[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_160":161,"_162":163},"routes/_app.x.$handle.$name",{"_98":97,"_32":45,"_107":88,"_27":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":25,"_122":123,"_124":125,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":25},"version",10,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","52fcb796-6a55-11f1-bda6-1607ee4eb77e","name","fileType","http","content","// gsheetsBridge — OAuth edition. Each user authenticates as THEMSELVES with Google;\n// the val brokers Google sign-in and calls the Sheets + Slides APIs on the user's behalf.\n//\n// This val plays two OAuth roles at once:\n// (a) an OAuth 2.1 authorization server that Claude logs into (the MCP connector), and\n// (b) an OAuth client of Google (to obtain each user's own Sheets/Slides access).\n//\n// Flow: Claude -> /authorize -> (redirect) Google consent -> /oauth/google/callback\n// -> val stores the user's Google refresh token, issues its own code -> Claude POST /token\n// -> val issues access+refresh tokens -> Claude calls /mcp with a Bearer token\n// -> val refreshes a Google access token for that user and calls Google AS them.\n//\n// Authorization is enforced by Google: a user can only touch files their own account\n// is shared on. No service account, no group, no claiming.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst PROTOCOL_VERSION = \"2025-06-18\";\nconst enc = encodeURIComponent;\n\nconst GOOGLE_AUTH = \"https://accounts.google.com/o/oauth2/v2/auth\";\nconst GOOGLE_TOKEN = \"https://oauth2.googleapis.com/token\";\nconst GOOGLE_USERINFO = \"https://openidconnect.googleapis.com/v1/userinfo\";\nconst GOOGLE_SCOPES = \"openid email https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/presentations\";\nconst CLAUDE_CALLBACKS = [\n \"https://claude.ai/api/mcp/auth_callback\",\n \"https://claude.com/api/mcp/auth_callback\",\n];\n\nconst clientId = () => Deno.env.get(\"GOOGLE_OAUTH_CLIENT_ID\") || \"\";\nconst clientSecret = () => Deno.env.get(\"GOOGLE_OAUTH_CLIENT_SECRET\") || \"\";\n\n// ---- storage ----\nconst schemaReady = (async () => {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS oauth_clients (client_id TEXT PRIMARY KEY, client_secret TEXT, redirect_uris TEXT, created_at TEXT)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS oauth_pending (gstate TEXT PRIMARY KEY, client_id TEXT, claude_redirect TEXT, claude_state TEXT, code_challenge TEXT, ccm TEXT, created_at TEXT)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS oauth_codes (code TEXT PRIMARY KEY, client_id TEXT, redirect_uri TEXT, code_challenge TEXT, ccm TEXT, g_refresh TEXT, user_email TEXT, expires_at INTEGER)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS oauth_tokens (access_hash TEXT PRIMARY KEY, refresh_hash TEXT, client_id TEXT, g_refresh TEXT, user_email TEXT, access_exp INTEGER, created_at TEXT)`);\n})();\n\nfunction b64url(bytes: Uint8Array): string {\n return btoa(String.fromCharCode(...bytes)).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\nfunction randToken(n = 32): string {\n const b = new Uint8Array(n); crypto.getRandomValues(b); return b64url(b);\n}\nasync function sha256b64url(s: string): Promise {\n const buf = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return b64url(new Uint8Array(buf));\n}\nfunction json(obj: unknown, status = 200, headers: Record = {}) {\n return new Response(JSON.stringify(obj, null, 2), {\n status,\n headers: { \"content-type\": \"application/json\", \"access-control-allow-origin\": \"*\", ...headers },\n });\n}\n\n// ---- discovery documents ----\nfunction asMetadata(origin: string) {\n return {\n issuer: origin,\n authorization_endpoint: `${origin}/authorize`,\n token_endpoint: `${origin}/token`,\n registration_endpoint: `${origin}/register`,\n response_types_supported: [\"code\"],\n grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n code_challenge_methods_supported: [\"S256\"],\n token_endpoint_auth_methods_supported: [\"client_secret_post\", \"none\"],\n scopes_supported: [\"openid\", \"email\", \"https://www.googleapis.com/auth/spreadsheets\", \"https://www.googleapis.com/auth/presentations\"],\n };\n}\nfunction prm(origin: string) {\n return {\n resource: origin,\n authorization_servers: [origin],\n scopes_supported: [\"https://www.googleapis.com/auth/spreadsheets\", \"https://www.googleapis.com/auth/presentations\"],\n bearer_methods_supported: [\"header\"],\n };\n}\n\n// ---- google access tokens (per-user, cached briefly per isolate) ----\nconst gTokenCache = new Map();\nasync function googleAccessToken(refresh: string): Promise {\n const k = await sha256b64url(refresh);\n const c = gTokenCache.get(k);\n if (c && c.exp > Date.now() + 60_000) return c.token;\n const body = new URLSearchParams({\n client_id: clientId(), client_secret: clientSecret(),\n refresh_token: refresh, grant_type: \"refresh_token\",\n });\n const r = await fetch(GOOGLE_TOKEN, { method: \"POST\", headers: { \"content-type\": \"application/x-www-form-urlencoded\" }, body });\n const j = await r.json();\n if (!r.ok) throw new Error(\"google token refresh failed: \" + JSON.stringify(j));\n const token = j.access_token as string;\n const exp = Date.now() + ((j.expires_in || 3600) * 1000);\n gTokenCache.set(k, { token, exp });\n return token;\n}\n\nasync function sheets(gToken: string, path: string, init: RequestInit = {}) {\n const r = await fetch(`https://sheets.googleapis.com/v4/spreadsheets${path}`, {\n ...init,\n headers: { authorization: `Bearer ${gToken}`, \"content-type\": \"application/json\", ...(init.headers || {}) },\n });\n const text = await r.text();\n if (!r.ok) throw Object.assign(new Error(`Sheets API ${r.status}: ${text}`), { status: r.status });\n try { return JSON.parse(text); } catch { return { raw: text }; }\n}\n\nasync function slides(gToken: string, path: string, init: RequestInit = {}) {\n const r = await fetch(`https://slides.googleapis.com/v1/presentations${path}`, {\n ...init,\n headers: { authorization: `Bearer ${gToken}`, \"content-type\": \"application/json\", ...(init.headers || {}) },\n });\n const text = await r.text();\n if (!r.ok) throw Object.assign(new Error(`Slides API ${r.status}: ${text}`), { status: r.status });\n try { return JSON.parse(text); } catch { return { raw: text }; }\n}\n\nasync function op(action: string, a: any, gToken: string) {\n const id = a?.spreadsheetId;\n const vio = a?.valueInputOption || \"USER_ENTERED\";\n switch (action) {\n case \"meta\": return sheets(gToken, `/${id}`);\n case \"get\": return sheets(gToken, `/${id}/values/${enc(a.range)}`);\n case \"getGrid\": {\n const p = new URLSearchParams({ includeGridData: \"true\" });\n if (a.ranges) for (const rg of [].concat(a.ranges)) p.append(\"ranges\", rg);\n if (a.fields) p.set(\"fields\", a.fields);\n return sheets(gToken, `/${id}?${p.toString()}`);\n }\n case \"update\": return sheets(gToken, `/${id}/values/${enc(a.range)}?valueInputOption=${vio}`,\n { method: \"PUT\", body: JSON.stringify({ values: a.values }) });\n case \"append\": return sheets(gToken, `/${id}/values/${enc(a.range)}:append?valueInputOption=${vio}`,\n { method: \"POST\", body: JSON.stringify({ values: a.values }) });\n case \"clear\": return sheets(gToken, `/${id}/values/${enc(a.range)}:clear`, { method: \"POST\" });\n case \"batchUpdate\": return sheets(gToken, `/${id}:batchUpdate`,\n { method: \"POST\", body: JSON.stringify({ requests: a.requests }) });\n // ---- Slides ----\n case \"slidesGet\": return slides(gToken, `/${a.presentationId}`);\n case \"slidesGetPage\": return slides(gToken, `/${a.presentationId}/pages/${enc(a.pageObjectId)}`);\n case \"slidesGetThumbnail\": {\n const p = new URLSearchParams();\n if (a.thumbnailSize) p.set(\"thumbnailProperties.thumbnailSize\", a.thumbnailSize);\n if (a.mimeType) p.set(\"thumbnailProperties.mimeType\", a.mimeType);\n const qs = p.toString();\n return slides(gToken, `/${a.presentationId}/pages/${enc(a.pageObjectId)}/thumbnail${qs ? `?${qs}` : \"\"}`);\n }\n case \"slidesBatchUpdate\": return slides(gToken, `/${a.presentationId}:batchUpdate`,\n { method: \"POST\", body: JSON.stringify({ requests: a.requests }) });\n case \"slidesCreate\": return slides(gToken, ``,\n { method: \"POST\", body: JSON.stringify({ title: a.title || \"Untitled presentation\" }) });\n default: throw new Error(`unknown action: ${action}`);\n }\n}\n\n// ---- MCP tool catalogue ----\nconst ID = { spreadsheetId: { type: \"string\", description: \"Spreadsheet ID — the token between /d/ and /edit in the sheet URL\" } };\nconst A1 = { range: { type: \"string\", description: \"A1 range, e.g. \\\"Tab 1!A1:C10\\\"; quote tab names with spaces/dots\" } };\nconst VALS = { values: { type: \"array\", items: { type: \"array\" }, description: \"2D array of cell values; strings starting with = are live formulas\" } };\nconst PID = { presentationId: { type: \"string\", description: \"Presentation ID — the token between /d/ and /edit in the deck URL\" } };\nconst TOOLS = [\n { name: \"sheets_whoami\", description: \"Return the Google account you are authenticated as.\", inputSchema: { type: \"object\", properties: {} } },\n { name: \"sheets_meta\", description: \"Spreadsheet structure: tab titles, sheetIds, dimensions, charts. Call this to get the numeric sheetId needed by sheets_batch_update.\", inputSchema: { type: \"object\", properties: { ...ID }, required: [\"spreadsheetId\"] } },\n { name: \"sheets_get\", description: \"Read a range's values.\", inputSchema: { type: \"object\", properties: { ...ID, ...A1 }, required: [\"spreadsheetId\", \"range\"] } },\n { name: \"sheets_get_grid\", description: \"Read cell formatting and formulas (includeGridData). Pass a fields mask to keep the response small.\", inputSchema: { type: \"object\", properties: { ...ID, ranges: { type: \"array\", items: { type: \"string\" } }, fields: { type: \"string\" } }, required: [\"spreadsheetId\"] } },\n { name: \"sheets_update\", description: \"Overwrite a range. Formulas parse live (USER_ENTERED).\", inputSchema: { type: \"object\", properties: { ...ID, ...A1, ...VALS, valueInputOption: { type: \"string\", enum: [\"USER_ENTERED\", \"RAW\"] } }, required: [\"spreadsheetId\", \"range\", \"values\"] } },\n { name: \"sheets_append\", description: \"Append rows after the last used row in a range.\", inputSchema: { type: \"object\", properties: { ...ID, ...A1, ...VALS, valueInputOption: { type: \"string\", enum: [\"USER_ENTERED\", \"RAW\"] } }, required: [\"spreadsheetId\", \"range\", \"values\"] } },\n { name: \"sheets_clear\", description: \"Clear the values in a range.\", inputSchema: { type: \"object\", properties: { ...ID, ...A1 }, required: [\"spreadsheetId\", \"range\"] } },\n { name: \"sheets_batch_update\", description: \"Apply spreadsheets.batchUpdate requests: formatting, freeze, borders, conditional formats, number formats, data-validation dropdowns, merges, add/delete tabs, charts, in-cell =IMAGE. 'requests' is the raw Sheets API requests array.\", inputSchema: { type: \"object\", properties: { ...ID, requests: { type: \"array\", items: { type: \"object\" } } }, required: [\"spreadsheetId\", \"requests\"] } },\n { name: \"slides_get\", description: \"Get a presentation: its slides, every page element, and their objectIds. Slides addresses everything by objectId (not by position), so call this first to get the objectIds needed for slides_batch_update.\", inputSchema: { type: \"object\", properties: { ...PID }, required: [\"presentationId\"] } },\n { name: \"slides_get_page\", description: \"Get one slide (page) by its objectId, including its page elements.\", inputSchema: { type: \"object\", properties: { ...PID, pageObjectId: { type: \"string\", description: \"objectId of the slide/page\" } }, required: [\"presentationId\", \"pageObjectId\"] } },\n { name: \"slides_get_thumbnail\", description: \"Render a slide to a PNG and return its contentUrl so you can SEE the result — use it to verify edits visually. Optional thumbnailSize LARGE|MEDIUM|SMALL.\", inputSchema: { type: \"object\", properties: { ...PID, pageObjectId: { type: \"string\", description: \"objectId of the slide to render\" }, thumbnailSize: { type: \"string\", enum: [\"LARGE\", \"MEDIUM\", \"SMALL\"] } }, required: [\"presentationId\", \"pageObjectId\"] } },\n { name: \"slides_batch_update\", description: \"Apply Slides batchUpdate requests: createSlide, deleteObject, insertText, createShape/createImage/createTable, updateTextStyle, replaceAllText, updatePageElementTransform (position/size in EMUs). 'requests' is the raw Slides API requests array. Get objectIds from slides_get first.\", inputSchema: { type: \"object\", properties: { ...PID, requests: { type: \"array\", items: { type: \"object\" } } }, required: [\"presentationId\", \"requests\"] } },\n { name: \"slides_create\", description: \"Create a new empty presentation owned by you and return its presentationId. Build it out with slides_batch_update.\", inputSchema: { type: \"object\", properties: { title: { type: \"string\", description: \"Title for the new deck\" } } } },\n];\nconst TOOL_ACTION: Record = {\n sheets_meta: \"meta\", sheets_get: \"get\", sheets_get_grid: \"getGrid\",\n sheets_update: \"update\", sheets_append: \"append\", sheets_clear: \"clear\", sheets_batch_update: \"batchUpdate\",\n slides_get: \"slidesGet\", slides_get_page: \"slidesGetPage\", slides_get_thumbnail: \"slidesGetThumbnail\",\n slides_batch_update: \"slidesBatchUpdate\", slides_create: \"slidesCreate\",\n};\n\nasync function handleRpc(msg: any, ctx: { g_refresh: string; user_email: string }) {\n const id = msg?.id ?? null;\n const reply = (result: any) => ({ jsonrpc: \"2.0\", id, result });\n const fail = (code: number, message: string) => ({ jsonrpc: \"2.0\", id, error: { code, message } });\n try {\n switch (msg?.method) {\n case \"initialize\":\n return reply({\n protocolVersion: msg?.params?.protocolVersion || PROTOCOL_VERSION,\n capabilities: { tools: { listChanged: false } },\n serverInfo: { name: \"gsheets-bridge\", version: \"2.1.0-oauth\" },\n });\n case \"ping\": return reply({});\n case \"tools/list\": return reply({ tools: TOOLS });\n case \"tools/call\": {\n const name = msg?.params?.name;\n const args = msg?.params?.arguments || {};\n try {\n if (name === \"sheets_whoami\") {\n return reply({ content: [{ type: \"text\", text: JSON.stringify({ user_email: ctx.user_email }, null, 2) }] });\n }\n const action = TOOL_ACTION[name];\n if (!action) return fail(-32602, `unknown tool: ${name}`);\n const gToken = await googleAccessToken(ctx.g_refresh);\n const data = await op(action, args, gToken);\n return reply({ content: [{ type: \"text\", text: JSON.stringify(data, null, 2) }] });\n } catch (e: any) {\n return reply({ content: [{ type: \"text\", text: \"Error: \" + String(e?.message || e) }], isError: true });\n }\n }\n default: return fail(-32601, `method not found: ${msg?.method}`);\n }\n } catch (e: any) {\n return fail(-32603, String(e?.message || e));\n }\n}\n\nconst isNotification = (m: any) => m && m.method && (m.id === undefined || m.id === null);\n\nexport default async function (req: Request): Promise {\n await schemaReady;\n const url = new URL(req.url);\n const origin = url.origin;\n const path = url.pathname;\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: {\n \"access-control-allow-origin\": \"*\",\n \"access-control-allow-methods\": \"GET,POST,OPTIONS\",\n \"access-control-allow-headers\": \"authorization,content-type\",\n } });\n }\n\n // ---- OAuth discovery ----\n if (path.startsWith(\"/.well-known/oauth-protected-resource\")) return json(prm(origin));\n if (path.startsWith(\"/.well-known/oauth-authorization-server\") || path.startsWith(\"/.well-known/openid-configuration\")) return json(asMetadata(origin));\n\n // ---- Dynamic Client Registration ----\n if (path === \"/register\" && req.method === \"POST\") {\n let m: any = {}; try { m = await req.json(); } catch {}\n const cid = randToken(16), csec = randToken(24);\n await sqlite.execute({ sql: \"INSERT INTO oauth_clients (client_id, client_secret, redirect_uris, created_at) VALUES (?,?,?,?)\", args: [cid, csec, JSON.stringify(m.redirect_uris || []), new Date().toISOString()] });\n return json({ client_id: cid, client_secret: csec, redirect_uris: m.redirect_uris || [], token_endpoint_auth_method: \"client_secret_post\", grant_types: [\"authorization_code\", \"refresh_token\"], response_types: [\"code\"] }, 201);\n }\n\n // ---- /authorize: bounce the user to Google ----\n if (path === \"/authorize\" && req.method === \"GET\") {\n if (!clientId()) return json({ error: \"server_not_configured\", detail: \"GOOGLE_OAUTH_CLIENT_ID not set\" }, 500);\n const p = url.searchParams;\n const claudeRedirect = p.get(\"redirect_uri\") || \"\";\n if (!CLAUDE_CALLBACKS.includes(claudeRedirect)) return json({ error: \"invalid_redirect_uri\", detail: claudeRedirect }, 400);\n const gstate = randToken(24);\n await sqlite.execute({ sql: \"INSERT INTO oauth_pending (gstate, client_id, claude_redirect, claude_state, code_challenge, ccm, created_at) VALUES (?,?,?,?,?,?,?)\", args: [gstate, p.get(\"client_id\") || \"\", claudeRedirect, p.get(\"state\") || \"\", p.get(\"code_challenge\") || \"\", p.get(\"code_challenge_method\") || \"\", new Date().toISOString()] });\n const g = new URLSearchParams({ client_id: clientId(), redirect_uri: `${origin}/oauth/google/callback`, response_type: \"code\", scope: GOOGLE_SCOPES, access_type: \"offline\", prompt: \"consent\", state: gstate });\n return new Response(null, { status: 302, headers: { Location: `${GOOGLE_AUTH}?${g.toString()}` } });\n }\n\n // ---- Google calls us back; mint our own code for Claude ----\n if (path === \"/oauth/google/callback\" && req.method === \"GET\") {\n const code = url.searchParams.get(\"code\"), gstate = url.searchParams.get(\"state\");\n if (!code || !gstate) return json({ error: \"missing code/state\" }, 400);\n const pend = (await sqlite.execute({ sql: \"SELECT client_id, claude_redirect, claude_state, code_challenge, ccm FROM oauth_pending WHERE gstate=?\", args: [gstate] })).rows[0];\n if (!pend) return json({ error: \"unknown state\" }, 400);\n await sqlite.execute({ sql: \"DELETE FROM oauth_pending WHERE gstate=?\", args: [gstate] });\n const body = new URLSearchParams({ client_id: clientId(), client_secret: clientSecret(), code, grant_type: \"authorization_code\", redirect_uri: `${origin}/oauth/google/callback` });\n const tr = await fetch(GOOGLE_TOKEN, { method: \"POST\", headers: { \"content-type\": \"application/x-www-form-urlencoded\" }, body });\n const tj = await tr.json();\n if (!tr.ok) return json({ error: \"google_token_exchange_failed\", detail: tj }, 400);\n const gRefresh = tj.refresh_token;\n if (!gRefresh) return json({ error: \"no_refresh_token\", detail: \"Google returned no refresh token (need access_type=offline & prompt=consent, and a first-time grant)\" }, 400);\n let email = \"\";\n try { const ur = await fetch(GOOGLE_USERINFO, { headers: { authorization: `Bearer ${tj.access_token}` } }); email = (await ur.json()).email || \"\"; } catch {}\n const ccode = randToken(24);\n await sqlite.execute({ sql: \"INSERT INTO oauth_codes (code, client_id, redirect_uri, code_challenge, ccm, g_refresh, user_email, expires_at) VALUES (?,?,?,?,?,?,?,?)\", args: [ccode, String(pend[0]), String(pend[1]), String(pend[3]), String(pend[4]), gRefresh, email, Date.now() + 600_000] });\n const back = new URL(String(pend[1]));\n back.searchParams.set(\"code\", ccode);\n if (pend[2]) back.searchParams.set(\"state\", String(pend[2]));\n return new Response(null, { status: 302, headers: { Location: back.toString() } });\n }\n\n // ---- /token: Claude exchanges code (or refreshes) for our tokens ----\n if (path === \"/token\" && req.method === \"POST\") {\n const form = new URLSearchParams(await req.text());\n const grant = form.get(\"grant_type\");\n if (grant === \"authorization_code\") {\n const code = form.get(\"code\") || \"\", verifier = form.get(\"code_verifier\") || \"\";\n const row = (await sqlite.execute({ sql: \"SELECT client_id, redirect_uri, code_challenge, ccm, g_refresh, user_email, expires_at FROM oauth_codes WHERE code=?\", args: [code] })).rows[0];\n if (!row) return json({ error: \"invalid_grant\" }, 400);\n await sqlite.execute({ sql: \"DELETE FROM oauth_codes WHERE code=?\", args: [code] });\n if (Number(row[6]) < Date.now()) return json({ error: \"invalid_grant\", detail: \"code expired\" }, 400);\n const challenge = String(row[2] || \"\");\n if (challenge) { if ((await sha256b64url(verifier)) !== challenge) return json({ error: \"invalid_grant\", detail: \"PKCE mismatch\" }, 400); }\n const access = randToken(32), refresh = randToken(32);\n await sqlite.execute({ sql: \"INSERT INTO oauth_tokens (access_hash, refresh_hash, client_id, g_refresh, user_email, access_exp, created_at) VALUES (?,?,?,?,?,?,?)\", args: [await sha256b64url(access), await sha256b64url(refresh), String(row[0]), String(row[4]), String(row[5]), Date.now() + 3600_000, new Date().toISOString()] });\n return json({ access_token: access, token_type: \"Bearer\", expires_in: 3600, refresh_token: refresh, scope: GOOGLE_SCOPES });\n }\n if (grant === \"refresh_token\") {\n const rt = form.get(\"refresh_token\") || \"\", rh = await sha256b64url(rt);\n const row = (await sqlite.execute({ sql: \"SELECT g_refresh, user_email FROM oauth_tokens WHERE refresh_hash=?\", args: [rh] })).rows[0];\n if (!row) return json({ error: \"invalid_grant\" }, 400);\n const access = randToken(32);\n await sqlite.execute({ sql: \"UPDATE oauth_tokens SET access_hash=?, access_exp=? WHERE refresh_hash=?\", args: [await sha256b64url(access), Date.now() + 3600_000, rh] });\n return json({ access_token: access, token_type: \"Bearer\", expires_in: 3600, refresh_token: rt, scope: GOOGLE_SCOPES });\n }\n return json({ error: \"unsupported_grant_type\" }, 400);\n }\n\n // ---- MCP transport: POST /mcp with Bearer ----\n if (path.startsWith(\"/mcp\")) {\n const challenge = { \"WWW-Authenticate\": `Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\"` };\n const m = (req.headers.get(\"authorization\") || \"\").match(/^Bearer\\s+(.+)$/i);\n if (!m) return json({ error: \"unauthorized\" }, 401, challenge);\n const row = (await sqlite.execute({ sql: \"SELECT g_refresh, user_email, access_exp FROM oauth_tokens WHERE access_hash=?\", args: [await sha256b64url(m[1])] })).rows[0];\n if (!row) return json({ error: \"invalid_token\" }, 401, challenge);\n if (Number(row[2]) < Date.now()) return json({ error: \"invalid_token\", detail: \"expired\" }, 401, challenge);\n if (req.method !== \"POST\") return new Response(null, { status: 405, headers: { Allow: \"POST\" } });\n const ctx = { g_refresh: String(row[0]), user_email: String(row[1]) };\n let body: any; try { body = await req.json(); } catch { return json({ jsonrpc: \"2.0\", id: null, error: { code: -32700, message: \"parse error\" } }); }\n if (Array.isArray(body)) { const out: any[] = []; for (const mm of body) if (!isNotification(mm)) out.push(await handleRpc(mm, ctx)); return out.length ? json(out) : new Response(null, { status: 202 }); }\n if (isNotification(body)) return new Response(null, { status: 202 });\n return json(await handleRpc(body, ctx));\n }\n\n // ---- root ----\n return json({ service: \"gsheets-bridge (oauth)\", connector_url: `${origin}/mcp`, status: clientId() ? \"configured\" : \"awaiting GOOGLE_OAUTH_CLIENT_ID/SECRET\" });\n}\n","// gsheetsBridge — OAuth edition. Each user authenticates as THEMSELVES with Google;\n// the val brokers Google sign-in and calls the Sheets + Slides APIs on the user's behalf.\n//\n// This val plays two OAuth roles at once:\n// (a) an OAuth 2.1 authorization server that Claude logs into (the MCP connector), and\n// (b) an OAuth client of Google (to obtain each user's own Sheets/Slides access).\n//\n// Flow: Claude -> /authorize -> (redirect) Google consent -> /oauth/google/callback\n// -> val stores the user's Google refresh token, issues its own code -> Claude POST /token\n// -> val issues access+refresh tokens -> Claude calls /mcp with a Bearer token\n// -> val refreshes a Google access token for that user and calls Google AS them.\n//\n// Authorization is enforced by Google: a user can only touch files their own account\n// is shared on. No service account, no group, no claiming.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst PROTOCOL_VERSION = \"2025-06-18\";\nconst enc = encodeURIComponent;\n\nconst GOOGLE_AUTH = \"https://accounts.google.com/o/oauth2/v2/auth\";\nconst GOOGLE_TOKEN = \"https://oauth2.googleapis.com/token\";\nconst GOOGLE_USERINFO = \"https://openidconnect.googleapis.com/v1/userinfo\";\nconst GOOGLE_SCOPES = \"openid email https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/presentations\";\nconst CLAUDE_CALLBACKS = [\n \"https://claude.ai/api/mcp/auth_callback\",\n \"https://claude.com/api/mcp/auth_callback\",\n];\n\nconst clientId = () => Deno.env.get(\"GOOGLE_OAUTH_CLIENT_ID\") || \"\";\nconst clientSecret = () => Deno.env.get(\"GOOGLE_OAUTH_CLIENT_SECRET\") || \"\";\n\n// ---- storage ----\nconst schemaReady = (async () => {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS oauth_clients (client_id TEXT PRIMARY KEY, client_secret TEXT, redirect_uris TEXT, created_at TEXT)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS oauth_pending (gstate TEXT PRIMARY KEY, client_id TEXT, claude_redirect TEXT, claude_state TEXT, code_challenge TEXT, ccm TEXT, created_at TEXT)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS oauth_codes (code TEXT PRIMARY KEY, client_id TEXT, redirect_uri TEXT, code_challenge TEXT, ccm TEXT, g_refresh TEXT, user_email TEXT, expires_at INTEGER)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS oauth_tokens (access_hash TEXT PRIMARY KEY, refresh_hash TEXT, client_id TEXT, g_refresh TEXT, user_email TEXT, access_exp INTEGER, created_at TEXT)`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS gsb_debug (id INTEGER PRIMARY KEY AUTOINCREMENT, ts TEXT, sess TEXT, email TEXT, method TEXT, tool TEXT, outcome TEXT, error TEXT)`);\n})();\n\nfunction b64url(bytes: Uint8Array): string {\n return btoa(String.fromCharCode(...bytes)).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\nfunction randToken(n = 32): string {\n const b = new Uint8Array(n); crypto.getRandomValues(b); return b64url(b);\n}\nasync function sha256b64url(s: string): Promise {\n const buf = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return b64url(new Uint8Array(buf));\n}\nfunction json(obj: unknown, status = 200, headers: Record = {}) {\n return new Response(JSON.stringify(obj, null, 2), {\n status,\n headers: { \"content-type\": \"application/json\", \"access-control-allow-origin\": \"*\", ...headers },\n });\n}\n\n// ---- debug log (temporary; drop gsb_debug when done) ----\nasync function dbg(sess: string, email: string, method: string, tool: string, outcome: string, error: string) {\n try {\n await sqlite.execute({\n sql: \"INSERT INTO gsb_debug (ts, sess, email, method, tool, outcome, error) VALUES (?,?,?,?,?,?,?)\",\n args: [new Date().toISOString(), sess, email, method, tool, outcome, String(error).slice(0, 500)],\n });\n } catch {}\n}\n\n// ---- discovery documents ----\nfunction asMetadata(origin: string) {\n return {\n issuer: origin,\n authorization_endpoint: `${origin}/authorize`,\n token_endpoint: `${origin}/token`,\n registration_endpoint: `${origin}/register`,\n response_types_supported: [\"code\"],\n grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n code_challenge_methods_supported: [\"S256\"],\n token_endpoint_auth_methods_supported: [\"client_secret_post\", \"none\"],\n scopes_supported: [\"openid\", \"email\", \"https://www.googleapis.com/auth/spreadsheets\", \"https://www.googleapis.com/auth/presentations\"],\n };\n}\nfunction prm(origin: string) {\n return {\n resource: origin,\n authorization_servers: [origin],\n scopes_supported: [\"https://www.googleapis.com/auth/spreadsheets\", \"https://www.googleapis.com/auth/presentations\"],\n bearer_methods_supported: [\"header\"],\n };\n}\n\n// ---- google access tokens (per-user, cached briefly per isolate) ----\nconst gTokenCache = new Map();\nasync function googleAccessToken(refresh: string): Promise {\n const k = await sha256b64url(refresh);\n const c = gTokenCache.get(k);\n if (c && c.exp > Date.now() + 60_000) return c.token;\n const body = new URLSearchParams({\n client_id: clientId(), client_secret: clientSecret(),\n refresh_token: refresh, grant_type: \"refresh_token\",\n });\n const r = await fetch(GOOGLE_TOKEN, { method: \"POST\", headers: { \"content-type\": \"application/x-www-form-urlencoded\" }, body });\n const j = await r.json();\n if (!r.ok) throw new Error(\"google token refresh failed: \" + JSON.stringify(j));\n const token = j.access_token as string;\n const exp = Date.now() + ((j.expires_in || 3600) * 1000);\n gTokenCache.set(k, { token, exp });\n return token;\n}\n\nasync function sheets(gToken: string, path: string, init: RequestInit = {}) {\n const r = await fetch(`https://sheets.googleapis.com/v4/spreadsheets${path}`, {\n ...init,\n headers: { authorization: `Bearer ${gToken}`, \"content-type\": \"application/json\", ...(init.headers || {}) },\n });\n const text = await r.text();\n if (!r.ok) throw Object.assign(new Error(`Sheets API ${r.status}: ${text}`), { status: r.status });\n try { return JSON.parse(text); } catch { return { raw: text }; }\n}\n\nasync function slides(gToken: string, path: string, init: RequestInit = {}) {\n const r = await fetch(`https://slides.googleapis.com/v1/presentations${path}`, {\n ...init,\n headers: { authorization: `Bearer ${gToken}`, \"content-type\": \"application/json\", ...(init.headers || {}) },\n });\n const text = await r.text();\n if (!r.ok) throw Object.assign(new Error(`Slides API ${r.status}: ${text}`), { status: r.status });\n try { return JSON.parse(text); } catch { return { raw: text }; }\n}\n\nasync function op(action: string, a: any, gToken: string) {\n const id = a?.spreadsheetId;\n const vio = a?.valueInputOption || \"USER_ENTERED\";\n switch (action) {\n case \"meta\": return sheets(gToken, `/${id}`);\n case \"get\": return sheets(gToken, `/${id}/values/${enc(a.range)}`);\n case \"getGrid\": {\n const p = new URLSearchParams({ includeGridData: \"true\" });\n if (a.ranges) for (const rg of [].concat(a.ranges)) p.append(\"ranges\", rg);\n if (a.fields) p.set(\"fields\", a.fields);\n return sheets(gToken, `/${id}?${p.toString()}`);\n }\n case \"update\": return sheets(gToken, `/${id}/values/${enc(a.range)}?valueInputOption=${vio}`,\n { method: \"PUT\", body: JSON.stringify({ values: a.values }) });\n case \"append\": return sheets(gToken, `/${id}/values/${enc(a.range)}:append?valueInputOption=${vio}`,\n { method: \"POST\", body: JSON.stringify({ values: a.values }) });\n case \"clear\": return sheets(gToken, `/${id}/values/${enc(a.range)}:clear`, { method: \"POST\" });\n case \"batchUpdate\": return sheets(gToken, `/${id}:batchUpdate`,\n { method: \"POST\", body: JSON.stringify({ requests: a.requests }) });\n // ---- Slides ----\n case \"slidesGet\": return slides(gToken, `/${a.presentationId}`);\n case \"slidesGetPage\": return slides(gToken, `/${a.presentationId}/pages/${enc(a.pageObjectId)}`);\n case \"slidesGetThumbnail\": {\n const p = new URLSearchParams();\n if (a.thumbnailSize) p.set(\"thumbnailProperties.thumbnailSize\", a.thumbnailSize);\n if (a.mimeType) p.set(\"thumbnailProperties.mimeType\", a.mimeType);\n const qs = p.toString();\n return slides(gToken, `/${a.presentationId}/pages/${enc(a.pageObjectId)}/thumbnail${qs ? `?${qs}` : \"\"}`);\n }\n case \"slidesBatchUpdate\": return slides(gToken, `/${a.presentationId}:batchUpdate`,\n { method: \"POST\", body: JSON.stringify({ requests: a.requests }) });\n case \"slidesCreate\": return slides(gToken, ``,\n { method: \"POST\", body: JSON.stringify({ title: a.title || \"Untitled presentation\" }) });\n default: throw new Error(`unknown action: ${action}`);\n }\n}\n\n// ---- MCP tool catalogue ----\nconst ID = { spreadsheetId: { type: \"string\", description: \"Spreadsheet ID — the token between /d/ and /edit in the sheet URL\" } };\nconst A1 = { range: { type: \"string\", description: \"A1 range, e.g. \\\"Tab 1!A1:C10\\\"; quote tab names with spaces/dots\" } };\nconst VALS = { values: { type: \"array\", items: { type: \"array\" }, description: \"2D array of cell values; strings starting with = are live formulas\" } };\nconst PID = { presentationId: { type: \"string\", description: \"Presentation ID — the token between /d/ and /edit in the deck URL\" } };\nconst TOOLS = [\n { name: \"sheets_whoami\", description: \"Return the Google account you are authenticated as.\", inputSchema: { type: \"object\", properties: {} } },\n { name: \"sheets_meta\", description: \"Spreadsheet structure: tab titles, sheetIds, dimensions, charts. Call this to get the numeric sheetId needed by sheets_batch_update.\", inputSchema: { type: \"object\", properties: { ...ID }, required: [\"spreadsheetId\"] } },\n { name: \"sheets_get\", description: \"Read a range's values.\", inputSchema: { type: \"object\", properties: { ...ID, ...A1 }, required: [\"spreadsheetId\", \"range\"] } },\n { name: \"sheets_get_grid\", description: \"Read cell formatting and formulas (includeGridData). Pass a fields mask to keep the response small.\", inputSchema: { type: \"object\", properties: { ...ID, ranges: { type: \"array\", items: { type: \"string\" } }, fields: { type: \"string\" } }, required: [\"spreadsheetId\"] } },\n { name: \"sheets_update\", description: \"Overwrite a range. Formulas parse live (USER_ENTERED).\", inputSchema: { type: \"object\", properties: { ...ID, ...A1, ...VALS, valueInputOption: { type: \"string\", enum: [\"USER_ENTERED\", \"RAW\"] } }, required: [\"spreadsheetId\", \"range\", \"values\"] } },\n { name: \"sheets_append\", description: \"Append rows after the last used row in a range.\", inputSchema: { type: \"object\", properties: { ...ID, ...A1, ...VALS, valueInputOption: { type: \"string\", enum: [\"USER_ENTERED\", \"RAW\"] } }, required: [\"spreadsheetId\", \"range\", \"values\"] } },\n { name: \"sheets_clear\", description: \"Clear the values in a range.\", inputSchema: { type: \"object\", properties: { ...ID, ...A1 }, required: [\"spreadsheetId\", \"range\"] } },\n { name: \"sheets_batch_update\", description: \"Apply spreadsheets.batchUpdate requests: formatting, freeze, borders, conditional formats, number formats, data-validation dropdowns, merges, add/delete tabs, charts, in-cell =IMAGE. 'requests' is the raw Sheets API requests array.\", inputSchema: { type: \"object\", properties: { ...ID, requests: { type: \"array\", items: { type: \"object\" } } }, required: [\"spreadsheetId\", \"requests\"] } },\n { name: \"slides_get\", description: \"Get a presentation: its slides, every page element, and their objectIds. Slides addresses everything by objectId (not by position), so call this first to get the objectIds needed for slides_batch_update.\", inputSchema: { type: \"object\", properties: { ...PID }, required: [\"presentationId\"] } },\n { name: \"slides_get_page\", description: \"Get one slide (page) by its objectId, including its page elements.\", inputSchema: { type: \"object\", properties: { ...PID, pageObjectId: { type: \"string\", description: \"objectId of the slide/page\" } }, required: [\"presentationId\", \"pageObjectId\"] } },\n { name: \"slides_get_thumbnail\", description: \"Render a slide to a PNG and return its contentUrl so you can SEE the result — use it to verify edits visually. Optional thumbnailSize LARGE|MEDIUM|SMALL.\", inputSchema: { type: \"object\", properties: { ...PID, pageObjectId: { type: \"string\", description: \"objectId of the slide to render\" }, thumbnailSize: { type: \"string\", enum: [\"LARGE\", \"MEDIUM\", \"SMALL\"] } }, required: [\"presentationId\", \"pageObjectId\"] } },\n { name: \"slides_batch_update\", description: \"Apply Slides batchUpdate requests: createSlide, deleteObject, insertText, createShape/createImage/createTable, updateTextStyle, replaceAllText, updatePageElementTransform (position/size in EMUs). 'requests' is the raw Slides API requests array. Get objectIds from slides_get first.\", inputSchema: { type: \"object\", properties: { ...PID, requests: { type: \"array\", items: { type: \"object\" } } }, required: [\"presentationId\", \"requests\"] } },\n { name: \"slides_create\", description: \"Create a new empty presentation owned by you and return its presentationId. Build it out with slides_batch_update.\", inputSchema: { type: \"object\", properties: { title: { type: \"string\", description: \"Title for the new deck\" } } } },\n];\nconst TOOL_ACTION: Record = {\n sheets_meta: \"meta\", sheets_get: \"get\", sheets_get_grid: \"getGrid\",\n sheets_update: \"update\", sheets_append: \"append\", sheets_clear: \"clear\", sheets_batch_update: \"batchUpdate\",\n slides_get: \"slidesGet\", slides_get_page: \"slidesGetPage\", slides_get_thumbnail: \"slidesGetThumbnail\",\n slides_batch_update: \"slidesBatchUpdate\", slides_create: \"slidesCreate\",\n};\n\nasync function handleRpc(msg: any, ctx: { g_refresh: string; user_email: string; sess: string }) {\n const id = msg?.id ?? null;\n const method = String(msg?.method || \"\");\n const reply = (result: any) => ({ jsonrpc: \"2.0\", id, result });\n const fail = (code: number, message: string) => ({ jsonrpc: \"2.0\", id, error: { code, message } });\n const toolName = method === \"tools/call\" ? String(msg?.params?.name || \"\") : \"\";\n await dbg(ctx.sess, ctx.user_email, method, toolName, \"recv\", \"\");\n try {\n switch (msg?.method) {\n case \"initialize\":\n return reply({\n protocolVersion: msg?.params?.protocolVersion || PROTOCOL_VERSION,\n capabilities: { tools: { listChanged: false } },\n serverInfo: { name: \"gsheets-bridge\", version: \"2.1.0-oauth\" },\n });\n case \"ping\": return reply({});\n case \"tools/list\": return reply({ tools: TOOLS });\n case \"tools/call\": {\n const name = msg?.params?.name;\n const args = msg?.params?.arguments || {};\n try {\n if (name === \"sheets_whoami\") {\n await dbg(ctx.sess, ctx.user_email, method, name, \"ok\", \"\");\n return reply({ content: [{ type: \"text\", text: JSON.stringify({ user_email: ctx.user_email }, null, 2) }] });\n }\n const action = TOOL_ACTION[name];\n if (!action) { await dbg(ctx.sess, ctx.user_email, method, String(name), \"rpcError\", \"unknown tool\"); return fail(-32602, `unknown tool: ${name}`); }\n const gToken = await googleAccessToken(ctx.g_refresh);\n const data = await op(action, args, gToken);\n await dbg(ctx.sess, ctx.user_email, method, name, \"ok\", \"\");\n return reply({ content: [{ type: \"text\", text: JSON.stringify(data, null, 2) }] });\n } catch (e: any) {\n await dbg(ctx.sess, ctx.user_email, method, String(name), \"toolError\", String(e?.message || e));\n return reply({ content: [{ type: \"text\", text: \"Error: \" + String(e?.message || e) }], isError: true });\n }\n }\n default: await dbg(ctx.sess, ctx.user_email, method, \"\", \"rpcError\", \"method not found\"); return fail(-32601, `method not found: ${msg?.method}`);\n }\n } catch (e: any) {\n await dbg(ctx.sess, ctx.user_email, method, toolName, \"fatal\", String(e?.message || e));\n return fail(-32603, String(e?.message || e));\n }\n}\n\nconst isNotification = (m: any) => m && m.method && (m.id === undefined || m.id === null);\n\nexport default async function (req: Request): Promise {\n await schemaReady;\n const url = new URL(req.url);\n const origin = url.origin;\n const path = url.pathname;\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: {\n \"access-control-allow-origin\": \"*\",\n \"access-control-allow-methods\": \"GET,POST,OPTIONS\",\n \"access-control-allow-headers\": \"authorization,content-type\",\n } });\n }\n\n // ---- OAuth discovery ----\n if (path.startsWith(\"/.well-known/oauth-protected-resource\")) return json(prm(origin));\n if (path.startsWith(\"/.well-known/oauth-authorization-server\") || path.startsWith(\"/.well-known/openid-configuration\")) return json(asMetadata(origin));\n\n // ---- Dynamic Client Registration ----\n if (path === \"/register\" && req.method === \"POST\") {\n let m: any = {}; try { m = await req.json(); } catch {}\n const cid = randToken(16), csec = randToken(24);\n await sqlite.execute({ sql: \"INSERT INTO oauth_clients (client_id, client_secret, redirect_uris, created_at) VALUES (?,?,?,?)\", args: [cid, csec, JSON.stringify(m.redirect_uris || []), new Date().toISOString()] });\n return json({ client_id: cid, client_secret: csec, redirect_uris: m.redirect_uris || [], token_endpoint_auth_method: \"client_secret_post\", grant_types: [\"authorization_code\", \"refresh_token\"], response_types: [\"code\"] }, 201);\n }\n\n // ---- /authorize: bounce the user to Google ----\n if (path === \"/authorize\" && req.method === \"GET\") {\n if (!clientId()) return json({ error: \"server_not_configured\", detail: \"GOOGLE_OAUTH_CLIENT_ID not set\" }, 500);\n const p = url.searchParams;\n const claudeRedirect = p.get(\"redirect_uri\") || \"\";\n if (!CLAUDE_CALLBACKS.includes(claudeRedirect)) return json({ error: \"invalid_redirect_uri\", detail: claudeRedirect }, 400);\n const gstate = randToken(24);\n await sqlite.execute({ sql: \"INSERT INTO oauth_pending (gstate, client_id, claude_redirect, claude_state, code_challenge, ccm, created_at) VALUES (?,?,?,?,?,?,?)\", args: [gstate, p.get(\"client_id\") || \"\", claudeRedirect, p.get(\"state\") || \"\", p.get(\"code_challenge\") || \"\", p.get(\"code_challenge_method\") || \"\", new Date().toISOString()] });\n const g = new URLSearchParams({ client_id: clientId(), redirect_uri: `${origin}/oauth/google/callback`, response_type: \"code\", scope: GOOGLE_SCOPES, access_type: \"offline\", prompt: \"consent\", state: gstate });\n return new Response(null, { status: 302, headers: { Location: `${GOOGLE_AUTH}?${g.toString()}` } });\n }\n\n // ---- Google calls us back; mint our own code for Claude ----\n if (path === \"/oauth/google/callback\" && req.method === \"GET\") {\n const code = url.searchParams.get(\"code\"), gstate = url.searchParams.get(\"state\");\n if (!code || !gstate) return json({ error: \"missing code/state\" }, 400);\n const pend = (await sqlite.execute({ sql: \"SELECT client_id, claude_redirect, claude_state, code_challenge, ccm FROM oauth_pending WHERE gstate=?\", args: [gstate] })).rows[0];\n if (!pend) return json({ error: \"unknown state\" }, 400);\n await sqlite.execute({ sql: \"DELETE FROM oauth_pending WHERE gstate=?\", args: [gstate] });\n const body = new URLSearchParams({ client_id: clientId(), client_secret: clientSecret(), code, grant_type: \"authorization_code\", redirect_uri: `${origin}/oauth/google/callback` });\n const tr = await fetch(GOOGLE_TOKEN, { method: \"POST\", headers: { \"content-type\": \"application/x-www-form-urlencoded\" }, body });\n const tj = await tr.json();\n if (!tr.ok) return json({ error: \"google_token_exchange_failed\", detail: tj }, 400);\n const gRefresh = tj.refresh_token;\n if (!gRefresh) return json({ error: \"no_refresh_token\", detail: \"Google returned no refresh token (need access_type=offline & prompt=consent, and a first-time grant)\" }, 400);\n let email = \"\";\n try { const ur = await fetch(GOOGLE_USERINFO, { headers: { authorization: `Bearer ${tj.access_token}` } }); email = (await ur.json()).email || \"\"; } catch {}\n const ccode = randToken(24);\n await sqlite.execute({ sql: \"INSERT INTO oauth_codes (code, client_id, redirect_uri, code_challenge, ccm, g_refresh, user_email, expires_at) VALUES (?,?,?,?,?,?,?,?)\", args: [ccode, String(pend[0]), String(pend[1]), String(pend[3]), String(pend[4]), gRefresh, email, Date.now() + 600_000] });\n const back = new URL(String(pend[1]));\n back.searchParams.set(\"code\", ccode);\n if (pend[2]) back.searchParams.set(\"state\", String(pend[2]));\n return new Response(null, { status: 302, headers: { Location: back.toString() } });\n }\n\n // ---- /token: Claude exchanges code (or refreshes) for our tokens ----\n if (path === \"/token\" && req.method === \"POST\") {\n const form = new URLSearchParams(await req.text());\n const grant = form.get(\"grant_type\");\n if (grant === \"authorization_code\") {\n const code = form.get(\"code\") || \"\", verifier = form.get(\"code_verifier\") || \"\";\n const row = (await sqlite.execute({ sql: \"SELECT client_id, redirect_uri, code_challenge, ccm, g_refresh, user_email, expires_at FROM oauth_codes WHERE code=?\", args: [code] })).rows[0];\n if (!row) return json({ error: \"invalid_grant\" }, 400);\n await sqlite.execute({ sql: \"DELETE FROM oauth_codes WHERE code=?\", args: [code] });\n if (Number(row[6]) < Date.now()) return json({ error: \"invalid_grant\", detail: \"code expired\" }, 400);\n const challenge = String(row[2] || \"\");\n if (challenge) { if ((await sha256b64url(verifier)) !== challenge) return json({ error: \"invalid_grant\", detail: \"PKCE mismatch\" }, 400); }\n const access = randToken(32), refresh = randToken(32);\n await sqlite.execute({ sql: \"INSERT INTO oauth_tokens (access_hash, refresh_hash, client_id, g_refresh, user_email, access_exp, created_at) VALUES (?,?,?,?,?,?,?)\", args: [await sha256b64url(access), await sha256b64url(refresh), String(row[0]), String(row[4]), String(row[5]), Date.now() + 3600_000, new Date().toISOString()] });\n return json({ access_token: access, token_type: \"Bearer\", expires_in: 3600, refresh_token: refresh, scope: GOOGLE_SCOPES });\n }\n if (grant === \"refresh_token\") {\n const rt = form.get(\"refresh_token\") || \"\", rh = await sha256b64url(rt);\n const row = (await sqlite.execute({ sql: \"SELECT g_refresh, user_email FROM oauth_tokens WHERE refresh_hash=?\", args: [rh] })).rows[0];\n if (!row) return json({ error: \"invalid_grant\" }, 400);\n const access = randToken(32);\n await sqlite.execute({ sql: \"UPDATE oauth_tokens SET access_hash=?, access_exp=? WHERE refresh_hash=?\", args: [await sha256b64url(access), Date.now() + 3600_000, rh] });\n return json({ access_token: access, token_type: \"Bearer\", expires_in: 3600, refresh_token: rt, scope: GOOGLE_SCOPES });\n }\n return json({ error: \"unsupported_grant_type\" }, 400);\n }\n\n // ---- MCP transport: POST /mcp with Bearer ----\n if (path.startsWith(\"/mcp\")) {\n const challenge = { \"WWW-Authenticate\": `Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\"` };\n const m = (req.headers.get(\"authorization\") || \"\").match(/^Bearer\\s+(.+)$/i);\n if (!m) return json({ error: \"unauthorized\" }, 401, challenge);\n const ah = await sha256b64url(m[1]);\n const row = (await sqlite.execute({ sql: \"SELECT g_refresh, user_email, access_exp FROM oauth_tokens WHERE access_hash=?\", args: [ah] })).rows[0];\n if (!row) { await dbg(ah.slice(0, 8), \"\", \"auth\", \"\", \"401-invalidtoken\", \"\"); return json({ error: \"invalid_token\" }, 401, challenge); }\n if (Number(row[2]) < Date.now()) { await dbg(ah.slice(0, 8), String(row[1] || \"\"), \"auth\", \"\", \"401-expired\", \"\"); return json({ error: \"invalid_token\", detail: \"expired\" }, 401, challenge); }\n if (req.method !== \"POST\") return new Response(null, { status: 405, headers: { Allow: \"POST\" } });\n const ctx = { g_refresh: String(row[0]), user_email: String(row[1]), sess: ah.slice(0, 8) };\n let body: any; try { body = await req.json(); } catch { return json({ jsonrpc: \"2.0\", id: null, error: { code: -32700, message: \"parse error\" } }); }\n if (Array.isArray(body)) { const out: any[] = []; for (const mm of body) if (!isNotification(mm)) out.push(await handleRpc(mm, ctx)); return out.length ? json(out) : new Response(null, { status: 202 }); }\n if (isNotification(body)) return new Response(null, { status: 202 });\n return json(await handleRpc(body, ctx));\n }\n\n // ---- root ----\n return json({ service: \"gsheets-bridge (oauth)\", connector_url: `${origin}/mcp`, status: clientId() ? \"configured\" : \"awaiting GOOGLE_OAUTH_CLIENT_ID/SECRET\" });\n}\n","createdAt",["D",1783623299159],"branchVersion","branchId","4110a3e6-6012-463e-b4ee-d9d70d11bc8c","id","80e3ae5b-75ef-44b7-82b8-f89f5245b1f2","google-workspace-bridge",["D",1781705012188],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Per-user OAuth bridge to edit Google Sheets, Slides & Docs","imageUrl","4d6a2ce9-7b0b-41ae-acae-02936cc37376","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019e6588-8f32-7029-9083-725ae084ef6f","tursoName","80e3ae5b75ef44b782b8f89f5245b1f2","tursoHostname","80e3ae5b75ef44b782b8f89f5245b1f2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789447865497],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":55,"_103":104,"_105":25},"branch",{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"isOwned",26,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","valentinmoebs","handle","displayName","Valentin Moebs","avatar","https://lh3.googleusercontent.com/a/ACg8ocKHKyhQu2hb7BbRWE8BJhDtC42HdaVpFZJ8vPB8I94_RiniZKUc=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":155,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":156,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":157,"_82":158,"_84":159,"_86":25},"tree",[150],"files",[150],"counts",{"_138":61,"_139":140,"_141":61,"_142":143,"_144":145},"contents",[130],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":131,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_133":25,"_38":134,"_13":135,"_33":34,"_35":37,"_24":25,"_136":-5,"_27":137},"5b92605f-b8e4-430e-8003-2cbe797c8335","parentId","latest",["D",1783623299159],9,"label",[28],"pulls","branches",1,"forks","envVars",{"_146":148,"_149":61},"connections",{"_146":61,"_147":61},"count","unfilledCount",2,"emptyCount",{"_43":131,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_133":25,"_38":151,"_13":135,"_33":34,"_35":37,"_24":25,"_136":-5,"_152":153,"_27":154},["D",1783623299159],"children",[],[28],["D",1781705012188],["D",1789447865497],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":55,"_103":104,"_105":25},{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"ctx",{"_80":-5,"_127":193,"_194":195,"_196":197,"_198":25,"_199":25,"_200":25,"_201":125,"_202":-5,"_203":-7,"_204":-7,"_205":61,"_206":25,"_207":25,"_208":-5,"_209":25,"_210":25,"_211":25,"_212":-5},"ENV",{"_164":165,"_166":167,"_168":88,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v10