[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_272":273,"_274":275},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_205":-5,"_20":206,"_22":207,"_208":209,"_210":211,"_26":212,"_24":213,"_214":-5,"_215":-5,"_216":53,"_217":218,"_219":45,"_220":-5,"_221":-5,"_222":223},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","oromaskevic23","name","imperial-auth-broker","branchName","main","version","path","skills/freelance-platform-authorization/SKILL.md","project",{"_33":147,"_13":14,"_46":148,"_149":-5,"_150":53,"_151":152,"_153":152,"_154":155,"_156":-5,"_157":158,"_159":65,"_160":45,"_161":-5,"_162":-5,"_163":48,"_164":165,"_166":167,"_168":169,"_170":171,"_172":-5,"_173":174,"_175":174,"_176":177,"_178":177,"_179":177,"_180":174,"_181":174,"_182":183,"_184":185,"_186":187,"_188":53},"tree",[58,59,60,61,62],"file",{"_33":34,"_13":35,"_36":37,"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":24,"_50":51,"_52":53,"_54":-5,"_18":55},"contents",[],"upstream","pull","ahead","behind","envVars","id","ef15affe-736b-4a92-86d8-81421c999799","SKILL.md","fileId","01a03fae-c49f-761f-89cd-b134837c0256","parentId","01a03fae-c49e-7746-8f12-cff2baa9168b","branchId","46203c01-b7b8-4cc3-8a67-8f5aa1a461a3","branchVersion",15,"latest",true,"createdAt",["D",1787774813345],0,"fileType","content","---\nname: freelance-platform-authorization\ndescription: Use when connecting, authorizing, reusing, auditing, or revoking freelance-platform access for Daniel Mercer and the freelance NCA team. Prefer official API/OAuth/team delegation when available, otherwise use a one-time owner-controlled persistent browser login. Never store or request passwords, bypass MFA/CAPTCHA/KYC, impersonate the account owner, or act contrary to platform terms.\n---\n\n# Freelance Platform Authorization\n\n## Objective\nCreate the narrowest lawful account binding that lets the freelance team research, prepare, and—only where the platform permits—submit routine non-binding work actions without repeated internal approval.\n\nOwner authorization is necessary but does not override provider authentication, platform Terms, identity rules, KYC, payment rules, or regulated obligations.\n\n## Precedence\nUse the safest supported route in this order:\n\n1. Official platform team/agency delegation.\n2. Official API/OAuth token with least privilege.\n3. Owner-controlled persistent browser context created after one-time login.\n4. Human action gate when none of the above permits delegation/automation.\n\nNever use password sharing or session theft as an authorization method.\n\n## One-time binding flow\n1. Confirm the service and intended actions.\n2. Read the current platform policy/Terms source recorded in `PLATFORM-POLICY.json` and re-check when stale or materially changed.\n3. Classify requested actions as:\n - `AUTO_STANDING`: public research, drafting, estimation, QA, internal preparation.\n - `BOUND_AND_PLATFORM_PERMITTED`: routine authenticated actions explicitly allowed by the platform/account model.\n - `HUMAN_REQUIRED`: identity/KYC, binding acceptance, financial instructions, tax forms, payment withdrawal, legal signatures, dispute settlement, account ownership changes.\n - `DENY`: credential sharing/theft, MFA/CAPTCHA bypass, fake identity, fabricated portfolio/reviews, fake hours, spam, off-platform payment evasion, multiple-account abuse.\n4. For browser binding, require the owner to complete provider login/MFA once in the secure live session.\n5. Persist only the browser context identifier; never write passwords, cookies, MFA codes, recovery codes, payment credentials, seed phrases, or private keys into public code or logs.\n6. Mark a service `BOUND` only after an actual persistent context exists.\n7. Reuse the context until the provider expires/revokes it; then request one-time re-authentication.\n\n## Platform-specific operating model\n### Upwork\nPrefer Agency/Team permissions or official API where available. Do not share the owner's password. Do not misrepresent who performed work, falsify hours/work, or evade required platform communication/payment rules. If a proposal/bid action is not clearly permitted to be automated/delegated, prepare it fully and stop at the platform-permitted human/team-member submission gate.\n\n### Fiverr\nUse truthful person/entity identity only. No account sharing, false identity, multiple-account abuse, fake reviews, or misrepresentation of who provides the service. Agents may prepare gigs, offers, messages, assets and delivery work; authenticated posting/acceptance must follow Fiverr's current permitted account model.\n\n### Freelancer / PeoplePerHour / Contra / other platforms\nDo not infer permission from technical accessibility. Re-check current provider Terms and use official delegation/API mechanisms where available. If delegation/automation permission is unclear, use `HUMAN_REQUIRED_FOR_ACCOUNT_ACTION` while keeping all research/drafting/delivery automation active.\n\n## Revenue boundary\nA job discovery is not a win.\nA submitted proposal is not a contract.\nA contract is not revenue.\nRevenue is verified only from attributable platform/payment evidence.\n\nPreferred treasury flow:\n`PLATFORM PAYMENT -> CAPITAL CORE RECONCILIATION -> FEES/TAX/RESERVES -> OPERATING BUDGET -> APPROVED TREASURY ALLOCATION`.\n\nNo autonomous withdrawal, crypto conversion, wallet signing, or value transfer.\n\n## Evidence\nFor every binding or account action record:\n- service;\n- route (`TEAM`, `OAUTH_API`, `PERSISTENT_BROWSER`, `HUMAN_GATE`);\n- account binding state;\n- exact action class;\n- platform policy source/date;\n- execution result;\n- receipt/message/job/proposal identifier when available;\n- human gates encountered;\n- no-secret-exposure check.\n\n## Completion statuses\nUse only:\n- `BOUND`\n- `UNBOUND`\n- `PARTIAL`\n- `HUMAN_GATE`\n- `BLOCKED_PLATFORM_POLICY`\n- `REVOKED`\n\nNever claim successful authorization because a connection page merely exists.","deleted",false,"label",[56,57,35],"skills","freelance-platform-authorization",{"_33":101,"_13":56,"_36":102,"_38":-5,"_40":41,"_42":103,"_44":45,"_46":104,"_17":48,"_49":105,"_50":-5,"_52":53,"_54":-5,"_70":106,"_18":107},{"_33":92,"_13":93,"_36":94,"_38":-5,"_40":41,"_42":95,"_44":45,"_46":96,"_17":97,"_49":68,"_50":98,"_52":53,"_54":14,"_70":99,"_18":100},{"_33":82,"_13":83,"_36":84,"_38":-5,"_40":41,"_42":85,"_44":45,"_46":86,"_17":87,"_49":68,"_50":88,"_52":53,"_54":89,"_70":90,"_18":91},{"_33":73,"_13":74,"_36":75,"_38":-5,"_40":41,"_42":76,"_44":45,"_46":77,"_17":66,"_49":78,"_50":79,"_52":53,"_54":-5,"_70":80,"_18":81},{"_33":63,"_13":64,"_36":65,"_38":-5,"_40":41,"_42":66,"_44":45,"_46":67,"_17":48,"_49":68,"_50":69,"_52":53,"_54":-5,"_70":71,"_18":72},"80ba58b7-54bf-4991-8517-0b76547cc5ff","status.ts","48f877e0-a17c-11f1-a7a9-1607ee4eb77e",1,["D",1787769059728],"http","export default function(){return Response.json({service:\"IMPERIAL Authorization Broker\",state:\"BOOTSTRAPPING\",mode:\"STANDING_AUTHORIZATION_WITH_ONE_TIME_ACCOUNT_BINDING\",bypassExternalAuthentication:false,architectFinalAuthority:true});}","children",[],[64],"fe08d2df-3ab9-4cd3-b788-84993525a236","cyber-telemetry-emitter.ts","01a04009-2b8f-75a9-ac62-60db5d8e3d41",20,["D",1787780750631],"interval","export default async function(){const key=Deno.env.get('CYBER_TELEMETRY_KEY');if(!key)return{state:'BLOCKED_MISSING_KEY'};const r=await fetch('https://imperial-cyber-telemetry.val.run/',{method:'POST',headers:{'content-type':'application/json','x-imperial-telemetry-key':key},body:JSON.stringify({sourceId:'AUTH-BROKER',observedAt:new Date().toISOString(),eventType:'AUTHORIZATION_BROKER_HEARTBEAT',state:'ACTIVE',severity:'INFO',detail:'Authorization broker heartbeat; external account bindings may remain pending'})});return{state:r.status===202?'PASS':'WARN',status:r.status}}",[],[74],"9e4f52a0-b0d5-4bfa-9d58-8500b2e71cfa","browser-bind.ts","0d52b97a-a17d-11f1-8599-1607ee4eb77e",18,["D",1787775039285],4,"import { Hono } from \"npm:hono\";\nimport { Browserbase } from \"npm:@browserbasehq/sdk\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { getOAuthUserData, oauthMiddleware } from \"https://esm.town/v/std/oauth/middleware.ts\";\n\nconst OWNER=\"oromaskevic23\";\nconst SERVICES:any={x:\"X\",reddit:\"Reddit\",telegram:\"Telegram\",medium:\"Medium\",coinmarketcap:\"CoinMarketCap Community\",bitcointalk:\"BitcoinTalk\",coinbase:\"Coinbase Listings\",kraken:\"Kraken Listings\",bybit:\"Bybit Listings\",okx:\"OKX Listings\",bitget:\"Bitget Listings\",kucoin:\"KuCoin Listings\",gate:\"Gate Listings\",upwork:\"Upwork\",fiverr:\"Fiverr\",freelancer:\"Freelancer.com\",peopleperhour:\"PeoplePerHour\",contra:\"Contra\"};\nconst SERVICE_URLS:any={upwork:\"https://www.upwork.com/ab/account-security/login\",fiverr:\"https://www.fiverr.com/login\",freelancer:\"https://www.freelancer.com/login\",peopleperhour:\"https://www.peopleperhour.com/site/login\",contra:\"https://contra.com/login\",x:\"https://x.com/i/flow/login\",reddit:\"https://www.reddit.com/login/\",medium:\"https://medium.com/m/signin\",coinmarketcap:\"https://coinmarketcap.com/community/\",bitcointalk:\"https://bitcointalk.org/index.php?action=login\",coinbase:\"https://www.coinbase.com/listings/apply\",kraken:\"https://www.kraken.com/get-listed\",bybit:\"https://www.bybit.com/en/trade/spot/listing-apply\",okx:\"https://www.okx.com/\",bitget:\"https://www.bitget.com/\",kucoin:\"https://www.kucoin.com/listing\",gate:\"https://www.gate.com/en-eu/listing\"};\nconst app=new Hono();\napp.onError((e,c)=>c.html(`

Authorization Bridge error

${String(e).replace(/[<>]/g,\"\")}

`,500));\nasync function owner(c:any){const s=await getOAuthUserData(c.req.raw);return s?.user?.username===OWNER?s:null;}\nasync function schema(){await sqlite.execute(\"CREATE TABLE IF NOT EXISTS auth_contexts(service TEXT PRIMARY KEY,context_id TEXT NOT NULL,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\");await sqlite.execute(\"CREATE TABLE IF NOT EXISTS auth_events(id INTEGER PRIMARY KEY AUTOINCREMENT,observed_at TEXT NOT NULL,service TEXT NOT NULL,kind TEXT NOT NULL,result TEXT NOT NULL)\");}\nfunction page(body:string){return `IMPERIAL Auth Bridge

IMPERIAL Authorization Bridge

${body}

Standing authorization removes repeated internal approvals. External login/MFA remains the provider's security control and is completed once in the live browser session, then the persisted browser context is reused until the provider expires or revokes it.

No passwords, cookies, MFA codes, seed phrases or private keys are stored in public code.

`;}\napp.get(\"/\",async c=>{const s=await owner(c);if(!s)return c.redirect(\"/auth/login\");await schema();const api=!!Deno.env.get(\"BROWSERBASE_API_KEY\");const q=await sqlite.execute(\"SELECT service,updated_at FROM auth_contexts ORDER BY service\");const bound=new Map((q.rows||[]).map((r:any)=>[String(r.service),String(r.updated_at)]));const cards=Object.entries(SERVICES).map(([k,v])=>`

${v}

${bound.has(k)?`Persistent browser context created · ${bound.get(k)}`:`One-time binding not completed`}

`).join(\"\");return c.html(page(`

Signed in as ${s.user.username}.

${api?\"

Browser automation provider key: configured.

\":\"

One-time browser infrastructure binding required.

1. Create/sign in to Browserbase and copy the API key shown in its Dashboard.

Open Browserbase

2. Store it once in the encrypted Val Town environment:

Add BROWSERBASE_API_KEY

3. Return here. Each exchange/social account is then logged in once and its authorized browser context is reused until that provider expires or revokes it.

\"}${cards}`));});\napp.post(\"/bind\",async c=>{const s=await owner(c);if(!s)return c.text(\"Unauthorized\",401);await schema();const form=await c.req.formData();const service=String(form.get(\"service\")||\"\");if(!SERVICES[service])return c.text(\"Unknown service\",400);const apiKey=Deno.env.get(\"BROWSERBASE_API_KEY\");if(!apiKey)return c.html(page(`

Provider key not bound

Add BROWSERBASE_API_KEY once in the encrypted environment, then return here.

`),503);const bb=new Browserbase({apiKey});let q=await sqlite.execute({sql:\"SELECT context_id FROM auth_contexts WHERE service=?\",args:[service]});let contextId=String(q.rows?.[0]?.context_id||\"\");if(!contextId){const ctx:any=await bb.contexts.create();contextId=String(ctx.id);const now=new Date().toISOString();await sqlite.execute({sql:\"INSERT INTO auth_contexts(service,context_id,created_at,updated_at) VALUES(?,?,?,?)\",args:[service,contextId,now,now]});}const session:any=await bb.sessions.create({browserSettings:{context:{id:contextId,persist:true}}});const now=new Date().toISOString();await sqlite.execute({sql:\"UPDATE auth_contexts SET updated_at=? WHERE service=?\",args:[now,service]});await sqlite.execute({sql:\"INSERT INTO auth_events(observed_at,service,kind,result) VALUES(?,?,?,?)\",args:[now,service,\"BROWSER_BIND_SESSION_CREATED\",\"SUCCESS\"]});const live=`https://browserbase.com/sessions/${session.id}`;const target=SERVICE_URLS[service]||'';return c.html(page(`

${SERVICES[service]}

Persistent context ready.

Open the secure Browserbase Live View and log in to the provider account once. Complete MFA/passkey yourself if the provider asks. When the session closes, the provider login state is persisted to this service context and future automated sessions reuse it.

Open one-time login session

${target?`

Inside that live browser, navigate to: ${target}

`:''}

← Back to bindings

`));});\nexport default oauthMiddleware(app.fetch);\n","imperial-auth-connect",[],[83],"c5dc2299-3f7b-4c5c-a3cb-de685fbc1fc7","broker.ts","75aafa4c-a17c-11f1-a25e-1607ee4eb77e",16,["D",1787774926516],7,"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nconst VERSION=\"1.2.0\";\nconst SERVICE_BINDINGS:any={\n x:{label:\"X\",env:[\"X_ACCESS_TOKEN\"],browser:true,mode:\"OAUTH_API_OR_PERSISTENT_BROWSER\",scopes:[\"read\",\"write\"]},\n reddit:{label:\"Reddit\",env:[\"REDDIT_ACCESS_TOKEN\"],browser:true,mode:\"OAUTH_OR_PERSISTENT_BROWSER\",scopes:[\"identity\",\"submit\",\"read\"]},\n telegram:{label:\"Telegram\",env:[\"TELEGRAM_BOT_TOKEN\",\"TELEGRAM_CHANNEL_ID\"],browser:false,mode:\"BOT_ADMIN_BINDING\",scopes:[\"post_to_owned_channel\"]},\n medium:{label:\"Medium\",env:[\"MEDIUM_INTEGRATION_TOKEN\"],browser:true,mode:\"API_OR_PERSISTENT_BROWSER\",scopes:[\"publish\"]},\n coinmarketcap:{label:\"CoinMarketCap Community\",env:[\"CMC_COMMUNITY_TOKEN\"],browser:true,mode:\"AUTHORIZED_CONNECTOR_OR_PERSISTENT_BROWSER\",scopes:[\"publish\"]},\n bitcointalk:{label:\"BitcoinTalk\",env:[],browser:true,mode:\"PERSISTENT_BROWSER\",scopes:[\"post_to_owned_account\"]},\n coinbase:{label:\"Coinbase Listings\",env:[],browser:true,mode:\"PERSISTENT_BROWSER\",scopes:[\"issuer_application\"]},\n kraken:{label:\"Kraken Listings\",env:[],browser:true,mode:\"PERSISTENT_BROWSER\",scopes:[\"issuer_application\"]},\n bybit:{label:\"Bybit Listings\",env:[],browser:true,mode:\"PERSISTENT_BROWSER\",scopes:[\"issuer_application\"]},\n okx:{label:\"OKX Listings\",env:[],browser:true,mode:\"PERSISTENT_BROWSER\",scopes:[\"issuer_application\"]},\n bitget:{label:\"Bitget Listings\",env:[],browser:true,mode:\"PERSISTENT_BROWSER\",scopes:[\"issuer_application\"]},\n kucoin:{label:\"KuCoin Listings\",env:[],browser:true,mode:\"PERSISTENT_BROWSER\",scopes:[\"issuer_application\"]},\n gate:{label:\"Gate Listings\",env:[],browser:true,mode:\"PERSISTENT_BROWSER\",scopes:[\"issuer_application\"]},\n upwork:{label:\"Upwork\",env:[],browser:true,mode:\"TEAM_OR_OWNER_CONTROLLED_PERSISTENT_BROWSER\",scopes:[\"job_research\",\"proposal_prepare\",\"account_action_only_if_platform_permitted\"]},\n fiverr:{label:\"Fiverr\",env:[],browser:true,mode:\"OWNER_CONTROLLED_PERSISTENT_BROWSER_ASSIST\",scopes:[\"gig_prepare\",\"message_prepare\",\"delivery_assist\",\"account_action_only_if_platform_permitted\"]},\n freelancer:{label:\"Freelancer.com\",env:[],browser:true,mode:\"OWNER_CONTROLLED_PERSISTENT_BROWSER_ASSIST\",scopes:[\"project_research\",\"bid_prepare\",\"delivery_assist\",\"account_action_only_if_platform_permitted\"]},\n peopleperhour:{label:\"PeoplePerHour\",env:[],browser:true,mode:\"OWNER_CONTROLLED_PERSISTENT_BROWSER_ASSIST\",scopes:[\"project_research\",\"proposal_prepare\",\"delivery_assist\",\"account_action_only_if_platform_permitted\"]},\n contra:{label:\"Contra\",env:[],browser:true,mode:\"OWNER_CONTROLLED_PERSISTENT_BROWSER_ASSIST\",scopes:[\"opportunity_research\",\"proposal_prepare\",\"delivery_assist\",\"account_action_only_if_platform_permitted\"]}\n};\nconst FREELANCE_POLICY:any={\n upwork:{reviewedAt:\"2026-08-26\",source:\"https://www.upwork.com/legal\",status:\"STRICT_ACCOUNT_MODEL_REVIEWED\",authenticatedAutomation:\"HUMAN_OR_OFFICIAL_TEAM_GATE\"},\n fiverr:{reviewedAt:\"2026-08-26\",source:\"https://www.fiverr.com/legal-portal/legal-terms/terms-of-service\",status:\"STRICT_IDENTITY_MODEL_REVIEWED\",authenticatedAutomation:\"HUMAN_OR_PLATFORM_PERMITTED_GATE\"},\n freelancer:{reviewedAt:\"2026-08-26\",source:\"https://www.freelancer.com/about/terms\",status:\"PERSONAL_ACCOUNT_PASSWORD_SHARING_PROHIBITED_REVIEWED\",authenticatedAutomation:\"HUMAN_OR_PLATFORM_PERMITTED_GATE\"},\n peopleperhour:{reviewedAt:\"2026-08-26\",source:\"https://www.peopleperhour.com/static/terms\",status:\"PERSONAL_ACCOUNT_ACCURATE_IDENTITY_REVIEWED\",authenticatedAutomation:\"HUMAN_OR_PLATFORM_PERMITTED_GATE\"},\n contra:{reviewedAt:\"2026-08-26\",source:\"https://contra.com/policies/terms\",status:\"BUSINESS_AGENT_IDENTITY_SUPPORTED_BUT_AUTOMATED_OUTREACH_RESTRICTED\",authenticatedAutomation:\"HUMAN_OR_PLATFORM_PERMITTED_GATE\"}\n};\nconst ACTION_CLASSES:any={public_research:\"AUTO_STANDING\",read_monitoring:\"AUTO_STANDING\",draft:\"AUTO_STANDING\",edit_owned_content:\"AUTO_STANDING\",publish_owned_approved:\"AUTO_STANDING\",prepare_application:\"AUTO_STANDING\",submit_nonbinding_verified_form:\"AUTO_STANDING\",freelance_prepare_proposal:\"AUTO_STANDING\",freelance_prepare_delivery:\"AUTO_STANDING\",freelance_submit_proposal:\"PLATFORM_POLICY_REQUIRED\",freelance_send_client_message:\"PLATFORM_POLICY_REQUIRED\",connect_account:\"ONE_TIME_BINDING\",oauth_consent:\"ONE_TIME_BINDING\",mfa:\"ONE_TIME_BINDING\",passkey:\"ONE_TIME_BINDING\",refresh_reconsent:\"ONE_TIME_BINDING\",kyc:\"HUMAN_REQUIRED\",kyb:\"HUMAN_REQUIRED\",accept_terms:\"HUMAN_REQUIRED\",legal_signature:\"HUMAN_REQUIRED\",sworn_statement:\"HUMAN_REQUIRED\",notarization:\"HUMAN_REQUIRED\",paid_spend:\"HUMAN_REQUIRED\",listing_fee:\"HUMAN_REQUIRED\",wallet_signature:\"HUMAN_REQUIRED\",token_transfer:\"HUMAN_REQUIRED\",liquidity_provision:\"HUMAN_REQUIRED\",freelance_accept_contract:\"HUMAN_REQUIRED\",freelance_identity_verification:\"HUMAN_REQUIRED\",freelance_set_payment_method:\"HUMAN_REQUIRED\",freelance_withdraw_funds:\"HUMAN_REQUIRED\",bypass_mfa:\"DENY\",bypass_captcha:\"DENY\",credential_theft:\"DENY\",session_hijack:\"DENY\",fake_kyc:\"DENY\",impersonation:\"DENY\",spam:\"DENY\",market_manipulation:\"DENY\",fake_portfolio:\"DENY\",fake_reviews:\"DENY\",fake_hours:\"DENY\",off_platform_payment_evasion:\"DENY\"};\nasync function ensureSchema(){await sqlite.execute(\"CREATE TABLE IF NOT EXISTS auth_contexts(service TEXT PRIMARY KEY,context_id TEXT NOT NULL,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\");}\nasync function bindingState(service:string,s:any){await ensureSchema();const envPresent=(s.env||[]).filter((k:string)=>!!Deno.env.get(k));const envComplete=(s.env||[]).length>0&&envPresent.length===s.env.length;const q=s.browser?await sqlite.execute({sql:\"SELECT updated_at FROM auth_contexts WHERE service=?\",args:[service]}):{rows:[]};const browserContextPresent=!!q.rows?.length;const state=envComplete||browserContextPresent?\"BOUND\":\"UNBOUND\";return {state,executionMode:envComplete?\"API_OR_CONNECTOR\":browserContextPresent?\"PERSISTENT_BROWSER_CONTEXT\":\"NONE\",apiCredentialKeysRequired:s.env||[],apiCredentialKeysBound:envPresent.length,browserContextSupported:!!s.browser,browserContextPresent,browserInfrastructureConfigured:!!Deno.env.get(\"BROWSERBASE_API_KEY\"),lastBrowserBindingAt:browserContextPresent?String(q.rows?.[0]?.updated_at||\"\"):null,secretValuesExposed:false};}\nasync function decision(service:string,action:string){const s=SERVICE_BINDINGS[service];const cls=ACTION_CLASSES[action]||\"REVIEW_REQUIRED\";const bind=s?await bindingState(service,s):{state:\"UNKNOWN_SERVICE\"};const platformPolicy=FREELANCE_POLICY[service]||null;let executable=false,nextAction=\"REVIEW_ACTION\";if(cls===\"DENY\")nextAction=\"DO_NOT_EXECUTE\";else if(cls===\"HUMAN_REQUIRED\")nextAction=\"PREPARE_EVERYTHING_AND_STOP_AT_EXACT_HUMAN_GATE\";else if(cls===\"ONE_TIME_BINDING\")nextAction=(s&&bind.state===\"BOUND\")?\"BINDING_ALREADY_PRESENT_REUSE_WITHIN_SCOPE\":\"COMPLETE_ONE_TIME_PROVIDER_AUTHENTICATION\";else if(cls===\"PLATFORM_POLICY_REQUIRED\"){if(!s)nextAction=\"UNKNOWN_SERVICE\";else if(bind.state!==\"BOUND\")nextAction=\"COMPLETE_ONE_TIME_ACCOUNT_BINDING_THEN_RECHECK_PLATFORM_POLICY\";else nextAction=platformPolicy?.status===\"POLICY_REVIEW_REQUIRED\"?\"REVIEW_CURRENT_PLATFORM_TERMS_BEFORE_ACCOUNT_ACTION\":\"PREPARE_AND_STOP_AT_PLATFORM_PERMITTED_HUMAN_OR_OFFICIAL_TEAM_GATE\";}else if(cls===\"AUTO_STANDING\"){if(!s||[\"public_research\",\"read_monitoring\",\"draft\",\"edit_owned_content\",\"freelance_prepare_proposal\",\"freelance_prepare_delivery\"].includes(action)){executable=true;nextAction=\"EXECUTE_WITHOUT_REDUNDANT_APPROVAL\";}else if(bind.state===\"BOUND\"){executable=true;nextAction=\"EXECUTE_WITH_EXISTING_BINDING_AND_AUDIT_RECEIPT\";}else nextAction=\"ONE_TIME_ACCOUNT_BINDING_REQUIRED_THEN_AUTO\";}return {service,serviceLabel:s?.label??null,action,classification:cls,standingArchitectAuthorization:true,platformPolicy,binding:bind,executableNow:executable,nextAction,rule:\"OWNER_PERMISSION != PLATFORM_PERMISSION; AUTHENTICATION != AUTHORIZATION; standing permission removes repeated internal approval but never overrides provider authentication, platform Terms, MFA, KYC, legal terms, signatures or payments\"};}\nexport default async function(req:Request){const u=new URL(req.url);const service=(u.searchParams.get(\"service\")||\"\").toLowerCase();const action=(u.searchParams.get(\"action\")||\"\").toLowerCase();if(service||action)return Response.json({schema:\"ic.auth-broker.decision.v1\",observedAt:new Date().toISOString(),...await decision(service,action)},{headers:{\"cache-control\":\"no-store\"}});const services:any={};for(const [k,v] of Object.entries(SERVICE_BINDINGS) as any)services[k]={label:v.label,mode:v.mode,scopes:v.scopes,...await bindingState(k,v)};return Response.json({service:\"IMPERIAL Authorization Broker\",version:VERSION,state:\"ACTIVE\",mode:\"STANDING_AUTHORIZATION_WITH_ONE_TIME_ACCOUNT_BINDING\",standingArchitectAuthorization:true,bypassExternalAuthentication:false,redundantInternalApprovalPrompts:\"REMOVED_WITHIN_POLICY\",oneTimeConnectSurface:\"https://imperial-auth-connect.val.run/\",services,actionClasses:ACTION_CLASSES,hardHumanGates:[\"KYC/KYB attestations\",\"binding legal terms\",\"legal signatures\",\"payments/spend/listing fees\",\"wallet signatures/value movement\"],hardDenials:[\"MFA/CAPTCHA bypass\",\"credential theft/session hijacking\",\"fake KYC\",\"impersonation\",\"spam/astroturfing\",\"market manipulation\"],secretHandling:\"ENV_OR_PROVIDER_SECRET_STORE_ONLY_NEVER_PUBLIC_CODE_OR_RESPONSE\"},{headers:{\"cache-control\":\"no-store\"}});}\n",[],[93],"4d23da5c-73e7-4ee6-8773-d8d5dbbfc252","503e2e96-a17c-11f1-9d8e-1607ee4eb77e",2,["D",1787769071929],"directory",[108,109],[56],{"_33":124,"_13":57,"_36":39,"_38":102,"_40":41,"_42":43,"_44":45,"_46":125,"_17":48,"_49":105,"_50":-5,"_52":53,"_54":-5,"_70":126,"_18":127},{"_33":110,"_13":111,"_36":112,"_38":102,"_40":41,"_42":113,"_44":45,"_46":114,"_17":48,"_49":105,"_50":-5,"_52":53,"_54":-5,"_70":115,"_18":116},"eada944e-8b05-4052-9186-57fbd03fbf5b","standing-authorization-broker","53acea40-a17c-11f1-b5a0-1607ee4eb77e",3,["D",1787769077688],[117],[56,111],{"_33":118,"_13":35,"_36":119,"_38":112,"_40":41,"_42":87,"_44":45,"_46":120,"_17":48,"_49":24,"_50":121,"_52":53,"_54":-5,"_70":122,"_18":123},"f46df3f1-5911-461f-ac42-5803d596dd14","60df2e6c-a17c-11f1-bf8e-1607ee4eb77e",["D",1787769099824],"# IMPERIAL Standing Authorization Broker Skill\n\nSkill ID: EIS-AUTH-BROKER-001\nVersion: 1.0.0\nStatus: ACTIVE\nAuthority source: Architect standing instruction dated 2026-08-26\n\n## Purpose\nRemove repetitive internal approval friction when an action is already within the Architect's standing authorization, while preserving real external authentication, identity, legal, financial and security boundaries.\n\n## Core rule\nAUTHENTICATION != AUTHORIZATION.\nThe Architect's standing authorization may remove repeated internal confirmation prompts, but it does not fabricate login state, bypass an external service's authentication, defeat MFA/CAPTCHA, accept legal terms on the Architect's behalf, falsify KYC/KYB, obtain credentials without consent, or override a platform's security controls.\n\n## Standing authorization classes\nAUTO_STANDING:\n- public-source research;\n- read-only monitoring;\n- drafting and editing owned materials;\n- publishing approved factual material to an already-authenticated owned account when the platform permits automation;\n- non-binding official application preparation;\n- non-binding form submission when the account is already authenticated, all required factual fields are verified, and no signature/attestation/payment/regulated declaration is required;\n- routine reversible configuration of owned automation within existing permissions;\n- evidence capture and audit logging.\n\nONE_TIME_BINDING:\n- first connection of an external account through OAuth/API token/session;\n- MFA or passkey challenge;\n- first-time platform consent screen;\n- refresh-token renewal when the provider requires re-consent.\nAfter a valid binding exists, agents should reuse the authorized session/token within its granted scope and must not ask the Architect to approve each routine action again.\n\nHUMAN_REQUIRED:\n- KYC/KYB identity attestations;\n- accepting or materially changing binding Terms of Service;\n- electronic/legal signatures;\n- notarization;\n- sworn statements;\n- representation as licensed counsel;\n- payment, paid advertising spend, listing fees or other financial commitments;\n- wallet signatures, token transfers, approvals, mint/burn, liquidity provision;\n- irreversible account deletion or transfer of ownership;\n- disclosure of secrets/private keys.\n\nDENY:\n- bypassing MFA/CAPTCHA or access controls;\n- credential theft, phishing, session hijacking or cookie theft;\n- impersonation;\n- unauthorized account creation or use;\n- fake KYC/KYB;\n- evasion of platform suspension or legal restrictions;\n- spam/astroturfing/vote manipulation;\n- market manipulation.\n\n## Resolution algorithm\n1. Identify the requested service and action.\n2. Check whether a valid connector/session/token is already bound.\n3. Classify action as AUTO_STANDING / ONE_TIME_BINDING / HUMAN_REQUIRED / DENY.\n4. If AUTO_STANDING and binding exists: execute without asking for redundant approval.\n5. If ONE_TIME_BINDING: create one explicit binding task containing service, requested scopes, provider URL and reason. After successful binding, persist only the provider-issued credential in the platform secret store, never source code or chat.\n6. If HUMAN_REQUIRED: stop only at the exact human action, keeping all preparation complete.\n7. If DENY: do not attempt a workaround that defeats the provider's controls.\n8. Record an audit receipt: service, action, decision, evidence, timestamp, connector state and result.\n\n## Publication rule\nA draft is not a publication. A prepared exchange application is not submitted. A submission is not a listing. Record external evidence before changing status.\n\n## Security rule\nTokens, passwords, passkeys, session cookies, seed phrases and private keys must never be written to public Val Town code, GitHub, logs, campaign text or audit payloads. Use encrypted environment/connector secret storage only.\n",[],[56,111,35],"32033cab-41ea-48b6-b7f2-b640475a4cb2",["D",1787774813345],[128,129],[56,57],{"_33":133,"_13":134,"_36":135,"_38":39,"_40":41,"_42":43,"_44":45,"_46":136,"_17":48,"_49":105,"_50":-5,"_52":53,"_54":-5,"_70":137,"_18":138},{"_33":34,"_13":35,"_36":37,"_38":39,"_40":41,"_42":43,"_44":45,"_46":130,"_17":48,"_49":24,"_50":51,"_52":53,"_54":-5,"_70":131,"_18":132},["D",1787774813345],[],[56,57,35],"6a22d3fc-6e87-498b-907d-a89acd414a3f","agents","01a03fae-c49e-7746-8f12-d35f0787228f",["D",1787774813345],[139],[56,57,134],{"_33":140,"_13":141,"_36":142,"_38":135,"_40":41,"_42":43,"_44":45,"_46":143,"_17":48,"_49":24,"_50":144,"_52":53,"_54":-5,"_70":145,"_18":146},"ea5e7d79-08dc-4f7a-8b75-d7f890da747d","openai.yaml","01a03fae-c49f-761f-89cd-adba30efc7be",["D",1787774813345],"interface:\n display_name: \"Freelance Platform Authorization\"\n short_description: \"Authorize freelance platforms safely and reuse approved sessions.\"\npolicy:\n allow_implicit_invocation: true\n",[],[56,57,134,141],"72e490d5-88f0-42ef-9561-78c73af0772f",["D",1787769059661],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Standing authorization & OAuth handoff broker","imageUrl","userId","fe39b163-4b50-466e-82d1-8bd01133e4b6","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a03585-eb44-758d-92a4-77db1a9a243c","tursoName","72e490d588f042ef956178c73af0772f","tursoHostname","72e490d588f042ef956178c73af0772f-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789511441255],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_204":200},"org",{"_11":12,"_197":198,"_199":200,"_157":158,"_201":202,"_203":53},"branch",{"_17":76,"_13":16,"_33":41,"_189":147,"_190":-5,"_191":-5,"_192":-5,"_193":-5,"_194":-5,"_195":14,"_196":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Олександр Ромаскевич","avatar","https://lh3.googleusercontent.com/a/ACg8ocIo1MJ3hDjpQrinMIRok3d2YY1vpHgehs8m2u1_vc7pmFovRGI=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":147,"_13":14,"_46":267,"_149":-5,"_150":53,"_151":152,"_153":152,"_154":155,"_156":-5,"_157":158,"_159":65,"_160":45,"_161":-5,"_162":-5,"_163":48,"_164":165,"_166":167,"_168":169,"_170":268,"_172":-5,"_173":174,"_175":174,"_176":177,"_178":177,"_179":177,"_180":174,"_181":174,"_182":269,"_184":270,"_186":271,"_188":53},[234,241,242,243,244],"files",[234,235,236,237,238,239,240,241,242,243,244],"counts",{"_225":48,"_226":66,"_227":48,"_32":228,"_229":230},[],{"_33":34,"_13":35,"_36":37,"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":24,"_50":51,"_52":53,"_54":-5,"_18":224},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[56,57,35],"pulls","branches","forks",{"_231":66,"_233":48},"connections",{"_231":48,"_232":48},"count","unfilledCount","emptyCount",{"_33":101,"_13":56,"_36":102,"_38":-5,"_40":41,"_42":103,"_44":45,"_46":104,"_17":48,"_49":105,"_50":-5,"_52":53,"_54":-5,"_70":265,"_18":266},{"_33":124,"_13":57,"_36":39,"_38":102,"_40":41,"_42":43,"_44":45,"_46":125,"_17":48,"_49":105,"_50":-5,"_52":53,"_54":-5,"_70":263,"_18":264},{"_33":133,"_13":134,"_36":135,"_38":39,"_40":41,"_42":43,"_44":45,"_46":136,"_17":48,"_49":105,"_50":-5,"_52":53,"_54":-5,"_70":261,"_18":262},{"_33":140,"_13":141,"_36":142,"_38":135,"_40":41,"_42":43,"_44":45,"_46":143,"_17":48,"_49":24,"_50":144,"_52":53,"_54":-5,"_70":259,"_18":260},{"_33":34,"_13":35,"_36":37,"_38":39,"_40":41,"_42":43,"_44":45,"_46":130,"_17":48,"_49":24,"_50":51,"_52":53,"_54":-5,"_70":257,"_18":258},{"_33":110,"_13":111,"_36":112,"_38":102,"_40":41,"_42":113,"_44":45,"_46":114,"_17":48,"_49":105,"_50":-5,"_52":53,"_54":-5,"_70":255,"_18":256},{"_33":118,"_13":35,"_36":119,"_38":112,"_40":41,"_42":87,"_44":45,"_46":120,"_17":48,"_49":24,"_50":121,"_52":53,"_54":-5,"_70":253,"_18":254},{"_33":92,"_13":93,"_36":94,"_38":-5,"_40":41,"_42":95,"_44":45,"_46":96,"_17":97,"_49":68,"_50":98,"_52":53,"_54":14,"_70":251,"_18":252},{"_33":82,"_13":83,"_36":84,"_38":-5,"_40":41,"_42":85,"_44":45,"_46":86,"_17":87,"_49":68,"_50":88,"_52":53,"_54":89,"_70":249,"_18":250},{"_33":73,"_13":74,"_36":75,"_38":-5,"_40":41,"_42":76,"_44":45,"_46":77,"_17":66,"_49":78,"_50":79,"_52":53,"_54":-5,"_70":247,"_18":248},{"_33":63,"_13":64,"_36":65,"_38":-5,"_40":41,"_42":66,"_44":45,"_46":67,"_17":48,"_49":68,"_50":69,"_52":53,"_54":-5,"_70":245,"_18":246},[],[64],[],[74],[],[83],[],[93],[],[56,111,35],[240],[56,111],[],[56,57,35],[],[56,57,134,141],[237],[56,57,134],[236,238],[56,57],[235,239],[56],["D",1787769059661],["D",1789511441255],{"_11":12,"_204":200},{"_11":12,"_197":198,"_199":200,"_157":158,"_201":202,"_203":53},{"_17":76,"_13":16,"_33":41,"_189":147,"_190":-5,"_191":-5,"_192":-5,"_193":-5,"_194":-5,"_195":14,"_196":12},"ctx",{"_182":-5,"_221":305,"_306":307,"_308":309,"_310":53,"_311":53,"_312":53,"_313":45,"_314":-5,"_315":-7,"_316":-7,"_317":48,"_318":53,"_319":53,"_320":-5,"_321":53,"_322":53,"_323":53,"_324":-5},"ENV",{"_276":277,"_278":279,"_280":16,"_281":282,"_283":284,"_285":286,"_287":288,"_289":290,"_291":292,"_293":294,"_295":296,"_297":298,"_299":300,"_301":302,"_303":304},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]