@openclaw/matrix 2026.5.20 → 2026.5.22

package/node_modules/matrix-widget-api/src/transport/PostmessageTransport.ts

@@ -0,0 +1,200 @@
+/*
+ * Copyright 2020 - 2024 The Matrix.org Foundation C.I.C.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { EventEmitter } from "events";
+
+import { ITransport } from "./ITransport";
+import {
+    invertedDirection,
+    isErrorResponse,
+    IWidgetApiRequest,
+    IWidgetApiRequestData,
+    IWidgetApiResponse,
+    IWidgetApiResponseData,
+    WidgetApiResponseError,
+    WidgetApiAction,
+    WidgetApiDirection,
+    WidgetApiToWidgetAction,
+} from "..";
+
+interface IOutboundRequest {
+    request: IWidgetApiRequest;
+    resolve: (response: IWidgetApiResponse) => void;
+    reject: (err: Error) => void;
+}
+
+/**
+ * Transport for the Widget API over postMessage.
+ */
+export class PostmessageTransport extends EventEmitter implements ITransport {
+    public strictOriginCheck = false;
+    public targetOrigin = "*";
+    public timeoutSeconds = 10;
+
+    private _ready = false;
+    private _widgetId: string | null;
+    private readonly outboundRequests = new Map<string, IOutboundRequest | null>();
+    private readonly stopController = new AbortController();
+
+    public get ready(): boolean {
+        return this._ready;
+    }
+
+    public get widgetId(): string | null {
+        return this._widgetId || null;
+    }
+
+    public constructor(
+        private readonly sendDirection: WidgetApiDirection,
+        initialWidgetId: string | null,
+        private readonly transportWindow: Window | typeof globalThis,
+        private readonly inboundWindow: Window | typeof globalThis,
+    ) {
+        super();
+        this._widgetId = initialWidgetId;
+    }
+
+    private get nextRequestId(): string {
+        const idBase = `widgetapi-${Date.now()}`;
+        let index = 0;
+        let id = idBase;
+        while (this.outboundRequests.has(id)) {
+            id = `${idBase}-${index++}`;
+        }
+
+        // reserve the ID
+        this.outboundRequests.set(id, null);
+
+        return id;
+    }
+
+    private sendInternal(message: IWidgetApiRequest | IWidgetApiResponse): void {
+        console.log(`[PostmessageTransport] Sending object to ${this.targetOrigin}: `, message);
+        this.transportWindow.postMessage(message, this.targetOrigin);
+    }
+
+    public reply<T extends IWidgetApiResponseData>(request: IWidgetApiRequest, responseData: T): void {
+        return this.sendInternal(<IWidgetApiResponse>{
+            ...request,
+            response: responseData,
+        });
+    }
+
+    public send<T extends IWidgetApiRequestData, R extends IWidgetApiResponseData>(
+        action: WidgetApiAction,
+        data: T,
+    ): Promise<R> {
+        return this.sendComplete(action, data).then((r) => <R>r.response);
+    }
+
+    public sendComplete<T extends IWidgetApiRequestData, R extends IWidgetApiResponse>(
+        action: WidgetApiAction,
+        data: T,
+    ): Promise<R> {
+        if (!this.ready || !this.widgetId) {
+            return Promise.reject(new Error("Not ready or unknown widget ID"));
+        }
+        const request: IWidgetApiRequest = {
+            api: this.sendDirection,
+            widgetId: this.widgetId,
+            requestId: this.nextRequestId,
+            action: action,
+            data: data,
+        };
+        if (action === WidgetApiToWidgetAction.UpdateVisibility) {
+            request["visible"] = data["visible"];
+        }
+        return new Promise<R>((prResolve, prReject) => {
+            const resolve = (response: IWidgetApiResponse): void => {
+                cleanUp();
+                prResolve(<R>response);
+            };
+            const reject = (err: Error): void => {
+                cleanUp();
+                prReject(err);
+            };
+
+            const timerId = setTimeout(() => reject(new Error("Request timed out")), (this.timeoutSeconds || 1) * 1000);
+
+            const onStop = (): void => reject(new Error("Transport stopped"));
+            this.stopController.signal.addEventListener("abort", onStop);
+
+            const cleanUp = (): void => {
+                this.outboundRequests.delete(request.requestId);
+                clearTimeout(timerId);
+                this.stopController.signal.removeEventListener("abort", onStop);
+            };
+
+            this.outboundRequests.set(request.requestId, { request, resolve, reject });
+            this.sendInternal(request);
+        });
+    }
+
+    public start(): void {
+        this.inboundWindow.addEventListener("message", this.handleMessage);
+        this._ready = true;
+    }
+
+    public stop(): void {
+        this._ready = false;
+        this.stopController.abort();
+        this.inboundWindow.removeEventListener("message", this.handleMessage);
+    }
+
+    private readonly handleMessage = (ev: MessageEvent): void => {
+        if (this.stopController.signal.aborted) return;
+        if (!ev.data) return; // invalid event
+
+        if (this.strictOriginCheck && ev.origin !== globalThis.origin) return; // bad origin
+
+        // treat the message as a response first, then downgrade to a request
+        const response = <IWidgetApiResponse>ev.data;
+        if (!response.action || !response.requestId || !response.widgetId) return; // invalid request/response
+
+        if (response.response) {
+            if (response.api !== this.sendDirection) return; // wrong direction
+            this.handleResponse(response);
+        } else {
+            const request = <IWidgetApiRequest>response;
+            if (request.api !== invertedDirection(this.sendDirection)) return; // wrong direction
+            this.handleRequest(request);
+        }
+    };
+
+    private handleRequest(request: IWidgetApiRequest): void {
+        if (this.widgetId) {
+            if (this.widgetId !== request.widgetId) return; // wrong widget
+        } else {
+            this._widgetId = request.widgetId;
+        }
+
+        this.emit("message", new CustomEvent("message", { detail: request }));
+    }
+
+    private handleResponse(response: IWidgetApiResponse): void {
+        if (response.widgetId !== this.widgetId) return; // wrong widget
+
+        const req = this.outboundRequests.get(response.requestId);
+        if (!req) return; // response to an unknown request
+
+        if (isErrorResponse(response.response)) {
+            const { message, ...data } = response.response.error;
+            req.reject(new WidgetApiResponseError(message, data));
+        } else {
+            req.resolve(response);
+        }
+    }
+}

package/node_modules/matrix-widget-api/src/util/SimpleObservable.ts

@@ -0,0 +1,39 @@
+/*
+ * Copyright 2020 The Matrix.org Foundation C.I.C.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export type ObservableFunction<T> = (val: T) => void;
+
+export class SimpleObservable<T> {
+    private listeners: ObservableFunction<T>[] = [];
+
+    public constructor(initialFn?: ObservableFunction<T>) {
+        if (initialFn) this.listeners.push(initialFn);
+    }
+
+    public onUpdate(fn: ObservableFunction<T>): void {
+        this.listeners.push(fn);
+    }
+
+    public update(val: T): void {
+        for (const listener of this.listeners) {
+            listener(val);
+        }
+    }
+
+    public close(): void {
+        this.listeners = []; // reset
+    }
+}

package/node_modules/mdurl/LICENSE

@@ -0,0 +1,45 @@
+Copyright (c) 2015 Vitaly Puzrin, Alex Kocharin.
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+--------------------------------------------------------------------------------
+
+.parse() is based on Joyent's node.js `url` code:
+
+Copyright Joyent, Inc. and other Node contributors. All rights reserved.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+IN THE SOFTWARE.

package/node_modules/mdurl/README.md

@@ -0,0 +1,102 @@
+# mdurl
+
+[![CI](https://github.com/markdown-it/mdurl/actions/workflows/ci.yml/badge.svg)](https://github.com/markdown-it/mdurl/actions/workflows/ci.yml)
+[![NPM version](https://img.shields.io/npm/v/mdurl.svg?style=flat)](https://www.npmjs.org/package/mdurl)
+
+> URL utilities for [markdown-it](https://github.com/markdown-it/markdown-it) parser.
+
+
+## API
+
+### .encode(str [, exclude, keepEncoded]) -> String
+
+Percent-encode a string, avoiding double encoding. Don't touch `/a-zA-Z0-9/` +
+excluded chars + `/%[a-fA-F0-9]{2}/` (if not disabled). Broken surrorates are
+replaced with `U+FFFD`.
+
+Params:
+
+- __str__ - input string.
+- __exclude__ - optional, `;/?:@&=+$,-_.!~*'()#`. Additional chars to keep intact
+  (except `/a-zA-Z0-9/`).
+- __keepEncoded__ - optional, `true`. By default it skips already encoded sequences
+  (`/%[a-fA-F0-9]{2}/`). If set to `false`, `%` will be encoded.
+
+
+### encode.defaultChars, encode.componentChars
+
+You can use these constants as second argument to `encode` function.
+
+ - `encode.defaultChars` is the same exclude set as in the standard `encodeURI()` function
+ - `encode.componentChars` is the same exclude set as in the `encodeURIComponent()` function
+
+For example, `encode('something', encode.componentChars, true)` is roughly the equivalent of
+the `encodeURIComponent()` function (except `encode()` doesn't throw).
+
+
+### .decode(str [, exclude]) -> String
+
+Decode percent-encoded string. Invalid percent-encoded sequences (e.g. `%2G`)
+are left as is. Invalid UTF-8 characters are replaced with `U+FFFD`.
+
+
+Params:
+
+- __str__ - input string.
+- __exclude__ - set of characters to leave encoded, optional, `;/?:@&=+$,#`.
+
+
+### decode.defaultChars, decode.componentChars
+
+You can use these constants as second argument to `decode` function.
+
+ - `decode.defaultChars` is the same exclude set as in the standard `decodeURI()` function
+ - `decode.componentChars` is the same exclude set as in the `decodeURIComponent()` function
+
+For example, `decode('something', decode.defaultChars)` has the same behavior as
+`decodeURI('something')` on a correctly encoded input.
+
+
+### .parse(url, slashesDenoteHost) -> urlObs
+
+Parse url string. Similar to node's [url.parse](http://nodejs.org/api/url.html#url_url_parse_urlstr_parsequerystring_slashesdenotehost), but without any
+normalizations and query string parse.
+
+ - __url__ - input url (string)
+ - __slashesDenoteHost__ - if url starts with `//`, expect a hostname after it. Optional, `false`.
+
+Result (hash):
+
+- protocol
+- slashes
+- auth
+- port
+- hostname
+- hash
+- search
+- pathname
+
+Difference with node's `url`:
+
+1. No leading slash in paths, e.g. in `url.parse('http://foo?bar')` pathname is
+   ``, not `/`
+2. Backslashes are not replaced with slashes, so `http:\\example.org\` is
+   treated like a relative path
+3. Trailing colon is treated like a part of the path, i.e. in
+   `http://example.org:foo` pathname is `:foo`
+4. Nothing is URL-encoded in the resulting object, (in joyent/node some chars
+   in auth and paths are encoded)
+5. `url.parse()` does not have `parseQueryString` argument
+6. Removed extraneous result properties: `host`, `path`, `query`, etc.,
+   which can be constructed using other parts of the url.
+
+
+### .format(urlObject)
+
+Format an object previously obtained with `.parse()` function. Similar to node's
+[url.format](http://nodejs.org/api/url.html#url_url_format_urlobj).
+
+
+## License
+
+[MIT](https://github.com/markdown-it/mdurl/blob/master/LICENSE)