@openclaw/matrix 2026.9.3 → 2026.9.5

package/node_modules/markdown-it/node_modules/entities/src/encode.ts

@@ -1,18 +1,166 @@
-import { getCodePoint, XML_BITSET_VALUE } from "./escape.js";
-import { htmlTrie } from "./generated/encode-html.js";
+import { XML_BITSET_VALUE, xmlEncodeRegex } from "./escape.js";
+import htmlTrieData from "./generated/encode-html.js";
 
 /**
- * We store the characters to consider as a compact bitset for fast lookups.
+ * A node inside the encoding trie used by `encode.ts`.
+ *
+ * There are two physical shapes to minimize allocations and lookup cost:
+ *
+ * 1. Leaf node (string)
+ *    - A plain string (already in the form `"&name;"`).
+ *    - Represents a terminal match with no children.
+ *
+ * 2. Branch / value node (object)
+ */
+type EncodeTrieNode =
+    | string
+    | { value: string | null; next: Map<number, EncodeTrieNode> };
+
+/**
+ * Flat lookup table for ASCII entity values (code points 0–127).
+ *
+ * Built once at startup from the full trie.  For ASCII characters that need
+ * encoding, a direct `asciiEntities[charCode]` array index is much faster
+ * than `Map.get(charCode)` because it avoids hashing and bucket lookup.
+ *
+ * A few ASCII characters also start multi-code-point entities
+ * (e.g. `<` + U+20D2 → `&nvlt;`).  For those, the table holds the branch
+ * node itself (children plus the single-char value), so the ASCII path
+ * never consults `htmlTrie`.
+ */
+const asciiEntities: (EncodeTrieNode | null)[] = /* #__PURE__ */ Array.from(
+    { length: 128 },
+    () => null,
+);
+
+const htmlTrie: Map<number, EncodeTrieNode> = (() => {
+    /**
+     * Parse a compact encode trie string into a Map keyed by code point.
+     *
+     * The serialized format (produced by `scripts/write-encode-map.ts`) stores
+     * entries in ascending code-point order with delta encoding:
+     *
+     *   [gap]name;[{children}]
+     *
+     * - `gap` is a base-10 integer giving `currentKey - previousKey - 1`.
+     *   The very first entry stores the absolute key.  A gap of 0 is omitted.
+     * - `name;` is the entity name (without `&` prefix) terminated by `;`.
+     *   Because gaps use only digits `[0-9]` and entity names always start with
+     *   a letter `[A-Za-z]`, no additional delimiter is needed.
+     * - `{…}` is an optional children block using the same scheme recursively.
+     *   Children represent the second code unit of multi-character entities
+     *   (e.g. `<` + U+20D2 → `&nvlt;`).
+     */
+    const trie = new Map<number, EncodeTrieNode>();
+    const data = htmlTrieData;
+    let cursor = 0;
+    let lastKey = -1;
+
+    function readGap(): number {
+        let value = 0;
+        let ch: number;
+        while (
+            (ch = data.charCodeAt(cursor)) >= 48 /* '0' */ &&
+            ch <= 57 /* '9' */
+        ) {
+            value = value * 10 + ch - 48;
+            cursor++;
+        }
+        return value;
+    }
+
+    function readEntity(): string {
+        const semi = data.indexOf(";", cursor);
+        const entity = `&${data.substring(cursor, semi)};`;
+        cursor = semi + 1;
+        return entity;
+    }
+
+    const astralEntries: [number, string][] = [];
+
+    while (cursor < data.length) {
+        lastKey += readGap() + 1;
+
+        const entityValue =
+            data.charCodeAt(cursor) === 123 /* '{' */ ? null : readEntity();
+
+        if (data.charCodeAt(cursor) === 123 /* '{' */) {
+            cursor++; // Skip '{'
+            const next = new Map<number, EncodeTrieNode>();
+            let childKey = -1;
+            while (data.charCodeAt(cursor) !== 125 /* '}' */) {
+                childKey += readGap() + 1;
+                next.set(childKey, readEntity());
+            }
+            const branch = { value: entityValue, next };
+            trie.set(lastKey, branch);
+            cursor++; // Skip '}'
+            // ASCII fast path holds the branch node itself (children + value).
+            if (lastKey < 0x80) {
+                asciiEntities[lastKey] = branch;
+            }
+        } else if (lastKey < 0x80) {
+            asciiEntities[lastKey] = entityValue;
+        } else if (lastKey > 0xff_ff) {
+            astralEntries.push([lastKey, entityValue!]);
+        } else {
+            trie.set(lastKey, entityValue!);
+        }
+    }
+
+    /*
+     * Batch-insert astral entries as surrogate-pair trie nodes.
+     * Entries are sorted by code point, so same-high-surrogate groups
+     * are contiguous — no intermediate grouping Map needed.
+     */
+    let astralIndex = 0;
+    while (astralIndex < astralEntries.length) {
+        const hi =
+            0xd8_00 | ((astralEntries[astralIndex][0] - 0x1_00_00) >> 10);
+        const children: [number, string][] = [];
+        while (
+            astralIndex < astralEntries.length &&
+            (0xd8_00 | ((astralEntries[astralIndex][0] - 0x1_00_00) >> 10)) ===
+                hi
+        ) {
+            const lo =
+                0xdc_00 |
+                ((astralEntries[astralIndex][0] - 0x1_00_00) & 0x3_ff);
+            children.push([lo, astralEntries[astralIndex][1]]);
+            astralIndex++;
+        }
+        trie.set(hi, { value: null, next: new Map(children) });
+    }
+
+    return trie;
+})();
+
+/**
+ * Bitset covering ASCII code points 0–127.  Each of the four 32-bit words
+ * covers a 32-code-point range.  A set bit means "this character needs
+ * encoding" when used with `encodeHTML`.
  */
 const HTML_BITSET = /* #__PURE__ */ new Uint32Array([
-    0x16_00, // Bits for 09,0A,0C
-    0xfc_00_ff_fe, // 32..63 -> 21-2D (minus space), 2E,2F,3A-3F
-    0xf8_00_00_01, // 64..95 -> 40, 5B-5F
-    0x38_00_00_01, // 96..127-> 60, 7B-7D
+    0x16_00, // 09 (\t), 0A (\n), 0C (\f)
+    0xfc_00_ff_fe, // 21-2D (!-.), 2E (.), 2F (/), 3A-3F (:;<=>?)
+    0xf8_00_00_01, // 40 (@), 5B-5F ([\]^_)
+    0x38_00_00_01, // 60 (`), 7B-7D ({|})
 ]);
 
 const XML_BITSET = /* #__PURE__ */ new Uint32Array([0, XML_BITSET_VALUE, 0, 0]);
 
+/*
+ * Regex equivalent of `HTML_BITSET` (plus all non-ASCII code units, lone
+ * surrogates included — no `u` flag). Must stay in sync with the bitset:
+ * the scan uses the regex to find candidates and the bitset to re-check
+ * adjacent characters. The XML equivalent is `xmlEncodeRegex`, shared with
+ * `escape.ts`.
+ */
+// eslint-disable-next-line unicorn/prefer-unicode-code-point-escapes -- the `\u{...}` form requires the `u` flag, which we deliberately omit so lone surrogates match by code unit
+const HTML_ENCODE_RE = /[\t\n\f!-/:-@[-`{-}\u0080-\uFFFF]/g;
+
+const numericReference = (cp: number) => `&#x${cp.toString(16)};`;
+
 /**
  * Encodes all characters in the input using HTML entities. This includes
  * characters that are valid ASCII characters in HTML documents, such as `#`.
@@ -23,10 +171,10 @@ const XML_BITSET = /* #__PURE__ */ new Uint32Array([0, XML_BITSET_VALUE, 0, 0]);
  *
  * If a character has no equivalent entity, a numeric hexadecimal reference
  * (eg. `&#xfc;`) will be used.
- * @param input Input string to encode or decode.
+ * @param input Input string to encode.
  */
 export function encodeHTML(input: string): string {
-    return encodeHTMLTrieRe(HTML_BITSET, input);
+    return encodeHTMLTrieRe(HTML_BITSET, HTML_ENCODE_RE, input);
 }
 /**
  * Encodes all non-ASCII characters, as well as characters not valid in HTML
@@ -35,61 +183,155 @@ export function encodeHTML(input: string): string {
  *
  * If a character has no equivalent entity, a numeric hexadecimal reference
  * (eg. `&#xfc;`) will be used.
- * @param input Input string to encode or decode.
+ * @param input Input string to encode.
  */
 export function encodeNonAsciiHTML(input: string): string {
-    return encodeHTMLTrieRe(XML_BITSET, input);
+    return encodeHTMLTrieRe(XML_BITSET, xmlEncodeRegex, input);
 }
 
-function encodeHTMLTrieRe(bitset: Uint32Array, input: string): string {
+/**
+ * Whether `code` (a UTF-16 code unit) must be encoded: any non-ASCII unit, or
+ * an ASCII unit flagged in `bitset`.
+ * @param bitset Bitset of ASCII characters to encode.
+ * @param code Code unit to test.
+ */
+function isEncodable(bitset: Uint32Array, code: number): boolean {
+    return code >= 0x80 || ((bitset[code >>> 5] >>> code) & 1) === 1;
+}
+
+/*
+ * The inline scan beats the regex jump only for short gaps (measured
+ * break-even is ~7 characters; below it the per-call regex overhead
+ * dominates, above it the regex skips clean spans faster in native code).
+ * So we scan at most `INLINE_SCAN_WINDOW` characters inline before deferring
+ * to the regex. Any gap long enough to exhaust the window switches to
+ * long-gap mode, which skips the inline scan entirely; we stay in that mode
+ * while total gaps are at least `LONG_GAP_THRESHOLD` characters long and
+ * drop back to the inline scan as soon as a shorter gap appears. Gaps are
+ * always measured from where they start, so every window-exhausting gap
+ * enters long-gap mode and no gap length pays both scans repeatedly.
+ */
+/** @internal Exported for tests; not re-exported from the package entry. */
+export const INLINE_SCAN_WINDOW = 16;
+const LONG_GAP_THRESHOLD = 8;
+
+function encodeHTMLTrieRe(
+    bitset: Uint32Array,
+    re: RegExp,
+    input: string,
+): string {
+    const { length } = input;
     let out: string | undefined;
     let last = 0; // Start of the next untouched slice.
-    const { length } = input;
+    let index = 0;
+    let wasLongGap = false; // The previous gap was long; skip the inline scan.
+
+    while (index < length) {
+        let char = input.charCodeAt(index);
 
-    for (let index = 0; index < length; index++) {
-        const char = input.charCodeAt(index);
-        // Skip ASCII characters that don't need encoding
-        if (char < 0x80 && !((bitset[char >>> 5] >>> char) & 1)) {
-            continue;
+        /*
+         * Find the next encodable character (one matching `bitset`, or any
+         * non-ASCII unit). Gaps between entities in dense text are only a
+         * few characters, so scan a short window inline first; the regex —
+         * which matches exactly the same characters and skips clean spans
+         * in native code — runs for longer gaps. Gap lengths cluster, so
+         * after a window-exhausting gap the window is skipped until a gap
+         * shorter than LONG_GAP_THRESHOLD reappears. Once located, the
+         * character is captured in `char` and control falls through to the
+         * encode logic below instead of re-testing it on the next loop
+         * iteration.
+         */
+        if (!isEncodable(bitset, char)) {
+            const gapStart = index;
+            let next = index + 1;
+            let wasFound = false;
+            if (!wasLongGap) {
+                const bound = Math.min(index + INLINE_SCAN_WINDOW, length);
+                while (
+                    next < bound &&
+                    !isEncodable(bitset, (char = input.charCodeAt(next)))
+                ) {
+                    next++;
+                }
+                if (next < bound) {
+                    // `char` already holds the encodable unit at `next`.
+                    index = next;
+                    wasFound = true;
+                } else if (next >= length) {
+                    break;
+                }
+            }
+            if (!wasFound) {
+                /*
+                 * Every match is a single code unit, so `test` pins it at
+                 * `lastIndex - 1` without allocating a match object.
+                 */
+                re.lastIndex = next;
+                if (!re.test(input)) break;
+                index = re.lastIndex - 1;
+                /*
+                 * Reaching the regex from the inline scan means the gap
+                 * exhausted the window, so it is long by definition; once
+                 * in long-gap mode, stay until a gap shorter than the
+                 * threshold appears.
+                 */
+                wasLongGap =
+                    !wasLongGap || index - gapStart >= LONG_GAP_THRESHOLD;
+                char = input.charCodeAt(index);
+            }
         }
 
-        if (out === undefined) out = input.substring(0, index);
+        // Lazy-init: copy the prefix before the first character that needs encoding.
+        if (out == null) out = input.substring(0, index);
         else if (last !== index) out += input.substring(last, index);
 
-        let node = htmlTrie.get(char);
-
-        if (typeof node === "object") {
-            if (index + 1 < length) {
-                const nextChar = input.charCodeAt(index + 1);
-                const value =
-                    typeof node.next === "number"
-                        ? node.next === nextChar
-                            ? node.nextValue
-                            : undefined
-                        : node.next.get(nextChar);
-
-                if (value !== undefined) {
-                    out += value;
-                    index++;
-                    last = index + 1;
-                    continue;
+        if (char < 0x80) {
+            const node = asciiEntities[char];
+            if (typeof node === "object" && node !== null) {
+                // Multi-code-point entity first (e.g. < + U+20D2 → &nvlt;).
+                if (index + 1 < length) {
+                    const value = node.next.get(input.charCodeAt(index + 1));
+                    if (value != null) {
+                        out += value;
+                        last = index += 2;
+                        continue;
+                    }
                 }
+                out += node.value ?? numericReference(char);
+            } else {
+                out += node ?? numericReference(char);
             }
-            node = node.value;
-        }
-
-        if (node === undefined) {
-            const cp = getCodePoint(input, index);
-            out += `&#x${cp.toString(16)};`;
-            if (cp !== char) index++;
-            last = index + 1;
         } else {
-            out += node;
-            last = index + 1;
+            // Non-ASCII: full trie lookup with multi-char entity support.
+            let node: EncodeTrieNode | undefined | null = htmlTrie.get(char);
+
+            if (typeof node === "object") {
+                if (index + 1 < length) {
+                    const value = node.next.get(input.charCodeAt(index + 1));
+                    if (value != null) {
+                        out += value;
+                        last = index += 2;
+                        continue;
+                    }
+                }
+                node = node.value;
+            }
+
+            if (node == null) {
+                // No named entity exists; emit a hexadecimal numeric reference.
+                const cp = input.codePointAt(index)!;
+                out += numericReference(cp);
+                // Astral code points consume two UTF-16 code units.
+                if (cp !== char) index++;
+            } else {
+                out += node;
+            }
         }
+        last = index += 1;
     }
 
-    if (out === undefined) return input;
+    // If nothing needed encoding, return the original string (avoids allocation).
+    if (out == null) return input;
     if (last < length) out += input.substr(last);
     return out;
 }

package/node_modules/markdown-it/node_modules/entities/src/escape.ts

@@ -1,55 +1,99 @@
-const xmlCodeMap = new Map([
-    [34, """],
-    [38, "&"],
-    [39, "'"],
-    [60, "<"],
-    [62, ">"],
-]);
-
-// For compatibility with node < 4, we wrap `codePointAt`
+/**
+ * Get the named reference for an XML special character or U+00A0.
+ * @param char Code unit matched by one of the escape regexes.
+ */
+function getEscape(char: number): string {
+    return char === 34
+        ? "&quot;"
+        : char === 38
+          ? "&amp;"
+          : char === 39
+            ? "&apos;"
+            : char === 60
+              ? "&lt;"
+              : char === 62
+                ? "&gt;"
+                : "&nbsp;";
+}
+
 /**
  * Read a code point at a given index.
- * @param input Input string to encode or decode.
+ * @param input String to read the code point from.
  * @param index Current read position in the input string.
+ * @returns The code point at `index`, or `undefined` if `index` is out of range.
+ * @deprecated Use `String.prototype.codePointAt` directly instead; this export
+ *   will be removed in the next major.
  */
-export const getCodePoint: (c: string, index: number) => number =
-    typeof String.prototype.codePointAt === "function"
-        ? (input: string, index: number): number => input.codePointAt(index)!
-        : // http://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
-          (c: string, index: number): number =>
-              (c.charCodeAt(index) & 0xfc_00) === 0xd8_00
-                  ? (c.charCodeAt(index) - 0xd8_00) * 0x4_00 +
-                    c.charCodeAt(index + 1) -
-                    0xdc_00 +
-                    0x1_00_00
-                  : c.charCodeAt(index);
+export const getCodePoint: (input: string, index: number) => number = (
+    input: string,
+    index: number,
+): number => input.codePointAt(index)!;
 
 /**
  * Bitset for ASCII characters that need to be escaped in XML.
  */
 export const XML_BITSET_VALUE = 0x50_00_00_c4; // 32..63 -> 34 ("),38 (&),39 ('),60 (<),62 (>)
 
+/**
+ * Matches exactly the characters `encodeXML` escapes: the five XML special
+ * characters plus every non-ASCII code unit (lone surrogates included — no
+ * `u` flag). Kept in sync with `XML_BITSET_VALUE`.
+ *
+ * Shared with `encodeNonAsciiHTML` in `encode.ts`. Because the regex is
+ * stateful (`g` flag), every call site must set `lastIndex` before use.
+ */
+// eslint-disable-next-line unicorn/prefer-unicode-code-point-escapes -- the `\u{...}` form requires the `u` flag, which we deliberately omit so lone surrogates match by code unit
+export const xmlEncodeRegex: RegExp = /["&'<>\u0080-\uFFFF]/g;
+
+/**
+ * Whether `code` (a UTF-16 code unit) is escaped by {@link encodeXML}: a
+ * non-ASCII unit, or one of the five XML specials flagged in
+ * `XML_BITSET_VALUE` (which is only meaningful for code units 32-63).
+ * @param code Code unit to test.
+ */
+function isXmlEscapable(code: number): boolean {
+    return (
+        code >= 0x80 ||
+        (code >= 32 && code < 64 && ((XML_BITSET_VALUE >>> code) & 1) === 1)
+    );
+}
+
 /**
  * Encodes all non-ASCII characters, as well as characters not valid in XML
- * documents using XML entities. Uses a fast bitset scan instead of RegExp.
+ * documents using XML entities.
  *
  * If a character has no equivalent entity, a numeric hexadecimal reference
  * (eg. `&#xfc;`) will be used.
- * @param input Input string to encode or decode.
+ * @param input Input string to encode.
  */
 export function encodeXML(input: string): string {
+    const { length } = input;
     let out: string | undefined;
     let last = 0;
-    const { length } = input;
+    let index = 0;
 
-    for (let index = 0; index < length; index++) {
+    while (index < length) {
         const char = input.charCodeAt(index);
 
-        // Check for ASCII chars that don't need escaping
-        if (
-            char < 0x80 &&
-            (((XML_BITSET_VALUE >>> char) & 1) === 0 || char >= 64 || char < 32)
-        ) {
+        /*
+         * Find the next character to escape: scan a short window inline
+         * (escapable characters cluster in markup-heavy input), then fall
+         * back to the regex, which skips clean spans in native code.
+         */
+        if (!isXmlEscapable(char)) {
+            const bound = Math.min(index + 32, length);
+            let next = index + 1;
+            while (next < bound && !isXmlEscapable(input.charCodeAt(next))) {
+                next++;
+            }
+            if (next < bound) {
+                index = next;
+                continue;
+            }
+            if (next >= length) break;
+            xmlEncodeRegex.lastIndex = next;
+            if (!xmlEncodeRegex.test(input)) break;
+            index = xmlEncodeRegex.lastIndex - 1;
             continue;
         }
 
@@ -58,16 +102,16 @@ export function encodeXML(input: string): string {
 
         if (char < 64) {
             // Known replacement
-            out += xmlCodeMap.get(char)!;
-            last = index + 1;
+            out += getEscape(char);
+            last = index += 1;
             continue;
         }
 
         // Non-ASCII: encode as numeric entity (handle surrogate pair)
-        const cp = getCodePoint(input, index);
+        const cp = input.codePointAt(index)!;
         out += `&#x${cp.toString(16)};`;
         if (cp !== char) index++; // Skip trailing surrogate
-        last = index + 1;
+        last = index += 1;
     }
 
     if (out === undefined) return input;
@@ -86,75 +130,58 @@ export function encodeXML(input: string): string {
 export const escape: typeof encodeXML = encodeXML;
 
 /**
- * Creates a function that escapes all characters matched by the given regular
- * expression using the given map of characters to escape to their entities.
- * @param regex Regular expression to match characters to escape.
- * @param map Map of characters to escape to their entities.
- * @returns Function that escapes all characters matched by the given regular
- * expression using the given map of characters to escape to their entities.
+ * Escape `data` using `re`, mapping each matched character to its entity.
+ * Every match is one UTF-16 code unit, so its index is `lastIndex - 1`.
+ * @param re Global regex matching exactly the characters to escape
+ *   (`"`, `&`, `'`, `<`, `>`, `\u00A0` at most).
+ * @param data String to escape.
  */
-function getEscaper(
-    regex: RegExp,
-    map: Map<number, string>,
-): (data: string) => string {
-    return function escape(data: string): string {
-        let match: RegExpExecArray | null;
-        let lastIndex = 0;
-        let result = "";
-
-        while ((match = regex.exec(data))) {
-            if (lastIndex !== match.index) {
-                result += data.substring(lastIndex, match.index);
-            }
-
-            // We know that this character will be in the map.
-            result += map.get(match[0].charCodeAt(0))!;
+function escapeWithRegex(re: RegExp, data: string): string {
+    re.lastIndex = 0;
+    if (!re.test(data)) return data;
 
-            // Every match will be of length 1
-            lastIndex = match.index + 1;
-        }
+    let out = "";
+    let last = 0;
+    do {
+        const index = re.lastIndex - 1;
+        if (last !== index) out += data.substring(last, index);
+        const char = data.charCodeAt(index);
+        out += getEscape(char);
+        last = index + 1;
+    } while (re.test(data));
 
-        return result + data.substring(lastIndex);
-    };
+    return out + data.substring(last);
 }
 
+const xmlEscapeRegex = /["&'<>]/g;
 /**
  * Encodes all characters not valid in XML documents using XML entities.
  *
  * Note that the output will be character-set dependent.
  * @param data String to escape.
  */
-export const escapeUTF8: (data: string) => string = /* #__PURE__ */ getEscaper(
-    /["&'<>]/g,
-    xmlCodeMap,
-);
+export function escapeUTF8(data: string): string {
+    return escapeWithRegex(xmlEscapeRegex, data);
+}
+
+const attributeEscapeRegex = /["&\u{A0}]/gu;
 
 /**
  * Encodes all characters that have to be escaped in HTML attributes,
  * following {@link https://html.spec.whatwg.org/multipage/parsing.html#escapingString}.
  * @param data String to escape.
  */
-export const escapeAttribute: (data: string) => string =
-    /* #__PURE__ */ getEscaper(
-        /["&\u00A0]/g,
-        new Map([
-            [34, "&quot;"],
-            [38, "&amp;"],
-            [160, "&nbsp;"],
-        ]),
-    );
+export function escapeAttribute(data: string): string {
+    return escapeWithRegex(attributeEscapeRegex, data);
+}
+
+const textEscapeRegex = /[&<>\u{A0}]/gu;
 
 /**
  * Encodes all characters that have to be escaped in HTML text,
  * following {@link https://html.spec.whatwg.org/multipage/parsing.html#escapingString}.
  * @param data String to escape.
  */
-export const escapeText: (data: string) => string = /* #__PURE__ */ getEscaper(
-    /[&<>\u00A0]/g,
-    new Map([
-        [38, "&amp;"],
-        [60, "&lt;"],
-        [62, "&gt;"],
-        [160, "&nbsp;"],
-    ]),
-);
+export function escapeText(data: string): string {
+    return escapeWithRegex(textEscapeRegex, data);
+}