Authorizing...

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_152":153,"_154":155},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_115":-5,"_20":116,"_22":117,"_118":119,"_120":121,"_25":122,"_24":-5,"_123":-5,"_124":-5,"_125":53,"_126":127,"_128":44,"_129":-5,"_130":-5,"_131":132},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","nicholasab","name","woods-castle-mcp","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":-5,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":94,"_95":96,"_97":98,"_99":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","123d8290-1149-11f1-ae00-42dde27851f2","main.ts","fileId","84004ec0-113b-11f1-914d-42dde27851f2","parentId","branchId","83fb1e6e-113b-11f1-914d-42dde27851f2","branchVersion",14,"latest",true,"createdAt",["D",1771914096109],13,"fileType","http","content","// Woods Castle — MCP Server for Val Town\n// Deploy: Create a new HTTP val on val.town, paste this code, save.\n// Connect Claude.ai: Settings > Connectors > Add custom connector > paste the val URL + \"/mcp\"\n// Connect Claude Code: claude mcp add --transport http woods-castle /mcp\n//\n// This server shares data with the moodboard site via the same Val Town blob API.\n// All doc content is stored under doc_source:{id} keys in the blob.\n// Git-tracked docs are seeded automatically by build.sh on every Cloudflare deploy.\n\nconst DATA_API =\n \"https://nicholasab--41a3b4ce10e911f1bf3442dde27851f2.web.val.run\";\nconst SERVER_INFO = { name: \"woods-castle-mcp\", version: \"1.2.0\" };\n\n// Fixed OAuth client for Claude.ai advanced settings (skips DCR)\nconst FIXED_CLIENT_ID = \"woods-castle-claude\";\nconst FIXED_CLIENT_SECRET = \"wc-secret-2026\";\n\n// ── Tool Definitions ──\n\nconst TOOLS = [\n {\n name: \"list_docs\",\n description:\n \"List all available design documents (GDD, Style Guide, team-created docs). Returns id, title, and source (git or valtown) for each.\",\n inputSchema: { type: \"object\", properties: {} },\n },\n {\n name: \"read_doc\",\n description:\n \"Read the full markdown content of a design document by its ID.\",\n inputSchema: {\n type: \"object\",\n properties: {\n doc_id: {\n type: \"string\",\n description:\n \"Document ID (e.g. 'gdd', 'style-guide', 'combat-brainstorm')\",\n },\n },\n required: [\"doc_id\"],\n },\n },\n {\n name: \"edit_doc\",\n description:\n \"Replace the full content of a design document. For git-tracked docs (GDD, Style Guide), this creates an override in Val Town storage.\",\n inputSchema: {\n type: \"object\",\n properties: {\n doc_id: { type: \"string\", description: \"Document ID\" },\n content: { type: \"string\", description: \"New full markdown content\" },\n },\n required: [\"doc_id\", \"content\"],\n },\n },\n {\n name: \"create_doc\",\n description:\n \"Create a new team design document. Generates a URL-safe slug from the title.\",\n inputSchema: {\n type: \"object\",\n properties: {\n title: {\n type: \"string\",\n description: \"Document title (e.g. 'Combat Brainstorm')\",\n },\n content: {\n type: \"string\",\n description:\n \"Markdown content. If omitted, creates a template with the title as heading.\",\n },\n },\n required: [\"title\"],\n },\n },\n {\n name: \"delete_doc\",\n description:\n \"Delete a team-created document. Cannot delete git-tracked docs (GDD, Style Guide).\",\n inputSchema: {\n type: \"object\",\n properties: {\n doc_id: { type: \"string\", description: \"Document ID to delete\" },\n },\n required: [\"doc_id\"],\n },\n },\n {\n name: \"list_images\",\n description:\n \"List moodboard reference images, optionally filtered by category (character, forest, castle, cosmic, combat-hud, hd-2d, gear).\",\n inputSchema: {\n type: \"object\",\n properties: {\n category: {\n type: \"string\",\n description:\n \"Category folder name to filter by. Omit for all images.\",\n },\n },\n },\n },\n {\n name: \"get_annotation\",\n description:\n \"Get annotation data for a moodboard image: notes, rating (1-5), tags, useFor, source URL.\",\n inputSchema: {\n type: \"object\",\n properties: {\n image_path: {\n type: \"string\",\n description:\n \"Image path as shown by list_images (e.g. 'character/faraam-knight.png')\",\n },\n },\n required: [\"image_path\"],\n },\n },\n {\n name: \"set_annotation\",\n description:\n \"Set or update annotation data for a moodboard image. Only provided fields are updated; omitted fields are preserved.\",\n inputSchema: {\n type: \"object\",\n properties: {\n image_path: { type: \"string\", description: \"Image path\" },\n notes: { type: \"string\", description: \"Notes about the image\" },\n rating: { type: \"number\", description: \"Rating from 1 to 5\" },\n tags: {\n type: \"array\",\n items: { type: \"string\" },\n description: \"Tags for categorization\",\n },\n useFor: {\n type: \"string\",\n description: \"What this image should be used for in the game\",\n },\n source: { type: \"string\", description: \"Source URL for the image\" },\n },\n required: [\"image_path\"],\n },\n },\n {\n name: \"add_comment\",\n description:\n \"Add a comment to a specific section of a design document. Sections are identified by their heading slug.\",\n inputSchema: {\n type: \"object\",\n properties: {\n doc_id: { type: \"string\", description: \"Document ID\" },\n section: {\n type: \"string\",\n description:\n \"Section heading slug (e.g. 'core-vision', 'the-four-axes')\",\n },\n text: { type: \"string\", description: \"Comment text\" },\n author: { type: \"string\", description: \"Author name\" },\n },\n required: [\"doc_id\", \"section\", \"text\", \"author\"],\n },\n },\n {\n name: \"get_comments\",\n description: \"Get all comments for a specific section of a document.\",\n inputSchema: {\n type: \"object\",\n properties: {\n doc_id: { type: \"string\", description: \"Document ID\" },\n section: { type: \"string\", description: \"Section heading slug\" },\n },\n required: [\"doc_id\", \"section\"],\n },\n },\n {\n name: \"search_docs\",\n description:\n \"Search across all document content for a text query. Returns matching doc IDs and surrounding context.\",\n inputSchema: {\n type: \"object\",\n properties: {\n query: {\n type: \"string\",\n description: \"Text to search for (case-insensitive)\",\n },\n },\n required: [\"query\"],\n },\n },\n];\n\n// ── Data Layer ──\n\nasync function getData() {\n try {\n const res = await fetch(DATA_API, { signal: AbortSignal.timeout(8000) });\n if (!res.ok) return {};\n return await res.json();\n } catch (e) {\n console.error(\"getData failed:\", e.message);\n return {};\n }\n}\n\nasync function setData(data) {\n await fetch(DATA_API, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(data),\n });\n}\n\n// ── Tool Implementations ──\n\nasync function callTool(name, args) {\n const data = await getData();\n\n switch (name) {\n case \"list_docs\": {\n const teamDocs = data[\"doc_manifest\"] || [];\n const teamIds = new Set(teamDocs.map((d) => d.id));\n const docs = [];\n\n for (const key of Object.keys(data)) {\n if (!key.startsWith(\"doc_source:\")) continue;\n const id = key.replace(\"doc_source:\", \"\");\n const content = data[key] || \"\";\n const title =\n content.split(\"\\n\")[0].replace(/^#\\s*/, \"\").replace(/ — .*/, \"\") ||\n id;\n docs.push({\n id,\n label: title,\n source: teamIds.has(id) ? \"valtown\" : \"git\",\n });\n }\n return JSON.stringify(docs, null, 2);\n }\n\n case \"read_doc\": {\n const content = data[`doc_source:${args.doc_id}`];\n if (!content) {\n return `Document '${args.doc_id}' not found. Use list_docs to see available documents.`;\n }\n return content;\n }\n\n case \"edit_doc\": {\n data[`doc_source:${args.doc_id}`] = args.content;\n await setData(data);\n return `Document '${args.doc_id}' updated (${args.content.length} chars).`;\n }\n\n case \"create_doc\": {\n const slug = slugify(args.title);\n if (data[`doc_source:${slug}`]) {\n return `Document '${slug}' already exists. Use edit_doc to modify it, or choose a different title.`;\n }\n const content = args.content ||\n `# ${args.title}\\n\\n## Overview\\n\\nStart writing...\\n`;\n data[`doc_source:${slug}`] = content;\n if (!data[\"doc_manifest\"]) data[\"doc_manifest\"] = [];\n data[\"doc_manifest\"].push({\n id: slug,\n label: args.title,\n source: \"valtown\",\n });\n await setData(data);\n return `Document '${slug}' created.`;\n }\n\n case \"delete_doc\": {\n const manifest = data[\"doc_manifest\"] || [];\n const isTeamDoc = manifest.some((d) => d.id === args.doc_id);\n if (!isTeamDoc) {\n return `Cannot delete '${args.doc_id}': it's a git-tracked doc. Only team-created docs can be deleted.`;\n }\n delete data[`doc_source:${args.doc_id}`];\n data[\"doc_manifest\"] = manifest.filter((d) => d.id !== args.doc_id);\n for (const key of Object.keys(data)) {\n if (key.startsWith(`doc_comments:${args.doc_id}:`)) {\n delete data[key];\n }\n }\n await setData(data);\n return `Document '${args.doc_id}' deleted.`;\n }\n\n case \"list_images\": {\n const images = Object.keys(data).filter((k) => {\n if (\n k.startsWith(\"doc_source:\") || k.startsWith(\"doc_comments:\") ||\n k === \"doc_manifest\"\n ) return false;\n if (!k.includes(\"/\")) return false;\n if (args.category && !k.startsWith(args.category + \"/\")) return false;\n return true;\n });\n\n const result = images.map((path) => {\n const ann = data[path] || {};\n return {\n path,\n rating: ann.rating || null,\n tags: ann.tags || [],\n hasNotes: !!(ann.notes || ann.useFor),\n deleted: !!ann.deleted,\n };\n });\n return JSON.stringify(result, null, 2);\n }\n\n case \"get_annotation\": {\n const ann = data[args.image_path];\n if (!ann) return `No annotation found for '${args.image_path}'.`;\n return JSON.stringify(ann, null, 2);\n }\n\n case \"set_annotation\": {\n const existing = data[args.image_path] || {};\n const updated = { ...existing };\n if (args.notes !== undefined) updated.notes = args.notes;\n if (args.rating !== undefined) updated.rating = args.rating;\n if (args.tags !== undefined) updated.tags = args.tags;\n if (args.useFor !== undefined) updated.useFor = args.useFor;\n if (args.source !== undefined) updated.source = args.source;\n data[args.image_path] = updated;\n await setData(data);\n return `Annotation updated for '${args.image_path}'.`;\n }\n\n case \"add_comment\": {\n const key = `doc_comments:${args.doc_id}:${args.section}`;\n if (!data[key]) data[key] = { comments: [] };\n const comment = {\n id: \"c_\" + Math.floor(Date.now() / 1000) + \"_\" +\n Math.random().toString(36).substr(2, 4),\n author: args.author,\n text: args.text,\n ts: Math.floor(Date.now() / 1000),\n };\n data[key].comments.push(comment);\n await setData(data);\n return `Comment added to ${args.doc_id} > ${args.section} by ${args.author}.`;\n }\n\n case \"get_comments\": {\n const key = `doc_comments:${args.doc_id}:${args.section}`;\n const thread = data[key];\n if (!thread || !thread.comments || thread.comments.length === 0) {\n return `No comments on ${args.doc_id} > ${args.section}.`;\n }\n return JSON.stringify(thread.comments, null, 2);\n }\n\n case \"search_docs\": {\n const query = args.query.toLowerCase();\n const results = [];\n for (const key of Object.keys(data)) {\n if (!key.startsWith(\"doc_source:\")) continue;\n const id = key.replace(\"doc_source:\", \"\");\n const content = data[key];\n const lower = content.toLowerCase();\n const idx = lower.indexOf(query);\n if (idx === -1) continue;\n const start = Math.max(0, idx - 100);\n const end = Math.min(content.length, idx + query.length + 100);\n const context = (start > 0 ? \"...\" : \"\") + content.slice(start, end) +\n (end < content.length ? \"...\" : \"\");\n results.push({ doc_id: id, context: context.trim() });\n }\n if (results.length === 0) return `No results for '${args.query}'.`;\n return JSON.stringify(results, null, 2);\n }\n\n default:\n return `Unknown tool: ${name}`;\n }\n}\n\n// ── Seed Endpoint ──\n\nasync function handleSeed(req) {\n try {\n const body = await req.json();\n const docs = body.docs || {};\n const data = await getData();\n let count = 0;\n for (const [id, content] of Object.entries(docs)) {\n data[`doc_source:${id}`] = content;\n count++;\n }\n await setData(data);\n return corsJson({ ok: true, seeded: count });\n } catch (e) {\n return corsJson({ error: e.message }, 400);\n }\n}\n\n// ── Auth Helpers ──\n\n// Check if a request has a valid Bearer token.\n// We accept ANY bearer token — data is public, OAuth is just for protocol compliance.\n// Returns true if authenticated, false if not.\nfunction hasValidBearer(req) {\n const auth = req.headers.get(\"Authorization\") || \"\";\n return auth.startsWith(\"Bearer \") && auth.length > 7;\n}\n\n// Return a 401 challenge directing the client to our OAuth server.\nfunction unauthorizedResponse(req) {\n const base = getBaseUrl(req);\n const resourceMetadataUrl = `${base}/.well-known/oauth-protected-resource`;\n return new Response(JSON.stringify({ error: \"Unauthorized\" }), {\n status: 401,\n headers: {\n \"Content-Type\": \"application/json\",\n \"WWW-Authenticate\": `Bearer resource_metadata=\"${resourceMetadataUrl}\"`,\n ...corsHeaders(),\n },\n });\n}\n\n// ── MCP JSON-RPC Handler ──\n\nasync function handleMcp(req) {\n // Accept both authenticated and unauthenticated requests.\n // Data is public — OAuth is optional for Claude.ai compatibility.\n const hasAuth = hasValidBearer(req);\n console.log(\"MCP: auth=\" + hasAuth);\n\n let body;\n try {\n body = await req.json();\n } catch {\n return corsJson({\n jsonrpc: \"2.0\",\n id: null,\n error: { code: -32700, message: \"Parse error\" },\n }, 400);\n }\n\n console.log(\"MCP method:\", body.method);\n\n const { id, method, params } = body;\n\n // Generate MCP response headers (session ID for connection stability)\n const sessionId = req.headers.get(\"Mcp-Session-Id\") || crypto.randomUUID();\n const mcpHeaders = {\n \"Content-Type\": \"application/json\",\n \"Mcp-Session-Id\": sessionId,\n ...corsHeaders(),\n };\n\n switch (method) {\n case \"initialize\": {\n const clientVersion = params?.protocolVersion || \"2024-11-05\";\n // Support known protocol versions\n const SUPPORTED = [\"2024-11-05\", \"2025-03-26\", \"2025-11-25\"];\n const negotiated = SUPPORTED.includes(clientVersion)\n ? clientVersion\n : SUPPORTED[SUPPORTED.length - 1];\n console.log(\n \"INITIALIZE: client wants\",\n clientVersion,\n \"→ negotiated\",\n negotiated,\n );\n return new Response(\n JSON.stringify({\n jsonrpc: \"2.0\",\n id,\n result: {\n protocolVersion: negotiated,\n capabilities: { tools: {} },\n serverInfo: SERVER_INFO,\n },\n }),\n { status: 200, headers: mcpHeaders },\n );\n }\n\n case \"notifications/initialized\":\n return new Response(\"\", { status: 200, headers: mcpHeaders });\n\n case \"tools/list\":\n return new Response(\n JSON.stringify({\n jsonrpc: \"2.0\",\n id,\n result: { tools: TOOLS },\n }),\n { status: 200, headers: mcpHeaders },\n );\n\n case \"tools/call\": {\n const toolName = params?.name;\n const toolArgs = params?.arguments || {};\n try {\n const result = await callTool(toolName, toolArgs);\n return new Response(\n JSON.stringify({\n jsonrpc: \"2.0\",\n id,\n result: {\n content: [{ type: \"text\", text: result }],\n },\n }),\n { status: 200, headers: mcpHeaders },\n );\n } catch (e) {\n return new Response(\n JSON.stringify({\n jsonrpc: \"2.0\",\n id,\n error: { code: -32603, message: e.message },\n }),\n { status: 200, headers: mcpHeaders },\n );\n }\n }\n\n default:\n return new Response(\n JSON.stringify({\n jsonrpc: \"2.0\",\n id,\n error: { code: -32601, message: `Method not found: ${method}` },\n }),\n { status: 200, headers: mcpHeaders },\n );\n }\n}\n\n// ── OAuth Endpoints ──\n// Claude.ai discovers OAuth via .well-known, registers dynamically, gets a token,\n// then calls /mcp with Authorization: Bearer .\n// We implement a minimal \"rubber stamp\" OAuth: accept any registration, auto-approve,\n// issue tokens. Data is public (same as moodboard site).\n\nfunction getBaseUrl(req) {\n const url = new URL(req.url);\n return `${url.protocol}//${url.host}`;\n}\n\nfunction handleOAuthMetadata(req) {\n const base = getBaseUrl(req);\n return corsJson({\n issuer: base,\n authorization_endpoint: `${base}/authorize`,\n token_endpoint: `${base}/token`,\n registration_endpoint: `${base}/register`,\n response_types_supported: [\"code\"],\n grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n code_challenge_methods_supported: [\"S256\"],\n // Claude.ai requires client_secret_post — must be listed here\n token_endpoint_auth_methods_supported: [\n \"client_secret_post\",\n \"client_secret_basic\",\n \"none\",\n ],\n });\n}\n\nfunction handleProtectedResourceMetadata(req) {\n const base = getBaseUrl(req);\n return corsJson({\n resource: `${base}/mcp`,\n authorization_servers: [base],\n bearer_methods_supported: [\"header\"],\n });\n}\n\nfunction handleRegister(req) {\n return req.json().then((body) => {\n // Echo back what the client wants — Claude.ai requests client_secret_post\n const authMethod = body.token_endpoint_auth_method || \"client_secret_post\";\n const clientId = \"wc_\" + crypto.randomUUID().replace(/-/g, \"\").slice(0, 16);\n const response = {\n client_id: clientId,\n client_name: body.client_name || \"Claude\",\n redirect_uris: body.redirect_uris || [],\n grant_types: body.grant_types || [\"authorization_code\"],\n response_types: body.response_types || [\"code\"],\n token_endpoint_auth_method: authMethod,\n };\n // If they want a secret, give them one\n if (authMethod !== \"none\") {\n response.client_secret = \"wc_secret_\" +\n crypto.randomUUID().replace(/-/g, \"\").slice(0, 24);\n }\n console.log(\"REGISTER response:\", JSON.stringify(response));\n return corsJson(response, 201);\n });\n}\n\n// Validate client credentials for token exchange.\n// Accepts both fixed (advanced settings) and dynamically registered clients.\nfunction validateClient(params) {\n const clientId = params.get(\"client_id\") || \"\";\n const clientSecret = params.get(\"client_secret\") || \"\";\n\n // Fixed client from advanced settings\n if (clientId === FIXED_CLIENT_ID) {\n return clientSecret === FIXED_CLIENT_SECRET;\n }\n // Dynamic clients — rubber stamp (we don't persist registrations)\n return true;\n}\n\nfunction handleAuthorize(req) {\n // Auto-approve: redirect back with an authorization code.\n // IMPORTANT: We use an HTML page with JS redirect instead of a bare 302.\n // This avoids CSP form-action issues that can silently break the OAuth flow\n // when the redirect chain passes through claude:// URI schemes.\n const url = new URL(req.url);\n const redirectUri = url.searchParams.get(\"redirect_uri\");\n const state = url.searchParams.get(\"state\");\n const code = \"wc_code_\" + crypto.randomUUID().replace(/-/g, \"\");\n\n if (!redirectUri) {\n return new Response(\"Missing redirect_uri\", {\n status: 400,\n headers: corsHeaders(),\n });\n }\n\n const redirect = new URL(redirectUri);\n redirect.searchParams.set(\"code\", code);\n if (state) redirect.searchParams.set(\"state\", state);\n const target = redirect.toString();\n\n const html = `\n\n\n\nAuthorizing...\n\n

Authorizing... Click here if not redirected

\n\n`;\n\n return new Response(html, {\n status: 200,\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n // Explicitly allow all form actions including claude:// scheme\n \"Content-Security-Policy\":\n \"default-src 'self' 'unsafe-inline'; form-action *; frame-ancestors 'none';\",\n ...corsHeaders(),\n },\n });\n}\n\nasync function handleToken(req) {\n // Parse the form-encoded body\n let bodyText = \"\";\n try {\n bodyText = await req.text();\n console.log(\"TOKEN request body:\", bodyText.slice(0, 500));\n } catch (e) {\n console.log(\"TOKEN: could not read body:\", e.message);\n }\n\n const params = new URLSearchParams(bodyText);\n console.log(\n \"TOKEN grant_type:\",\n params.get(\"grant_type\"),\n \"client_id:\",\n params.get(\"client_id\"),\n );\n\n // Validate client credentials\n if (!validateClient(params)) {\n console.log(\"TOKEN: invalid client credentials\");\n return corsJson({ error: \"invalid_client\" }, 401);\n }\n\n // Issue a bearer token\n const token = \"wc_token_\" + crypto.randomUUID().replace(/-/g, \"\");\n const response = {\n access_token: token,\n token_type: \"Bearer\",\n expires_in: 86400,\n scope: \"read write\",\n refresh_token: \"wc_refresh_\" + crypto.randomUUID().replace(/-/g, \"\"),\n };\n console.log(\"TOKEN response:\", JSON.stringify(response));\n return corsJson(response);\n}\n\n// ── HTTP Router ──\n\nexport default async function (req) {\n const url = new URL(req.url);\n const path = url.pathname;\n\n // Log EVERY request for debugging\n console.log(\n `${req.method} ${path} ${url.search ? url.search.slice(0, 80) : \"\"}`,\n );\n\n // CORS preflight\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: corsHeaders() });\n }\n\n // Force .well-known to 404 — prevents Claude.ai from entering OAuth flow\n if (path.startsWith(\"/.well-known/\")) {\n console.log(\"BLOCKED .well-known:\", path);\n return new Response(\"Not found\", { status: 404, headers: corsHeaders() });\n }\n\n // MCP endpoint — no auth required\n if (path === \"/mcp\" && req.method === \"POST\") {\n return handleMcp(req);\n }\n\n // OAuth endpoints DISABLED — Claude.ai falls back to these default paths\n // even when .well-known returns 404, triggering a broken OAuth flow.\n // Return 404 to force Claude to use the unauthenticated connection.\n if (\n (path === \"/register\" || path === \"/authorize\" || path === \"/token\") &&\n !url.searchParams.has(\"force_oauth\")\n ) {\n console.log(\"BLOCKED OAuth fallback:\", req.method, path);\n return new Response(\"Not found\", { status: 404, headers: corsHeaders() });\n }\n\n // Seed endpoint (no auth required — called by build.sh)\n if (path === \"/seed\" && req.method === \"POST\") {\n return handleSeed(req);\n }\n\n // Health check\n if (path === \"/\" && req.method === \"GET\") {\n return corsJson({\n name: SERVER_INFO.name,\n version: SERVER_INFO.version,\n status: \"ok\",\n tools: TOOLS.length,\n endpoint: \"/mcp\",\n });\n }\n\n console.log(\"404 UNMATCHED:\", req.method, path);\n return new Response(\"Not found\", { status: 404, headers: corsHeaders() });\n}\n\n// ── Helpers ──\n\nfunction corsHeaders() {\n return {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS, DELETE\",\n \"Access-Control-Allow-Headers\":\n \"Content-Type, Authorization, Accept, Mcp-Session-Id\",\n \"Access-Control-Expose-Headers\": \"Mcp-Session-Id\",\n };\n}\n\nfunction corsJson(data, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...corsHeaders(),\n },\n });\n}\n\nfunction escapeHtml(str) {\n return str.replace(/&/g, \"&\").replace(//g, \">\")\n .replace(/\"/g, \""\");\n}\n\nfunction slugify(text) {\n return text\n .toLowerCase()\n .replace(/[^\\w\\s-]/g, \"\")\n .replace(/\\s+/g, \"-\")\n .replace(/-+/g, \"-\")\n .replace(/^-|-$/g, \"\");\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1771914096109],"children",[],[35],"83faa330-113b-11f1-914d-42dde27851f2",["D",1771908274004],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","019c8bb2-7d82-747e-8deb-39d29294bd86","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019c8bb2-7d83-755a-a7b2-c8c2c04aab62","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_114":110},"org",{"_11":12,"_108":-5,"_109":110,"_70":71,"_111":112,"_113":53},"branch",{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zQTU2bUt6Mjg0UHo3NUJ0aHJ2RWJ1emt5TXMifQ","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":148,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":-5,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":149,"_95":150,"_97":151,"_99":53},[145],"files",[145],"counts",{"_135":77,"_136":137,"_138":77,"_31":139,"_140":141},[133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":134},[35],"pulls","branches",1,"forks",{"_142":77,"_144":77},"connections",{"_142":77,"_143":77},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":146,"_18":147},[],[35],["D",1771908274004],{"_11":12,"_114":110},{"_11":12,"_108":-5,"_109":110,"_70":71,"_111":112,"_113":53},{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"ctx",{"_93":-5,"_130":185,"_186":187,"_188":189,"_190":53,"_191":53,"_192":53,"_193":44,"_194":-5,"_195":-7,"_196":-7,"_197":77,"_198":53,"_199":53,"_200":-5,"_201":53,"_202":53,"_203":53,"_204":-5},"ENV",{"_156":157,"_158":159,"_160":16,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]