bitrix24-mcp-bridge 0.3.0 → 0.5.0

package/extension/dist/connector.js

@@ -11,11 +11,20 @@
     for (let [k, v] of Object.entries(params)) add(k, v);
     return out.toString();
   }
+  function applyPathParams(endpoint, params) {
+    let rest = { ...params };
+    return { endpoint: endpoint.replace(/\{(\w+)\}/g, (_match, key) => {
+      let value = rest[key];
+      if (value == null || value === "")
+        throw new Error(`missing path param "${key}" for endpoint ${endpoint}`);
+      return delete rest[key], encodeURIComponent(String(value));
+    }), rest };
+  }
   function buildRequest(origin, req, sessid) {
-    let q = req.action ? `?action=${encodeURIComponent(req.action)}` : "", url = `${origin}${req.endpoint}${q}`;
+    let { endpoint, rest } = applyPathParams(req.endpoint, req.params), q = req.action ? `?action=${encodeURIComponent(req.action)}` : "", url = `${origin}${endpoint}${q}`;
     if (req.bodyType === "json")
-      return { url, body: JSON.stringify(req.params), contentType: "application/json" };
-    let body = encodeForm({ ...req.params, sessid });
+      return { url, body: JSON.stringify(rest), contentType: "application/json" };
+    let body = encodeForm({ ...rest, sessid });
     return { url, body, contentType: "application/x-www-form-urlencoded" };
   }
   function interpret(json) {
@@ -26,6 +35,30 @@
     }
     return { ok: !0, data: json };
   }
+  var BINARY_CHUNK_BYTES = 1024 * 1024;
+  function toBase64(bytes) {
+    let binary = "";
+    for (let i = 0; i < bytes.length; i += 32768)
+      binary += String.fromCharCode(...bytes.subarray(i, i + 32768));
+    return btoa(binary);
+  }
+  function looksLikeLoginPage(contentType, contentDisposition) {
+    return /^\s*text\/html/i.test(contentType) && !/attachment/i.test(contentDisposition ?? "");
+  }
+  function fileNameFromDisposition(contentDisposition) {
+    if (!contentDisposition) return null;
+    let encoded = /filename\*=(?:UTF-8'')?([^;]+)/i.exec(contentDisposition);
+    if (encoded)
+      try {
+        return decodeURIComponent(encoded[1].trim().replace(/^"|"$/g, ""));
+      } catch {
+      }
+    let plain = /filename="?([^";]+)"?/i.exec(contentDisposition);
+    return plain ? plain[1].trim() : null;
+  }
+  function interpretText(text, contentType, status) {
+    return status >= 400 ? { ok: !1, error: `HTTP ${status}` } : text.trim() ? { ok: !0, data: { contentType, text } } : { ok: !1, error: "empty response" };
+  }
 
   // extension/src/bridge-protocol.ts
   function parseConfig(raw) {
@@ -56,7 +89,7 @@
   }
 
   // extension/src/connector.ts
-  var ORIGIN = location.origin, SESSID_TIMEOUT_MS = 2e3, RECONNECT_MS = 3e3, socket = null, nonceSeq = 0;
+  var ORIGIN = location.origin, SESSID_TIMEOUT_MS = 2e3, RECONNECT_MS = 3e3, MAX_DOWNLOAD_BYTES = 512 * 1024 * 1024, socket = null, nonceSeq = 0;
   function freshSessid() {
     let nonce = `${Date.now()}-${nonceSeq++}-${Math.random().toString(36).slice(2)}`;
     return new Promise((resolve) => {
@@ -72,23 +105,48 @@
       window.addEventListener("message", onMsg), window.postMessage(buildSessidRequest(nonce), ORIGIN);
     });
   }
-  async function handleCall(req) {
+  async function fetchPortal(req) {
     let sessid = await freshSessid();
-    if (!sessid) return { ok: !1, error: "session context not ready \u2014 open a normal Bitrix24 portal tab" };
+    if (!sessid) return { error: "session context not ready \u2014 open a normal Bitrix24 portal tab" };
     let { url, body, contentType } = buildRequest(ORIGIN, req, sessid), init = {
       method: req.method,
       credentials: "include",
       // sessid rides the CSRF header for all ajax (v2 form + json); form bodies also carry it inline.
       headers: { "Content-Type": contentType, "X-Bitrix-Csrf-Token": sessid }
     }, finalUrl = url;
-    req.method === "POST" ? init.body = body : finalUrl += (url.includes("?") ? "&" : "?") + body;
-    let json = await (await fetch(finalUrl, init)).json();
+    return req.method === "POST" ? init.body = body : finalUrl += (url.includes("?") ? "&" : "?") + body, fetch(finalUrl, init);
+  }
+  async function handleCall(req) {
+    let resp = await fetchPortal(req);
+    if (!(resp instanceof Response)) return { ok: !1, error: resp.error };
+    if (req.responseType === "text")
+      return interpretText(await resp.text(), resp.headers.get("content-type") ?? "", resp.status);
+    let json = await resp.json();
     return interpret(json);
   }
+  async function handleBinaryCall(req, ws) {
+    let resp = await fetchPortal(req);
+    if (!(resp instanceof Response)) return { ok: !1, error: resp.error };
+    if (resp.status >= 400) return { ok: !1, error: `HTTP ${resp.status}` };
+    let contentType = resp.headers.get("content-type") ?? "", disposition = resp.headers.get("content-disposition");
+    if (looksLikeLoginPage(contentType, disposition))
+      return { ok: !1, error: "portal answered with an HTML page, not a file \u2014 session likely expired" };
+    let bytes = new Uint8Array(await resp.arrayBuffer());
+    if (bytes.length > MAX_DOWNLOAD_BYTES)
+      return { ok: !1, error: `file is ${bytes.length} bytes, over the ${MAX_DOWNLOAD_BYTES} limit` };
+    let fileName = fileNameFromDisposition(disposition);
+    ws.send(JSON.stringify({ type: "binary-begin", id: req.id, contentType, bytes: bytes.length, fileName }));
+    let seq = 0;
+    for (let at = 0; at < bytes.length; at += BINARY_CHUNK_BYTES) {
+      let slice = bytes.subarray(at, at + BINARY_CHUNK_BYTES);
+      ws.send(JSON.stringify({ type: "binary-chunk", id: req.id, seq: seq++, data: toBase64(slice) }));
+    }
+    return { ok: !0, data: { contentType, bytes: bytes.length, fileName, chunks: seq } };
+  }
   function connect(config) {
     let ws = new WebSocket(`ws://127.0.0.1:${config.port}`);
     ws.addEventListener("open", () => {
-      ws.send(JSON.stringify({ type: "auth", token: config.token })), socket = ws;
+      ws.send(JSON.stringify({ type: "auth", token: config.token, version: chrome.runtime.getManifest().version })), socket = ws;
     }), ws.addEventListener("message", async (ev) => {
       let req;
       try {
@@ -99,7 +157,7 @@
       }
       if (req.type === "call")
         try {
-          let r = await handleCall(req);
+          let r = req.responseType === "binary" ? await handleBinaryCall(req, ws) : await handleCall(req);
           ws.send(JSON.stringify({ type: "result", id: req.id, ok: r.ok, data: r.data, error: r.error }));
         } catch (e) {
           ws.send(JSON.stringify({ type: "result", id: req.id, ok: !1, error: String(e) }));

package/extension/dist/connector.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/bridge-core.ts", "../src/bridge-protocol.ts", "../src/connector.ts"],
-  "sourcesContent": ["// Pure, browser-agnostic \u2014 unit-tested.\n\n// Wire types come from the shared single source; re-exported so downstream\n// extension modules keep importing them from here.\nimport type { CallRequest } from \"../../shared/wire.ts\";\nexport type { CallRequest, CapturedEntry } from \"../../shared/wire.ts\";\n\n// Extension-only: the shape handleCall returns to the bridge (not a wire message).\nexport interface InterpretResult {\n  ok: boolean;\n  data?: unknown;\n  error?: string;\n}\n\nexport function encodeForm(params: Record<string, unknown>): string {\n  const out = new URLSearchParams();\n  const add = (key: string, val: unknown): void => {\n    if (val === null || val === undefined) return;\n    if (Array.isArray(val)) val.forEach((v, i) => add(`${key}[${i}]`, v));\n    else if (typeof val === \"object\") for (const [k, v] of Object.entries(val)) add(`${key}[${k}]`, v);\n    else out.set(key, String(val));\n  };\n  for (const [k, v] of Object.entries(params)) add(k, v);\n  return out.toString();\n}\n\nexport function buildRequest(\n  origin: string,\n  req: CallRequest,\n  sessid: string,\n): { url: string; body: string; contentType: string } {\n  const q = req.action ? `?action=${encodeURIComponent(req.action)}` : \"\";\n  const url = `${origin}${req.endpoint}${q}`;\n  // JSON actions (ui.entityselector.*, tasks.v2.*) send a JSON body; sessid rides the\n  // X-Bitrix-Csrf-Token header (added by the caller), never the body.\n  if (req.bodyType === \"json\") {\n    return { url, body: JSON.stringify(req.params), contentType: \"application/json\" };\n  }\n  const body = encodeForm({ ...req.params, sessid });\n  return { url, body, contentType: \"application/x-www-form-urlencoded\" };\n}\n\n// Bitrix wraps errors in HTTP 200: { status:\"error\", errors:[{code}] } or { error, error_description }.\n// NOTE: successful ajax responses carry an EMPTY `errors: []` array \u2014 a truthy value in JS \u2014 so we\n// must treat only a NON-EMPTY errors list (or status:\"error\"/a top-level error) as a real failure.\nexport function interpret(json: any): InterpretResult {\n  const list = json && (Array.isArray(json.errors) ? json.errors : json.error ? [{ code: json.error }] : []);\n  const hasErrors = Array.isArray(list) && list.length > 0;\n  if (json && (json.status === \"error\" || hasErrors)) {\n    const first = list[0];\n    const code = (first && (first.code || first.message)) || json.error || \"bitrix_error\";\n    const description = json.error_description || (first && first.message);\n    const error = description && description !== code ? `${code}: ${description}` : code;\n    return { ok: false, error, data: json };\n  }\n  return { ok: true, data: json };\n}\n", "// Pure, browser-agnostic \u2014 unit-tested. No DOM / chrome / window.BX here.\n//\n// Two concerns live together because both are the *contract* between the extension's\n// two content scripts and the packaged config, and both are pure/testable:\n//   1) parseConfig  \u2014 validate the per-user config.json ({ token, port }).\n//   2) the postMessage protocol \u2014 the envelopes the ISOLATED connector and the MAIN\n//      script exchange over window.postMessage (sessid request/response, and \u2014 in the\n//      capture build \u2014 MAIN-observed capture entries forwarded to the connector).\n\nimport type { CapturedEntry } from \"./bridge-core.ts\";\n\nexport interface BridgeConfig {\n  token: string;\n  port: number;\n}\n\n/**\n * Parse and validate the packaged config.json body. Throws with a clear,\n * user-facing message (mentioning config.json) on any malformed input so the\n * connector can surface why it failed to start.\n */\nexport function parseConfig(raw: string): BridgeConfig {\n  let doc: unknown;\n  try {\n    doc = JSON.parse(raw);\n  } catch {\n    throw new Error(\"config.json is not valid JSON\");\n  }\n  if (typeof doc !== \"object\" || doc === null) {\n    throw new Error(\"config.json must be an object like { token, port }\");\n  }\n  const obj = doc as Record<string, unknown>;\n  const token = typeof obj.token === \"string\" ? obj.token.trim() : \"\";\n  if (!token) throw new Error(\"config.json is missing a non-empty `token`\");\n  const port = Number(obj.port);\n  if (!Number.isInteger(port) || port < 1 || port > 65535) {\n    throw new Error(\"config.json is missing a numeric `port`\");\n  }\n  return { token, port };\n}\n\n// --- sessid postMessage protocol -------------------------------------------\n//\n// window.postMessage is delivered to BOTH the MAIN and ISOLATED worlds of the same\n// frame (they share the DOM window), and each world also receives its own posts. So\n// every envelope is tagged with a fixed `source` and a `kind`, and each side ignores\n// anything that isn't addressed to it. Responses additionally carry the request nonce\n// so the connector can match a reply to the exact in-flight request it issued.\n\nexport const BRIDGE_MSG_SOURCE = \"bitrix24-mcp-bridge\";\n\nexport interface SessidRequestMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"sessid-request\";\n  nonce: string;\n}\n\nexport interface SessidResponseMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"sessid-response\";\n  nonce: string;\n  sessid: string;\n}\n\nexport function buildSessidRequest(nonce: string): SessidRequestMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-request\", nonce };\n}\n\nexport function buildSessidResponse(nonce: string, sessid: string): SessidResponseMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-response\", nonce, sessid };\n}\n\nfunction isRecord(v: unknown): v is Record<string, unknown> {\n  return typeof v === \"object\" && v !== null;\n}\n\n/** For the MAIN shim: a well-formed request from our connector, or null. */\nexport function parseSessidRequest(data: unknown): SessidRequestMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"sessid-request\") return null;\n  if (typeof data.nonce !== \"string\") return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-request\", nonce: data.nonce };\n}\n\n/** For the ISOLATED connector: a response matching `expectedNonce`, or null. */\nexport function parseSessidResponse(data: unknown, expectedNonce: string): SessidResponseMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"sessid-response\") return null;\n  if (typeof data.nonce !== \"string\" || data.nonce !== expectedNonce) return null;\n  if (typeof data.sessid !== \"string\") return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-response\", nonce: data.nonce, sessid: data.sessid };\n}\n\n// --- capture forwarding (capture build only) -------------------------------\n//\n// The capture hooks must observe the PAGE's fetch/XHR, so they run in the MAIN world.\n// The socket lives only in the ISOLATED connector, so MAIN forwards each observed entry\n// to the connector over postMessage; the connector relays it to the daemon.\n\nexport interface CaptureForwardMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"capture\";\n  call: CapturedEntry;\n}\n\nexport function buildCaptureForward(call: CapturedEntry): CaptureForwardMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"capture\", call };\n}\n\n/** For the ISOLATED connector: a capture entry forwarded by the MAIN script, or null. */\nexport function parseCaptureForward(data: unknown): CaptureForwardMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"capture\") return null;\n  if (!isRecord(data.call)) return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"capture\", call: data.call as unknown as CapturedEntry };\n}\n", "// ISOLATED-world connector. This is where the token and the WebSocket live \u2014 never in\n// the page's MAIN world, so the page cannot read the token without knowing the dynamic\n// (`use_dynamic_url`) resource URL for config.json, and cannot hijack the socket. It has\n// `chrome.runtime`, so it loads the per-user config from the packaged config.json at\n// runtime (nothing per-user is baked into this JS \u2014 the file is static). The actual\n// boundary is `use_dynamic_url: true` on config.json in the manifest: it makes the\n// resource URL unguessable from the page while `chrome.runtime.getURL()` here still\n// resolves it.\n//\n// Per daemon call it asks the MAIN shim for a FRESH sessid over postMessage (nonce-matched),\n// then reuses the pure bridge-core helpers to build the request, fetch it with the page's\n// cookies, and interpret the response.\n\nimport { buildRequest, interpret, type CallRequest, type InterpretResult } from \"./bridge-core.ts\";\nimport {\n  parseConfig,\n  buildSessidRequest,\n  parseSessidResponse,\n  parseCaptureForward,\n  type BridgeConfig,\n} from \"./bridge-protocol.ts\";\n\n// Gates the capture relay listener; stripped from normal builds via esbuild `define`.\ndeclare const __BITRIX_CAPTURE__: boolean;\n\n// Minimal ambient for the one chrome API we use (no @types/chrome dependency).\ndeclare const chrome: { runtime: { getURL(path: string): string } };\n\nconst ORIGIN = location.origin;\nconst SESSID_TIMEOUT_MS = 2000;\nconst RECONNECT_MS = 3000;\n\nlet socket: WebSocket | null = null;\nlet nonceSeq = 0;\n\n/** Ask the MAIN shim for a fresh sessid; resolves \"\" if it doesn't answer in time. */\nfunction freshSessid(): Promise<string> {\n  const nonce = `${Date.now()}-${nonceSeq++}-${Math.random().toString(36).slice(2)}`;\n  return new Promise((resolve) => {\n    const onMsg = (ev: MessageEvent): void => {\n      if (ev.source !== window) return;\n      const res = parseSessidResponse(ev.data, nonce);\n      if (!res) return;\n      cleanup();\n      resolve(res.sessid);\n    };\n    const timer = setTimeout(() => {\n      cleanup();\n      resolve(\"\");\n    }, SESSID_TIMEOUT_MS);\n    const cleanup = (): void => {\n      clearTimeout(timer);\n      window.removeEventListener(\"message\", onMsg);\n    };\n    window.addEventListener(\"message\", onMsg);\n    window.postMessage(buildSessidRequest(nonce), ORIGIN);\n  });\n}\n\nasync function handleCall(req: CallRequest): Promise<InterpretResult> {\n  const sessid = await freshSessid();\n  if (!sessid) return { ok: false, error: \"session context not ready \u2014 open a normal Bitrix24 portal tab\" }; // G5\n  const { url, body, contentType } = buildRequest(ORIGIN, req, sessid);\n  const init: RequestInit = {\n    method: req.method,\n    credentials: \"include\",\n    // sessid rides the CSRF header for all ajax (v2 form + json); form bodies also carry it inline.\n    headers: { \"Content-Type\": contentType, \"X-Bitrix-Csrf-Token\": sessid },\n  };\n  let finalUrl = url;\n  if (req.method === \"POST\") init.body = body;\n  else finalUrl += (url.includes(\"?\") ? \"&\" : \"?\") + body;\n  const resp = await fetch(finalUrl, init);\n  const json = await resp.json();\n  return interpret(json); // G3\n}\n\nfunction connect(config: BridgeConfig): void {\n  const ws = new WebSocket(`ws://127.0.0.1:${config.port}`);\n  ws.addEventListener(\"open\", () => {\n    ws.send(JSON.stringify({ type: \"auth\", token: config.token })); // auth first (server closes non-auth)\n    socket = ws;\n  });\n  ws.addEventListener(\"message\", async (ev: MessageEvent) => {\n    let req: CallRequest;\n    try {\n      req = JSON.parse(ev.data) as CallRequest;\n    } catch (e) {\n      console.error(\"[bitrix-bridge] malformed WS frame, dropping:\", e);\n      return;\n    }\n    if (req.type !== \"call\") return;\n    try {\n      const r = await handleCall(req);\n      ws.send(JSON.stringify({ type: \"result\", id: req.id, ok: r.ok, data: r.data, error: r.error }));\n    } catch (e) {\n      ws.send(JSON.stringify({ type: \"result\", id: req.id, ok: false, error: String(e) }));\n    }\n  });\n  ws.addEventListener(\"close\", () => {\n    if (socket === ws) socket = null;\n    setTimeout(() => connect(config), RECONNECT_MS); // auto-reconnect\n  });\n}\n\n// Capture build only: relay MAIN-observed capture entries to the daemon.\nif (__BITRIX_CAPTURE__) {\n  window.addEventListener(\"message\", (ev: MessageEvent) => {\n    if (ev.source !== window) return;\n    const fwd = parseCaptureForward(ev.data);\n    if (!fwd) return;\n    if (socket && socket.readyState === WebSocket.OPEN) {\n      socket.send(JSON.stringify({ type: \"capture\", call: fwd.call }));\n    }\n  });\n}\n\nasync function start(): Promise<void> {\n  let config: BridgeConfig;\n  try {\n    const resp = await fetch(chrome.runtime.getURL(\"config.json\"));\n    if (!resp.ok) throw new Error(`HTTP ${resp.status}`);\n    config = parseConfig(await resp.text());\n  } catch (e) {\n    // Nothing to fall back to \u2014 surface why the bridge won't start and stop.\n    console.error(\"[bitrix-bridge] cannot load config.json:\", e);\n    return;\n  }\n  connect(config);\n}\n\nstart();\n"],
-  "mappings": ";;;AAcO,WAAS,WAAW,QAAyC;AAClE,QAAM,MAAM,IAAI,gBAAgB,GAC1B,MAAM,CAAC,KAAa,QAAuB;AAC/C,UAAI,OAAQ;AACZ,YAAI,MAAM,QAAQ,GAAG,EAAG,KAAI,QAAQ,CAAC,GAAG,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;AAAA,iBAC3D,OAAO,OAAQ,SAAU,UAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,EAAG,KAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;AAAA,YAC5F,KAAI,IAAI,KAAK,OAAO,GAAG,CAAC;AAAA,IAC/B;AACA,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,EAAG,KAAI,GAAG,CAAC;AACrD,WAAO,IAAI,SAAS;AAAA,EACtB;AAEO,WAAS,aACd,QACA,KACA,QACoD;AACpD,QAAM,IAAI,IAAI,SAAS,WAAW,mBAAmB,IAAI,MAAM,CAAC,KAAK,IAC/D,MAAM,GAAG,MAAM,GAAG,IAAI,QAAQ,GAAG,CAAC;AAGxC,QAAI,IAAI,aAAa;AACnB,aAAO,EAAE,KAAK,MAAM,KAAK,UAAU,IAAI,MAAM,GAAG,aAAa,mBAAmB;AAElF,QAAM,OAAO,WAAW,EAAE,GAAG,IAAI,QAAQ,OAAO,CAAC;AACjD,WAAO,EAAE,KAAK,MAAM,aAAa,oCAAoC;AAAA,EACvE;AAKO,WAAS,UAAU,MAA4B;AACpD,QAAM,OAAO,SAAS,MAAM,QAAQ,KAAK,MAAM,IAAI,KAAK,SAAS,KAAK,QAAQ,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAClG,YAAY,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS;AACvD,QAAI,SAAS,KAAK,WAAW,WAAW,YAAY;AAClD,UAAM,QAAQ,KAAK,CAAC,GACd,OAAQ,UAAU,MAAM,QAAQ,MAAM,YAAa,KAAK,SAAS,gBACjE,cAAc,KAAK,qBAAsB,SAAS,MAAM;AAE9D,aAAO,EAAE,IAAI,IAAO,OADN,eAAe,gBAAgB,OAAO,GAAG,IAAI,KAAK,WAAW,KAAK,MACrD,MAAM,KAAK;AAAA,IACxC;AACA,WAAO,EAAE,IAAI,IAAM,MAAM,KAAK;AAAA,EAChC;;;ACnCO,WAAS,YAAY,KAA2B;AACrD,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,MAAM,GAAG;AAAA,IACtB,QAAQ;AACN,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AACA,QAAI,OAAO,OAAQ,YAAY,QAAQ;AACrC,YAAM,IAAI,MAAM,oDAAoD;AAEtE,QAAM,MAAM,KACN,QAAQ,OAAO,IAAI,SAAU,WAAW,IAAI,MAAM,KAAK,IAAI;AACjE,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,4CAA4C;AACxE,QAAM,OAAO,OAAO,IAAI,IAAI;AAC5B,QAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO;AAChD,YAAM,IAAI,MAAM,yCAAyC;AAE3D,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAUO,MAAM,oBAAoB;AAe1B,WAAS,mBAAmB,OAAiC;AAClE,WAAO,EAAE,QAAQ,mBAAmB,MAAM,kBAAkB,MAAM;AAAA,EACpE;AAMA,WAAS,SAAS,GAA0C;AAC1D,WAAO,OAAO,KAAM,YAAY,MAAM;AAAA,EACxC;AAWO,WAAS,oBAAoB,MAAe,eAAiD;AAIlG,WAHI,CAAC,SAAS,IAAI,KACd,KAAK,WAAW,qBAAqB,KAAK,SAAS,qBACnD,OAAO,KAAK,SAAU,YAAY,KAAK,UAAU,iBACjD,OAAO,KAAK,UAAW,WAAiB,OACrC,EAAE,QAAQ,mBAAmB,MAAM,mBAAmB,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO;AAAA,EACtG;;;AC/DA,MAAM,SAAS,SAAS,QAClB,oBAAoB,KACpB,eAAe,KAEjB,SAA2B,MAC3B,WAAW;AAGf,WAAS,cAA+B;AACtC,QAAM,QAAQ,GAAG,KAAK,IAAI,CAAC,IAAI,UAAU,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAChF,WAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,QAAQ,CAAC,OAA2B;AACxC,YAAI,GAAG,WAAW,OAAQ;AAC1B,YAAM,MAAM,oBAAoB,GAAG,MAAM,KAAK;AAC9C,QAAK,QACL,QAAQ,GACR,QAAQ,IAAI,MAAM;AAAA,MACpB,GACM,QAAQ,WAAW,MAAM;AAC7B,gBAAQ,GACR,QAAQ,EAAE;AAAA,MACZ,GAAG,iBAAiB,GACd,UAAU,MAAY;AAC1B,qBAAa,KAAK,GAClB,OAAO,oBAAoB,WAAW,KAAK;AAAA,MAC7C;AACA,aAAO,iBAAiB,WAAW,KAAK,GACxC,OAAO,YAAY,mBAAmB,KAAK,GAAG,MAAM;AAAA,IACtD,CAAC;AAAA,EACH;AAEA,iBAAe,WAAW,KAA4C;AACpE,QAAM,SAAS,MAAM,YAAY;AACjC,QAAI,CAAC,OAAQ,QAAO,EAAE,IAAI,IAAO,OAAO,qEAAgE;AACxG,QAAM,EAAE,KAAK,MAAM,YAAY,IAAI,aAAa,QAAQ,KAAK,MAAM,GAC7D,OAAoB;AAAA,MACxB,QAAQ,IAAI;AAAA,MACZ,aAAa;AAAA;AAAA,MAEb,SAAS,EAAE,gBAAgB,aAAa,uBAAuB,OAAO;AAAA,IACxE,GACI,WAAW;AACf,IAAI,IAAI,WAAW,SAAQ,KAAK,OAAO,OAClC,aAAa,IAAI,SAAS,GAAG,IAAI,MAAM,OAAO;AAEnD,QAAM,OAAO,OADA,MAAM,MAAM,UAAU,IAAI,GACf,KAAK;AAC7B,WAAO,UAAU,IAAI;AAAA,EACvB;AAEA,WAAS,QAAQ,QAA4B;AAC3C,QAAM,KAAK,IAAI,UAAU,kBAAkB,OAAO,IAAI,EAAE;AACxD,OAAG,iBAAiB,QAAQ,MAAM;AAChC,SAAG,KAAK,KAAK,UAAU,EAAE,MAAM,QAAQ,OAAO,OAAO,MAAM,CAAC,CAAC,GAC7D,SAAS;AAAA,IACX,CAAC,GACD,GAAG,iBAAiB,WAAW,OAAO,OAAqB;AACzD,UAAI;AACJ,UAAI;AACF,cAAM,KAAK,MAAM,GAAG,IAAI;AAAA,MAC1B,SAAS,GAAG;AACV,gBAAQ,MAAM,iDAAiD,CAAC;AAChE;AAAA,MACF;AACA,UAAI,IAAI,SAAS;AACjB,YAAI;AACF,cAAM,IAAI,MAAM,WAAW,GAAG;AAC9B,aAAG,KAAK,KAAK,UAAU,EAAE,MAAM,UAAU,IAAI,IAAI,IAAI,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,OAAO,EAAE,MAAM,CAAC,CAAC;AAAA,QAChG,SAAS,GAAG;AACV,aAAG,KAAK,KAAK,UAAU,EAAE,MAAM,UAAU,IAAI,IAAI,IAAI,IAAI,IAAO,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;AAAA,QACrF;AAAA,IACF,CAAC,GACD,GAAG,iBAAiB,SAAS,MAAM;AACjC,MAAI,WAAW,OAAI,SAAS,OAC5B,WAAW,MAAM,QAAQ,MAAM,GAAG,YAAY;AAAA,IAChD,CAAC;AAAA,EACH;AAcA,iBAAe,QAAuB;AACpC,QAAI;AACJ,QAAI;AACF,UAAM,OAAO,MAAM,MAAM,OAAO,QAAQ,OAAO,aAAa,CAAC;AAC7D,UAAI,CAAC,KAAK,GAAI,OAAM,IAAI,MAAM,QAAQ,KAAK,MAAM,EAAE;AACnD,eAAS,YAAY,MAAM,KAAK,KAAK,CAAC;AAAA,IACxC,SAAS,GAAG;AAEV,cAAQ,MAAM,4CAA4C,CAAC;AAC3D;AAAA,IACF;AACA,YAAQ,MAAM;AAAA,EAChB;AAEA,QAAM;",
+  "sourcesContent": ["// Pure, browser-agnostic \u2014 unit-tested.\n\n// Wire types come from the shared single source; re-exported so downstream\n// extension modules keep importing them from here.\nimport type { CallRequest } from \"../../shared/wire.ts\";\nexport type { CallRequest, CapturedEntry } from \"../../shared/wire.ts\";\n\n// Extension-only: the shape handleCall returns to the bridge (not a wire message).\nexport interface InterpretResult {\n  ok: boolean;\n  data?: unknown;\n  error?: string;\n}\n\nexport function encodeForm(params: Record<string, unknown>): string {\n  const out = new URLSearchParams();\n  const add = (key: string, val: unknown): void => {\n    if (val === null || val === undefined) return;\n    if (Array.isArray(val)) val.forEach((v, i) => add(`${key}[${i}]`, v));\n    else if (typeof val === \"object\") for (const [k, v] of Object.entries(val)) add(`${key}[${k}]`, v);\n    else out.set(key, String(val));\n  };\n  for (const [k, v] of Object.entries(params)) add(k, v);\n  return out.toString();\n}\n\n// Endpoints may carry `{name}` placeholders (e.g. \"/call/detail/{callId}\"); the value comes\n// from params and is consumed there, so it never rides along in the body/query as well.\nexport function applyPathParams(\n  endpoint: string,\n  params: Record<string, unknown>,\n): { endpoint: string; rest: Record<string, unknown> } {\n  const rest = { ...params };\n  const filled = endpoint.replace(/\\{(\\w+)\\}/g, (_match, key: string) => {\n    const value = rest[key];\n    if (value === null || value === undefined || value === \"\") {\n      throw new Error(`missing path param \"${key}\" for endpoint ${endpoint}`);\n    }\n    delete rest[key];\n    return encodeURIComponent(String(value));\n  });\n  return { endpoint: filled, rest };\n}\n\nexport function buildRequest(\n  origin: string,\n  req: CallRequest,\n  sessid: string,\n): { url: string; body: string; contentType: string } {\n  const { endpoint, rest } = applyPathParams(req.endpoint, req.params);\n  const q = req.action ? `?action=${encodeURIComponent(req.action)}` : \"\";\n  const url = `${origin}${endpoint}${q}`;\n  // JSON actions (ui.entityselector.*, tasks.v2.*) send a JSON body; sessid rides the\n  // X-Bitrix-Csrf-Token header (added by the caller), never the body.\n  if (req.bodyType === \"json\") {\n    return { url, body: JSON.stringify(rest), contentType: \"application/json\" };\n  }\n  const body = encodeForm({ ...rest, sessid });\n  return { url, body, contentType: \"application/x-www-form-urlencoded\" };\n}\n\n// Bitrix wraps errors in HTTP 200: { status:\"error\", errors:[{code}] } or { error, error_description }.\n// NOTE: successful ajax responses carry an EMPTY `errors: []` array \u2014 a truthy value in JS \u2014 so we\n// must treat only a NON-EMPTY errors list (or status:\"error\"/a top-level error) as a real failure.\nexport function interpret(json: any): InterpretResult {\n  const list = json && (Array.isArray(json.errors) ? json.errors : json.error ? [{ code: json.error }] : []);\n  const hasErrors = Array.isArray(list) && list.length > 0;\n  if (json && (json.status === \"error\" || hasErrors)) {\n    const first = list[0];\n    const code = (first && (first.code || first.message)) || json.error || \"bitrix_error\";\n    const description = json.error_description || (first && first.message);\n    const error = description && description !== code ? `${code}: ${description}` : code;\n    return { ok: false, error, data: json };\n  }\n  return { ok: true, data: json };\n}\n\n// Chunk size for binary downloads: base64 inflates it by ~33%, so a 1 MiB slice stays a\n// comfortable WS frame while keeping the message count low for large videos.\nexport const BINARY_CHUNK_BYTES = 1024 * 1024;\n\n// `btoa` needs a binary string, and String.fromCharCode blows the call stack on big arrays \u2014\n// so the array is walked in small windows.\nexport function toBase64(bytes: Uint8Array): string {\n  let binary = \"\";\n  const window = 0x8000;\n  for (let i = 0; i < bytes.length; i += window) {\n    binary += String.fromCharCode(...bytes.subarray(i, i + window));\n  }\n  return btoa(binary);\n}\n\n/**\n * The portal answers an unauthenticated download with HTTP 200 and a login PAGE, so the status\n * code cannot be trusted. A genuine file download is marked as an attachment; an HTML body\n * without that marker is the login page, not a .html the user asked for.\n */\nexport function looksLikeLoginPage(contentType: string, contentDisposition: string | null): boolean {\n  return /^\\s*text\\/html/i.test(contentType) && !/attachment/i.test(contentDisposition ?? \"\");\n}\n\n/** Server-suggested file name, e.g. `attachment; filename=\"image (29).png\"` (RFC 5987 aware). */\nexport function fileNameFromDisposition(contentDisposition: string | null): string | null {\n  if (!contentDisposition) return null;\n  const encoded = /filename\\*=(?:UTF-8'')?([^;]+)/i.exec(contentDisposition);\n  if (encoded) {\n    try {\n      return decodeURIComponent(encoded[1].trim().replace(/^\"|\"$/g, \"\"));\n    } catch {\n      // fall through to the plain form\n    }\n  }\n  const plain = /filename=\"?([^\";]+)\"?/i.exec(contentDisposition);\n  return plain ? plain[1].trim() : null;\n}\n\n// HTML sub-domain (responseType \"text\"): no Bitrix envelope to read, so the HTTP status is the\n// only failure signal we get. A login redirect answers 200 with a page \u2014 that one is caught\n// downstream, where the parser knows what the payload was supposed to look like.\nexport function interpretText(text: string, contentType: string, status: number): InterpretResult {\n  if (status >= 400) return { ok: false, error: `HTTP ${status}` };\n  if (!text.trim()) return { ok: false, error: \"empty response\" };\n  return { ok: true, data: { contentType, text } };\n}\n", "// Pure, browser-agnostic \u2014 unit-tested. No DOM / chrome / window.BX here.\n//\n// Two concerns live together because both are the *contract* between the extension's\n// two content scripts and the packaged config, and both are pure/testable:\n//   1) parseConfig  \u2014 validate the per-user config.json ({ token, port }).\n//   2) the postMessage protocol \u2014 the envelopes the ISOLATED connector and the MAIN\n//      script exchange over window.postMessage (sessid request/response, and \u2014 in the\n//      capture build \u2014 MAIN-observed capture entries forwarded to the connector).\n\nimport type { CapturedEntry } from \"./bridge-core.ts\";\n\nexport interface BridgeConfig {\n  token: string;\n  port: number;\n}\n\n/**\n * Parse and validate the packaged config.json body. Throws with a clear,\n * user-facing message (mentioning config.json) on any malformed input so the\n * connector can surface why it failed to start.\n */\nexport function parseConfig(raw: string): BridgeConfig {\n  let doc: unknown;\n  try {\n    doc = JSON.parse(raw);\n  } catch {\n    throw new Error(\"config.json is not valid JSON\");\n  }\n  if (typeof doc !== \"object\" || doc === null) {\n    throw new Error(\"config.json must be an object like { token, port }\");\n  }\n  const obj = doc as Record<string, unknown>;\n  const token = typeof obj.token === \"string\" ? obj.token.trim() : \"\";\n  if (!token) throw new Error(\"config.json is missing a non-empty `token`\");\n  const port = Number(obj.port);\n  if (!Number.isInteger(port) || port < 1 || port > 65535) {\n    throw new Error(\"config.json is missing a numeric `port`\");\n  }\n  return { token, port };\n}\n\n// --- sessid postMessage protocol -------------------------------------------\n//\n// window.postMessage is delivered to BOTH the MAIN and ISOLATED worlds of the same\n// frame (they share the DOM window), and each world also receives its own posts. So\n// every envelope is tagged with a fixed `source` and a `kind`, and each side ignores\n// anything that isn't addressed to it. Responses additionally carry the request nonce\n// so the connector can match a reply to the exact in-flight request it issued.\n\nexport const BRIDGE_MSG_SOURCE = \"bitrix24-mcp-bridge\";\n\nexport interface SessidRequestMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"sessid-request\";\n  nonce: string;\n}\n\nexport interface SessidResponseMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"sessid-response\";\n  nonce: string;\n  sessid: string;\n}\n\nexport function buildSessidRequest(nonce: string): SessidRequestMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-request\", nonce };\n}\n\nexport function buildSessidResponse(nonce: string, sessid: string): SessidResponseMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-response\", nonce, sessid };\n}\n\nfunction isRecord(v: unknown): v is Record<string, unknown> {\n  return typeof v === \"object\" && v !== null;\n}\n\n/** For the MAIN shim: a well-formed request from our connector, or null. */\nexport function parseSessidRequest(data: unknown): SessidRequestMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"sessid-request\") return null;\n  if (typeof data.nonce !== \"string\") return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-request\", nonce: data.nonce };\n}\n\n/** For the ISOLATED connector: a response matching `expectedNonce`, or null. */\nexport function parseSessidResponse(data: unknown, expectedNonce: string): SessidResponseMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"sessid-response\") return null;\n  if (typeof data.nonce !== \"string\" || data.nonce !== expectedNonce) return null;\n  if (typeof data.sessid !== \"string\") return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-response\", nonce: data.nonce, sessid: data.sessid };\n}\n\n// --- capture forwarding (capture build only) -------------------------------\n//\n// The capture hooks must observe the PAGE's fetch/XHR, so they run in the MAIN world.\n// The socket lives only in the ISOLATED connector, so MAIN forwards each observed entry\n// to the connector over postMessage; the connector relays it to the daemon.\n\nexport interface CaptureForwardMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"capture\";\n  call: CapturedEntry;\n}\n\nexport function buildCaptureForward(call: CapturedEntry): CaptureForwardMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"capture\", call };\n}\n\n/** For the ISOLATED connector: a capture entry forwarded by the MAIN script, or null. */\nexport function parseCaptureForward(data: unknown): CaptureForwardMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"capture\") return null;\n  if (!isRecord(data.call)) return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"capture\", call: data.call as unknown as CapturedEntry };\n}\n", "// ISOLATED-world connector. This is where the token and the WebSocket live \u2014 never in\n// the page's MAIN world, so the page cannot read the token without knowing the dynamic\n// (`use_dynamic_url`) resource URL for config.json, and cannot hijack the socket. It has\n// `chrome.runtime`, so it loads the per-user config from the packaged config.json at\n// runtime (nothing per-user is baked into this JS \u2014 the file is static). The actual\n// boundary is `use_dynamic_url: true` on config.json in the manifest: it makes the\n// resource URL unguessable from the page while `chrome.runtime.getURL()` here still\n// resolves it.\n//\n// Per daemon call it asks the MAIN shim for a FRESH sessid over postMessage (nonce-matched),\n// then reuses the pure bridge-core helpers to build the request, fetch it with the page's\n// cookies, and interpret the response.\n\nimport {\n  buildRequest,\n  interpret,\n  interpretText,\n  toBase64,\n  looksLikeLoginPage,\n  fileNameFromDisposition,\n  BINARY_CHUNK_BYTES,\n  type CallRequest,\n  type InterpretResult,\n} from \"./bridge-core.ts\";\nimport {\n  parseConfig,\n  buildSessidRequest,\n  parseSessidResponse,\n  parseCaptureForward,\n  type BridgeConfig,\n} from \"./bridge-protocol.ts\";\n\n// Gates the capture relay listener; stripped from normal builds via esbuild `define`.\ndeclare const __BITRIX_CAPTURE__: boolean;\n\n// Minimal ambient for the one chrome API we use (no @types/chrome dependency).\ndeclare const chrome: { runtime: { getURL(path: string): string; getManifest(): { version?: string } } };\n\nconst ORIGIN = location.origin;\nconst SESSID_TIMEOUT_MS = 2000;\nconst RECONNECT_MS = 3000;\n// The whole body is buffered here before streaming, so this caps peak tab memory.\nconst MAX_DOWNLOAD_BYTES = 512 * 1024 * 1024;\n\nlet socket: WebSocket | null = null;\nlet nonceSeq = 0;\n\n/** Ask the MAIN shim for a fresh sessid; resolves \"\" if it doesn't answer in time. */\nfunction freshSessid(): Promise<string> {\n  const nonce = `${Date.now()}-${nonceSeq++}-${Math.random().toString(36).slice(2)}`;\n  return new Promise((resolve) => {\n    const onMsg = (ev: MessageEvent): void => {\n      if (ev.source !== window) return;\n      const res = parseSessidResponse(ev.data, nonce);\n      if (!res) return;\n      cleanup();\n      resolve(res.sessid);\n    };\n    const timer = setTimeout(() => {\n      cleanup();\n      resolve(\"\");\n    }, SESSID_TIMEOUT_MS);\n    const cleanup = (): void => {\n      clearTimeout(timer);\n      window.removeEventListener(\"message\", onMsg);\n    };\n    window.addEventListener(\"message\", onMsg);\n    window.postMessage(buildSessidRequest(nonce), ORIGIN);\n  });\n}\n\nasync function fetchPortal(req: CallRequest): Promise<Response | { error: string }> {\n  const sessid = await freshSessid();\n  if (!sessid) return { error: \"session context not ready \u2014 open a normal Bitrix24 portal tab\" }; // G5\n  const { url, body, contentType } = buildRequest(ORIGIN, req, sessid);\n  const init: RequestInit = {\n    method: req.method,\n    credentials: \"include\",\n    // sessid rides the CSRF header for all ajax (v2 form + json); form bodies also carry it inline.\n    headers: { \"Content-Type\": contentType, \"X-Bitrix-Csrf-Token\": sessid },\n  };\n  let finalUrl = url;\n  if (req.method === \"POST\") init.body = body;\n  else finalUrl += (url.includes(\"?\") ? \"&\" : \"?\") + body;\n  return fetch(finalUrl, init);\n}\n\nasync function handleCall(req: CallRequest): Promise<InterpretResult> {\n  const resp = await fetchPortal(req);\n  if (!(resp instanceof Response)) return { ok: false, error: resp.error };\n  if (req.responseType === \"text\") {\n    return interpretText(await resp.text(), resp.headers.get(\"content-type\") ?? \"\", resp.status);\n  }\n  const json = await resp.json();\n  return interpret(json); // G3\n}\n\n/** Streams the body to the daemon as base64 chunks; the daemon writes them to a file. */\nasync function handleBinaryCall(req: CallRequest, ws: WebSocket): Promise<InterpretResult> {\n  const resp = await fetchPortal(req);\n  if (!(resp instanceof Response)) return { ok: false, error: resp.error };\n  if (resp.status >= 400) return { ok: false, error: `HTTP ${resp.status}` };\n\n  const contentType = resp.headers.get(\"content-type\") ?? \"\";\n  const disposition = resp.headers.get(\"content-disposition\");\n  if (looksLikeLoginPage(contentType, disposition)) {\n    return { ok: false, error: \"portal answered with an HTML page, not a file \u2014 session likely expired\" };\n  }\n\n  const bytes = new Uint8Array(await resp.arrayBuffer());\n  if (bytes.length > MAX_DOWNLOAD_BYTES) {\n    return { ok: false, error: `file is ${bytes.length} bytes, over the ${MAX_DOWNLOAD_BYTES} limit` };\n  }\n  const fileName = fileNameFromDisposition(disposition);\n  ws.send(JSON.stringify({ type: \"binary-begin\", id: req.id, contentType, bytes: bytes.length, fileName }));\n  let seq = 0;\n  for (let at = 0; at < bytes.length; at += BINARY_CHUNK_BYTES) {\n    const slice = bytes.subarray(at, at + BINARY_CHUNK_BYTES);\n    ws.send(JSON.stringify({ type: \"binary-chunk\", id: req.id, seq: seq++, data: toBase64(slice) }));\n  }\n  return { ok: true, data: { contentType, bytes: bytes.length, fileName, chunks: seq } };\n}\n\nfunction connect(config: BridgeConfig): void {\n  const ws = new WebSocket(`ws://127.0.0.1:${config.port}`);\n  ws.addEventListener(\"open\", () => {\n    ws.send(JSON.stringify({ type: \"auth\", token: config.token, version: chrome.runtime.getManifest().version }));\n    socket = ws;\n  });\n  ws.addEventListener(\"message\", async (ev: MessageEvent) => {\n    let req: CallRequest;\n    try {\n      req = JSON.parse(ev.data) as CallRequest;\n    } catch (e) {\n      console.error(\"[bitrix-bridge] malformed WS frame, dropping:\", e);\n      return;\n    }\n    if (req.type !== \"call\") return;\n    try {\n      const r = req.responseType === \"binary\" ? await handleBinaryCall(req, ws) : await handleCall(req);\n      ws.send(JSON.stringify({ type: \"result\", id: req.id, ok: r.ok, data: r.data, error: r.error }));\n    } catch (e) {\n      ws.send(JSON.stringify({ type: \"result\", id: req.id, ok: false, error: String(e) }));\n    }\n  });\n  ws.addEventListener(\"close\", () => {\n    if (socket === ws) socket = null;\n    setTimeout(() => connect(config), RECONNECT_MS); // auto-reconnect\n  });\n}\n\n// Capture build only: relay MAIN-observed capture entries to the daemon.\nif (__BITRIX_CAPTURE__) {\n  window.addEventListener(\"message\", (ev: MessageEvent) => {\n    if (ev.source !== window) return;\n    const fwd = parseCaptureForward(ev.data);\n    if (!fwd) return;\n    if (socket && socket.readyState === WebSocket.OPEN) {\n      socket.send(JSON.stringify({ type: \"capture\", call: fwd.call }));\n    }\n  });\n}\n\nasync function start(): Promise<void> {\n  let config: BridgeConfig;\n  try {\n    const resp = await fetch(chrome.runtime.getURL(\"config.json\"));\n    if (!resp.ok) throw new Error(`HTTP ${resp.status}`);\n    config = parseConfig(await resp.text());\n  } catch (e) {\n    // Nothing to fall back to \u2014 surface why the bridge won't start and stop.\n    console.error(\"[bitrix-bridge] cannot load config.json:\", e);\n    return;\n  }\n  connect(config);\n}\n\nstart();\n"],
+  "mappings": ";;;AAcO,WAAS,WAAW,QAAyC;AAClE,QAAM,MAAM,IAAI,gBAAgB,GAC1B,MAAM,CAAC,KAAa,QAAuB;AAC/C,UAAI,OAAQ;AACZ,YAAI,MAAM,QAAQ,GAAG,EAAG,KAAI,QAAQ,CAAC,GAAG,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;AAAA,iBAC3D,OAAO,OAAQ,SAAU,UAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,EAAG,KAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;AAAA,YAC5F,KAAI,IAAI,KAAK,OAAO,GAAG,CAAC;AAAA,IAC/B;AACA,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,EAAG,KAAI,GAAG,CAAC;AACrD,WAAO,IAAI,SAAS;AAAA,EACtB;AAIO,WAAS,gBACd,UACA,QACqD;AACrD,QAAM,OAAO,EAAE,GAAG,OAAO;AASzB,WAAO,EAAE,UARM,SAAS,QAAQ,cAAc,CAAC,QAAQ,QAAgB;AACrE,UAAM,QAAQ,KAAK,GAAG;AACtB,UAAI,SAAU,QAA+B,UAAU;AACrD,cAAM,IAAI,MAAM,uBAAuB,GAAG,kBAAkB,QAAQ,EAAE;AAExE,oBAAO,KAAK,GAAG,GACR,mBAAmB,OAAO,KAAK,CAAC;AAAA,IACzC,CAAC,GAC0B,KAAK;AAAA,EAClC;AAEO,WAAS,aACd,QACA,KACA,QACoD;AACpD,QAAM,EAAE,UAAU,KAAK,IAAI,gBAAgB,IAAI,UAAU,IAAI,MAAM,GAC7D,IAAI,IAAI,SAAS,WAAW,mBAAmB,IAAI,MAAM,CAAC,KAAK,IAC/D,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,CAAC;AAGpC,QAAI,IAAI,aAAa;AACnB,aAAO,EAAE,KAAK,MAAM,KAAK,UAAU,IAAI,GAAG,aAAa,mBAAmB;AAE5E,QAAM,OAAO,WAAW,EAAE,GAAG,MAAM,OAAO,CAAC;AAC3C,WAAO,EAAE,KAAK,MAAM,aAAa,oCAAoC;AAAA,EACvE;AAKO,WAAS,UAAU,MAA4B;AACpD,QAAM,OAAO,SAAS,MAAM,QAAQ,KAAK,MAAM,IAAI,KAAK,SAAS,KAAK,QAAQ,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAClG,YAAY,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS;AACvD,QAAI,SAAS,KAAK,WAAW,WAAW,YAAY;AAClD,UAAM,QAAQ,KAAK,CAAC,GACd,OAAQ,UAAU,MAAM,QAAQ,MAAM,YAAa,KAAK,SAAS,gBACjE,cAAc,KAAK,qBAAsB,SAAS,MAAM;AAE9D,aAAO,EAAE,IAAI,IAAO,OADN,eAAe,gBAAgB,OAAO,GAAG,IAAI,KAAK,WAAW,KAAK,MACrD,MAAM,KAAK;AAAA,IACxC;AACA,WAAO,EAAE,IAAI,IAAM,MAAM,KAAK;AAAA,EAChC;AAIO,MAAM,qBAAqB,OAAO;AAIlC,WAAS,SAAS,OAA2B;AAClD,QAAI,SAAS;AAEb,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,gBAAU,OAAO,aAAa,GAAG,MAAM,SAAS,GAAG,IAAI,KAAM,CAAC;AAEhE,WAAO,KAAK,MAAM;AAAA,EACpB;AAOO,WAAS,mBAAmB,aAAqB,oBAA4C;AAClG,WAAO,kBAAkB,KAAK,WAAW,KAAK,CAAC,cAAc,KAAK,sBAAsB,EAAE;AAAA,EAC5F;AAGO,WAAS,wBAAwB,oBAAkD;AACxF,QAAI,CAAC,mBAAoB,QAAO;AAChC,QAAM,UAAU,kCAAkC,KAAK,kBAAkB;AACzE,QAAI;AACF,UAAI;AACF,eAAO,mBAAmB,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,UAAU,EAAE,CAAC;AAAA,MACnE,QAAQ;AAAA,MAER;AAEF,QAAM,QAAQ,yBAAyB,KAAK,kBAAkB;AAC9D,WAAO,QAAQ,MAAM,CAAC,EAAE,KAAK,IAAI;AAAA,EACnC;AAKO,WAAS,cAAc,MAAc,aAAqB,QAAiC;AAChG,WAAI,UAAU,MAAY,EAAE,IAAI,IAAO,OAAO,QAAQ,MAAM,GAAG,IAC1D,KAAK,KAAK,IACR,EAAE,IAAI,IAAM,MAAM,EAAE,aAAa,KAAK,EAAE,IADtB,EAAE,IAAI,IAAO,OAAO,iBAAiB;AAAA,EAEhE;;;ACtGO,WAAS,YAAY,KAA2B;AACrD,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,MAAM,GAAG;AAAA,IACtB,QAAQ;AACN,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AACA,QAAI,OAAO,OAAQ,YAAY,QAAQ;AACrC,YAAM,IAAI,MAAM,oDAAoD;AAEtE,QAAM,MAAM,KACN,QAAQ,OAAO,IAAI,SAAU,WAAW,IAAI,MAAM,KAAK,IAAI;AACjE,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,4CAA4C;AACxE,QAAM,OAAO,OAAO,IAAI,IAAI;AAC5B,QAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO;AAChD,YAAM,IAAI,MAAM,yCAAyC;AAE3D,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAUO,MAAM,oBAAoB;AAe1B,WAAS,mBAAmB,OAAiC;AAClE,WAAO,EAAE,QAAQ,mBAAmB,MAAM,kBAAkB,MAAM;AAAA,EACpE;AAMA,WAAS,SAAS,GAA0C;AAC1D,WAAO,OAAO,KAAM,YAAY,MAAM;AAAA,EACxC;AAWO,WAAS,oBAAoB,MAAe,eAAiD;AAIlG,WAHI,CAAC,SAAS,IAAI,KACd,KAAK,WAAW,qBAAqB,KAAK,SAAS,qBACnD,OAAO,KAAK,SAAU,YAAY,KAAK,UAAU,iBACjD,OAAO,KAAK,UAAW,WAAiB,OACrC,EAAE,QAAQ,mBAAmB,MAAM,mBAAmB,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO;AAAA,EACtG;;;ACrDA,MAAM,SAAS,SAAS,QAClB,oBAAoB,KACpB,eAAe,KAEf,qBAAqB,MAAM,OAAO,MAEpC,SAA2B,MAC3B,WAAW;AAGf,WAAS,cAA+B;AACtC,QAAM,QAAQ,GAAG,KAAK,IAAI,CAAC,IAAI,UAAU,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAChF,WAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,QAAQ,CAAC,OAA2B;AACxC,YAAI,GAAG,WAAW,OAAQ;AAC1B,YAAM,MAAM,oBAAoB,GAAG,MAAM,KAAK;AAC9C,QAAK,QACL,QAAQ,GACR,QAAQ,IAAI,MAAM;AAAA,MACpB,GACM,QAAQ,WAAW,MAAM;AAC7B,gBAAQ,GACR,QAAQ,EAAE;AAAA,MACZ,GAAG,iBAAiB,GACd,UAAU,MAAY;AAC1B,qBAAa,KAAK,GAClB,OAAO,oBAAoB,WAAW,KAAK;AAAA,MAC7C;AACA,aAAO,iBAAiB,WAAW,KAAK,GACxC,OAAO,YAAY,mBAAmB,KAAK,GAAG,MAAM;AAAA,IACtD,CAAC;AAAA,EACH;AAEA,iBAAe,YAAY,KAAyD;AAClF,QAAM,SAAS,MAAM,YAAY;AACjC,QAAI,CAAC,OAAQ,QAAO,EAAE,OAAO,qEAAgE;AAC7F,QAAM,EAAE,KAAK,MAAM,YAAY,IAAI,aAAa,QAAQ,KAAK,MAAM,GAC7D,OAAoB;AAAA,MACxB,QAAQ,IAAI;AAAA,MACZ,aAAa;AAAA;AAAA,MAEb,SAAS,EAAE,gBAAgB,aAAa,uBAAuB,OAAO;AAAA,IACxE,GACI,WAAW;AACf,WAAI,IAAI,WAAW,SAAQ,KAAK,OAAO,OAClC,aAAa,IAAI,SAAS,GAAG,IAAI,MAAM,OAAO,MAC5C,MAAM,UAAU,IAAI;AAAA,EAC7B;AAEA,iBAAe,WAAW,KAA4C;AACpE,QAAM,OAAO,MAAM,YAAY,GAAG;AAClC,QAAI,EAAE,gBAAgB,UAAW,QAAO,EAAE,IAAI,IAAO,OAAO,KAAK,MAAM;AACvE,QAAI,IAAI,iBAAiB;AACvB,aAAO,cAAc,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI,KAAK,MAAM;AAE7F,QAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,WAAO,UAAU,IAAI;AAAA,EACvB;AAGA,iBAAe,iBAAiB,KAAkB,IAAyC;AACzF,QAAM,OAAO,MAAM,YAAY,GAAG;AAClC,QAAI,EAAE,gBAAgB,UAAW,QAAO,EAAE,IAAI,IAAO,OAAO,KAAK,MAAM;AACvE,QAAI,KAAK,UAAU,IAAK,QAAO,EAAE,IAAI,IAAO,OAAO,QAAQ,KAAK,MAAM,GAAG;AAEzE,QAAM,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,IAClD,cAAc,KAAK,QAAQ,IAAI,qBAAqB;AAC1D,QAAI,mBAAmB,aAAa,WAAW;AAC7C,aAAO,EAAE,IAAI,IAAO,OAAO,8EAAyE;AAGtG,QAAM,QAAQ,IAAI,WAAW,MAAM,KAAK,YAAY,CAAC;AACrD,QAAI,MAAM,SAAS;AACjB,aAAO,EAAE,IAAI,IAAO,OAAO,WAAW,MAAM,MAAM,oBAAoB,kBAAkB,SAAS;AAEnG,QAAM,WAAW,wBAAwB,WAAW;AACpD,OAAG,KAAK,KAAK,UAAU,EAAE,MAAM,gBAAgB,IAAI,IAAI,IAAI,aAAa,OAAO,MAAM,QAAQ,SAAS,CAAC,CAAC;AACxG,QAAI,MAAM;AACV,aAAS,KAAK,GAAG,KAAK,MAAM,QAAQ,MAAM,oBAAoB;AAC5D,UAAM,QAAQ,MAAM,SAAS,IAAI,KAAK,kBAAkB;AACxD,SAAG,KAAK,KAAK,UAAU,EAAE,MAAM,gBAAgB,IAAI,IAAI,IAAI,KAAK,OAAO,MAAM,SAAS,KAAK,EAAE,CAAC,CAAC;AAAA,IACjG;AACA,WAAO,EAAE,IAAI,IAAM,MAAM,EAAE,aAAa,OAAO,MAAM,QAAQ,UAAU,QAAQ,IAAI,EAAE;AAAA,EACvF;AAEA,WAAS,QAAQ,QAA4B;AAC3C,QAAM,KAAK,IAAI,UAAU,kBAAkB,OAAO,IAAI,EAAE;AACxD,OAAG,iBAAiB,QAAQ,MAAM;AAChC,SAAG,KAAK,KAAK,UAAU,EAAE,MAAM,QAAQ,OAAO,OAAO,OAAO,SAAS,OAAO,QAAQ,YAAY,EAAE,QAAQ,CAAC,CAAC,GAC5G,SAAS;AAAA,IACX,CAAC,GACD,GAAG,iBAAiB,WAAW,OAAO,OAAqB;AACzD,UAAI;AACJ,UAAI;AACF,cAAM,KAAK,MAAM,GAAG,IAAI;AAAA,MAC1B,SAAS,GAAG;AACV,gBAAQ,MAAM,iDAAiD,CAAC;AAChE;AAAA,MACF;AACA,UAAI,IAAI,SAAS;AACjB,YAAI;AACF,cAAM,IAAI,IAAI,iBAAiB,WAAW,MAAM,iBAAiB,KAAK,EAAE,IAAI,MAAM,WAAW,GAAG;AAChG,aAAG,KAAK,KAAK,UAAU,EAAE,MAAM,UAAU,IAAI,IAAI,IAAI,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,OAAO,EAAE,MAAM,CAAC,CAAC;AAAA,QAChG,SAAS,GAAG;AACV,aAAG,KAAK,KAAK,UAAU,EAAE,MAAM,UAAU,IAAI,IAAI,IAAI,IAAI,IAAO,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;AAAA,QACrF;AAAA,IACF,CAAC,GACD,GAAG,iBAAiB,SAAS,MAAM;AACjC,MAAI,WAAW,OAAI,SAAS,OAC5B,WAAW,MAAM,QAAQ,MAAM,GAAG,YAAY;AAAA,IAChD,CAAC;AAAA,EACH;AAcA,iBAAe,QAAuB;AACpC,QAAI;AACJ,QAAI;AACF,UAAM,OAAO,MAAM,MAAM,OAAO,QAAQ,OAAO,aAAa,CAAC;AAC7D,UAAI,CAAC,KAAK,GAAI,OAAM,IAAI,MAAM,QAAQ,KAAK,MAAM,EAAE;AACnD,eAAS,YAAY,MAAM,KAAK,KAAK,CAAC;AAAA,IACxC,SAAS,GAAG;AAEV,cAAQ,MAAM,4CAA4C,CAAC;AAC3D;AAAA,IACF;AACA,YAAQ,MAAM;AAAA,EAChB;AAEA,QAAM;",
   "names": []
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "name": "bitrix24-mcp-bridge",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "MCP bridge server for Bitrix24 — exposes REST API access, tasks, projects and chat to MCP clients like Claude Code.",
   "license": "MIT",
   "repository": {
@@ -34,6 +34,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.0",
+    "node-html-parser": "^9.0.0",
     "ws": "^8.18.0",
     "zod": "^3.23.0"
   },