Authorization Bridge error

${String(e).replace(/[<>]/g,\"\")}

`,500));\nasync function owner(c:any){const s=await getOAuthUserData(c.req.raw);return s?.user?.username===OWNER?s:null;}\nasync function schema(){await sqlite.execute(\"CREATE TABLE IF NOT EXISTS auth_contexts(service TEXT PRIMARY KEY,context_id TEXT NOT NULL,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\");await sqlite.execute(\"CREATE TABLE IF NOT EXISTS auth_events(id INTEGER PRIMARY KEY AUTOINCREMENT,observed_at TEXT NOT NULL,service TEXT NOT NULL,kind TEXT NOT NULL,result TEXT NOT NULL)\");}\nfunction page(body:string){return `IMPERIAL Auth Bridge

IMPERIAL Authorization Bridge

${body}

Standing authorization removes repeated internal approvals. External login/MFA remains the provider's security control and is completed once in the live browser session, then the persisted browser context is reused until the provider expires or revokes it.

No passwords, cookies, MFA codes, seed phrases or private keys are stored in public code.

`;}\napp.get(\"/\",async c=>{const s=await owner(c);if(!s)return c.redirect(\"/auth/login\");await schema();const api=!!Deno.env.get(\"BROWSERBASE_API_KEY\");const q=await sqlite.execute(\"SELECT service,updated_at FROM auth_contexts ORDER BY service\");const bound=new Map((q.rows||[]).map((r:any)=>[String(r.service),String(r.updated_at)]));const cards=Object.entries(SERVICES).map(([k,v])=>`

${v}

${bound.has(k)?`Persistent browser context created · ${bound.get(k)}`:`One-time binding not completed`}

`).join(\"\");return c.html(page(`

Signed in as ${s.user.username}.

${api?\"

Browser automation provider key: configured.

\":\"

One-time infrastructure binding required: set BROWSERBASE_API_KEY in the encrypted Val Town environment. After that, service logins are persisted per service.

\"}${cards}`));});\napp.post(\"/bind\",async c=>{const s=await owner(c);if(!s)return c.text(\"Unauthorized\",401);await schema();const form=await c.req.formData();const service=String(form.get(\"service\")||\"\");if(!SERVICES[service])return c.text(\"Unknown service\",400);const apiKey=Deno.env.get(\"BROWSERBASE_API_KEY\");if(!apiKey)return c.html(page(`

Provider key not bound

Add BROWSERBASE_API_KEY once in the encrypted environment, then return here.

`),503);const bb=new Browserbase({apiKey});let q=await sqlite.execute({sql:\"SELECT context_id FROM auth_contexts WHERE service=?\",args:[service]});let contextId=String(q.rows?.[0]?.context_id||\"\");if(!contextId){const ctx:any=await bb.contexts.create();contextId=String(ctx.id);const now=new Date().toISOString();await sqlite.execute({sql:\"INSERT INTO auth_contexts(service,context_id,created_at,updated_at) VALUES(?,?,?,?)\",args:[service,contextId,now,now]});}const session:any=await bb.sessions.create({browserSettings:{context:{id:contextId,persist:true}}});const now=new Date().toISOString();await sqlite.execute({sql:\"UPDATE auth_contexts SET updated_at=? WHERE service=?\",args:[now,service]});await sqlite.execute({sql:\"INSERT INTO auth_events(observed_at,service,kind,result) VALUES(?,?,?,?)\",args:[now,service,\"BROWSER_BIND_SESSION_CREATED\",\"SUCCESS\"]});const live=`https://browserbase.com/sessions/${session.id}`;return c.html(page(`

${SERVICES[service]}

Persistent context ready.

Open the secure Browserbase Live View and log in to the provider account once. Complete MFA/passkey yourself if the provider asks. When the session closes, the provider login state is persisted to this service context and future automated sessions reuse it.

Open one-time login session

← Back to bindings

`));});\nexport default oauthMiddleware(app.fetch);\n","imperial-auth-connect",[145],"648167ce-3631-40f4-9a07-e32fa0fd3b47",["D",1787769721625],[28],"4d23da5c-73e7-4ee6-8773-d8d5dbbfc252","skills","503e2e96-a17c-11f1-9d8e-1607ee4eb77e",2,["D",1787769071929],"directory",[156],"pulls","branches","forks","envVars",{"_169":138,"_171":63},"connections",{"_169":63,"_170":63},"count","unfilledCount","emptyCount",{"_43":155,"_32":156,"_30":157,"_137":-5,"_41":42,"_40":158,"_139":59,"_38":203,"_13":63,"_33":160,"_35":-5,"_24":25,"_142":-5,"_179":204,"_27":205},{"_43":198,"_32":197,"_30":191,"_137":157,"_41":42,"_40":199,"_139":59,"_38":200,"_13":63,"_33":160,"_35":-5,"_24":25,"_142":-5,"_179":201,"_27":202},{"_43":188,"_32":189,"_30":190,"_137":191,"_41":42,"_40":192,"_139":59,"_38":193,"_13":63,"_33":20,"_35":194,"_24":25,"_142":-5,"_179":195,"_27":196},{"_43":152,"_32":28,"_30":31,"_137":-5,"_41":42,"_40":14,"_139":25,"_38":185,"_13":138,"_33":34,"_35":37,"_24":25,"_142":45,"_179":186,"_27":187},{"_43":144,"_32":145,"_30":146,"_137":-5,"_41":42,"_40":147,"_139":25,"_38":182,"_13":63,"_33":34,"_35":149,"_24":25,"_142":150,"_179":183,"_27":184},{"_43":135,"_32":136,"_30":57,"_137":-5,"_41":42,"_40":138,"_139":59,"_38":178,"_13":63,"_33":34,"_35":141,"_24":25,"_142":-5,"_179":180,"_27":181},["D",1787769059728],"children",[],[136],["D",1787769389149],[],[145],["D",1787769721625],[],[28],"f46df3f1-5911-461f-ac42-5803d596dd14","SKILL.md","60df2e6c-a17c-11f1-bf8e-1607ee4eb77e","53acea40-a17c-11f1-b5a0-1607ee4eb77e",4,["D",1787769099824],"# IMPERIAL Standing Authorization Broker Skill\n\nSkill ID: EIS-AUTH-BROKER-001\nVersion: 1.0.0\nStatus: ACTIVE\nAuthority source: Architect standing instruction dated 2026-08-26\n\n## Purpose\nRemove repetitive internal approval friction when an action is already within the Architect's standing authorization, while preserving real external authentication, identity, legal, financial and security boundaries.\n\n## Core rule\nAUTHENTICATION != AUTHORIZATION.\nThe Architect's standing authorization may remove repeated internal confirmation prompts, but it does not fabricate login state, bypass an external service's authentication, defeat MFA/CAPTCHA, accept legal terms on the Architect's behalf, falsify KYC/KYB, obtain credentials without consent, or override a platform's security controls.\n\n## Standing authorization classes\nAUTO_STANDING:\n- public-source research;\n- read-only monitoring;\n- drafting and editing owned materials;\n- publishing approved factual material to an already-authenticated owned account when the platform permits automation;\n- non-binding official application preparation;\n- non-binding form submission when the account is already authenticated, all required factual fields are verified, and no signature/attestation/payment/regulated declaration is required;\n- routine reversible configuration of owned automation within existing permissions;\n- evidence capture and audit logging.\n\nONE_TIME_BINDING:\n- first connection of an external account through OAuth/API token/session;\n- MFA or passkey challenge;\n- first-time platform consent screen;\n- refresh-token renewal when the provider requires re-consent.\nAfter a valid binding exists, agents should reuse the authorized session/token within its granted scope and must not ask the Architect to approve each routine action again.\n\nHUMAN_REQUIRED:\n- KYC/KYB identity attestations;\n- accepting or materially changing binding Terms of Service;\n- electronic/legal signatures;\n- notarization;\n- sworn statements;\n- representation as licensed counsel;\n- payment, paid advertising spend, listing fees or other financial commitments;\n- wallet signatures, token transfers, approvals, mint/burn, liquidity provision;\n- irreversible account deletion or transfer of ownership;\n- disclosure of secrets/private keys.\n\nDENY:\n- bypassing MFA/CAPTCHA or access controls;\n- credential theft, phishing, session hijacking or cookie theft;\n- impersonation;\n- unauthorized account creation or use;\n- fake KYC/KYB;\n- evasion of platform suspension or legal restrictions;\n- spam/astroturfing/vote manipulation;\n- market manipulation.\n\n## Resolution algorithm\n1. Identify the requested service and action.\n2. Check whether a valid connector/session/token is already bound.\n3. Classify action as AUTO_STANDING / ONE_TIME_BINDING / HUMAN_REQUIRED / DENY.\n4. If AUTO_STANDING and binding exists: execute without asking for redundant approval.\n5. If ONE_TIME_BINDING: create one explicit binding task containing service, requested scopes, provider URL and reason. After successful binding, persist only the provider-issued credential in the platform secret store, never source code or chat.\n6. If HUMAN_REQUIRED: stop only at the exact human action, keeping all preparation complete.\n7. If DENY: do not attempt a workaround that defeats the provider's controls.\n8. Record an audit receipt: service, action, decision, evidence, timestamp, connector state and result.\n\n## Publication rule\nA draft is not a publication. A prepared exchange application is not submitted. A submission is not a listing. Record external evidence before changing status.\n\n## Security rule\nTokens, passwords, passkeys, session cookies, seed phrases and private keys must never be written to public Val Town code, GitHub, logs, campaign text or audit payloads. Use encrypted environment/connector secret storage only.\n",[],[156,197,189],"standing-authorization-broker","eada944e-8b05-4052-9186-57fbd03fbf5b",3,["D",1787769077688],[174],[156,197],["D",1787769071929],[173],[156],["D",1787769059661],["D",1789511441255],{"_100":99,"_108":104},{"_100":99,"_101":102,"_103":104,"_18":55,"_105":106,"_107":25},{"_13":89,"_32":90,"_43":42,"_91":44,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":45,"_98":99},"ctx",{"_82":-5,"_128":244,"_245":246,"_247":248,"_249":25,"_250":25,"_251":25,"_252":59,"_253":-5,"_254":-7,"_255":-7,"_256":63,"_257":25,"_258":25,"_259":-5,"_260":25,"_261":25,"_262":25,"_263":-5},"ENV",{"_215":216,"_217":218,"_219":90,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241,"_242":243},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","5015b8df46402d8bba4f485ecc37aec202b0e06b","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v7