires_in) : null,\n scope: typeof payload?.scope === \"string\" ? payload.scope.slice(0, 500) : null,\n refreshTokenReturned: typeof payload?.refresh_token === \"string\" && payload.refresh_token.length > 0,\n };\n } finally {\n clearTimeout(timer);\n }\n}\n\nfunction parseMcpBody(contentType: string | null, text: string) {\n if (contentType?.includes(\"text/event-stream\")) {\n const events = text\n .split(/\\n\\n+/)\n .map(block => block.split(\"\\n\").filter(line => line.startsWith(\"data:\")).map(line => line.slice(5).trim()).join(\"\\n\"))\n .filter(Boolean)\n .map(data => { try { return JSON.parse(data); } catch { return { raw: data.slice(0, 1000) }; } });\n return events.length === 1 ? events[0] : events;\n }\n try { return JSON.parse(text); } catch { return { raw: text.slice(0, 1000) }; }\n}\n\nasync function mcpPost(accessToken: string, body: any, extraHeaders: Record = {}) {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), 10_000);\n try {\n const response = await fetch(AGENT_OS.resource, {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${accessToken}`,\n \"Content-Type\": \"application/json\",\n Accept: \"application/json, text/event-stream\",\n ...extraHeaders,\n },\n body: JSON.stringify(body),\n signal: controller.signal,\n });\n const text = await response.text();\n return {\n ok: response.ok,\n status: response.status,\n sessionId: response.headers.get(\"mcp-session-id\"),\n protocolVersion: response.headers.get(\"mcp-protocol-version\"),\n body: parseMcpBody(response.headers.get(\"content-type\"), text),\n };\n } finally {\n clearTimeout(timer);\n }\n}\n\nfunction extractRpcResult(body: any) {\n if (body && !Array.isArray(body) && typeof body === \"object\") return body;\n if (Array.isArray(body)) return body.find(x => x && typeof x === \"object\" && (\"result\" in x || \"error\" in x)) ?? body[0] ?? null;\n return null;\n}\n\nfunction compactTools(body: any) {\n const rpc = extractRpcResult(body);\n const tools = Array.isArray(rpc?.result?.tools) ? rpc.result.tools : [];\n return tools.slice(0, 100).map((tool: any) => ({\n name: String(tool?.name ?? \"\").slice(0, 160),\n description: String(tool?.description ?? \"\").replace(/\\s+/g, \" \").trim().slice(0, 500),\n inputSchema: tool?.inputSchema && typeof tool.inputSchema === \"object\" ? tool.inputSchema : null,\n }));\n}\n\nfunction isSafeMarketTool(tool: { name: string; description: string; inputSchema: any }) {\n const text = `${tool.name} ${tool.description}`.toLowerCase().replace(/[_-]+/g, \" \");\n const positive = /(market data|ticker|price|order book|orderbook|depth|kline|candlestick|candle)/.test(text);\n const dangerous = /(place\\s+order|create\\s+order|cancel\\s+order|execute\\s+trade|\\btrade\\b|withdraw|transfer|deposit|account|wallet|position|margin|leverage)/.test(text);\n return positive && !dangerous;\n}\n\nfunction argsForSafeMarketTool(tool: { inputSchema: any }) {\n const schema = tool.inputSchema;\n if (!schema || typeof schema !== \"object\") return {};\n const props = schema.properties && typeof schema.properties === \"object\" ? schema.properties : {};\n const required = Array.isArray(schema.required) ? schema.required.map(String) : [];\n const args: Record = {};\n for (const key of Object.keys(props)) {\n const lower = key.toLowerCase();\n const property = props[key] ?? {};\n if (lower === \"symbol\" || lower === \"pair\" || lower === \"tradingpair\") args[key] = \"BTCUSDT\";\n else if (lower === \"symbols\") args[key] = [\"BTCUSDT\"];\n else if (lower === \"interval\" || lower === \"timeframe\") args[key] = \"5m\";\n else if (lower === \"limit\") {\n const minimum = Number.isFinite(Number(property.minimum)) ? Number(property.minimum) : 1;\n const maximum = Number.isFinite(Number(property.maximum)) ? Number(property.maximum) : 20;\n args[key] = Math.max(minimum, Math.min(maximum, 5));\n } else if (lower === \"market\" || lower === \"markettype\") args[key] = \"spot\";\n }\n const unknownRequired = required.filter(key => !(key in args));\n return unknownRequired.length ? null : args;\n}\n\nasync function callModern(accessToken: string, method: string, params: any, name?: string) {\n return await mcpPost(accessToken, {\n jsonrpc: \"2.0\",\n id: crypto.randomUUID(),\n method,\n params: {\n ...params,\n _meta: {\n ...(params?._meta ?? {}),\n \"io.modelcontextprotocol/protocolVersion\": \"2026-07-28\",\n \"io.modelcontextprotocol/clientCapabilities\": {},\n \"io.modelcontextprotocol/clientInfo\": { name: \"PayAna Falsifier Agent\", version: \"1.2.0-rc1\" },\n },\n },\n }, {\n \"MCP-Protocol-Version\": \"2026-07-28\",\n \"Mcp-Method\": method,\n ...(name ? { \"Mcp-Name\": name } : {}),\n });\n}\n\nasync function listToolsModern(accessToken: string) {\n const discover = await callModern(accessToken, \"server/discover\", {});\n const tools = await callModern(accessToken, \"tools/list\", {});\n return { era: \"2026-07-28\", discover, tools, compact: compactTools(tools.body) };\n}\n\nasync function listToolsLegacy(accessToken: string) {\n const init = await mcpPost(accessToken, {\n jsonrpc: \"2.0\",\n id: 1,\n method: \"initialize\",\n params: {\n protocolVersion: \"2025-11-25\",\n capabilities: {},\n clientInfo: { name: \"PayAna Falsifier Agent\", version: \"1.2.0-rc1\" },\n },\n });\n if (!init.ok) return { era: \"legacy\", init, tools: null, compact: [] as any[] };\n const session = init.sessionId ?? undefined;\n await mcpPost(accessToken, {\n jsonrpc: \"2.0\",\n method: \"notifications/initialized\",\n params: {},\n }, session ? { \"Mcp-Session-Id\": session } : {});\n const tools = await mcpPost(accessToken, {\n jsonrpc: \"2.0\",\n id: 2,\n method: \"tools/list\",\n params: {},\n }, session ? { \"Mcp-Session-Id\": session } : {});\n return { era: String((extractRpcResult(init.body) as any)?.result?.protocolVersion ?? \"legacy\"), init, tools, compact: compactTools(tools.body) };\n}\n\nexport async function probeAuthorizedAgentOs(accessToken: string) {\n const modern = await listToolsModern(accessToken);\n const modernRpc = extractRpcResult(modern.tools.body);\n let selected: any = modern;\n if (!modern.tools.ok || modernRpc?.error || !Array.isArray(modernRpc?.result?.tools)) {\n selected = await listToolsLegacy(accessToken);\n }\n\n const tools = selected.compact as { name: string; description: string; inputSchema: any }[];\n const safeCandidates = tools.filter(isSafeMarketTool);\n const safeMarketToolNames = safeCandidates.map(t => t.name).slice(0, 30);\n const callableMarketCandidates = safeCandidates\n .map(tool => ({ name: tool.name, args: argsForSafeMarketTool(tool) }))\n .filter(x => x.args !== null)\n .slice(0, 20);\n const allToolNames = tools.map(t => t.name).slice(0, 100);\n return {\n connected: tools.length > 0,\n protocolEra: selected.era,\n toolCount: tools.length,\n allToolNames,\n safeMarketToolNames,\n callableMarketCandidates,\n automaticToolCallPerformed: false,\n boundary: \"AUTHORIZED_TOOL_CATALOG_READ_ONLY; ACCESS_TOKEN_AND_REFRESH_TOKEN_NOT_PERSISTED; NO_TOOL_CALL_PERFORMED\",\n };\n}\n",[],[187,326],["D",1788821633861],[238,239],[187],"21cd1aa3-35b9-4c48-a205-5efeab26cdfd","styles.css","01a07e13-fb44-7031-82f2-6cad2ce03b43",["D",1788821633861],":root{color-scheme:dark;--bg:#07090d;--panel:rgba(16,20,27,.78);--panel2:rgba(20,25,33,.64);--line:rgba(255,255,255,.08);--line2:rgba(255,255,255,.13);--text:#f5f7fa;--muted:#929aa8;--soft:#c7ccd4;--green:#63e6be;--amber:#ffd166;--red:#ff7b8b;--blue:#8bb8ff;--violet:#ba9cff;--radius:22px;--shadow:0 24px 70px rgba(0,0,0,.34)}*{box-sizing:border-box}html{background:var(--bg);font-family:Inter,ui-sans-serif,-apple-system,BlinkMacSystemFont,\"SF Pro Display\",\"Segoe UI\",sans-serif}body{margin:0;min-height:100vh;color:var(--text);background:radial-gradient(900px 500px at 76% -8%,rgba(94,122,255,.12),transparent 65%),radial-gradient(750px 520px at -8% 30%,rgba(71,230,190,.07),transparent 67%),linear-gradient(180deg,#080a0f 0%,#07090d 100%);font-feature-settings:\"tnum\" 1,\"cv02\" 1,\"cv03\" 1}button,select{font:inherit}button{color:inherit}.app-shell{width:min(1220px,calc(100% - 32px));margin:0 auto;padding:26px 0 48px}.topbar{display:flex;justify-content:space-between;align-items:center;gap:18px;margin-bottom:28px}.brand{display:flex;align-items:center;gap:12px}.mark{width:38px;height:38px;border-radius:13px;border:1px solid var(--line2);display:grid;place-items:center;background:linear-gradient(145deg,rgba(139,184,255,.15),rgba(99,230,190,.07));box-shadow:inset 0 1px rgba(255,255,255,.08)}.mark svg{width:20px;height:20px}.brand-copy strong{display:block;font-size:14px;letter-spacing:.01em}.brand-copy span{display:block;color:var(--muted);font-size:11px;margin-top:2px}.status-pill{display:flex;align-items:center;gap:8px;border:1px solid var(--line);background:rgba(255,255,255,.035);padding:8px 11px;border-radius:999px;color:var(--soft);font-size:11px}.dot{width:7px;height:7px;border-radius:50%;background:var(--green);box-shadow:0 0 0 5px rgba(99,230,190,.08)}.hero{display:grid;grid-template-columns:1.25fr .75fr;gap:18px;margin-bottom:18px}.hero-main,.hero-side,.card{border:1px solid var(--line);background:linear-gradient(145deg,rgba(255,255,255,.042),rgba(255,255,255,.018));box-shadow:var(--shadow);backdrop-filter:blur(20px);-webkit-backdrop-filter:blur(20px)}.hero-main{border-radius:28px;padding:30px 30px 26px;min-height:265px;position:relative;overflow:hidden}.hero-main:after{content:\"\";position:absolute;width:300px;height:300px;border-radius:50%;right:-150px;top:-160px;background:rgba(139,184,255,.08);filter:blur(10px);pointer-events:none}.eyebrow{font-size:11px;letter-spacing:.13em;text-transform:uppercase;color:var(--blue);font-weight:700}.hero h1{font-size:clamp(34px,5vw,64px);line-height:.98;letter-spacing:-.052em;margin:16px 0 15px;max-width:780px}.hero p{margin:0;max-width:690px;color:#adb5c1;font-size:14px;line-height:1.62}.hero-note{display:flex;flex-wrap:wrap;gap:8px;margin-top:24px}.mini-pill{font-size:10px;color:#bbc2cc;border:1px solid var(--line);border-radius:999px;padding:6px 8px;background:rgba(255,255,255,.025)}.hero-side{border-radius:28px;padding:22px;display:flex;flex-direction:column;justify-content:space-between}.hero-side-title{font-size:11px;color:var(--muted);text-transform:uppercase;letter-spacing:.1em}.symbol-row{display:flex;gap:8px;flex-wrap:wrap;margin-top:12px}.symbol-btn{border:1px solid var(--line);background:rgba(255,255,255,.025);border-radius:12px;padding:8px 10px;font-size:11px;cursor:pointer;transition:.18s ease}.symbol-btn:hover{background:rgba(255,255,255,.06);transform:translateY(-1px)}.symbol-btn.active{border-color:rgba(139,184,255,.45);background:rgba(139,184,255,.11);color:#dce9ff}.action-stack{display:grid;gap:8px;margin-top:20px}.refresh{display:block;width:100%;margin-top:20px;border:1px solid rgba(139,184,255,.25);background:linear-gradient(180deg,rgba(139,184,255,.14),rgba(139,184,255,.08));border-radius:14px;padding:11px 14px;font-weight:700;font-size:12px;cursor:pointer;transition:.18s ease;text-align:center;text-decoration:none;color:inherit}.action-stack .refresh{margin-top:0}.refresh:hover{transform:translateY(-1px);border-color:rgba(139,184,255,.4)}.refresh:disabled{opacity:.5;cursor:wait;transform:none}.secondary-action{background:rgba(255,255,255,.025);border-color:var(--line2);font-weight:650}.grid{display:grid;grid-template-columns:repeat(12,minmax(0,1fr));gap:14px}.card{border-radius:var(--radius);padding:18px;min-width:0}.span-3{grid-column:span 3}.span-4{grid-column:span 4}.span-5{grid-column:span 5}.span-7{grid-column:span 7}.span-12{grid-column:span 12}.metric-label{color:var(--muted);font-size:10px;text-transform:uppercase;letter-spacing:.09em}.metric-value{font-size:27px;line-height:1.05;font-weight:760;letter-spacing:-.035em;margin-top:9px}.metric-sub{font-size:10px;color:var(--muted);margin-top:7px}.pos{color:var(--green)}.neg{color:var(--red)}.neutral{color:var(--soft)}.section-head{display:flex;justify-content:space-between;align-items:flex-start;gap:12px;margin-bottom:14px}.section-head h2{font-size:14px;margin:0;letter-spacing:-.015em}.section-head span{font-size:10px;color:var(--muted)}.chart-wrap{height:205px;position:relative}.chart-wrap svg{width:100%;height:100%;overflow:visible}.chart-line{fill:none;stroke:#8bb8ff;stroke-width:2;vector-effect:non-scaling-stroke}.chart-area{fill:url(#chartFill)}.chart-grid{stroke:rgba(255,255,255,.05);stroke-width:1;vector-effect:non-scaling-stroke}.chart-meta{position:absolute;right:0;top:0;text-align:right}.chart-meta strong{display:block;font-size:13px}.chart-meta span{font-size:10px;color:var(--muted)}.assessment{display:flex;flex-direction:column;gap:14px}.bias-row{display:flex;align-items:center;justify-content:space-between;gap:12px}.bias-badge{font-size:10px;font-weight:750;letter-spacing:.06em;border-radius:999px;padding:7px 9px;border:1px solid var(--line2);background:rgba(255,255,255,.03)}.confidence-track{height:7px;background:rgba(255,255,255,.055);border-radius:999px;overflow:hidden}.confidence-fill{height:100%;background:linear-gradient(90deg,#729dff,#63e6be);border-radius:999px}.risk-list,.source-list,.falsifier-list{display:grid;gap:8px}.risk-item,.source-item,.falsifier-item{border:1px solid var(--line);background:rgba(255,255,255,.018);border-radius:13px;padding:10px 11px;font-size:11px;line-height:1.42;color:#c5cbd4}.risk-item{display:flex;align-items:center;gap:8px}.risk-icon{width:7px;height:7px;border-radius:50%;background:var(--amber);flex:0 0 auto}.source-item{display:grid;grid-template-columns:auto 1fr auto;gap:9px;align-items:center}.source-state{font-size:9px;font-weight:800;letter-spacing:.05em}.source-state.pass{color:var(--green)}.source-state.fail{color:var(--red)}.source-name{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.source-ms{font-size:9px;color:var(--muted)}.evidence-banner{display:flex;align-items:flex-start;gap:11px;padding:12px;border-radius:15px;border:1px solid rgba(99,230,190,.14);background:rgba(99,230,190,.035)}.evidence-banner svg{width:18px;height:18px;flex:0 0 auto;margin-top:1px}.evidence-banner strong{display:block;font-size:11px}.evidence-banner p{font-size:10px;color:var(--muted);margin:4px 0 0;line-height:1.45}.kv{display:grid;grid-template-columns:1fr auto;gap:9px 14px;font-size:11px}.kv span:nth-child(odd){color:var(--muted)}.kv span:nth-child(even){font-variant-numeric:tabular-nums;font-weight:650}.skeleton{animation:pulse 1.35s ease-in-out infinite alternate;background:rgba(255,255,255,.05);border-radius:8px;color:transparent!important}@keyframes pulse{to{background:rgba(255,255,255,.1)}}.error-box{grid-column:1/-1;border:1px solid rgba(255,123,139,.22);background:rgba(255,123,139,.05);border-radius:18px;padding:16px;color:#ffc2ca;font-size:12px}.footer{display:flex;justify-content:space-between;gap:16px;align-items:center;margin-top:18px;padding:4px 2px;color:#68717e;font-size:10px}.footer a{color:#9099a7;text-decoration:none}.footer a:hover{color:#d4d9e0}@media(max-width:980px){.hero{grid-template-columns:1fr}.span-3{grid-column:span 6}.span-4,.span-5,.span-7{grid-column:span 12}}@media(max-width:620px){.app-shell{width:min(100% - 20px,1220px);padding-top:14px}.topbar{margin-bottom:16px}.brand-copy span{display:none}.status-pill{font-size:9px}.hero-main,.hero-side{border-radius:22px;padding:20px}.hero-main{min-height:auto}.hero h1{font-size:39px}.span-3{grid-column:span 12}.card{padding:15px;border-radius:18px}.metric-value{font-size:24px}.footer{align-items:flex-start;flex-direction:column}.source-item{grid-template-columns:auto minmax(0,1fr) auto}}.metric-value-compact{font-size:22px}.mt12{margin-top:12px}.confidence-progress{display:block;width:100%;height:7px;margin:8px 0 0;appearance:none;-webkit-appearance:none;border:0;border-radius:999px;overflow:hidden;background:rgba(255,255,255,.055)}.confidence-progress::-webkit-progress-bar{background:rgba(255,255,255,.055);border-radius:999px}.confidence-progress::-webkit-progress-value{background:linear-gradient(90deg,#729dff,#63e6be);border-radius:999px}.confidence-progress::-moz-progress-bar{background:linear-gradient(90deg,#729dff,#63e6be);border-radius:999px}.neuron-card{overflow:hidden}.hypothesis-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:10px}.hypothesis-card{margin:0;border:1px solid var(--line);background:rgba(255,255,255,.018);border-radius:16px;padding:14px;min-height:132px}.hypothesis-card p{margin:8px 0 0;color:#c4cbd5;font-size:11px;line-height:1.55}.hypothesis-label{font-size:9px;font-weight:800;letter-spacing:.09em;text-transform:uppercase}.hypothesis-winning{border-color:rgba(99,230,190,.15);background:rgba(99,230,190,.025)}.hypothesis-winning .hypothesis-label{color:var(--green)}.hypothesis-opposite{border-color:rgba(255,123,139,.14);background:rgba(255,123,139,.022)}.hypothesis-opposite .hypothesis-label{color:var(--red)}.hypothesis-alternative{border-color:rgba(186,156,255,.15);background:rgba(186,156,255,.022)}.hypothesis-alternative .hypothesis-label{color:var(--violet)}.counter-grid{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin-top:10px}.counter-panel,.alternative-strip,.next-test{border:1px solid var(--line);background:rgba(255,255,255,.014);border-radius:15px;padding:13px}.counter-title{font-size:9px;font-weight:800;letter-spacing:.07em;text-transform:uppercase;color:var(--muted)}.support-title{color:var(--green)}.oppose-title{color:var(--red)}.evidence-stack{display:grid;gap:7px;margin-top:9px}.evidence-row{display:flex;gap:8px;align-items:flex-start;color:#c5cbd4;font-size:10px;line-height:1.45}.evidence-dot{width:6px;height:6px;border-radius:50%;margin-top:4px;flex:0 0 auto}.support-dot{background:var(--green)}.oppose-dot{background:var(--red)}.alternative-strip{margin-top:10px}.alternative-list{display:flex;flex-wrap:wrap;gap:7px;margin-top:9px}.next-test{display:flex;gap:12px;align-items:flex-start;margin-top:10px;border-color:rgba(139,184,255,.16);background:rgba(139,184,255,.025)}.next-test strong{font-size:9px;letter-spacing:.07em;text-transform:uppercase;color:var(--blue);min-width:150px}.next-test span{font-size:10px;color:#c5cbd4;line-height:1.5}@media(max-width:760px){.hypothesis-grid,.counter-grid{grid-template-columns:1fr}.next-test{flex-direction:column;gap:6px}.next-test strong{min-width:0}}",[],[192,336],"dd8e6526-8965-482b-85a5-74636ca4d836","root.tsx","01a07e13-fb44-7031-82f2-68a2b26a5513",["D",1788821633861],"/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\nexport function Root() {\n return (\n <>\n {raw(\"\")}\n \n \n \n \n \n \n PayAna Market Sentinel\n \n \n \n \n

Diff · v3