bitrix24-mcp-bridge 0.4.0 → 1.0.0

package/extension/dist/connector.js

@@ -2,44 +2,64 @@
 (() => {
   // extension/src/bridge-core.ts
   function encodeForm(params) {
-    let out = new URLSearchParams(), add = (key, val) => {
-      if (val != null)
-        if (Array.isArray(val)) val.forEach((v, i) => add(`${key}[${i}]`, v));
-        else if (typeof val == "object") for (let [k, v] of Object.entries(val)) add(`${key}[${k}]`, v);
-        else out.set(key, String(val));
+    const out = new URLSearchParams();
+    const add = (key, val) => {
+      if (val === null || val === void 0) return;
+      if (Array.isArray(val)) val.forEach((v, i) => add(`${key}[${i}]`, v));
+      else if (typeof val === "object") for (const [k, v] of Object.entries(val)) add(`${key}[${k}]`, v);
+      else out.set(key, String(val));
     };
-    for (let [k, v] of Object.entries(params)) add(k, v);
+    for (const [k, v] of Object.entries(params)) add(k, v);
     return out.toString();
   }
   function applyPathParams(endpoint, params) {
-    let rest = { ...params };
-    return { endpoint: endpoint.replace(/\{(\w+)\}/g, (_match, key) => {
-      let value = rest[key];
-      if (value == null || value === "")
+    const rest = { ...params };
+    const filled = endpoint.replace(/\{(\w+)\}/g, (_match, key) => {
+      const value = rest[key];
+      if (value === null || value === void 0 || value === "") {
         throw new Error(`missing path param "${key}" for endpoint ${endpoint}`);
-      return delete rest[key], encodeURIComponent(String(value));
-    }), rest };
+      }
+      delete rest[key];
+      return encodeURIComponent(String(value));
+    });
+    return { endpoint: filled, rest };
   }
   function buildRequest(origin, req, sessid) {
-    let { endpoint, rest } = applyPathParams(req.endpoint, req.params), q = req.action ? `?action=${encodeURIComponent(req.action)}` : "", url = `${origin}${endpoint}${q}`;
-    if (req.bodyType === "json")
+    const { endpoint, rest } = applyPathParams(req.endpoint, req.params);
+    const q = req.action ? `?action=${encodeURIComponent(req.action)}` : "";
+    const url = `${origin}${endpoint}${q}`;
+    if (req.bodyType === "json") {
       return { url, body: JSON.stringify(rest), contentType: "application/json" };
-    let body = encodeForm({ ...rest, sessid });
+    }
+    const body = encodeForm({ ...rest, sessid });
     return { url, body, contentType: "application/x-www-form-urlencoded" };
   }
   function interpret(json) {
-    let list = json && (Array.isArray(json.errors) ? json.errors : json.error ? [{ code: json.error }] : []), hasErrors = Array.isArray(list) && list.length > 0;
-    if (json && (json.status === "error" || hasErrors)) {
-      let first = list[0], code = first && (first.code || first.message) || json.error || "bitrix_error", description = json.error_description || first && first.message;
-      return { ok: !1, error: description && description !== code ? `${code}: ${description}` : code, data: json };
+    if (!isRecord(json)) return { ok: true, data: json };
+    const list = Array.isArray(json.errors) ? json.errors : json.error ? [isRecord(json.error) ? json.error : { code: json.error }] : [];
+    if (json.status === "error" || list.length > 0) {
+      const first = isRecord(list[0]) ? list[0] : void 0;
+      const code = text(first?.code) || text(first?.message) || text(json.error) || "bitrix_error";
+      const description = text(json.error_description) || text(first?.message);
+      const error = description && description !== code ? `${code}: ${description}` : code;
+      return { ok: false, error, data: json };
     }
-    return { ok: !0, data: json };
+    return { ok: true, data: json };
+  }
+  function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+  }
+  function text(value) {
+    if (typeof value === "number") return value ? String(value) : "";
+    return typeof value === "string" ? value : "";
   }
   var BINARY_CHUNK_BYTES = 1024 * 1024;
   function toBase64(bytes) {
     let binary = "";
-    for (let i = 0; i < bytes.length; i += 32768)
-      binary += String.fromCharCode(...bytes.subarray(i, i + 32768));
+    const window2 = 32768;
+    for (let i = 0; i < bytes.length; i += window2) {
+      binary += String.fromCharCode(...bytes.subarray(i, i + window2));
+    }
     return btoa(binary);
   }
   function looksLikeLoginPage(contentType, contentDisposition) {
@@ -47,17 +67,20 @@
   }
   function fileNameFromDisposition(contentDisposition) {
     if (!contentDisposition) return null;
-    let encoded = /filename\*=(?:UTF-8'')?([^;]+)/i.exec(contentDisposition);
-    if (encoded)
+    const encoded = /filename\*=(?:UTF-8'')?([^;]+)/i.exec(contentDisposition);
+    if (encoded) {
       try {
         return decodeURIComponent(encoded[1].trim().replace(/^"|"$/g, ""));
       } catch {
       }
-    let plain = /filename="?([^";]+)"?/i.exec(contentDisposition);
+    }
+    const plain = /filename="?([^";]+)"?/i.exec(contentDisposition);
     return plain ? plain[1].trim() : null;
   }
-  function interpretText(text, contentType, status) {
-    return status >= 400 ? { ok: !1, error: `HTTP ${status}` } : text.trim() ? { ok: !0, data: { contentType, text } } : { ok: !1, error: "empty response" };
+  function interpretText(text2, contentType, status) {
+    if (status >= 400) return { ok: false, error: `HTTP ${status}` };
+    if (!text2.trim()) return { ok: false, error: "empty response" };
+    return { ok: true, data: { contentType, text: text2 } };
   }
 
   // extension/src/bridge-protocol.ts
@@ -68,86 +91,115 @@
     } catch {
       throw new Error("config.json is not valid JSON");
     }
-    if (typeof doc != "object" || doc === null)
+    if (typeof doc !== "object" || doc === null) {
       throw new Error("config.json must be an object like { token, port }");
-    let obj = doc, token = typeof obj.token == "string" ? obj.token.trim() : "";
+    }
+    const obj = doc;
+    const token = typeof obj.token === "string" ? obj.token.trim() : "";
     if (!token) throw new Error("config.json is missing a non-empty `token`");
-    let port = Number(obj.port);
-    if (!Number.isInteger(port) || port < 1 || port > 65535)
+    const port = Number(obj.port);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
       throw new Error("config.json is missing a numeric `port`");
+    }
     return { token, port };
   }
   var BRIDGE_MSG_SOURCE = "bitrix24-mcp-bridge";
   function buildSessidRequest(nonce) {
     return { source: BRIDGE_MSG_SOURCE, kind: "sessid-request", nonce };
   }
-  function isRecord(v) {
-    return typeof v == "object" && v !== null;
+  function isRecord2(v) {
+    return typeof v === "object" && v !== null;
   }
   function parseSessidResponse(data, expectedNonce) {
-    return !isRecord(data) || data.source !== BRIDGE_MSG_SOURCE || data.kind !== "sessid-response" || typeof data.nonce != "string" || data.nonce !== expectedNonce || typeof data.sessid != "string" ? null : { source: BRIDGE_MSG_SOURCE, kind: "sessid-response", nonce: data.nonce, sessid: data.sessid };
+    if (!isRecord2(data)) return null;
+    if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== "sessid-response") return null;
+    if (typeof data.nonce !== "string" || data.nonce !== expectedNonce) return null;
+    if (typeof data.sessid !== "string") return null;
+    return { source: BRIDGE_MSG_SOURCE, kind: "sessid-response", nonce: data.nonce, sessid: data.sessid };
   }
 
   // extension/src/connector.ts
-  var ORIGIN = location.origin, SESSID_TIMEOUT_MS = 2e3, RECONNECT_MS = 3e3, MAX_DOWNLOAD_BYTES = 512 * 1024 * 1024, socket = null, nonceSeq = 0;
+  var ORIGIN = location.origin;
+  var SESSID_TIMEOUT_MS = 2e3;
+  var RECONNECT_MS = 3e3;
+  var MAX_DOWNLOAD_BYTES = 512 * 1024 * 1024;
+  var socket = null;
+  var nonceSeq = 0;
   function freshSessid() {
-    let nonce = `${Date.now()}-${nonceSeq++}-${Math.random().toString(36).slice(2)}`;
+    const nonce = `${Date.now()}-${nonceSeq++}-${Math.random().toString(36).slice(2)}`;
     return new Promise((resolve) => {
-      let onMsg = (ev) => {
+      const onMsg = (ev) => {
         if (ev.source !== window) return;
-        let res = parseSessidResponse(ev.data, nonce);
-        res && (cleanup(), resolve(res.sessid));
-      }, timer = setTimeout(() => {
-        cleanup(), resolve("");
-      }, SESSID_TIMEOUT_MS), cleanup = () => {
-        clearTimeout(timer), window.removeEventListener("message", onMsg);
+        const res = parseSessidResponse(ev.data, nonce);
+        if (!res) return;
+        cleanup();
+        resolve(res.sessid);
+      };
+      const timer = setTimeout(() => {
+        cleanup();
+        resolve("");
+      }, SESSID_TIMEOUT_MS);
+      const cleanup = () => {
+        clearTimeout(timer);
+        window.removeEventListener("message", onMsg);
       };
-      window.addEventListener("message", onMsg), window.postMessage(buildSessidRequest(nonce), ORIGIN);
+      window.addEventListener("message", onMsg);
+      window.postMessage(buildSessidRequest(nonce), ORIGIN);
     });
   }
   async function fetchPortal(req) {
-    let sessid = await freshSessid();
+    const sessid = await freshSessid();
     if (!sessid) return { error: "session context not ready \u2014 open a normal Bitrix24 portal tab" };
-    let { url, body, contentType } = buildRequest(ORIGIN, req, sessid), init = {
+    const { url, body, contentType } = buildRequest(ORIGIN, req, sessid);
+    const init = {
       method: req.method,
       credentials: "include",
       // sessid rides the CSRF header for all ajax (v2 form + json); form bodies also carry it inline.
       headers: { "Content-Type": contentType, "X-Bitrix-Csrf-Token": sessid }
-    }, finalUrl = url;
-    return req.method === "POST" ? init.body = body : finalUrl += (url.includes("?") ? "&" : "?") + body, fetch(finalUrl, init);
+    };
+    let finalUrl = url;
+    if (req.method === "POST") init.body = body;
+    else finalUrl += (url.includes("?") ? "&" : "?") + body;
+    return fetch(finalUrl, init);
   }
   async function handleCall(req) {
-    let resp = await fetchPortal(req);
-    if (!(resp instanceof Response)) return { ok: !1, error: resp.error };
-    if (req.responseType === "text")
+    const resp = await fetchPortal(req);
+    if (!(resp instanceof Response)) return { ok: false, error: resp.error };
+    if (req.responseType === "text") {
       return interpretText(await resp.text(), resp.headers.get("content-type") ?? "", resp.status);
-    let json = await resp.json();
+    }
+    const json = await resp.json();
     return interpret(json);
   }
   async function handleBinaryCall(req, ws) {
-    let resp = await fetchPortal(req);
-    if (!(resp instanceof Response)) return { ok: !1, error: resp.error };
-    if (resp.status >= 400) return { ok: !1, error: `HTTP ${resp.status}` };
-    let contentType = resp.headers.get("content-type") ?? "", disposition = resp.headers.get("content-disposition");
-    if (looksLikeLoginPage(contentType, disposition))
-      return { ok: !1, error: "portal answered with an HTML page, not a file \u2014 session likely expired" };
-    let bytes = new Uint8Array(await resp.arrayBuffer());
-    if (bytes.length > MAX_DOWNLOAD_BYTES)
-      return { ok: !1, error: `file is ${bytes.length} bytes, over the ${MAX_DOWNLOAD_BYTES} limit` };
-    let fileName = fileNameFromDisposition(disposition);
+    const resp = await fetchPortal(req);
+    if (!(resp instanceof Response)) return { ok: false, error: resp.error };
+    if (resp.status >= 400) return { ok: false, error: `HTTP ${resp.status}` };
+    const contentType = resp.headers.get("content-type") ?? "";
+    const disposition = resp.headers.get("content-disposition");
+    if (looksLikeLoginPage(contentType, disposition)) {
+      return { ok: false, error: "portal answered with an HTML page, not a file \u2014 session likely expired" };
+    }
+    const bytes = new Uint8Array(await resp.arrayBuffer());
+    if (bytes.length > MAX_DOWNLOAD_BYTES) {
+      return { ok: false, error: `file is ${bytes.length} bytes, over the ${MAX_DOWNLOAD_BYTES} limit` };
+    }
+    const fileName = fileNameFromDisposition(disposition);
     ws.send(JSON.stringify({ type: "binary-begin", id: req.id, contentType, bytes: bytes.length, fileName }));
     let seq = 0;
     for (let at = 0; at < bytes.length; at += BINARY_CHUNK_BYTES) {
-      let slice = bytes.subarray(at, at + BINARY_CHUNK_BYTES);
+      const slice = bytes.subarray(at, at + BINARY_CHUNK_BYTES);
       ws.send(JSON.stringify({ type: "binary-chunk", id: req.id, seq: seq++, data: toBase64(slice) }));
     }
-    return { ok: !0, data: { contentType, bytes: bytes.length, fileName, chunks: seq } };
+    return { ok: true, data: { contentType, bytes: bytes.length, fileName, chunks: seq } };
   }
   function connect(config) {
-    let ws = new WebSocket(`ws://127.0.0.1:${config.port}`);
+    const ws = new WebSocket(`ws://127.0.0.1:${config.port}`);
     ws.addEventListener("open", () => {
-      ws.send(JSON.stringify({ type: "auth", token: config.token, version: chrome.runtime.getManifest().version })), socket = ws;
-    }), ws.addEventListener("message", async (ev) => {
+      ws.send(JSON.stringify({ type: "auth", token: config.token, version: chrome.runtime.getManifest().version }));
+      socket = ws;
+    });
+    ws.addEventListener("message", async (ev) => {
       let req;
       try {
         req = JSON.parse(ev.data);
@@ -155,21 +207,23 @@
         console.error("[bitrix-bridge] malformed WS frame, dropping:", e);
         return;
       }
-      if (req.type === "call")
-        try {
-          let r = req.responseType === "binary" ? await handleBinaryCall(req, ws) : await handleCall(req);
-          ws.send(JSON.stringify({ type: "result", id: req.id, ok: r.ok, data: r.data, error: r.error }));
-        } catch (e) {
-          ws.send(JSON.stringify({ type: "result", id: req.id, ok: !1, error: String(e) }));
-        }
-    }), ws.addEventListener("close", () => {
-      socket === ws && (socket = null), setTimeout(() => connect(config), RECONNECT_MS);
+      if (req.type !== "call") return;
+      try {
+        const r = req.responseType === "binary" ? await handleBinaryCall(req, ws) : await handleCall(req);
+        ws.send(JSON.stringify({ type: "result", id: req.id, ok: r.ok, data: r.data, error: r.error }));
+      } catch (e) {
+        ws.send(JSON.stringify({ type: "result", id: req.id, ok: false, error: String(e) }));
+      }
+    });
+    ws.addEventListener("close", () => {
+      if (socket === ws) socket = null;
+      setTimeout(() => connect(config), RECONNECT_MS);
     });
   }
   async function start() {
     let config;
     try {
-      let resp = await fetch(chrome.runtime.getURL("config.json"));
+      const resp = await fetch(chrome.runtime.getURL("config.json"));
       if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
       config = parseConfig(await resp.text());
     } catch (e) {

package/extension/dist/connector.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/bridge-core.ts", "../src/bridge-protocol.ts", "../src/connector.ts"],
-  "sourcesContent": ["// Pure, browser-agnostic \u2014 unit-tested.\n\n// Wire types come from the shared single source; re-exported so downstream\n// extension modules keep importing them from here.\nimport type { CallRequest } from \"../../shared/wire.ts\";\nexport type { CallRequest, CapturedEntry } from \"../../shared/wire.ts\";\n\n// Extension-only: the shape handleCall returns to the bridge (not a wire message).\nexport interface InterpretResult {\n  ok: boolean;\n  data?: unknown;\n  error?: string;\n}\n\nexport function encodeForm(params: Record<string, unknown>): string {\n  const out = new URLSearchParams();\n  const add = (key: string, val: unknown): void => {\n    if (val === null || val === undefined) return;\n    if (Array.isArray(val)) val.forEach((v, i) => add(`${key}[${i}]`, v));\n    else if (typeof val === \"object\") for (const [k, v] of Object.entries(val)) add(`${key}[${k}]`, v);\n    else out.set(key, String(val));\n  };\n  for (const [k, v] of Object.entries(params)) add(k, v);\n  return out.toString();\n}\n\n// Endpoints may carry `{name}` placeholders (e.g. \"/call/detail/{callId}\"); the value comes\n// from params and is consumed there, so it never rides along in the body/query as well.\nexport function applyPathParams(\n  endpoint: string,\n  params: Record<string, unknown>,\n): { endpoint: string; rest: Record<string, unknown> } {\n  const rest = { ...params };\n  const filled = endpoint.replace(/\\{(\\w+)\\}/g, (_match, key: string) => {\n    const value = rest[key];\n    if (value === null || value === undefined || value === \"\") {\n      throw new Error(`missing path param \"${key}\" for endpoint ${endpoint}`);\n    }\n    delete rest[key];\n    return encodeURIComponent(String(value));\n  });\n  return { endpoint: filled, rest };\n}\n\nexport function buildRequest(\n  origin: string,\n  req: CallRequest,\n  sessid: string,\n): { url: string; body: string; contentType: string } {\n  const { endpoint, rest } = applyPathParams(req.endpoint, req.params);\n  const q = req.action ? `?action=${encodeURIComponent(req.action)}` : \"\";\n  const url = `${origin}${endpoint}${q}`;\n  // JSON actions (ui.entityselector.*, tasks.v2.*) send a JSON body; sessid rides the\n  // X-Bitrix-Csrf-Token header (added by the caller), never the body.\n  if (req.bodyType === \"json\") {\n    return { url, body: JSON.stringify(rest), contentType: \"application/json\" };\n  }\n  const body = encodeForm({ ...rest, sessid });\n  return { url, body, contentType: \"application/x-www-form-urlencoded\" };\n}\n\n// Bitrix wraps errors in HTTP 200: { status:\"error\", errors:[{code}] } or { error, error_description }.\n// NOTE: successful ajax responses carry an EMPTY `errors: []` array \u2014 a truthy value in JS \u2014 so we\n// must treat only a NON-EMPTY errors list (or status:\"error\"/a top-level error) as a real failure.\nexport function interpret(json: any): InterpretResult {\n  const list = json && (Array.isArray(json.errors) ? json.errors : json.error ? [{ code: json.error }] : []);\n  const hasErrors = Array.isArray(list) && list.length > 0;\n  if (json && (json.status === \"error\" || hasErrors)) {\n    const first = list[0];\n    const code = (first && (first.code || first.message)) || json.error || \"bitrix_error\";\n    const description = json.error_description || (first && first.message);\n    const error = description && description !== code ? `${code}: ${description}` : code;\n    return { ok: false, error, data: json };\n  }\n  return { ok: true, data: json };\n}\n\n// Chunk size for binary downloads: base64 inflates it by ~33%, so a 1 MiB slice stays a\n// comfortable WS frame while keeping the message count low for large videos.\nexport const BINARY_CHUNK_BYTES = 1024 * 1024;\n\n// `btoa` needs a binary string, and String.fromCharCode blows the call stack on big arrays \u2014\n// so the array is walked in small windows.\nexport function toBase64(bytes: Uint8Array): string {\n  let binary = \"\";\n  const window = 0x8000;\n  for (let i = 0; i < bytes.length; i += window) {\n    binary += String.fromCharCode(...bytes.subarray(i, i + window));\n  }\n  return btoa(binary);\n}\n\n/**\n * The portal answers an unauthenticated download with HTTP 200 and a login PAGE, so the status\n * code cannot be trusted. A genuine file download is marked as an attachment; an HTML body\n * without that marker is the login page, not a .html the user asked for.\n */\nexport function looksLikeLoginPage(contentType: string, contentDisposition: string | null): boolean {\n  return /^\\s*text\\/html/i.test(contentType) && !/attachment/i.test(contentDisposition ?? \"\");\n}\n\n/** Server-suggested file name, e.g. `attachment; filename=\"image (29).png\"` (RFC 5987 aware). */\nexport function fileNameFromDisposition(contentDisposition: string | null): string | null {\n  if (!contentDisposition) return null;\n  const encoded = /filename\\*=(?:UTF-8'')?([^;]+)/i.exec(contentDisposition);\n  if (encoded) {\n    try {\n      return decodeURIComponent(encoded[1].trim().replace(/^\"|\"$/g, \"\"));\n    } catch {\n      // fall through to the plain form\n    }\n  }\n  const plain = /filename=\"?([^\";]+)\"?/i.exec(contentDisposition);\n  return plain ? plain[1].trim() : null;\n}\n\n// HTML sub-domain (responseType \"text\"): no Bitrix envelope to read, so the HTTP status is the\n// only failure signal we get. A login redirect answers 200 with a page \u2014 that one is caught\n// downstream, where the parser knows what the payload was supposed to look like.\nexport function interpretText(text: string, contentType: string, status: number): InterpretResult {\n  if (status >= 400) return { ok: false, error: `HTTP ${status}` };\n  if (!text.trim()) return { ok: false, error: \"empty response\" };\n  return { ok: true, data: { contentType, text } };\n}\n", "// Pure, browser-agnostic \u2014 unit-tested. No DOM / chrome / window.BX here.\n//\n// Two concerns live together because both are the *contract* between the extension's\n// two content scripts and the packaged config, and both are pure/testable:\n//   1) parseConfig  \u2014 validate the per-user config.json ({ token, port }).\n//   2) the postMessage protocol \u2014 the envelopes the ISOLATED connector and the MAIN\n//      script exchange over window.postMessage (sessid request/response, and \u2014 in the\n//      capture build \u2014 MAIN-observed capture entries forwarded to the connector).\n\nimport type { CapturedEntry } from \"./bridge-core.ts\";\n\nexport interface BridgeConfig {\n  token: string;\n  port: number;\n}\n\n/**\n * Parse and validate the packaged config.json body. Throws with a clear,\n * user-facing message (mentioning config.json) on any malformed input so the\n * connector can surface why it failed to start.\n */\nexport function parseConfig(raw: string): BridgeConfig {\n  let doc: unknown;\n  try {\n    doc = JSON.parse(raw);\n  } catch {\n    throw new Error(\"config.json is not valid JSON\");\n  }\n  if (typeof doc !== \"object\" || doc === null) {\n    throw new Error(\"config.json must be an object like { token, port }\");\n  }\n  const obj = doc as Record<string, unknown>;\n  const token = typeof obj.token === \"string\" ? obj.token.trim() : \"\";\n  if (!token) throw new Error(\"config.json is missing a non-empty `token`\");\n  const port = Number(obj.port);\n  if (!Number.isInteger(port) || port < 1 || port > 65535) {\n    throw new Error(\"config.json is missing a numeric `port`\");\n  }\n  return { token, port };\n}\n\n// --- sessid postMessage protocol -------------------------------------------\n//\n// window.postMessage is delivered to BOTH the MAIN and ISOLATED worlds of the same\n// frame (they share the DOM window), and each world also receives its own posts. So\n// every envelope is tagged with a fixed `source` and a `kind`, and each side ignores\n// anything that isn't addressed to it. Responses additionally carry the request nonce\n// so the connector can match a reply to the exact in-flight request it issued.\n\nexport const BRIDGE_MSG_SOURCE = \"bitrix24-mcp-bridge\";\n\nexport interface SessidRequestMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"sessid-request\";\n  nonce: string;\n}\n\nexport interface SessidResponseMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"sessid-response\";\n  nonce: string;\n  sessid: string;\n}\n\nexport function buildSessidRequest(nonce: string): SessidRequestMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-request\", nonce };\n}\n\nexport function buildSessidResponse(nonce: string, sessid: string): SessidResponseMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-response\", nonce, sessid };\n}\n\nfunction isRecord(v: unknown): v is Record<string, unknown> {\n  return typeof v === \"object\" && v !== null;\n}\n\n/** For the MAIN shim: a well-formed request from our connector, or null. */\nexport function parseSessidRequest(data: unknown): SessidRequestMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"sessid-request\") return null;\n  if (typeof data.nonce !== \"string\") return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-request\", nonce: data.nonce };\n}\n\n/** For the ISOLATED connector: a response matching `expectedNonce`, or null. */\nexport function parseSessidResponse(data: unknown, expectedNonce: string): SessidResponseMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"sessid-response\") return null;\n  if (typeof data.nonce !== \"string\" || data.nonce !== expectedNonce) return null;\n  if (typeof data.sessid !== \"string\") return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-response\", nonce: data.nonce, sessid: data.sessid };\n}\n\n// --- capture forwarding (capture build only) -------------------------------\n//\n// The capture hooks must observe the PAGE's fetch/XHR, so they run in the MAIN world.\n// The socket lives only in the ISOLATED connector, so MAIN forwards each observed entry\n// to the connector over postMessage; the connector relays it to the daemon.\n\nexport interface CaptureForwardMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"capture\";\n  call: CapturedEntry;\n}\n\nexport function buildCaptureForward(call: CapturedEntry): CaptureForwardMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"capture\", call };\n}\n\n/** For the ISOLATED connector: a capture entry forwarded by the MAIN script, or null. */\nexport function parseCaptureForward(data: unknown): CaptureForwardMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"capture\") return null;\n  if (!isRecord(data.call)) return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"capture\", call: data.call as unknown as CapturedEntry };\n}\n", "// ISOLATED-world connector. This is where the token and the WebSocket live \u2014 never in\n// the page's MAIN world, so the page cannot read the token without knowing the dynamic\n// (`use_dynamic_url`) resource URL for config.json, and cannot hijack the socket. It has\n// `chrome.runtime`, so it loads the per-user config from the packaged config.json at\n// runtime (nothing per-user is baked into this JS \u2014 the file is static). The actual\n// boundary is `use_dynamic_url: true` on config.json in the manifest: it makes the\n// resource URL unguessable from the page while `chrome.runtime.getURL()` here still\n// resolves it.\n//\n// Per daemon call it asks the MAIN shim for a FRESH sessid over postMessage (nonce-matched),\n// then reuses the pure bridge-core helpers to build the request, fetch it with the page's\n// cookies, and interpret the response.\n\nimport {\n  buildRequest,\n  interpret,\n  interpretText,\n  toBase64,\n  looksLikeLoginPage,\n  fileNameFromDisposition,\n  BINARY_CHUNK_BYTES,\n  type CallRequest,\n  type InterpretResult,\n} from \"./bridge-core.ts\";\nimport {\n  parseConfig,\n  buildSessidRequest,\n  parseSessidResponse,\n  parseCaptureForward,\n  type BridgeConfig,\n} from \"./bridge-protocol.ts\";\n\n// Gates the capture relay listener; stripped from normal builds via esbuild `define`.\ndeclare const __BITRIX_CAPTURE__: boolean;\n\n// Minimal ambient for the one chrome API we use (no @types/chrome dependency).\ndeclare const chrome: { runtime: { getURL(path: string): string; getManifest(): { version?: string } } };\n\nconst ORIGIN = location.origin;\nconst SESSID_TIMEOUT_MS = 2000;\nconst RECONNECT_MS = 3000;\n// The whole body is buffered here before streaming, so this caps peak tab memory.\nconst MAX_DOWNLOAD_BYTES = 512 * 1024 * 1024;\n\nlet socket: WebSocket | null = null;\nlet nonceSeq = 0;\n\n/** Ask the MAIN shim for a fresh sessid; resolves \"\" if it doesn't answer in time. */\nfunction freshSessid(): Promise<string> {\n  const nonce = `${Date.now()}-${nonceSeq++}-${Math.random().toString(36).slice(2)}`;\n  return new Promise((resolve) => {\n    const onMsg = (ev: MessageEvent): void => {\n      if (ev.source !== window) return;\n      const res = parseSessidResponse(ev.data, nonce);\n      if (!res) return;\n      cleanup();\n      resolve(res.sessid);\n    };\n    const timer = setTimeout(() => {\n      cleanup();\n      resolve(\"\");\n    }, SESSID_TIMEOUT_MS);\n    const cleanup = (): void => {\n      clearTimeout(timer);\n      window.removeEventListener(\"message\", onMsg);\n    };\n    window.addEventListener(\"message\", onMsg);\n    window.postMessage(buildSessidRequest(nonce), ORIGIN);\n  });\n}\n\nasync function fetchPortal(req: CallRequest): Promise<Response | { error: string }> {\n  const sessid = await freshSessid();\n  if (!sessid) return { error: \"session context not ready \u2014 open a normal Bitrix24 portal tab\" }; // G5\n  const { url, body, contentType } = buildRequest(ORIGIN, req, sessid);\n  const init: RequestInit = {\n    method: req.method,\n    credentials: \"include\",\n    // sessid rides the CSRF header for all ajax (v2 form + json); form bodies also carry it inline.\n    headers: { \"Content-Type\": contentType, \"X-Bitrix-Csrf-Token\": sessid },\n  };\n  let finalUrl = url;\n  if (req.method === \"POST\") init.body = body;\n  else finalUrl += (url.includes(\"?\") ? \"&\" : \"?\") + body;\n  return fetch(finalUrl, init);\n}\n\nasync function handleCall(req: CallRequest): Promise<InterpretResult> {\n  const resp = await fetchPortal(req);\n  if (!(resp instanceof Response)) return { ok: false, error: resp.error };\n  if (req.responseType === \"text\") {\n    return interpretText(await resp.text(), resp.headers.get(\"content-type\") ?? \"\", resp.status);\n  }\n  const json = await resp.json();\n  return interpret(json); // G3\n}\n\n/** Streams the body to the daemon as base64 chunks; the daemon writes them to a file. */\nasync function handleBinaryCall(req: CallRequest, ws: WebSocket): Promise<InterpretResult> {\n  const resp = await fetchPortal(req);\n  if (!(resp instanceof Response)) return { ok: false, error: resp.error };\n  if (resp.status >= 400) return { ok: false, error: `HTTP ${resp.status}` };\n\n  const contentType = resp.headers.get(\"content-type\") ?? \"\";\n  const disposition = resp.headers.get(\"content-disposition\");\n  if (looksLikeLoginPage(contentType, disposition)) {\n    return { ok: false, error: \"portal answered with an HTML page, not a file \u2014 session likely expired\" };\n  }\n\n  const bytes = new Uint8Array(await resp.arrayBuffer());\n  if (bytes.length > MAX_DOWNLOAD_BYTES) {\n    return { ok: false, error: `file is ${bytes.length} bytes, over the ${MAX_DOWNLOAD_BYTES} limit` };\n  }\n  const fileName = fileNameFromDisposition(disposition);\n  ws.send(JSON.stringify({ type: \"binary-begin\", id: req.id, contentType, bytes: bytes.length, fileName }));\n  let seq = 0;\n  for (let at = 0; at < bytes.length; at += BINARY_CHUNK_BYTES) {\n    const slice = bytes.subarray(at, at + BINARY_CHUNK_BYTES);\n    ws.send(JSON.stringify({ type: \"binary-chunk\", id: req.id, seq: seq++, data: toBase64(slice) }));\n  }\n  return { ok: true, data: { contentType, bytes: bytes.length, fileName, chunks: seq } };\n}\n\nfunction connect(config: BridgeConfig): void {\n  const ws = new WebSocket(`ws://127.0.0.1:${config.port}`);\n  ws.addEventListener(\"open\", () => {\n    ws.send(JSON.stringify({ type: \"auth\", token: config.token, version: chrome.runtime.getManifest().version }));\n    socket = ws;\n  });\n  ws.addEventListener(\"message\", async (ev: MessageEvent) => {\n    let req: CallRequest;\n    try {\n      req = JSON.parse(ev.data) as CallRequest;\n    } catch (e) {\n      console.error(\"[bitrix-bridge] malformed WS frame, dropping:\", e);\n      return;\n    }\n    if (req.type !== \"call\") return;\n    try {\n      const r = req.responseType === \"binary\" ? await handleBinaryCall(req, ws) : await handleCall(req);\n      ws.send(JSON.stringify({ type: \"result\", id: req.id, ok: r.ok, data: r.data, error: r.error }));\n    } catch (e) {\n      ws.send(JSON.stringify({ type: \"result\", id: req.id, ok: false, error: String(e) }));\n    }\n  });\n  ws.addEventListener(\"close\", () => {\n    if (socket === ws) socket = null;\n    setTimeout(() => connect(config), RECONNECT_MS); // auto-reconnect\n  });\n}\n\n// Capture build only: relay MAIN-observed capture entries to the daemon.\nif (__BITRIX_CAPTURE__) {\n  window.addEventListener(\"message\", (ev: MessageEvent) => {\n    if (ev.source !== window) return;\n    const fwd = parseCaptureForward(ev.data);\n    if (!fwd) return;\n    if (socket && socket.readyState === WebSocket.OPEN) {\n      socket.send(JSON.stringify({ type: \"capture\", call: fwd.call }));\n    }\n  });\n}\n\nasync function start(): Promise<void> {\n  let config: BridgeConfig;\n  try {\n    const resp = await fetch(chrome.runtime.getURL(\"config.json\"));\n    if (!resp.ok) throw new Error(`HTTP ${resp.status}`);\n    config = parseConfig(await resp.text());\n  } catch (e) {\n    // Nothing to fall back to \u2014 surface why the bridge won't start and stop.\n    console.error(\"[bitrix-bridge] cannot load config.json:\", e);\n    return;\n  }\n  connect(config);\n}\n\nstart();\n"],
-  "mappings": ";;;AAcO,WAAS,WAAW,QAAyC;AAClE,QAAM,MAAM,IAAI,gBAAgB,GAC1B,MAAM,CAAC,KAAa,QAAuB;AAC/C,UAAI,OAAQ;AACZ,YAAI,MAAM,QAAQ,GAAG,EAAG,KAAI,QAAQ,CAAC,GAAG,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;AAAA,iBAC3D,OAAO,OAAQ,SAAU,UAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,EAAG,KAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;AAAA,YAC5F,KAAI,IAAI,KAAK,OAAO,GAAG,CAAC;AAAA,IAC/B;AACA,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,EAAG,KAAI,GAAG,CAAC;AACrD,WAAO,IAAI,SAAS;AAAA,EACtB;AAIO,WAAS,gBACd,UACA,QACqD;AACrD,QAAM,OAAO,EAAE,GAAG,OAAO;AASzB,WAAO,EAAE,UARM,SAAS,QAAQ,cAAc,CAAC,QAAQ,QAAgB;AACrE,UAAM,QAAQ,KAAK,GAAG;AACtB,UAAI,SAAU,QAA+B,UAAU;AACrD,cAAM,IAAI,MAAM,uBAAuB,GAAG,kBAAkB,QAAQ,EAAE;AAExE,oBAAO,KAAK,GAAG,GACR,mBAAmB,OAAO,KAAK,CAAC;AAAA,IACzC,CAAC,GAC0B,KAAK;AAAA,EAClC;AAEO,WAAS,aACd,QACA,KACA,QACoD;AACpD,QAAM,EAAE,UAAU,KAAK,IAAI,gBAAgB,IAAI,UAAU,IAAI,MAAM,GAC7D,IAAI,IAAI,SAAS,WAAW,mBAAmB,IAAI,MAAM,CAAC,KAAK,IAC/D,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,CAAC;AAGpC,QAAI,IAAI,aAAa;AACnB,aAAO,EAAE,KAAK,MAAM,KAAK,UAAU,IAAI,GAAG,aAAa,mBAAmB;AAE5E,QAAM,OAAO,WAAW,EAAE,GAAG,MAAM,OAAO,CAAC;AAC3C,WAAO,EAAE,KAAK,MAAM,aAAa,oCAAoC;AAAA,EACvE;AAKO,WAAS,UAAU,MAA4B;AACpD,QAAM,OAAO,SAAS,MAAM,QAAQ,KAAK,MAAM,IAAI,KAAK,SAAS,KAAK,QAAQ,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAClG,YAAY,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS;AACvD,QAAI,SAAS,KAAK,WAAW,WAAW,YAAY;AAClD,UAAM,QAAQ,KAAK,CAAC,GACd,OAAQ,UAAU,MAAM,QAAQ,MAAM,YAAa,KAAK,SAAS,gBACjE,cAAc,KAAK,qBAAsB,SAAS,MAAM;AAE9D,aAAO,EAAE,IAAI,IAAO,OADN,eAAe,gBAAgB,OAAO,GAAG,IAAI,KAAK,WAAW,KAAK,MACrD,MAAM,KAAK;AAAA,IACxC;AACA,WAAO,EAAE,IAAI,IAAM,MAAM,KAAK;AAAA,EAChC;AAIO,MAAM,qBAAqB,OAAO;AAIlC,WAAS,SAAS,OAA2B;AAClD,QAAI,SAAS;AAEb,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,gBAAU,OAAO,aAAa,GAAG,MAAM,SAAS,GAAG,IAAI,KAAM,CAAC;AAEhE,WAAO,KAAK,MAAM;AAAA,EACpB;AAOO,WAAS,mBAAmB,aAAqB,oBAA4C;AAClG,WAAO,kBAAkB,KAAK,WAAW,KAAK,CAAC,cAAc,KAAK,sBAAsB,EAAE;AAAA,EAC5F;AAGO,WAAS,wBAAwB,oBAAkD;AACxF,QAAI,CAAC,mBAAoB,QAAO;AAChC,QAAM,UAAU,kCAAkC,KAAK,kBAAkB;AACzE,QAAI;AACF,UAAI;AACF,eAAO,mBAAmB,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,UAAU,EAAE,CAAC;AAAA,MACnE,QAAQ;AAAA,MAER;AAEF,QAAM,QAAQ,yBAAyB,KAAK,kBAAkB;AAC9D,WAAO,QAAQ,MAAM,CAAC,EAAE,KAAK,IAAI;AAAA,EACnC;AAKO,WAAS,cAAc,MAAc,aAAqB,QAAiC;AAChG,WAAI,UAAU,MAAY,EAAE,IAAI,IAAO,OAAO,QAAQ,MAAM,GAAG,IAC1D,KAAK,KAAK,IACR,EAAE,IAAI,IAAM,MAAM,EAAE,aAAa,KAAK,EAAE,IADtB,EAAE,IAAI,IAAO,OAAO,iBAAiB;AAAA,EAEhE;;;ACtGO,WAAS,YAAY,KAA2B;AACrD,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,MAAM,GAAG;AAAA,IACtB,QAAQ;AACN,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AACA,QAAI,OAAO,OAAQ,YAAY,QAAQ;AACrC,YAAM,IAAI,MAAM,oDAAoD;AAEtE,QAAM,MAAM,KACN,QAAQ,OAAO,IAAI,SAAU,WAAW,IAAI,MAAM,KAAK,IAAI;AACjE,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,4CAA4C;AACxE,QAAM,OAAO,OAAO,IAAI,IAAI;AAC5B,QAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO;AAChD,YAAM,IAAI,MAAM,yCAAyC;AAE3D,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAUO,MAAM,oBAAoB;AAe1B,WAAS,mBAAmB,OAAiC;AAClE,WAAO,EAAE,QAAQ,mBAAmB,MAAM,kBAAkB,MAAM;AAAA,EACpE;AAMA,WAAS,SAAS,GAA0C;AAC1D,WAAO,OAAO,KAAM,YAAY,MAAM;AAAA,EACxC;AAWO,WAAS,oBAAoB,MAAe,eAAiD;AAIlG,WAHI,CAAC,SAAS,IAAI,KACd,KAAK,WAAW,qBAAqB,KAAK,SAAS,qBACnD,OAAO,KAAK,SAAU,YAAY,KAAK,UAAU,iBACjD,OAAO,KAAK,UAAW,WAAiB,OACrC,EAAE,QAAQ,mBAAmB,MAAM,mBAAmB,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO;AAAA,EACtG;;;ACrDA,MAAM,SAAS,SAAS,QAClB,oBAAoB,KACpB,eAAe,KAEf,qBAAqB,MAAM,OAAO,MAEpC,SAA2B,MAC3B,WAAW;AAGf,WAAS,cAA+B;AACtC,QAAM,QAAQ,GAAG,KAAK,IAAI,CAAC,IAAI,UAAU,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAChF,WAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,QAAQ,CAAC,OAA2B;AACxC,YAAI,GAAG,WAAW,OAAQ;AAC1B,YAAM,MAAM,oBAAoB,GAAG,MAAM,KAAK;AAC9C,QAAK,QACL,QAAQ,GACR,QAAQ,IAAI,MAAM;AAAA,MACpB,GACM,QAAQ,WAAW,MAAM;AAC7B,gBAAQ,GACR,QAAQ,EAAE;AAAA,MACZ,GAAG,iBAAiB,GACd,UAAU,MAAY;AAC1B,qBAAa,KAAK,GAClB,OAAO,oBAAoB,WAAW,KAAK;AAAA,MAC7C;AACA,aAAO,iBAAiB,WAAW,KAAK,GACxC,OAAO,YAAY,mBAAmB,KAAK,GAAG,MAAM;AAAA,IACtD,CAAC;AAAA,EACH;AAEA,iBAAe,YAAY,KAAyD;AAClF,QAAM,SAAS,MAAM,YAAY;AACjC,QAAI,CAAC,OAAQ,QAAO,EAAE,OAAO,qEAAgE;AAC7F,QAAM,EAAE,KAAK,MAAM,YAAY,IAAI,aAAa,QAAQ,KAAK,MAAM,GAC7D,OAAoB;AAAA,MACxB,QAAQ,IAAI;AAAA,MACZ,aAAa;AAAA;AAAA,MAEb,SAAS,EAAE,gBAAgB,aAAa,uBAAuB,OAAO;AAAA,IACxE,GACI,WAAW;AACf,WAAI,IAAI,WAAW,SAAQ,KAAK,OAAO,OAClC,aAAa,IAAI,SAAS,GAAG,IAAI,MAAM,OAAO,MAC5C,MAAM,UAAU,IAAI;AAAA,EAC7B;AAEA,iBAAe,WAAW,KAA4C;AACpE,QAAM,OAAO,MAAM,YAAY,GAAG;AAClC,QAAI,EAAE,gBAAgB,UAAW,QAAO,EAAE,IAAI,IAAO,OAAO,KAAK,MAAM;AACvE,QAAI,IAAI,iBAAiB;AACvB,aAAO,cAAc,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI,KAAK,MAAM;AAE7F,QAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,WAAO,UAAU,IAAI;AAAA,EACvB;AAGA,iBAAe,iBAAiB,KAAkB,IAAyC;AACzF,QAAM,OAAO,MAAM,YAAY,GAAG;AAClC,QAAI,EAAE,gBAAgB,UAAW,QAAO,EAAE,IAAI,IAAO,OAAO,KAAK,MAAM;AACvE,QAAI,KAAK,UAAU,IAAK,QAAO,EAAE,IAAI,IAAO,OAAO,QAAQ,KAAK,MAAM,GAAG;AAEzE,QAAM,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,IAClD,cAAc,KAAK,QAAQ,IAAI,qBAAqB;AAC1D,QAAI,mBAAmB,aAAa,WAAW;AAC7C,aAAO,EAAE,IAAI,IAAO,OAAO,8EAAyE;AAGtG,QAAM,QAAQ,IAAI,WAAW,MAAM,KAAK,YAAY,CAAC;AACrD,QAAI,MAAM,SAAS;AACjB,aAAO,EAAE,IAAI,IAAO,OAAO,WAAW,MAAM,MAAM,oBAAoB,kBAAkB,SAAS;AAEnG,QAAM,WAAW,wBAAwB,WAAW;AACpD,OAAG,KAAK,KAAK,UAAU,EAAE,MAAM,gBAAgB,IAAI,IAAI,IAAI,aAAa,OAAO,MAAM,QAAQ,SAAS,CAAC,CAAC;AACxG,QAAI,MAAM;AACV,aAAS,KAAK,GAAG,KAAK,MAAM,QAAQ,MAAM,oBAAoB;AAC5D,UAAM,QAAQ,MAAM,SAAS,IAAI,KAAK,kBAAkB;AACxD,SAAG,KAAK,KAAK,UAAU,EAAE,MAAM,gBAAgB,IAAI,IAAI,IAAI,KAAK,OAAO,MAAM,SAAS,KAAK,EAAE,CAAC,CAAC;AAAA,IACjG;AACA,WAAO,EAAE,IAAI,IAAM,MAAM,EAAE,aAAa,OAAO,MAAM,QAAQ,UAAU,QAAQ,IAAI,EAAE;AAAA,EACvF;AAEA,WAAS,QAAQ,QAA4B;AAC3C,QAAM,KAAK,IAAI,UAAU,kBAAkB,OAAO,IAAI,EAAE;AACxD,OAAG,iBAAiB,QAAQ,MAAM;AAChC,SAAG,KAAK,KAAK,UAAU,EAAE,MAAM,QAAQ,OAAO,OAAO,OAAO,SAAS,OAAO,QAAQ,YAAY,EAAE,QAAQ,CAAC,CAAC,GAC5G,SAAS;AAAA,IACX,CAAC,GACD,GAAG,iBAAiB,WAAW,OAAO,OAAqB;AACzD,UAAI;AACJ,UAAI;AACF,cAAM,KAAK,MAAM,GAAG,IAAI;AAAA,MAC1B,SAAS,GAAG;AACV,gBAAQ,MAAM,iDAAiD,CAAC;AAChE;AAAA,MACF;AACA,UAAI,IAAI,SAAS;AACjB,YAAI;AACF,cAAM,IAAI,IAAI,iBAAiB,WAAW,MAAM,iBAAiB,KAAK,EAAE,IAAI,MAAM,WAAW,GAAG;AAChG,aAAG,KAAK,KAAK,UAAU,EAAE,MAAM,UAAU,IAAI,IAAI,IAAI,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,OAAO,EAAE,MAAM,CAAC,CAAC;AAAA,QAChG,SAAS,GAAG;AACV,aAAG,KAAK,KAAK,UAAU,EAAE,MAAM,UAAU,IAAI,IAAI,IAAI,IAAI,IAAO,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;AAAA,QACrF;AAAA,IACF,CAAC,GACD,GAAG,iBAAiB,SAAS,MAAM;AACjC,MAAI,WAAW,OAAI,SAAS,OAC5B,WAAW,MAAM,QAAQ,MAAM,GAAG,YAAY;AAAA,IAChD,CAAC;AAAA,EACH;AAcA,iBAAe,QAAuB;AACpC,QAAI;AACJ,QAAI;AACF,UAAM,OAAO,MAAM,MAAM,OAAO,QAAQ,OAAO,aAAa,CAAC;AAC7D,UAAI,CAAC,KAAK,GAAI,OAAM,IAAI,MAAM,QAAQ,KAAK,MAAM,EAAE;AACnD,eAAS,YAAY,MAAM,KAAK,KAAK,CAAC;AAAA,IACxC,SAAS,GAAG;AAEV,cAAQ,MAAM,4CAA4C,CAAC;AAC3D;AAAA,IACF;AACA,YAAQ,MAAM;AAAA,EAChB;AAEA,QAAM;",
-  "names": []
+  "sourcesContent": ["// Pure, browser-agnostic \u2014 unit-tested.\n\n// Wire types come from the shared single source; re-exported so downstream\n// extension modules keep importing them from here.\nimport type { CallRequest } from \"../../shared/wire.ts\";\nexport type { CallRequest } from \"../../shared/wire.ts\";\n\n// Extension-only: the shape handleCall returns to the bridge (not a wire message).\nexport interface InterpretResult {\n  ok: boolean;\n  data?: unknown;\n  error?: string;\n}\n\nexport function encodeForm(params: Record<string, unknown>): string {\n  const out = new URLSearchParams();\n  const add = (key: string, val: unknown): void => {\n    if (val === null || val === undefined) return;\n    if (Array.isArray(val)) val.forEach((v, i) => add(`${key}[${i}]`, v));\n    else if (typeof val === \"object\") for (const [k, v] of Object.entries(val)) add(`${key}[${k}]`, v);\n    else out.set(key, String(val));\n  };\n  for (const [k, v] of Object.entries(params)) add(k, v);\n  return out.toString();\n}\n\n// Endpoints may carry `{name}` placeholders (e.g. \"/call/detail/{callId}\"); the value comes\n// from params and is consumed there, so it never rides along in the body/query as well.\nexport function applyPathParams(\n  endpoint: string,\n  params: Record<string, unknown>,\n): { endpoint: string; rest: Record<string, unknown> } {\n  const rest = { ...params };\n  const filled = endpoint.replace(/\\{(\\w+)\\}/g, (_match, key: string) => {\n    const value = rest[key];\n    if (value === null || value === undefined || value === \"\") {\n      throw new Error(`missing path param \"${key}\" for endpoint ${endpoint}`);\n    }\n    delete rest[key];\n    return encodeURIComponent(String(value));\n  });\n  return { endpoint: filled, rest };\n}\n\nexport function buildRequest(\n  origin: string,\n  req: CallRequest,\n  sessid: string,\n): { url: string; body: string; contentType: string } {\n  const { endpoint, rest } = applyPathParams(req.endpoint, req.params);\n  const q = req.action ? `?action=${encodeURIComponent(req.action)}` : \"\";\n  const url = `${origin}${endpoint}${q}`;\n  // JSON actions (ui.entityselector.*, tasks.v2.*) send a JSON body; sessid rides the\n  // X-Bitrix-Csrf-Token header (added by the caller), never the body.\n  if (req.bodyType === \"json\") {\n    return { url, body: JSON.stringify(rest), contentType: \"application/json\" };\n  }\n  const body = encodeForm({ ...rest, sessid });\n  return { url, body, contentType: \"application/x-www-form-urlencoded\" };\n}\n\n// Bitrix wraps errors in HTTP 200: { status:\"error\", errors:[{code}] } or { error, error_description }.\n// NOTE: successful ajax responses carry an EMPTY `errors: []` array \u2014 a truthy value in JS \u2014 so we\n// must treat only a NON-EMPTY errors list (or status:\"error\"/a top-level error) as a real failure.\nexport function interpret(json: unknown): InterpretResult {\n  if (!isRecord(json)) return { ok: true, data: json };\n  // Three envelopes: ajax `errors: [{code, message}]`, classic REST `error: \"CODE\"` (+ error_description),\n  // REST 3.0 `error: {code, message}`.\n  const list: unknown[] = Array.isArray(json.errors)\n    ? json.errors\n    : json.error\n      ? [isRecord(json.error) ? json.error : { code: json.error }]\n      : [];\n  if (json.status === \"error\" || list.length > 0) {\n    const first = isRecord(list[0]) ? list[0] : undefined;\n    const code = text(first?.code) || text(first?.message) || text(json.error) || \"bitrix_error\";\n    const description = text(json.error_description) || text(first?.message);\n    const error = description && description !== code ? `${code}: ${description}` : code;\n    return { ok: false, error, data: json };\n  }\n  return { ok: true, data: json };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction text(value: unknown): string {\n  if (typeof value === \"number\") return value ? String(value) : \"\";\n  return typeof value === \"string\" ? value : \"\";\n}\n\n// Chunk size for binary downloads: base64 inflates it by ~33%, so a 1 MiB slice stays a\n// comfortable WS frame while keeping the message count low for large videos.\nexport const BINARY_CHUNK_BYTES = 1024 * 1024;\n\n// `btoa` needs a binary string, and String.fromCharCode blows the call stack on big arrays \u2014\n// so the array is walked in small windows.\nexport function toBase64(bytes: Uint8Array): string {\n  let binary = \"\";\n  const window = 0x8000;\n  for (let i = 0; i < bytes.length; i += window) {\n    binary += String.fromCharCode(...bytes.subarray(i, i + window));\n  }\n  return btoa(binary);\n}\n\n/**\n * The portal answers an unauthenticated download with HTTP 200 and a login PAGE, so the status\n * code cannot be trusted. A genuine file download is marked as an attachment; an HTML body\n * without that marker is the login page, not a .html the user asked for.\n */\nexport function looksLikeLoginPage(contentType: string, contentDisposition: string | null): boolean {\n  return /^\\s*text\\/html/i.test(contentType) && !/attachment/i.test(contentDisposition ?? \"\");\n}\n\n/** Server-suggested file name, e.g. `attachment; filename=\"image (29).png\"` (RFC 5987 aware). */\nexport function fileNameFromDisposition(contentDisposition: string | null): string | null {\n  if (!contentDisposition) return null;\n  const encoded = /filename\\*=(?:UTF-8'')?([^;]+)/i.exec(contentDisposition);\n  if (encoded) {\n    try {\n      return decodeURIComponent(encoded[1].trim().replace(/^\"|\"$/g, \"\"));\n    } catch {\n      // fall through to the plain form\n    }\n  }\n  const plain = /filename=\"?([^\";]+)\"?/i.exec(contentDisposition);\n  return plain ? plain[1].trim() : null;\n}\n\n// HTML sub-domain (responseType \"text\"): no Bitrix envelope to read, so the HTTP status is the\n// only failure signal we get. A login redirect answers 200 with a page \u2014 that one is caught\n// downstream, where the parser knows what the payload was supposed to look like.\nexport function interpretText(text: string, contentType: string, status: number): InterpretResult {\n  if (status >= 400) return { ok: false, error: `HTTP ${status}` };\n  if (!text.trim()) return { ok: false, error: \"empty response\" };\n  return { ok: true, data: { contentType, text } };\n}\n", "// Pure, browser-agnostic \u2014 unit-tested. No DOM / chrome / window.BX here.\n//\n// Two concerns live together because both are the *contract* between the extension's\n// two content scripts and the packaged config, and both are pure/testable:\n//   1) parseConfig  \u2014 validate the per-user config.json ({ token, port }).\n//   2) the postMessage protocol \u2014 the envelopes the ISOLATED connector and the MAIN\n//      script exchange over window.postMessage (sessid request/response).\n\nexport interface BridgeConfig {\n  token: string;\n  port: number;\n}\n\n/**\n * Parse and validate the packaged config.json body. Throws with a clear,\n * user-facing message (mentioning config.json) on any malformed input so the\n * connector can surface why it failed to start.\n */\nexport function parseConfig(raw: string): BridgeConfig {\n  let doc: unknown;\n  try {\n    doc = JSON.parse(raw);\n  } catch {\n    throw new Error(\"config.json is not valid JSON\");\n  }\n  if (typeof doc !== \"object\" || doc === null) {\n    throw new Error(\"config.json must be an object like { token, port }\");\n  }\n  const obj = doc as Record<string, unknown>;\n  const token = typeof obj.token === \"string\" ? obj.token.trim() : \"\";\n  if (!token) throw new Error(\"config.json is missing a non-empty `token`\");\n  const port = Number(obj.port);\n  if (!Number.isInteger(port) || port < 1 || port > 65535) {\n    throw new Error(\"config.json is missing a numeric `port`\");\n  }\n  return { token, port };\n}\n\n// --- sessid postMessage protocol -------------------------------------------\n//\n// window.postMessage is delivered to BOTH the MAIN and ISOLATED worlds of the same\n// frame (they share the DOM window), and each world also receives its own posts. So\n// every envelope is tagged with a fixed `source` and a `kind`, and each side ignores\n// anything that isn't addressed to it. Responses additionally carry the request nonce\n// so the connector can match a reply to the exact in-flight request it issued.\n\nexport const BRIDGE_MSG_SOURCE = \"bitrix24-mcp-bridge\";\n\nexport interface SessidRequestMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"sessid-request\";\n  nonce: string;\n}\n\nexport interface SessidResponseMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"sessid-response\";\n  nonce: string;\n  sessid: string;\n}\n\nexport function buildSessidRequest(nonce: string): SessidRequestMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-request\", nonce };\n}\n\nexport function buildSessidResponse(nonce: string, sessid: string): SessidResponseMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-response\", nonce, sessid };\n}\n\nfunction isRecord(v: unknown): v is Record<string, unknown> {\n  return typeof v === \"object\" && v !== null;\n}\n\n/** For the MAIN shim: a well-formed request from our connector, or null. */\nexport function parseSessidRequest(data: unknown): SessidRequestMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"sessid-request\") return null;\n  if (typeof data.nonce !== \"string\") return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-request\", nonce: data.nonce };\n}\n\n/** For the ISOLATED connector: a response matching `expectedNonce`, or null. */\nexport function parseSessidResponse(data: unknown, expectedNonce: string): SessidResponseMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"sessid-response\") return null;\n  if (typeof data.nonce !== \"string\" || data.nonce !== expectedNonce) return null;\n  if (typeof data.sessid !== \"string\") return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-response\", nonce: data.nonce, sessid: data.sessid };\n}\n", "// ISOLATED-world connector. This is where the token and the WebSocket live \u2014 never in\n// the page's MAIN world, so the page cannot read the token without knowing the dynamic\n// (`use_dynamic_url`) resource URL for config.json, and cannot hijack the socket. It has\n// `chrome.runtime`, so it loads the per-user config from the packaged config.json at\n// runtime (nothing per-user is baked into this JS \u2014 the file is static). The actual\n// boundary is `use_dynamic_url: true` on config.json in the manifest: it makes the\n// resource URL unguessable from the page while `chrome.runtime.getURL()` here still\n// resolves it.\n//\n// Per daemon call it asks the MAIN shim for a FRESH sessid over postMessage (nonce-matched),\n// then reuses the pure bridge-core helpers to build the request, fetch it with the page's\n// cookies, and interpret the response.\n\nimport {\n  buildRequest,\n  interpret,\n  interpretText,\n  toBase64,\n  looksLikeLoginPage,\n  fileNameFromDisposition,\n  BINARY_CHUNK_BYTES,\n  type CallRequest,\n  type InterpretResult,\n} from \"./bridge-core.ts\";\nimport {\n  parseConfig,\n  buildSessidRequest,\n  parseSessidResponse,\n  type BridgeConfig,\n} from \"./bridge-protocol.ts\";\n\n// Minimal ambient for the one chrome API we use (no @types/chrome dependency).\ndeclare const chrome: { runtime: { getURL(path: string): string; getManifest(): { version?: string } } };\n\nconst ORIGIN = location.origin;\nconst SESSID_TIMEOUT_MS = 2000;\nconst RECONNECT_MS = 3000;\n// The whole body is buffered here before streaming, so this caps peak tab memory.\nconst MAX_DOWNLOAD_BYTES = 512 * 1024 * 1024;\n\nlet socket: WebSocket | null = null;\nlet nonceSeq = 0;\n\n/** Ask the MAIN shim for a fresh sessid; resolves \"\" if it doesn't answer in time. */\nfunction freshSessid(): Promise<string> {\n  const nonce = `${Date.now()}-${nonceSeq++}-${Math.random().toString(36).slice(2)}`;\n  return new Promise((resolve) => {\n    const onMsg = (ev: MessageEvent): void => {\n      if (ev.source !== window) return;\n      const res = parseSessidResponse(ev.data, nonce);\n      if (!res) return;\n      cleanup();\n      resolve(res.sessid);\n    };\n    const timer = setTimeout(() => {\n      cleanup();\n      resolve(\"\");\n    }, SESSID_TIMEOUT_MS);\n    const cleanup = (): void => {\n      clearTimeout(timer);\n      window.removeEventListener(\"message\", onMsg);\n    };\n    window.addEventListener(\"message\", onMsg);\n    window.postMessage(buildSessidRequest(nonce), ORIGIN);\n  });\n}\n\nasync function fetchPortal(req: CallRequest): Promise<Response | { error: string }> {\n  const sessid = await freshSessid();\n  if (!sessid) return { error: \"session context not ready \u2014 open a normal Bitrix24 portal tab\" }; // G5\n  const { url, body, contentType } = buildRequest(ORIGIN, req, sessid);\n  const init: RequestInit = {\n    method: req.method,\n    credentials: \"include\",\n    // sessid rides the CSRF header for all ajax (v2 form + json); form bodies also carry it inline.\n    headers: { \"Content-Type\": contentType, \"X-Bitrix-Csrf-Token\": sessid },\n  };\n  let finalUrl = url;\n  if (req.method === \"POST\") init.body = body;\n  else finalUrl += (url.includes(\"?\") ? \"&\" : \"?\") + body;\n  return fetch(finalUrl, init);\n}\n\nasync function handleCall(req: CallRequest): Promise<InterpretResult> {\n  const resp = await fetchPortal(req);\n  if (!(resp instanceof Response)) return { ok: false, error: resp.error };\n  if (req.responseType === \"text\") {\n    return interpretText(await resp.text(), resp.headers.get(\"content-type\") ?? \"\", resp.status);\n  }\n  const json = await resp.json();\n  return interpret(json); // G3\n}\n\n/** Streams the body to the daemon as base64 chunks; the daemon writes them to a file. */\nasync function handleBinaryCall(req: CallRequest, ws: WebSocket): Promise<InterpretResult> {\n  const resp = await fetchPortal(req);\n  if (!(resp instanceof Response)) return { ok: false, error: resp.error };\n  if (resp.status >= 400) return { ok: false, error: `HTTP ${resp.status}` };\n\n  const contentType = resp.headers.get(\"content-type\") ?? \"\";\n  const disposition = resp.headers.get(\"content-disposition\");\n  if (looksLikeLoginPage(contentType, disposition)) {\n    return { ok: false, error: \"portal answered with an HTML page, not a file \u2014 session likely expired\" };\n  }\n\n  const bytes = new Uint8Array(await resp.arrayBuffer());\n  if (bytes.length > MAX_DOWNLOAD_BYTES) {\n    return { ok: false, error: `file is ${bytes.length} bytes, over the ${MAX_DOWNLOAD_BYTES} limit` };\n  }\n  const fileName = fileNameFromDisposition(disposition);\n  ws.send(JSON.stringify({ type: \"binary-begin\", id: req.id, contentType, bytes: bytes.length, fileName }));\n  let seq = 0;\n  for (let at = 0; at < bytes.length; at += BINARY_CHUNK_BYTES) {\n    const slice = bytes.subarray(at, at + BINARY_CHUNK_BYTES);\n    ws.send(JSON.stringify({ type: \"binary-chunk\", id: req.id, seq: seq++, data: toBase64(slice) }));\n  }\n  return { ok: true, data: { contentType, bytes: bytes.length, fileName, chunks: seq } };\n}\n\nfunction connect(config: BridgeConfig): void {\n  const ws = new WebSocket(`ws://127.0.0.1:${config.port}`);\n  ws.addEventListener(\"open\", () => {\n    ws.send(JSON.stringify({ type: \"auth\", token: config.token, version: chrome.runtime.getManifest().version }));\n    socket = ws;\n  });\n  ws.addEventListener(\"message\", async (ev: MessageEvent) => {\n    let req: CallRequest;\n    try {\n      req = JSON.parse(ev.data) as CallRequest;\n    } catch (e) {\n      console.error(\"[bitrix-bridge] malformed WS frame, dropping:\", e);\n      return;\n    }\n    if (req.type !== \"call\") return;\n    try {\n      const r = req.responseType === \"binary\" ? await handleBinaryCall(req, ws) : await handleCall(req);\n      ws.send(JSON.stringify({ type: \"result\", id: req.id, ok: r.ok, data: r.data, error: r.error }));\n    } catch (e) {\n      ws.send(JSON.stringify({ type: \"result\", id: req.id, ok: false, error: String(e) }));\n    }\n  });\n  ws.addEventListener(\"close\", () => {\n    if (socket === ws) socket = null;\n    setTimeout(() => connect(config), RECONNECT_MS); // auto-reconnect\n  });\n}\n\nasync function start(): Promise<void> {\n  let config: BridgeConfig;\n  try {\n    const resp = await fetch(chrome.runtime.getURL(\"config.json\"));\n    if (!resp.ok) throw new Error(`HTTP ${resp.status}`);\n    config = parseConfig(await resp.text());\n  } catch (e) {\n    // Nothing to fall back to \u2014 surface why the bridge won't start and stop.\n    console.error(\"[bitrix-bridge] cannot load config.json:\", e);\n    return;\n  }\n  connect(config);\n}\n\nstart();\n"],
+  "mappings": ";;;AAcO,WAAS,WAAW,QAAyC;AAClE,UAAM,MAAM,IAAI,gBAAgB;AAChC,UAAM,MAAM,CAAC,KAAa,QAAuB;AAC/C,UAAI,QAAQ,QAAQ,QAAQ,OAAW;AACvC,UAAI,MAAM,QAAQ,GAAG,EAAG,KAAI,QAAQ,CAAC,GAAG,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;AAAA,eAC3D,OAAO,QAAQ,SAAU,YAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,EAAG,KAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;AAAA,UAC5F,KAAI,IAAI,KAAK,OAAO,GAAG,CAAC;AAAA,IAC/B;AACA,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,EAAG,KAAI,GAAG,CAAC;AACrD,WAAO,IAAI,SAAS;AAAA,EACtB;AAIO,WAAS,gBACd,UACA,QACqD;AACrD,UAAM,OAAO,EAAE,GAAG,OAAO;AACzB,UAAM,SAAS,SAAS,QAAQ,cAAc,CAAC,QAAQ,QAAgB;AACrE,YAAM,QAAQ,KAAK,GAAG;AACtB,UAAI,UAAU,QAAQ,UAAU,UAAa,UAAU,IAAI;AACzD,cAAM,IAAI,MAAM,uBAAuB,GAAG,kBAAkB,QAAQ,EAAE;AAAA,MACxE;AACA,aAAO,KAAK,GAAG;AACf,aAAO,mBAAmB,OAAO,KAAK,CAAC;AAAA,IACzC,CAAC;AACD,WAAO,EAAE,UAAU,QAAQ,KAAK;AAAA,EAClC;AAEO,WAAS,aACd,QACA,KACA,QACoD;AACpD,UAAM,EAAE,UAAU,KAAK,IAAI,gBAAgB,IAAI,UAAU,IAAI,MAAM;AACnE,UAAM,IAAI,IAAI,SAAS,WAAW,mBAAmB,IAAI,MAAM,CAAC,KAAK;AACrE,UAAM,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,CAAC;AAGpC,QAAI,IAAI,aAAa,QAAQ;AAC3B,aAAO,EAAE,KAAK,MAAM,KAAK,UAAU,IAAI,GAAG,aAAa,mBAAmB;AAAA,IAC5E;AACA,UAAM,OAAO,WAAW,EAAE,GAAG,MAAM,OAAO,CAAC;AAC3C,WAAO,EAAE,KAAK,MAAM,aAAa,oCAAoC;AAAA,EACvE;AAKO,WAAS,UAAU,MAAgC;AACxD,QAAI,CAAC,SAAS,IAAI,EAAG,QAAO,EAAE,IAAI,MAAM,MAAM,KAAK;AAGnD,UAAM,OAAkB,MAAM,QAAQ,KAAK,MAAM,IAC7C,KAAK,SACL,KAAK,QACH,CAAC,SAAS,KAAK,KAAK,IAAI,KAAK,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,IACzD,CAAC;AACP,QAAI,KAAK,WAAW,WAAW,KAAK,SAAS,GAAG;AAC9C,YAAM,QAAQ,SAAS,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI;AAC5C,YAAM,OAAO,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,OAAO,KAAK,KAAK,KAAK,KAAK,KAAK;AAC9E,YAAM,cAAc,KAAK,KAAK,iBAAiB,KAAK,KAAK,OAAO,OAAO;AACvE,YAAM,QAAQ,eAAe,gBAAgB,OAAO,GAAG,IAAI,KAAK,WAAW,KAAK;AAChF,aAAO,EAAE,IAAI,OAAO,OAAO,MAAM,KAAK;AAAA,IACxC;AACA,WAAO,EAAE,IAAI,MAAM,MAAM,KAAK;AAAA,EAChC;AAEA,WAAS,SAAS,OAAkD;AAClE,WAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA,EAC5E;AAEA,WAAS,KAAK,OAAwB;AACpC,QAAI,OAAO,UAAU,SAAU,QAAO,QAAQ,OAAO,KAAK,IAAI;AAC9D,WAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,EAC7C;AAIO,MAAM,qBAAqB,OAAO;AAIlC,WAAS,SAAS,OAA2B;AAClD,QAAI,SAAS;AACb,UAAMA,UAAS;AACf,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAKA,SAAQ;AAC7C,gBAAU,OAAO,aAAa,GAAG,MAAM,SAAS,GAAG,IAAIA,OAAM,CAAC;AAAA,IAChE;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AAOO,WAAS,mBAAmB,aAAqB,oBAA4C;AAClG,WAAO,kBAAkB,KAAK,WAAW,KAAK,CAAC,cAAc,KAAK,sBAAsB,EAAE;AAAA,EAC5F;AAGO,WAAS,wBAAwB,oBAAkD;AACxF,QAAI,CAAC,mBAAoB,QAAO;AAChC,UAAM,UAAU,kCAAkC,KAAK,kBAAkB;AACzE,QAAI,SAAS;AACX,UAAI;AACF,eAAO,mBAAmB,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,UAAU,EAAE,CAAC;AAAA,MACnE,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,QAAQ,yBAAyB,KAAK,kBAAkB;AAC9D,WAAO,QAAQ,MAAM,CAAC,EAAE,KAAK,IAAI;AAAA,EACnC;AAKO,WAAS,cAAcC,OAAc,aAAqB,QAAiC;AAChG,QAAI,UAAU,IAAK,QAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,MAAM,GAAG;AAC/D,QAAI,CAACA,MAAK,KAAK,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,iBAAiB;AAC9D,WAAO,EAAE,IAAI,MAAM,MAAM,EAAE,aAAa,MAAAA,MAAK,EAAE;AAAA,EACjD;;;ACxHO,WAAS,YAAY,KAA2B;AACrD,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,MAAM,GAAG;AAAA,IACtB,QAAQ;AACN,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AACA,QAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM;AAC3C,YAAM,IAAI,MAAM,oDAAoD;AAAA,IACtE;AACA,UAAM,MAAM;AACZ,UAAM,QAAQ,OAAO,IAAI,UAAU,WAAW,IAAI,MAAM,KAAK,IAAI;AACjE,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,4CAA4C;AACxE,UAAM,OAAO,OAAO,IAAI,IAAI;AAC5B,QAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,OAAO;AACvD,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AACA,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAUO,MAAM,oBAAoB;AAe1B,WAAS,mBAAmB,OAAiC;AAClE,WAAO,EAAE,QAAQ,mBAAmB,MAAM,kBAAkB,MAAM;AAAA,EACpE;AAMA,WAASC,UAAS,GAA0C;AAC1D,WAAO,OAAO,MAAM,YAAY,MAAM;AAAA,EACxC;AAWO,WAAS,oBAAoB,MAAe,eAAiD;AAClG,QAAI,CAACC,UAAS,IAAI,EAAG,QAAO;AAC5B,QAAI,KAAK,WAAW,qBAAqB,KAAK,SAAS,kBAAmB,QAAO;AACjF,QAAI,OAAO,KAAK,UAAU,YAAY,KAAK,UAAU,cAAe,QAAO;AAC3E,QAAI,OAAO,KAAK,WAAW,SAAU,QAAO;AAC5C,WAAO,EAAE,QAAQ,mBAAmB,MAAM,mBAAmB,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO;AAAA,EACtG;;;ACtDA,MAAM,SAAS,SAAS;AACxB,MAAM,oBAAoB;AAC1B,MAAM,eAAe;AAErB,MAAM,qBAAqB,MAAM,OAAO;AAExC,MAAI,SAA2B;AAC/B,MAAI,WAAW;AAGf,WAAS,cAA+B;AACtC,UAAM,QAAQ,GAAG,KAAK,IAAI,CAAC,IAAI,UAAU,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAChF,WAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,YAAM,QAAQ,CAAC,OAA2B;AACxC,YAAI,GAAG,WAAW,OAAQ;AAC1B,cAAM,MAAM,oBAAoB,GAAG,MAAM,KAAK;AAC9C,YAAI,CAAC,IAAK;AACV,gBAAQ;AACR,gBAAQ,IAAI,MAAM;AAAA,MACpB;AACA,YAAM,QAAQ,WAAW,MAAM;AAC7B,gBAAQ;AACR,gBAAQ,EAAE;AAAA,MACZ,GAAG,iBAAiB;AACpB,YAAM,UAAU,MAAY;AAC1B,qBAAa,KAAK;AAClB,eAAO,oBAAoB,WAAW,KAAK;AAAA,MAC7C;AACA,aAAO,iBAAiB,WAAW,KAAK;AACxC,aAAO,YAAY,mBAAmB,KAAK,GAAG,MAAM;AAAA,IACtD,CAAC;AAAA,EACH;AAEA,iBAAe,YAAY,KAAyD;AAClF,UAAM,SAAS,MAAM,YAAY;AACjC,QAAI,CAAC,OAAQ,QAAO,EAAE,OAAO,qEAAgE;AAC7F,UAAM,EAAE,KAAK,MAAM,YAAY,IAAI,aAAa,QAAQ,KAAK,MAAM;AACnE,UAAM,OAAoB;AAAA,MACxB,QAAQ,IAAI;AAAA,MACZ,aAAa;AAAA;AAAA,MAEb,SAAS,EAAE,gBAAgB,aAAa,uBAAuB,OAAO;AAAA,IACxE;AACA,QAAI,WAAW;AACf,QAAI,IAAI,WAAW,OAAQ,MAAK,OAAO;AAAA,QAClC,cAAa,IAAI,SAAS,GAAG,IAAI,MAAM,OAAO;AACnD,WAAO,MAAM,UAAU,IAAI;AAAA,EAC7B;AAEA,iBAAe,WAAW,KAA4C;AACpE,UAAM,OAAO,MAAM,YAAY,GAAG;AAClC,QAAI,EAAE,gBAAgB,UAAW,QAAO,EAAE,IAAI,OAAO,OAAO,KAAK,MAAM;AACvE,QAAI,IAAI,iBAAiB,QAAQ;AAC/B,aAAO,cAAc,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI,KAAK,MAAM;AAAA,IAC7F;AACA,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,WAAO,UAAU,IAAI;AAAA,EACvB;AAGA,iBAAe,iBAAiB,KAAkB,IAAyC;AACzF,UAAM,OAAO,MAAM,YAAY,GAAG;AAClC,QAAI,EAAE,gBAAgB,UAAW,QAAO,EAAE,IAAI,OAAO,OAAO,KAAK,MAAM;AACvE,QAAI,KAAK,UAAU,IAAK,QAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,KAAK,MAAM,GAAG;AAEzE,UAAM,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK;AACxD,UAAM,cAAc,KAAK,QAAQ,IAAI,qBAAqB;AAC1D,QAAI,mBAAmB,aAAa,WAAW,GAAG;AAChD,aAAO,EAAE,IAAI,OAAO,OAAO,8EAAyE;AAAA,IACtG;AAEA,UAAM,QAAQ,IAAI,WAAW,MAAM,KAAK,YAAY,CAAC;AACrD,QAAI,MAAM,SAAS,oBAAoB;AACrC,aAAO,EAAE,IAAI,OAAO,OAAO,WAAW,MAAM,MAAM,oBAAoB,kBAAkB,SAAS;AAAA,IACnG;AACA,UAAM,WAAW,wBAAwB,WAAW;AACpD,OAAG,KAAK,KAAK,UAAU,EAAE,MAAM,gBAAgB,IAAI,IAAI,IAAI,aAAa,OAAO,MAAM,QAAQ,SAAS,CAAC,CAAC;AACxG,QAAI,MAAM;AACV,aAAS,KAAK,GAAG,KAAK,MAAM,QAAQ,MAAM,oBAAoB;AAC5D,YAAM,QAAQ,MAAM,SAAS,IAAI,KAAK,kBAAkB;AACxD,SAAG,KAAK,KAAK,UAAU,EAAE,MAAM,gBAAgB,IAAI,IAAI,IAAI,KAAK,OAAO,MAAM,SAAS,KAAK,EAAE,CAAC,CAAC;AAAA,IACjG;AACA,WAAO,EAAE,IAAI,MAAM,MAAM,EAAE,aAAa,OAAO,MAAM,QAAQ,UAAU,QAAQ,IAAI,EAAE;AAAA,EACvF;AAEA,WAAS,QAAQ,QAA4B;AAC3C,UAAM,KAAK,IAAI,UAAU,kBAAkB,OAAO,IAAI,EAAE;AACxD,OAAG,iBAAiB,QAAQ,MAAM;AAChC,SAAG,KAAK,KAAK,UAAU,EAAE,MAAM,QAAQ,OAAO,OAAO,OAAO,SAAS,OAAO,QAAQ,YAAY,EAAE,QAAQ,CAAC,CAAC;AAC5G,eAAS;AAAA,IACX,CAAC;AACD,OAAG,iBAAiB,WAAW,OAAO,OAAqB;AACzD,UAAI;AACJ,UAAI;AACF,cAAM,KAAK,MAAM,GAAG,IAAI;AAAA,MAC1B,SAAS,GAAG;AACV,gBAAQ,MAAM,iDAAiD,CAAC;AAChE;AAAA,MACF;AACA,UAAI,IAAI,SAAS,OAAQ;AACzB,UAAI;AACF,cAAM,IAAI,IAAI,iBAAiB,WAAW,MAAM,iBAAiB,KAAK,EAAE,IAAI,MAAM,WAAW,GAAG;AAChG,WAAG,KAAK,KAAK,UAAU,EAAE,MAAM,UAAU,IAAI,IAAI,IAAI,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,OAAO,EAAE,MAAM,CAAC,CAAC;AAAA,MAChG,SAAS,GAAG;AACV,WAAG,KAAK,KAAK,UAAU,EAAE,MAAM,UAAU,IAAI,IAAI,IAAI,IAAI,OAAO,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;AAAA,MACrF;AAAA,IACF,CAAC;AACD,OAAG,iBAAiB,SAAS,MAAM;AACjC,UAAI,WAAW,GAAI,UAAS;AAC5B,iBAAW,MAAM,QAAQ,MAAM,GAAG,YAAY;AAAA,IAChD,CAAC;AAAA,EACH;AAEA,iBAAe,QAAuB;AACpC,QAAI;AACJ,QAAI;AACF,YAAM,OAAO,MAAM,MAAM,OAAO,QAAQ,OAAO,aAAa,CAAC;AAC7D,UAAI,CAAC,KAAK,GAAI,OAAM,IAAI,MAAM,QAAQ,KAAK,MAAM,EAAE;AACnD,eAAS,YAAY,MAAM,KAAK,KAAK,CAAC;AAAA,IACxC,SAAS,GAAG;AAEV,cAAQ,MAAM,4CAA4C,CAAC;AAC3D;AAAA,IACF;AACA,YAAQ,MAAM;AAAA,EAChB;AAEA,QAAM;",
+  "names": ["window", "text", "isRecord", "isRecord"]
 }

package/extension/dist/sessid-shim.js

@@ -6,18 +6,21 @@
     return { source: BRIDGE_MSG_SOURCE, kind: "sessid-response", nonce, sessid };
   }
   function isRecord(v) {
-    return typeof v == "object" && v !== null;
+    return typeof v === "object" && v !== null;
   }
   function parseSessidRequest(data) {
-    return !isRecord(data) || data.source !== BRIDGE_MSG_SOURCE || data.kind !== "sessid-request" || typeof data.nonce != "string" ? null : { source: BRIDGE_MSG_SOURCE, kind: "sessid-request", nonce: data.nonce };
+    if (!isRecord(data)) return null;
+    if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== "sessid-request") return null;
+    if (typeof data.nonce !== "string") return null;
+    return { source: BRIDGE_MSG_SOURCE, kind: "sessid-request", nonce: data.nonce };
   }
 
   // extension/src/sessid-shim.ts
   window.addEventListener("message", (ev) => {
     if (ev.source !== window) return;
-    let req = parseSessidRequest(ev.data);
+    const req = parseSessidRequest(ev.data);
     if (!req) return;
-    let sessid = window.BX?.bitrix_sessid?.() || "";
+    const sessid = window.BX?.bitrix_sessid?.() || "";
     window.postMessage(buildSessidResponse(req.nonce, sessid), location.origin);
   });
 })();

package/extension/dist/sessid-shim.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/bridge-protocol.ts", "../src/sessid-shim.ts"],
-  "sourcesContent": ["// Pure, browser-agnostic \u2014 unit-tested. No DOM / chrome / window.BX here.\n//\n// Two concerns live together because both are the *contract* between the extension's\n// two content scripts and the packaged config, and both are pure/testable:\n//   1) parseConfig  \u2014 validate the per-user config.json ({ token, port }).\n//   2) the postMessage protocol \u2014 the envelopes the ISOLATED connector and the MAIN\n//      script exchange over window.postMessage (sessid request/response, and \u2014 in the\n//      capture build \u2014 MAIN-observed capture entries forwarded to the connector).\n\nimport type { CapturedEntry } from \"./bridge-core.ts\";\n\nexport interface BridgeConfig {\n  token: string;\n  port: number;\n}\n\n/**\n * Parse and validate the packaged config.json body. Throws with a clear,\n * user-facing message (mentioning config.json) on any malformed input so the\n * connector can surface why it failed to start.\n */\nexport function parseConfig(raw: string): BridgeConfig {\n  let doc: unknown;\n  try {\n    doc = JSON.parse(raw);\n  } catch {\n    throw new Error(\"config.json is not valid JSON\");\n  }\n  if (typeof doc !== \"object\" || doc === null) {\n    throw new Error(\"config.json must be an object like { token, port }\");\n  }\n  const obj = doc as Record<string, unknown>;\n  const token = typeof obj.token === \"string\" ? obj.token.trim() : \"\";\n  if (!token) throw new Error(\"config.json is missing a non-empty `token`\");\n  const port = Number(obj.port);\n  if (!Number.isInteger(port) || port < 1 || port > 65535) {\n    throw new Error(\"config.json is missing a numeric `port`\");\n  }\n  return { token, port };\n}\n\n// --- sessid postMessage protocol -------------------------------------------\n//\n// window.postMessage is delivered to BOTH the MAIN and ISOLATED worlds of the same\n// frame (they share the DOM window), and each world also receives its own posts. So\n// every envelope is tagged with a fixed `source` and a `kind`, and each side ignores\n// anything that isn't addressed to it. Responses additionally carry the request nonce\n// so the connector can match a reply to the exact in-flight request it issued.\n\nexport const BRIDGE_MSG_SOURCE = \"bitrix24-mcp-bridge\";\n\nexport interface SessidRequestMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"sessid-request\";\n  nonce: string;\n}\n\nexport interface SessidResponseMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"sessid-response\";\n  nonce: string;\n  sessid: string;\n}\n\nexport function buildSessidRequest(nonce: string): SessidRequestMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-request\", nonce };\n}\n\nexport function buildSessidResponse(nonce: string, sessid: string): SessidResponseMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-response\", nonce, sessid };\n}\n\nfunction isRecord(v: unknown): v is Record<string, unknown> {\n  return typeof v === \"object\" && v !== null;\n}\n\n/** For the MAIN shim: a well-formed request from our connector, or null. */\nexport function parseSessidRequest(data: unknown): SessidRequestMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"sessid-request\") return null;\n  if (typeof data.nonce !== \"string\") return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-request\", nonce: data.nonce };\n}\n\n/** For the ISOLATED connector: a response matching `expectedNonce`, or null. */\nexport function parseSessidResponse(data: unknown, expectedNonce: string): SessidResponseMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"sessid-response\") return null;\n  if (typeof data.nonce !== \"string\" || data.nonce !== expectedNonce) return null;\n  if (typeof data.sessid !== \"string\") return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-response\", nonce: data.nonce, sessid: data.sessid };\n}\n\n// --- capture forwarding (capture build only) -------------------------------\n//\n// The capture hooks must observe the PAGE's fetch/XHR, so they run in the MAIN world.\n// The socket lives only in the ISOLATED connector, so MAIN forwards each observed entry\n// to the connector over postMessage; the connector relays it to the daemon.\n\nexport interface CaptureForwardMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"capture\";\n  call: CapturedEntry;\n}\n\nexport function buildCaptureForward(call: CapturedEntry): CaptureForwardMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"capture\", call };\n}\n\n/** For the ISOLATED connector: a capture entry forwarded by the MAIN script, or null. */\nexport function parseCaptureForward(data: unknown): CaptureForwardMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"capture\") return null;\n  if (!isRecord(data.call)) return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"capture\", call: data.call as unknown as CapturedEntry };\n}\n", "// MAIN-world shim. The ONLY reason it runs in the page's MAIN world is that\n// window.BX (and thus the rotating CSRF sessid) lives there. It holds NO token and\n// NO socket \u2014 it just answers the ISOLATED connector's sessid requests.\n//\n// In the capture build it additionally installs the page-traffic recorder (which must\n// run in MAIN to observe the page's own fetch/XHR) and forwards each observed entry to\n// the connector over postMessage; the connector owns the socket and relays to the daemon.\n\nimport { parseSessidRequest, buildSessidResponse, buildCaptureForward } from \"./bridge-protocol.ts\";\nimport { installCapture } from \"./capture.ts\";\n\n// Stripped from normal builds via esbuild `define` + dead-code elimination.\ndeclare const __BITRIX_CAPTURE__: boolean;\n\n// window.BX is provided by the Bitrix24 page itself (MAIN world).\ndeclare global {\n  interface Window {\n    BX?: { bitrix_sessid?: () => string };\n  }\n}\n\nwindow.addEventListener(\"message\", (ev: MessageEvent) => {\n  if (ev.source !== window) return; // same frame only \u2014 ignore other frames/windows\n  const req = parseSessidRequest(ev.data);\n  if (!req) return;\n  const sessid = window.BX?.bitrix_sessid?.() || \"\";\n  window.postMessage(buildSessidResponse(req.nonce, sessid), location.origin);\n});\n\nif (__BITRIX_CAPTURE__) {\n  installCapture((call) => window.postMessage(buildCaptureForward(call), location.origin));\n}\n"],
-  "mappings": ";;;AAiDO,MAAM,oBAAoB;AAmB1B,WAAS,oBAAoB,OAAe,QAAmC;AACpF,WAAO,EAAE,QAAQ,mBAAmB,MAAM,mBAAmB,OAAO,OAAO;AAAA,EAC7E;AAEA,WAAS,SAAS,GAA0C;AAC1D,WAAO,OAAO,KAAM,YAAY,MAAM;AAAA,EACxC;AAGO,WAAS,mBAAmB,MAAwC;AAGzE,WAFI,CAAC,SAAS,IAAI,KACd,KAAK,WAAW,qBAAqB,KAAK,SAAS,oBACnD,OAAO,KAAK,SAAU,WAAiB,OACpC,EAAE,QAAQ,mBAAmB,MAAM,kBAAkB,OAAO,KAAK,MAAM;AAAA,EAChF;;;AC7DA,SAAO,iBAAiB,WAAW,CAAC,OAAqB;AACvD,QAAI,GAAG,WAAW,OAAQ;AAC1B,QAAM,MAAM,mBAAmB,GAAG,IAAI;AACtC,QAAI,CAAC,IAAK;AACV,QAAM,SAAS,OAAO,IAAI,gBAAgB,KAAK;AAC/C,WAAO,YAAY,oBAAoB,IAAI,OAAO,MAAM,GAAG,SAAS,MAAM;AAAA,EAC5E,CAAC;",
+  "sourcesContent": ["// Pure, browser-agnostic \u2014 unit-tested. No DOM / chrome / window.BX here.\n//\n// Two concerns live together because both are the *contract* between the extension's\n// two content scripts and the packaged config, and both are pure/testable:\n//   1) parseConfig  \u2014 validate the per-user config.json ({ token, port }).\n//   2) the postMessage protocol \u2014 the envelopes the ISOLATED connector and the MAIN\n//      script exchange over window.postMessage (sessid request/response).\n\nexport interface BridgeConfig {\n  token: string;\n  port: number;\n}\n\n/**\n * Parse and validate the packaged config.json body. Throws with a clear,\n * user-facing message (mentioning config.json) on any malformed input so the\n * connector can surface why it failed to start.\n */\nexport function parseConfig(raw: string): BridgeConfig {\n  let doc: unknown;\n  try {\n    doc = JSON.parse(raw);\n  } catch {\n    throw new Error(\"config.json is not valid JSON\");\n  }\n  if (typeof doc !== \"object\" || doc === null) {\n    throw new Error(\"config.json must be an object like { token, port }\");\n  }\n  const obj = doc as Record<string, unknown>;\n  const token = typeof obj.token === \"string\" ? obj.token.trim() : \"\";\n  if (!token) throw new Error(\"config.json is missing a non-empty `token`\");\n  const port = Number(obj.port);\n  if (!Number.isInteger(port) || port < 1 || port > 65535) {\n    throw new Error(\"config.json is missing a numeric `port`\");\n  }\n  return { token, port };\n}\n\n// --- sessid postMessage protocol -------------------------------------------\n//\n// window.postMessage is delivered to BOTH the MAIN and ISOLATED worlds of the same\n// frame (they share the DOM window), and each world also receives its own posts. So\n// every envelope is tagged with a fixed `source` and a `kind`, and each side ignores\n// anything that isn't addressed to it. Responses additionally carry the request nonce\n// so the connector can match a reply to the exact in-flight request it issued.\n\nexport const BRIDGE_MSG_SOURCE = \"bitrix24-mcp-bridge\";\n\nexport interface SessidRequestMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"sessid-request\";\n  nonce: string;\n}\n\nexport interface SessidResponseMsg {\n  source: typeof BRIDGE_MSG_SOURCE;\n  kind: \"sessid-response\";\n  nonce: string;\n  sessid: string;\n}\n\nexport function buildSessidRequest(nonce: string): SessidRequestMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-request\", nonce };\n}\n\nexport function buildSessidResponse(nonce: string, sessid: string): SessidResponseMsg {\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-response\", nonce, sessid };\n}\n\nfunction isRecord(v: unknown): v is Record<string, unknown> {\n  return typeof v === \"object\" && v !== null;\n}\n\n/** For the MAIN shim: a well-formed request from our connector, or null. */\nexport function parseSessidRequest(data: unknown): SessidRequestMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"sessid-request\") return null;\n  if (typeof data.nonce !== \"string\") return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-request\", nonce: data.nonce };\n}\n\n/** For the ISOLATED connector: a response matching `expectedNonce`, or null. */\nexport function parseSessidResponse(data: unknown, expectedNonce: string): SessidResponseMsg | null {\n  if (!isRecord(data)) return null;\n  if (data.source !== BRIDGE_MSG_SOURCE || data.kind !== \"sessid-response\") return null;\n  if (typeof data.nonce !== \"string\" || data.nonce !== expectedNonce) return null;\n  if (typeof data.sessid !== \"string\") return null;\n  return { source: BRIDGE_MSG_SOURCE, kind: \"sessid-response\", nonce: data.nonce, sessid: data.sessid };\n}\n", "// MAIN-world shim. The ONLY reason it runs in the page's MAIN world is that\n// window.BX (and thus the rotating CSRF sessid) lives there. It holds NO token and\n// NO socket \u2014 it just answers the ISOLATED connector's sessid requests.\n\nimport { parseSessidRequest, buildSessidResponse } from \"./bridge-protocol.ts\";\n\n// window.BX is provided by the Bitrix24 page itself (MAIN world).\ndeclare global {\n  interface Window {\n    BX?: { bitrix_sessid?: () => string };\n  }\n}\n\nwindow.addEventListener(\"message\", (ev: MessageEvent) => {\n  if (ev.source !== window) return; // same frame only \u2014 ignore other frames/windows\n  const req = parseSessidRequest(ev.data);\n  if (!req) return;\n  const sessid = window.BX?.bitrix_sessid?.() || \"\";\n  window.postMessage(buildSessidResponse(req.nonce, sessid), location.origin);\n});\n"],
+  "mappings": ";;;AA8CO,MAAM,oBAAoB;AAmB1B,WAAS,oBAAoB,OAAe,QAAmC;AACpF,WAAO,EAAE,QAAQ,mBAAmB,MAAM,mBAAmB,OAAO,OAAO;AAAA,EAC7E;AAEA,WAAS,SAAS,GAA0C;AAC1D,WAAO,OAAO,MAAM,YAAY,MAAM;AAAA,EACxC;AAGO,WAAS,mBAAmB,MAAwC;AACzE,QAAI,CAAC,SAAS,IAAI,EAAG,QAAO;AAC5B,QAAI,KAAK,WAAW,qBAAqB,KAAK,SAAS,iBAAkB,QAAO;AAChF,QAAI,OAAO,KAAK,UAAU,SAAU,QAAO;AAC3C,WAAO,EAAE,QAAQ,mBAAmB,MAAM,kBAAkB,OAAO,KAAK,MAAM;AAAA,EAChF;;;AClEA,SAAO,iBAAiB,WAAW,CAAC,OAAqB;AACvD,QAAI,GAAG,WAAW,OAAQ;AAC1B,UAAM,MAAM,mBAAmB,GAAG,IAAI;AACtC,QAAI,CAAC,IAAK;AACV,UAAM,SAAS,OAAO,IAAI,gBAAgB,KAAK;AAC/C,WAAO,YAAY,oBAAoB,IAAI,OAAO,MAAM,GAAG,SAAS,MAAM;AAAA,EAC5E,CAAC;",
   "names": []
 }

package/package.json

@@ -1,8 +1,8 @@
 {
   "type": "module",
   "name": "bitrix24-mcp-bridge",
-  "version": "0.4.0",
-  "description": "MCP bridge server for Bitrix24 — exposes REST API access, tasks, projects and chat to MCP clients like Claude Code.",
+  "version": "1.0.0",
+  "description": "MCP bridge server for Bitrix24 — exposes tasks, projects, chats and calls from your live browser session to MCP clients like Claude Code.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -15,21 +15,15 @@
   "files": [
     "dist",
     "extension/dist",
-    "docs/api-notes.md",
-    "actions.example.json"
+    "docs/api-notes.md"
   ],
   "scripts": {
     "test": "bun test",
     "dev": "bun run src/index.ts",
     "typecheck": "bunx tsc --noEmit && bunx tsc -p extension/tsconfig.json",
     "build:dist": "node scripts/build-dist.mjs",
-    "build:ext": "bun run scripts/build-extension.ts",
-    "build:ext:capture": "BITRIX_CAPTURE=1 bun run scripts/build-extension.ts",
     "build:ext:static": "node scripts/build-ext-static.mjs",
     "prepare": "node scripts/build-dist.mjs && node scripts/build-ext-static.mjs",
-    "capture": "bun run src/capture-server.ts",
-    "catalog:draft": "bun run src/catalog/build-catalog.ts captured.har > actions.draft.json",
-    "catalog": "bun run src/catalog/build-catalog.ts",
     "sync:runtime": "bun run scripts/sync-runtime.ts"
   },
   "dependencies": {

package/actions.example.json

@@ -1,32 +0,0 @@
-{
-  "tasks.list": { "action": "tasks.task.list", "method": "POST" },
-  "task.get": { "action": "tasks.task.get", "method": "POST" },
-  "task.v2.get": { "action": "tasks.v2.Task.get", "method": "POST", "bodyType": "json" },
-  "task.scrum.info": { "action": "tasks.v2.Scrum.getTaskInfo", "method": "POST", "bodyType": "json" },
-  "task.files": { "action": "tasks.v2.File.listObjects", "method": "POST", "bodyType": "json" },
-  "task.views.count": { "action": "tasks.v2.Task.View.User.count", "method": "POST", "bodyType": "json" },
-
-  "projects.list": { "action": "socialnetwork.api.workgroup.list", "method": "POST" },
-  "projects.get": { "action": "socialnetwork.api.workgroup.get", "method": "POST" },
-
-  "chats.recent": { "endpoint": "/rest/im.recent.list.json", "method": "POST", "params": { "LIMIT": 50, "SKIP_OPENLINES": "Y", "GET_ORIGINAL_TEXT": "Y", "PARSE_TEXT": "Y", "WITH_COUNTERS": "N" } },
-  "chat.load": { "action": "im.v2.Chat.load", "method": "POST", "params": { "messageLimit": 25 } },
-  "chat.messages": { "action": "im.v2.Chat.Message.list", "method": "POST" },
-  "chat.messages.tail": { "action": "im.v2.Chat.Message.tail", "method": "POST", "params": { "order[id]": "DESC", "limit": 25 } },
-  "chat.message.read": { "action": "im.v2.Chat.Message.read", "method": "POST" },
-
-  "entityselector.load": { "action": "ui.entityselector.load", "method": "POST", "bodyType": "json" },
-  "entityselector.search": { "action": "ui.entityselector.doSearch", "method": "POST", "bodyType": "json" },
-
-  "recent.load": { "action": "im.v2.Recent.load", "method": "POST" },
-  "recent.tail": { "action": "im.v2.Recent.tail", "method": "POST" },
-  "chat.dialogId": { "action": "im.v2.Chat.getDialogId", "method": "POST" },
-  "chat.read.all": { "action": "im.v2.Chat.readAll", "method": "POST" },
-  "im.user.get": { "endpoint": "/rest/im.user.get.json", "method": "POST" },
-  "im.chat.get": { "endpoint": "/rest/im.chat.get.json", "method": "POST" },
-
-  "task.subtasks": { "action": "tasks.v2.Task.Relation.Child.list", "method": "POST", "bodyType": "json" },
-  "task.related": { "action": "tasks.v2.Task.Relation.Related.list", "method": "POST", "bodyType": "json" },
-
-  "call.detail": { "endpoint": "/call/detail/{callId}", "method": "GET", "params": { "IFRAME": "Y", "IFRAME_TYPE": "SIDE_SLIDER" }, "responseType": "text" }
-}