[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_160":161,"_162":163},"routes/_app.x.$handle.$name",{"_98":97,"_32":45,"_107":88,"_27":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":25,"_122":123,"_124":125,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":25},"version",7,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","52fcb796-6a55-11f1-bda6-1607ee4eb77e","name","fileType","http","content","// gsheetsBridge — edit existing Google Sheets via a service account.\n//\n// Transports:\n// 1. JSON API (operator/admin): POST / Authorization: Bearer \n// 2. MCP server (per-user): POST /mcp/ (Streamable HTTP, stateless)\n// Add that URL as a Claude custom connector. The token in the path is the credential.\n//\n// Auth model (MCP path):\n// - API_SECRET, if set, is the ADMIN token: full access to every shared sheet and\n// bypasses the per-user allowlist. Do NOT hand this URL to end users.\n// - Any other sufficiently-long token (>= 20 chars) is a PER-USER token. On first\n// contact it is registered automatically (trust-on-first-use). A user token may\n// only touch spreadsheets it has \"claimed\": the first token to successfully access\n// a given sheet claims it; other tokens are then denied. whoami needs no claim.\n// - Set REGISTRATION_CLOSED=1 to stop auto-registering new tokens (kill switch);\n// already-registered tokens keep working.\n// - Admin/owner can inspect or reassign ownership directly in the val's SQLite\n// (tables gsb_tokens, gsb_claims).\n//\n// Google auth: reads GOOGLE_SA_KEY (full service-account JSON) and mints tokens via a\n// JWT bearer flow. Share a sheet with the group address (whose member is the SA) to grant access.\nimport { JWT } from \"npm:google-auth-library\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nconst SCOPES = [\"https://www.googleapis.com/auth/spreadsheets\"];\nconst PROTOCOL_VERSION = \"2025-06-18\";\nconst enc = encodeURIComponent;\nconst MIN_TOKEN_LEN = 20;\n\nconst adminSecret = () => Deno.env.get(\"API_SECRET\") || \"\";\nconst registrationClosed = () => /^(1|true|yes)$/i.test(Deno.env.get(\"REGISTRATION_CLOSED\") || \"\");\n\n// ---- storage: per-user tokens + per-sheet claims ----\nconst schemaReady = (async () => {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS gsb_tokens (token_hash TEXT PRIMARY KEY, created_at TEXT NOT NULL)`,\n );\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS gsb_claims (spreadsheet_id TEXT PRIMARY KEY, token_hash TEXT NOT NULL, claimed_at TEXT NOT NULL)`,\n );\n})();\n\nasync function sha256hex(s: string): Promise {\n const buf = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\ntype Authz =\n | { ok: false; status: number; message: string }\n | { ok: true; isAdmin: true }\n | { ok: true; isAdmin: false; tokenHash: string };\n\n// Validate the path token. Registers unknown (long-enough) tokens trust-on-first-use.\nasync function resolveToken(tok: string): Promise {\n if (!tok) return { ok: false, status: 401, message: \"unauthorized\" };\n const admin = adminSecret();\n if (admin && tok === admin) return { ok: true, isAdmin: true };\n await schemaReady;\n const hash = await sha256hex(tok);\n const found = await sqlite.execute({\n sql: \"SELECT 1 FROM gsb_tokens WHERE token_hash = ? LIMIT 1\",\n args: [hash],\n });\n if (found.rows.length === 0) {\n if (registrationClosed()) return { ok: false, status: 401, message: \"unknown token (registration closed)\" };\n if (tok.length < MIN_TOKEN_LEN) return { ok: false, status: 401, message: \"unauthorized\" };\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO gsb_tokens (token_hash, created_at) VALUES (?, ?)\",\n args: [hash, new Date().toISOString()],\n });\n }\n return { ok: true, isAdmin: false, tokenHash: hash };\n}\n\nasync function getClaim(spreadsheetId: string): Promise {\n await schemaReady;\n const r = await sqlite.execute({\n sql: \"SELECT token_hash FROM gsb_claims WHERE spreadsheet_id = ? LIMIT 1\",\n args: [spreadsheetId],\n });\n return r.rows.length ? String(r.rows[0][0]) : null;\n}\n\nasync function claimSheet(spreadsheetId: string, tokenHash: string): Promise {\n await schemaReady;\n try {\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO gsb_claims (spreadsheet_id, token_hash, claimed_at) VALUES (?, ?, ?)\",\n args: [spreadsheetId, tokenHash, new Date().toISOString()],\n });\n } catch { /* race: another request claimed first; next request enforces */ }\n}\n\nasync function listClaims(tokenHash: string): Promise {\n await schemaReady;\n const r = await sqlite.execute({\n sql: \"SELECT spreadsheet_id FROM gsb_claims WHERE token_hash = ? ORDER BY claimed_at\",\n args: [tokenHash],\n });\n return r.rows.map((row: any) => String(row[0]));\n}\n\nfunction saCreds() {\n const raw = Deno.env.get(\"GOOGLE_SA_KEY\");\n if (!raw) throw new Error(\"Missing GOOGLE_SA_KEY env var\");\n return JSON.parse(raw);\n}\n\nasync function getToken(): Promise {\n const c = saCreds();\n const jwt = new JWT({ email: c.client_email, key: c.private_key, scopes: SCOPES });\n const { token } = await jwt.getAccessToken();\n if (!token) throw new Error(\"failed to obtain Google access token\");\n return token;\n}\n\nasync function sheets(path: string, init: RequestInit = {}) {\n const token = await getToken();\n const r = await fetch(`https://sheets.googleapis.com/v4/spreadsheets${path}`, {\n ...init,\n headers: { authorization: `Bearer ${token}`, \"content-type\": \"application/json\", ...(init.headers || {}) },\n });\n const text = await r.text();\n if (!r.ok) throw Object.assign(new Error(`Sheets API ${r.status}: ${text}`), { status: r.status });\n try { return JSON.parse(text); } catch { return { raw: text }; }\n}\n\n// Operations shared by both transports.\nasync function op(action: string, a: any) {\n const id = a?.spreadsheetId;\n const vio = a?.valueInputOption || \"USER_ENTERED\";\n switch (action) {\n case \"whoami\": { const c = saCreds(); return { client_email: c.client_email, project_id: c.project_id }; }\n case \"meta\": return sheets(`/${id}`);\n case \"get\": return sheets(`/${id}/values/${enc(a.range)}`);\n case \"getGrid\": {\n const p = new URLSearchParams({ includeGridData: \"true\" });\n if (a.ranges) for (const rg of [].concat(a.ranges)) p.append(\"ranges\", rg);\n if (a.fields) p.set(\"fields\", a.fields);\n return sheets(`/${id}?${p.toString()}`);\n }\n case \"update\": return sheets(`/${id}/values/${enc(a.range)}?valueInputOption=${vio}`,\n { method: \"PUT\", body: JSON.stringify({ values: a.values }) });\n case \"append\": return sheets(`/${id}/values/${enc(a.range)}:append?valueInputOption=${vio}`,\n { method: \"POST\", body: JSON.stringify({ values: a.values }) });\n case \"clear\": return sheets(`/${id}/values/${enc(a.range)}:clear`, { method: \"POST\" });\n case \"batchUpdate\": return sheets(`/${id}:batchUpdate`,\n { method: \"POST\", body: JSON.stringify({ requests: a.requests }) });\n default: throw new Error(`unknown action: ${action}`);\n }\n}\n\n// Run a tool with per-user allowlist enforcement + claim-on-first-success.\nasync function runTool(action: string, args: any, authz: Extract) {\n const id = args?.spreadsheetId ? String(args.spreadsheetId) : \"\";\n let existingClaim: string | null = null;\n if (!authz.isAdmin && id) {\n existingClaim = await getClaim(id);\n if (existingClaim && existingClaim !== authz.tokenHash) {\n throw Object.assign(new Error(\"this token is not authorized for that spreadsheet\"), { denied: true });\n }\n }\n const data = await op(action, args);\n if (!authz.isAdmin && id && !existingClaim) await claimSheet(id, authz.tokenHash);\n if (action === \"whoami\") {\n if (authz.isAdmin) (data as any).token = \"admin (full access)\";\n else { (data as any).token = \"registered (per-user)\"; (data as any).authorized_spreadsheets = await listClaims(authz.tokenHash); }\n }\n return data;\n}\n\nfunction json(obj: unknown, status = 200, headers: Record = {}) {\n return new Response(JSON.stringify(obj, null, 2), { status, headers: { \"content-type\": \"application/json\", ...headers } });\n}\n\n// ---- MCP tool catalogue ----\nconst ID = { spreadsheetId: { type: \"string\", description: \"Spreadsheet ID — the token between /d/ and /edit in the sheet URL\" } };\nconst A1 = { range: { type: \"string\", description: \"A1 range, e.g. \\\"Tab 1!A1:C10\\\"; quote tab names with spaces/dots\" } };\nconst VALS = { values: { type: \"array\", items: { type: \"array\" }, description: \"2D array of cell values; strings starting with = are live formulas\" } };\nconst TOOLS = [\n { name: \"sheets_whoami\", description: \"Return the service-account email to share sheets with, plus this token's authorized spreadsheets.\", inputSchema: { type: \"object\", properties: {} } },\n { name: \"sheets_meta\", description: \"Spreadsheet structure: tab titles, sheetIds, dimensions, charts. Call this to get the numeric sheetId needed by sheets_batch_update.\", inputSchema: { type: \"object\", properties: { ...ID }, required: [\"spreadsheetId\"] } },\n { name: \"sheets_get\", description: \"Read a range's values.\", inputSchema: { type: \"object\", properties: { ...ID, ...A1 }, required: [\"spreadsheetId\", \"range\"] } },\n { name: \"sheets_get_grid\", description: \"Read cell formatting and formulas (includeGridData). Pass a fields mask to keep the response small.\", inputSchema: { type: \"object\", properties: { ...ID, ranges: { type: \"array\", items: { type: \"string\" } }, fields: { type: \"string\" } }, required: [\"spreadsheetId\"] } },\n { name: \"sheets_update\", description: \"Overwrite a range. Formulas parse live (USER_ENTERED).\", inputSchema: { type: \"object\", properties: { ...ID, ...A1, ...VALS, valueInputOption: { type: \"string\", enum: [\"USER_ENTERED\", \"RAW\"] } }, required: [\"spreadsheetId\", \"range\", \"values\"] } },\n { name: \"sheets_append\", description: \"Append rows after the last used row in a range.\", inputSchema: { type: \"object\", properties: { ...ID, ...A1, ...VALS, valueInputOption: { type: \"string\", enum: [\"USER_ENTERED\", \"RAW\"] } }, required: [\"spreadsheetId\", \"range\", \"values\"] } },\n { name: \"sheets_clear\", description: \"Clear the values in a range.\", inputSchema: { type: \"object\", properties: { ...ID, ...A1 }, required: [\"spreadsheetId\", \"range\"] } },\n { name: \"sheets_batch_update\", description: \"Apply spreadsheets.batchUpdate requests: formatting, freeze, borders, conditional formats, number formats, data-validation dropdowns, merges, add/delete tabs, charts, in-cell =IMAGE. 'requests' is the raw Sheets API requests array.\", inputSchema: { type: \"object\", properties: { ...ID, requests: { type: \"array\", items: { type: \"object\" } } }, required: [\"spreadsheetId\", \"requests\"] } },\n];\nconst TOOL_ACTION: Record = {\n sheets_whoami: \"whoami\", sheets_meta: \"meta\", sheets_get: \"get\", sheets_get_grid: \"getGrid\",\n sheets_update: \"update\", sheets_append: \"append\", sheets_clear: \"clear\", sheets_batch_update: \"batchUpdate\",\n};\n\nasync function handleRpc(msg: any, authz: Extract) {\n const id = msg?.id ?? null;\n const reply = (result: any) => ({ jsonrpc: \"2.0\", id, result });\n const fail = (code: number, message: string) => ({ jsonrpc: \"2.0\", id, error: { code, message } });\n try {\n switch (msg?.method) {\n case \"initialize\":\n return reply({\n protocolVersion: msg?.params?.protocolVersion || PROTOCOL_VERSION,\n capabilities: { tools: { listChanged: false } },\n serverInfo: { name: \"gsheets-bridge\", version: \"1.1.0\" },\n });\n case \"ping\": return reply({});\n case \"tools/list\": return reply({ tools: TOOLS });\n case \"tools/call\": {\n const action = TOOL_ACTION[msg?.params?.name];\n if (!action) return fail(-32602, `unknown tool: ${msg?.params?.name}`);\n try {\n const data = await runTool(action, msg?.params?.arguments || {}, authz);\n return reply({ content: [{ type: \"text\", text: JSON.stringify(data, null, 2) }] });\n } catch (e: any) {\n return reply({ content: [{ type: \"text\", text: \"Error: \" + String(e?.message || e) }], isError: true });\n }\n }\n default: return fail(-32601, `method not found: ${msg?.method}`);\n }\n } catch (e: any) {\n return fail(-32603, String(e?.message || e));\n }\n}\n\nconst isNotification = (m: any) => m && m.method && (m.id === undefined || m.id === null);\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n // ---- MCP transport: POST /mcp/ ----\n if (url.pathname.startsWith(\"/mcp\")) {\n const tok = url.pathname.split(\"/\")[2] || url.searchParams.get(\"key\") || \"\";\n const authz = await resolveToken(tok);\n if (!authz.ok) return json({ error: authz.message }, authz.status);\n if (req.method !== \"POST\") return new Response(null, { status: 405, headers: { Allow: \"POST\" } });\n let body: any;\n try { body = await req.json(); } catch { return json({ jsonrpc: \"2.0\", id: null, error: { code: -32700, message: \"parse error\" } }); }\n if (Array.isArray(body)) {\n const out: any[] = [];\n for (const m of body) if (!isNotification(m)) out.push(await handleRpc(m, authz));\n return out.length ? json(out) : new Response(null, { status: 202 });\n }\n if (isNotification(body)) return new Response(null, { status: 202 });\n return json(await handleRpc(body, authz));\n }\n\n // ---- JSON API: POST / with Bearer admin secret (operator only) ----\n const admin = adminSecret();\n if (!admin || req.headers.get(\"authorization\") !== `Bearer ${admin}`) return json({ error: \"unauthorized\" }, 401);\n if (req.method !== \"POST\") return json({ error: \"POST a JSON body: { action, spreadsheetId, ... }\" }, 405);\n let body: any;\n try { body = await req.json(); } catch { return json({ error: \"invalid JSON body\" }, 400); }\n const action = body?.action;\n if (action === \"whoami\") { try { return json(await op(\"whoami\", {})); } catch (e: any) { return json({ error: String(e?.message || e) }, 500); } }\n if (!action || !body?.spreadsheetId) return json({ error: \"action and spreadsheetId are required\" }, 400);\n try { return json(await op(action, body)); }\n catch (e: any) { return json({ error: String(e?.message || e) }, e?.status || 500); }\n}\n","// gsheetsBridge — edit existing Google Sheets via a service account.\n//\n// Transports:\n// 1. JSON API (operator/admin): POST / Authorization: Bearer \n// 2. MCP server (per-user): POST /mcp/ (Streamable HTTP, stateless)\n// Add that URL as a Claude custom connector. The token in the path is the credential.\n//\n// Auth model (MCP path):\n// - API_SECRET, if set, is the ADMIN token: full access to every shared sheet and\n// bypasses the per-user allowlist. Do NOT hand this URL to end users.\n// - Any other sufficiently-long token (>= 20 chars) is a PER-USER token. On first\n// contact it is registered automatically (trust-on-first-use). A user token may\n// only touch spreadsheets it has \"claimed\": the first token to successfully access\n// a given sheet claims it; other tokens are then denied. whoami needs no claim.\n// - Set REGISTRATION_CLOSED=1 to stop auto-registering new tokens (kill switch);\n// already-registered tokens keep working.\n// - Admin/owner can inspect or reassign ownership directly in the val's SQLite\n// (tables gsb_tokens, gsb_claims).\n//\n// Google auth: reads GOOGLE_SA_KEY (full service-account JSON) and mints tokens via a\n// JWT bearer flow. Share a sheet with the group address (whose member is the SA) to grant access.\nimport { JWT } from \"npm:google-auth-library\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst SCOPES = [\"https://www.googleapis.com/auth/spreadsheets\"];\nconst PROTOCOL_VERSION = \"2025-06-18\";\nconst enc = encodeURIComponent;\nconst MIN_TOKEN_LEN = 20;\n\nconst adminSecret = () => Deno.env.get(\"API_SECRET\") || \"\";\nconst registrationClosed = () => /^(1|true|yes)$/i.test(Deno.env.get(\"REGISTRATION_CLOSED\") || \"\");\n\n// ---- storage: per-user tokens + per-sheet claims ----\nconst schemaReady = (async () => {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS gsb_tokens (token_hash TEXT PRIMARY KEY, created_at TEXT NOT NULL)`,\n );\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS gsb_claims (spreadsheet_id TEXT PRIMARY KEY, token_hash TEXT NOT NULL, claimed_at TEXT NOT NULL)`,\n );\n})();\n\nasync function sha256hex(s: string): Promise {\n const buf = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\ntype Authz =\n | { ok: false; status: number; message: string }\n | { ok: true; isAdmin: true }\n | { ok: true; isAdmin: false; tokenHash: string };\n\n// Validate the path token. Registers unknown (long-enough) tokens trust-on-first-use.\nasync function resolveToken(tok: string): Promise {\n if (!tok) return { ok: false, status: 401, message: \"unauthorized\" };\n const admin = adminSecret();\n if (admin && tok === admin) return { ok: true, isAdmin: true };\n await schemaReady;\n const hash = await sha256hex(tok);\n const found = await sqlite.execute({\n sql: \"SELECT 1 FROM gsb_tokens WHERE token_hash = ? LIMIT 1\",\n args: [hash],\n });\n if (found.rows.length === 0) {\n if (registrationClosed()) return { ok: false, status: 401, message: \"unknown token (registration closed)\" };\n if (tok.length < MIN_TOKEN_LEN) return { ok: false, status: 401, message: \"unauthorized\" };\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO gsb_tokens (token_hash, created_at) VALUES (?, ?)\",\n args: [hash, new Date().toISOString()],\n });\n }\n return { ok: true, isAdmin: false, tokenHash: hash };\n}\n\nasync function getClaim(spreadsheetId: string): Promise {\n await schemaReady;\n const r = await sqlite.execute({\n sql: \"SELECT token_hash FROM gsb_claims WHERE spreadsheet_id = ? LIMIT 1\",\n args: [spreadsheetId],\n });\n return r.rows.length ? String(r.rows[0][0]) : null;\n}\n\nasync function claimSheet(spreadsheetId: string, tokenHash: string): Promise {\n await schemaReady;\n try {\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO gsb_claims (spreadsheet_id, token_hash, claimed_at) VALUES (?, ?, ?)\",\n args: [spreadsheetId, tokenHash, new Date().toISOString()],\n });\n } catch { /* race: another request claimed first; next request enforces */ }\n}\n\nasync function listClaims(tokenHash: string): Promise {\n await schemaReady;\n const r = await sqlite.execute({\n sql: \"SELECT spreadsheet_id FROM gsb_claims WHERE token_hash = ? ORDER BY claimed_at\",\n args: [tokenHash],\n });\n return r.rows.map((row: any) => String(row[0]));\n}\n\nfunction saCreds() {\n const raw = Deno.env.get(\"GOOGLE_SA_KEY\");\n if (!raw) throw new Error(\"Missing GOOGLE_SA_KEY env var\");\n return JSON.parse(raw);\n}\n\nasync function getToken(): Promise {\n const c = saCreds();\n const jwt = new JWT({ email: c.client_email, key: c.private_key, scopes: SCOPES });\n const { token } = await jwt.getAccessToken();\n if (!token) throw new Error(\"failed to obtain Google access token\");\n return token;\n}\n\nasync function sheets(path: string, init: RequestInit = {}) {\n const token = await getToken();\n const r = await fetch(`https://sheets.googleapis.com/v4/spreadsheets${path}`, {\n ...init,\n headers: { authorization: `Bearer ${token}`, \"content-type\": \"application/json\", ...(init.headers || {}) },\n });\n const text = await r.text();\n if (!r.ok) throw Object.assign(new Error(`Sheets API ${r.status}: ${text}`), { status: r.status });\n try { return JSON.parse(text); } catch { return { raw: text }; }\n}\n\n// Operations shared by both transports.\nasync function op(action: string, a: any) {\n const id = a?.spreadsheetId;\n const vio = a?.valueInputOption || \"USER_ENTERED\";\n switch (action) {\n case \"whoami\": { const c = saCreds(); return { client_email: c.client_email, project_id: c.project_id }; }\n case \"meta\": return sheets(`/${id}`);\n case \"get\": return sheets(`/${id}/values/${enc(a.range)}`);\n case \"getGrid\": {\n const p = new URLSearchParams({ includeGridData: \"true\" });\n if (a.ranges) for (const rg of [].concat(a.ranges)) p.append(\"ranges\", rg);\n if (a.fields) p.set(\"fields\", a.fields);\n return sheets(`/${id}?${p.toString()}`);\n }\n case \"update\": return sheets(`/${id}/values/${enc(a.range)}?valueInputOption=${vio}`,\n { method: \"PUT\", body: JSON.stringify({ values: a.values }) });\n case \"append\": return sheets(`/${id}/values/${enc(a.range)}:append?valueInputOption=${vio}`,\n { method: \"POST\", body: JSON.stringify({ values: a.values }) });\n case \"clear\": return sheets(`/${id}/values/${enc(a.range)}:clear`, { method: \"POST\" });\n case \"batchUpdate\": return sheets(`/${id}:batchUpdate`,\n { method: \"POST\", body: JSON.stringify({ requests: a.requests }) });\n default: throw new Error(`unknown action: ${action}`);\n }\n}\n\n// Run a tool with per-user allowlist enforcement + claim-on-first-success.\nasync function runTool(action: string, args: any, authz: Extract) {\n const id = args?.spreadsheetId ? String(args.spreadsheetId) : \"\";\n let existingClaim: string | null = null;\n if (!authz.isAdmin && id) {\n existingClaim = await getClaim(id);\n if (existingClaim && existingClaim !== authz.tokenHash) {\n throw Object.assign(new Error(\"this token is not authorized for that spreadsheet\"), { denied: true });\n }\n }\n const data = await op(action, args);\n if (!authz.isAdmin && id && !existingClaim) await claimSheet(id, authz.tokenHash);\n if (action === \"whoami\") {\n if (authz.isAdmin) (data as any).token = \"admin (full access)\";\n else { (data as any).token = \"registered (per-user)\"; (data as any).authorized_spreadsheets = await listClaims(authz.tokenHash); }\n }\n return data;\n}\n\nfunction json(obj: unknown, status = 200, headers: Record = {}) {\n return new Response(JSON.stringify(obj, null, 2), { status, headers: { \"content-type\": \"application/json\", ...headers } });\n}\n\n// ---- MCP tool catalogue ----\nconst ID = { spreadsheetId: { type: \"string\", description: \"Spreadsheet ID — the token between /d/ and /edit in the sheet URL\" } };\nconst A1 = { range: { type: \"string\", description: \"A1 range, e.g. \\\"Tab 1!A1:C10\\\"; quote tab names with spaces/dots\" } };\nconst VALS = { values: { type: \"array\", items: { type: \"array\" }, description: \"2D array of cell values; strings starting with = are live formulas\" } };\nconst TOOLS = [\n { name: \"sheets_whoami\", description: \"Return the service-account email to share sheets with, plus this token's authorized spreadsheets.\", inputSchema: { type: \"object\", properties: {} } },\n { name: \"sheets_meta\", description: \"Spreadsheet structure: tab titles, sheetIds, dimensions, charts. Call this to get the numeric sheetId needed by sheets_batch_update.\", inputSchema: { type: \"object\", properties: { ...ID }, required: [\"spreadsheetId\"] } },\n { name: \"sheets_get\", description: \"Read a range's values.\", inputSchema: { type: \"object\", properties: { ...ID, ...A1 }, required: [\"spreadsheetId\", \"range\"] } },\n { name: \"sheets_get_grid\", description: \"Read cell formatting and formulas (includeGridData). Pass a fields mask to keep the response small.\", inputSchema: { type: \"object\", properties: { ...ID, ranges: { type: \"array\", items: { type: \"string\" } }, fields: { type: \"string\" } }, required: [\"spreadsheetId\"] } },\n { name: \"sheets_update\", description: \"Overwrite a range. Formulas parse live (USER_ENTERED).\", inputSchema: { type: \"object\", properties: { ...ID, ...A1, ...VALS, valueInputOption: { type: \"string\", enum: [\"USER_ENTERED\", \"RAW\"] } }, required: [\"spreadsheetId\", \"range\", \"values\"] } },\n { name: \"sheets_append\", description: \"Append rows after the last used row in a range.\", inputSchema: { type: \"object\", properties: { ...ID, ...A1, ...VALS, valueInputOption: { type: \"string\", enum: [\"USER_ENTERED\", \"RAW\"] } }, required: [\"spreadsheetId\", \"range\", \"values\"] } },\n { name: \"sheets_clear\", description: \"Clear the values in a range.\", inputSchema: { type: \"object\", properties: { ...ID, ...A1 }, required: [\"spreadsheetId\", \"range\"] } },\n { name: \"sheets_batch_update\", description: \"Apply spreadsheets.batchUpdate requests: formatting, freeze, borders, conditional formats, number formats, data-validation dropdowns, merges, add/delete tabs, charts, in-cell =IMAGE. 'requests' is the raw Sheets API requests array.\", inputSchema: { type: \"object\", properties: { ...ID, requests: { type: \"array\", items: { type: \"object\" } } }, required: [\"spreadsheetId\", \"requests\"] } },\n];\nconst TOOL_ACTION: Record = {\n sheets_whoami: \"whoami\", sheets_meta: \"meta\", sheets_get: \"get\", sheets_get_grid: \"getGrid\",\n sheets_update: \"update\", sheets_append: \"append\", sheets_clear: \"clear\", sheets_batch_update: \"batchUpdate\",\n};\n\nasync function handleRpc(msg: any, authz: Extract) {\n const id = msg?.id ?? null;\n const reply = (result: any) => ({ jsonrpc: \"2.0\", id, result });\n const fail = (code: number, message: string) => ({ jsonrpc: \"2.0\", id, error: { code, message } });\n try {\n switch (msg?.method) {\n case \"initialize\":\n return reply({\n protocolVersion: msg?.params?.protocolVersion || PROTOCOL_VERSION,\n capabilities: { tools: { listChanged: false } },\n serverInfo: { name: \"gsheets-bridge\", version: \"1.1.0\" },\n });\n case \"ping\": return reply({});\n case \"tools/list\": return reply({ tools: TOOLS });\n case \"tools/call\": {\n const action = TOOL_ACTION[msg?.params?.name];\n if (!action) return fail(-32602, `unknown tool: ${msg?.params?.name}`);\n try {\n const data = await runTool(action, msg?.params?.arguments || {}, authz);\n return reply({ content: [{ type: \"text\", text: JSON.stringify(data, null, 2) }] });\n } catch (e: any) {\n return reply({ content: [{ type: \"text\", text: \"Error: \" + String(e?.message || e) }], isError: true });\n }\n }\n default: return fail(-32601, `method not found: ${msg?.method}`);\n }\n } catch (e: any) {\n return fail(-32603, String(e?.message || e));\n }\n}\n\nconst isNotification = (m: any) => m && m.method && (m.id === undefined || m.id === null);\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n // ---- MCP transport: POST /mcp/ ----\n if (url.pathname.startsWith(\"/mcp\")) {\n const tok = url.pathname.split(\"/\")[2] || url.searchParams.get(\"key\") || \"\";\n const authz = await resolveToken(tok);\n if (!authz.ok) return json({ error: authz.message }, authz.status);\n if (req.method !== \"POST\") return new Response(null, { status: 405, headers: { Allow: \"POST\" } });\n let body: any;\n try { body = await req.json(); } catch { return json({ jsonrpc: \"2.0\", id: null, error: { code: -32700, message: \"parse error\" } }); }\n if (Array.isArray(body)) {\n const out: any[] = [];\n for (const m of body) if (!isNotification(m)) out.push(await handleRpc(m, authz));\n return out.length ? json(out) : new Response(null, { status: 202 });\n }\n if (isNotification(body)) return new Response(null, { status: 202 });\n return json(await handleRpc(body, authz));\n }\n\n // ---- JSON API: POST / with Bearer admin secret (operator only) ----\n const admin = adminSecret();\n if (!admin || req.headers.get(\"authorization\") !== `Bearer ${admin}`) return json({ error: \"unauthorized\" }, 401);\n if (req.method !== \"POST\") return json({ error: \"POST a JSON body: { action, spreadsheetId, ... }\" }, 405);\n let body: any;\n try { body = await req.json(); } catch { return json({ error: \"invalid JSON body\" }, 400); }\n const action = body?.action;\n if (action === \"whoami\") { try { return json(await op(\"whoami\", {})); } catch (e: any) { return json({ error: String(e?.message || e) }, 500); } }\n if (!action || !body?.spreadsheetId) return json({ error: \"action and spreadsheetId are required\" }, 400);\n try { return json(await op(action, body)); }\n catch (e: any) { return json({ error: String(e?.message || e) }, e?.status || 500); }\n}\n","createdAt",["D",1781783795318],"branchVersion","branchId","4110a3e6-6012-463e-b4ee-d9d70d11bc8c","id","80e3ae5b-75ef-44b7-82b8-f89f5245b1f2","google-workspace-bridge",["D",1781705012188],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Per-user OAuth bridge to edit Google Sheets, Slides & Docs","imageUrl","4d6a2ce9-7b0b-41ae-acae-02936cc37376","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019e6588-8f32-7029-9083-725ae084ef6f","tursoName","80e3ae5b75ef44b782b8f89f5245b1f2","tursoHostname","80e3ae5b75ef44b782b8f89f5245b1f2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789447865497],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":55,"_103":104,"_105":25},"branch",{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"isOwned",26,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","valentinmoebs","handle","displayName","Valentin Moebs","avatar","https://lh3.googleusercontent.com/a/ACg8ocKHKyhQu2hb7BbRWE8BJhDtC42HdaVpFZJ8vPB8I94_RiniZKUc=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":155,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":156,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":157,"_82":158,"_84":159,"_86":25},"tree",[150],"files",[150],"counts",{"_138":61,"_139":140,"_141":61,"_142":143,"_144":145},"contents",[130],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":131,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_133":25,"_38":134,"_13":135,"_33":34,"_35":37,"_24":25,"_136":-5,"_27":137},"f184861d-433f-459f-bc0e-19fcd24036cc","parentId","latest",["D",1781783795318],6,"label",[28],"pulls","branches",1,"forks","envVars",{"_146":148,"_149":61},"connections",{"_146":61,"_147":61},"count","unfilledCount",2,"emptyCount",{"_43":131,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_133":25,"_38":151,"_13":135,"_33":34,"_35":37,"_24":25,"_136":-5,"_152":153,"_27":154},["D",1781783795318],"children",[],[28],["D",1781705012188],["D",1789447865497],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":55,"_103":104,"_105":25},{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"ctx",{"_80":-5,"_127":193,"_194":195,"_196":197,"_198":25,"_199":25,"_200":25,"_201":125,"_202":-5,"_203":-7,"_204":-7,"_205":61,"_206":25,"_207":25,"_208":-5,"_209":25,"_210":25,"_211":25,"_212":-5},"ENV",{"_164":165,"_166":167,"_168":88,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v7