@openclaw/matrix 2026.9.4 → 2026.9.5

package/node_modules/matrix-js-sdk/node_modules/matrix-widget-api/src/interfaces/RtcLivekitActions.ts

@@ -0,0 +1,80 @@
+/*
+ * Copyright 2026 The Matrix.org Foundation C.I.C.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { IWidgetApiRequest, IWidgetApiRequestData } from "./IWidgetApiRequest";
+import { IWidgetApiResponseData } from "./IWidgetApiResponse";
+import { WidgetApiFromWidgetAction } from "./WidgetApiAction";
+
+/**
+ * The MatrixRTC member a LiveKit request is made for.
+ * @see {@link https://github.com/matrix-org/matrix-spec-proposals/pull/4195|MSC4195}
+ */
+export interface IRtcLivekitMember {
+    /** The identifier of the member within the MatrixRTC session. */
+    id: string;
+    /** The device ID the member claims to be using. */
+    claimed_device_id?: string; // eslint-disable-line camelcase
+}
+
+export interface IRtcLivekitGetTokenFromWidgetRequestData extends IWidgetApiRequestData {
+    /** The name of the homeserver hosting the MatrixRTC session. */
+    server_name: string; // eslint-disable-line camelcase
+    /** The URL of the LiveKit SFU to obtain a token for. */
+    url: string;
+    /** The room the MatrixRTC session belongs to. */
+    room_id: string; // eslint-disable-line camelcase
+    /** The MatrixRTC session (slot) to join. */
+    slot_id: string; // eslint-disable-line camelcase
+    member: IRtcLivekitMember;
+}
+
+export interface IRtcLivekitGetTokenFromWidgetActionRequest extends IWidgetApiRequest {
+    action: WidgetApiFromWidgetAction.MSC4533RtcLivekitGetToken;
+    data: IRtcLivekitGetTokenFromWidgetRequestData;
+}
+
+export interface IRtcLivekitGetTokenFromWidgetResponseData extends IWidgetApiResponseData {
+    /** The JWT to authenticate against the SFU with. */
+    jwt: string;
+}
+
+export interface IRtcLivekitGetTokenFromWidgetActionResponse extends IRtcLivekitGetTokenFromWidgetActionRequest {
+    response: IRtcLivekitGetTokenFromWidgetResponseData;
+}
+
+export interface IRtcLivekitDelegateDelayedLeaveFromWidgetRequestData extends IWidgetApiRequestData {
+    /** The room the MatrixRTC session belongs to. */
+    room_id: string; // eslint-disable-line camelcase
+    /** The MatrixRTC session (slot) the delayed leave event belongs to. */
+    slot_id: string; // eslint-disable-line camelcase
+    member: IRtcLivekitMember;
+    /** The ID of the delayed leave event to hand over to the server. */
+    delay_id: string; // eslint-disable-line camelcase
+}
+
+export interface IRtcLivekitDelegateDelayedLeaveFromWidgetActionRequest extends IWidgetApiRequest {
+    action: WidgetApiFromWidgetAction.MSC4533RtcLivekitDelegateDelayedLeave;
+    data: IRtcLivekitDelegateDelayedLeaveFromWidgetRequestData;
+}
+
+export interface IRtcLivekitDelegateDelayedLeaveFromWidgetResponseData extends IWidgetApiResponseData {
+    // nothing
+}
+
+export interface IRtcLivekitDelegateDelayedLeaveFromWidgetActionResponse
+    extends IRtcLivekitDelegateDelayedLeaveFromWidgetActionRequest {
+    response: IRtcLivekitDelegateDelayedLeaveFromWidgetResponseData;
+}

package/node_modules/matrix-js-sdk/node_modules/matrix-widget-api/src/interfaces/WidgetApiAction.ts

@@ -97,6 +97,16 @@ export enum WidgetApiFromWidgetAction {
      * @experimental It is not recommended to rely on this existing - it can be removed without notice.
      */
     MSC4515GetRtcTransports = "org.matrix.msc4515.get_rtc_transports",
+
+    /**
+     * @experimental It is not recommended to rely on this existing - it can be removed without notice.
+     */
+    MSC4533RtcLivekitGetToken = "org.matrix.msc4533.rtc_livekit_get_token",
+
+    /**
+     * @experimental It is not recommended to rely on this existing - it can be removed without notice.
+     */
+    MSC4533RtcLivekitDelegateDelayedLeave = "org.matrix.msc4533.rtc_livekit_delegate_delayed_leave",
 }
 
 export type WidgetApiAction = WidgetApiToWidgetAction | WidgetApiFromWidgetAction | string;

package/node_modules/matrix-js-sdk/node_modules/p-retry/index.d.ts

@@ -138,7 +138,7 @@ export type Options = {
 	readonly shouldConsumeRetry?: (context: RetryContext) => boolean | Promise<boolean>;
 
 	/**
-	The maximum amount of times to retry the operation.
+	The maximum amount of times to retry the operation. Must be a non-negative integer or `Infinity`.
 
 	@default 10
 	*/

package/node_modules/matrix-js-sdk/node_modules/p-retry/index.js

@@ -9,6 +9,10 @@ function validateRetries(retries) {
 		if (Number.isNaN(retries)) {
 			throw new TypeError('Expected `retries` to be a valid number or Infinity, got NaN.');
 		}
+
+		if (Number.isFinite(retries) && !Number.isInteger(retries)) {
+			throw new TypeError('Expected `retries` to be a non-negative integer or Infinity.');
+		}
 	} else if (retries !== undefined) {
 		throw new TypeError('Expected `retries` to be a number or Infinity.');
 	}

package/node_modules/matrix-js-sdk/node_modules/p-retry/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "p-retry",
-	"version": "8.0.0",
+	"version": "8.0.1",
 	"description": "Retry a promise-returning or async function",
 	"license": "MIT",
 	"repository": "sindresorhus/p-retry",

package/node_modules/matrix-js-sdk/node_modules/p-retry/readme.md

@@ -164,7 +164,7 @@ In the example above, `RateLimitError`s will not decrement the available `retrie
 Type: `number`\
 Default: `10`
 
-The maximum amount of times to retry the operation.
+The maximum amount of times to retry the operation. Must be a non-negative integer or `Infinity`.
 
 ##### factor
 

package/node_modules/matrix-js-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "matrix-js-sdk",
-  "version": "42.2.0",
+  "version": "42.3.0",
   "description": "Matrix Client-Server SDK for Javascript",
   "engines": {
     "node": ">=22.0.0"
@@ -79,7 +79,7 @@
     "knip": "^6.0.0",
     "lint-staged": "^17.0.0",
     "matrix-mock-request": "^2.5.0",
-    "oxfmt": "^0.61.0",
+    "oxfmt": "^0.63.0",
     "oxlint": "^1.70.0",
     "oxlint-tsgolint": "^7.0.0",
     "typedoc": "^0.28.1",

package/node_modules/matrix-js-sdk/src/client.ts

@@ -7383,10 +7383,9 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @see https://github.com/tcpipuk/matrix-spec-proposals/blob/main/proposals/4133-extended-profiles.md
      * @param userId The user ID to fetch the profile of.
      * @param key The key of the property to fetch.
-     * @returns The property value.
+     * @returns The property value, or `undefined` if the key was not set OR the profile could not be found.
      *
      * @throws An error if the server does not support MSC4133.
-     * @throws A M_NOT_FOUND error if the key was not set OR the profile could not be found.
      */
     public async getExtendedProfileProperty(userId: string, key: string): Promise<unknown> {
         if (!(await this.doesServerSupportExtendedProfiles())) {
@@ -7398,15 +7397,24 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         if (storedProfile?.[key] !== undefined) {
             return storedProfile[key];
         }
-        const profile = (await this.http.authedRequest(
-            Method.Get,
-            utils.encodeUri("/profile/$userId/$key", { $userId: userId, $key: key }),
-            undefined,
-            undefined,
-            {
-                prefix: await this.getExtendedProfileRequestPrefix(),
-            },
-        )) as SyncUserProfile;
+        let profile: SyncUserProfile;
+        try {
+            profile = (await this.http.authedRequest(
+                Method.Get,
+                utils.encodeUri("/profile/$userId/$key", { $userId: userId, $key: key }),
+                undefined,
+                undefined,
+                {
+                    prefix: await this.getExtendedProfileRequestPrefix(),
+                },
+            )) as SyncUserProfile;
+        } catch (e) {
+            if (e instanceof MatrixError && e.httpStatus === 404 && e.errcode === "M_NOT_FOUND") {
+                // The key is not set on the profile (or the profile does not exist).
+                return undefined;
+            }
+            throw e;
+        }
 
         // write through to the cache
         await this.store.storeUserProfiles(

package/node_modules/matrix-js-sdk/src/http-api/errors.ts

@@ -19,6 +19,7 @@ import { type IMatrixApiError as IWidgetMatrixError } from "matrix-widget-api";
 import { type IUsageLimit } from "../@types/partials.ts";
 import { type MatrixEvent } from "../models/event.ts";
 import { NamespacedValue } from "../NamespacedValue.ts";
+import { hasRequiredStringProperty, isRecord } from "../@types/type-guards.ts";
 
 interface IErrorJson extends Partial<IUsageLimit> {
     [key: string]: any; // extensible
@@ -80,6 +81,21 @@ export class HTTPError extends Error {
     }
 }
 
+/**
+ * Check if the given (JSON-parsed) response body looks like a Matrix error
+ * response as specified in https://spec.matrix.org/v1.19/client-server-api/#standard-error-response
+ *
+ * @param response - the parsed response body to check
+ * @returns whether the response is a valid {@link MatrixError}
+ */
+export function isMatrixErrorResponse(response: unknown): response is MatrixError {
+    return (
+        isRecord(response) &&
+        hasRequiredStringProperty(response, "error") &&
+        hasRequiredStringProperty(response, "errcode")
+    );
+}
+
 export class MatrixError extends HTTPError {
     // The Matrix 'errcode' value, e.g. "M_FORBIDDEN".
     public readonly errcode?: string;

package/node_modules/matrix-js-sdk/src/matrixrtc/MatrixRTCSession.ts

@@ -96,6 +96,12 @@ export interface SessionConfig {
      * Determines the kind of call this will be.
      */
     callIntent?: RTCCallIntent;
+
+    /**
+     * How long (in milliseconds) the callee's client should keep ringing/waiting for an
+     * answer before the sender gives up and the call notification is considered timed out.
+     */
+    notificationLifetimeMs?: number;
 }
 
 // The names follow these principles:
@@ -697,6 +703,7 @@ export class MatrixRTCSession extends TypedEventEmitter<
         notificationType: RTCNotificationType,
         callIntent?: RTCCallIntent,
     ): void {
+        const lifetime = this.joinConfig?.notificationLifetimeMs ?? 90_000;
         const sendNotificationEvent = async (): Promise<{
             response: ISendEventResponse;
             content: IRTCNotificationContent;
@@ -709,7 +716,7 @@ export class MatrixRTCSession extends TypedEventEmitter<
                     rel_type: RelationType.Reference,
                 },
                 "sender_ts": Date.now(),
-                "lifetime": 30_000, // 30 seconds
+                "lifetime": lifetime,
             };
             if (callIntent) {
                 content["m.call.intent"] = callIntent;

package/node_modules/matrix-js-sdk/src/oauth/authorize.ts

@@ -15,7 +15,7 @@ limitations under the License.
 */
 
 import { secureRandomString } from "../randomstring.ts";
-import { OAuth2Error } from "./error.ts";
+import { OAuth2Error, type OAuth2ErrorResponse } from "./error.ts";
 import { type ValidatedAuthMetadata } from "./discover.ts";
 import {
     hasOptionalNumberProperty,
@@ -127,10 +127,7 @@ export function isValidDeviceAccessTokenResponse(response: unknown): response is
 /**
  * Error from the OAuth2 token endpoint when exchanging a token for grant_type device_code.
  */
-export interface DeviceAccessTokenError {
-    error: string;
-    error_description?: string;
-    error_uri?: string;
+export interface DeviceAccessTokenError extends OAuth2ErrorResponse {
     session_state?: string;
 }
 

package/node_modules/matrix-js-sdk/src/oauth/error.ts

@@ -14,6 +14,9 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+import { hasOptionalStringProperty, hasRequiredStringProperty, isRecord } from "../@types/type-guards.ts";
+import { HTTPError } from "../http-api/errors.ts";
+
 /**
  * Errors expected to be encountered during OAuth2 discovery, client registration, and authentication.
  * Not intended to be displayed directly to the user.
@@ -32,3 +35,69 @@ export enum OAuth2Error {
     RevokeTokenFailed = "Failed to revoke token",
     DeviceAuthorizationGrantFailed = "Failed to perform device authorization grant",
 }
+
+/**
+ * An error response from an OAuth 2.0 endpoint,
+ * as specified in https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ */
+export interface OAuth2ErrorResponse {
+    /** A single ASCII error code, e.g. `invalid_grant`. */
+    error: string;
+    /** Human-readable ASCII text providing additional information about the error. */
+    error_description?: string;
+    /** A URI identifying a human-readable web page with information about the error. */
+    error_uri?: string;
+}
+
+/**
+ * Check whether the given (JSON-parsed) response body is an OAuth 2.0 error response
+ * as specified in https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ * @param response - the parsed response body to check
+ * @returns whether the response is a valid {@link OAuth2ErrorResponse}
+ */
+export function isOAuth2ErrorResponse(response: unknown): response is OAuth2ErrorResponse {
+    return (
+        isRecord(response) &&
+        hasRequiredStringProperty(response, "error") &&
+        hasOptionalStringProperty(response, "error_description") &&
+        hasOptionalStringProperty(response, "error_uri")
+    );
+}
+
+/**
+ * An error thrown when a request to an OAuth 2.0 endpoint fails with a body matching the error
+ * response format specified in [RFC 6749 section 5.2](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2).
+ */
+export class OAuth2HTTPError extends HTTPError implements OAuth2ErrorResponse {
+    /**
+     * RFC 6749 section 5.2 error code, e.g. `invalid_grant`
+     *
+     * IANA matains a registry of valid values at
+     * https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#extensions-error
+     */
+    public error: string;
+
+    /**
+     * RFC 6749 section 5.2 human-readable ASCII text providing additional information about the error.
+     * This field is optional and may be omitted by the endpoint.
+     */
+    public error_description?: string;
+
+    /**
+     * RFC 6749 section 5.2 URI identifying a human-readable web page with information about the error.
+     * This field is optional and may be omitted by the endpoint.
+     */
+    public error_uri?: string;
+
+    public constructor(
+        msg: string,
+        httpStatus: number | undefined,
+        httpHeaders: Headers | undefined,
+        { error, error_description, error_uri }: OAuth2ErrorResponse,
+    ) {
+        super(msg, httpStatus, httpHeaders);
+        this.error = error;
+        this.error_description = error_description;
+        this.error_uri = error_uri;
+    }
+}

package/node_modules/matrix-js-sdk/src/oauth/index.ts

@@ -34,9 +34,9 @@ import {
 } from "./register.ts";
 import { encodeUnpaddedBase64Url } from "../base64.ts";
 import { sha256 } from "../digest.ts";
-import { HTTPError, Method } from "../http-api/index.ts";
+import { HTTPError, isMatrixErrorResponse, MatrixError, Method } from "../http-api/index.ts";
 import { logger } from "../logger.ts";
-import { OAuth2Error } from "./error.ts";
+import { isOAuth2ErrorResponse, OAuth2Error, OAuth2HTTPError } from "./error.ts";
 import { secureRandomString } from "../randomstring.ts";
 import { type NonEmptyArray } from "../@types/common.ts";
 
@@ -289,6 +289,23 @@ export class OAuth2 {
         });
 
         if (res.status >= 400) {
+            let body: unknown;
+            try {
+                body = await res.json();
+            } catch {
+                // The endpoint didn't give us a JSON body, so we can't determine the error type. We'll throw a generic
+                // HTTPError below.
+            }
+            // Because the Matrix C-S API error response format is so similar to the OAuth 2.0 error response format
+            // the ordering of these checks is important. We want to check for a Matrix error response first, and only
+            // if it isn't one do we check for an OAuth 2.0 error response.
+            // This essentially relies on `errcode` not being present in an OAuth 2.0 error response.
+            if (isMatrixErrorResponse(body)) {
+                throw new MatrixError(body, res.status, undefined, undefined, res.headers);
+            }
+            if (isOAuth2ErrorResponse(body)) {
+                throw new OAuth2HTTPError(error, res.status, res.headers, body);
+            }
             throw new HTTPError(error, res.status, res.headers);
         }
 

package/node_modules/matrix-js-sdk/src/oauth/tokenRefresher.ts

@@ -15,6 +15,7 @@ limitations under the License.
 */
 
 import { type AccessTokens, HTTPError, type TokenRefreshFunction, TokenRefreshLogoutError } from "../http-api/index.ts";
+import { OAuth2HTTPError } from "./error.ts";
 import { type OAuth2 } from "./index.ts";
 
 /**
@@ -54,8 +55,14 @@ export class TokenRefresher {
     };
 
     private shouldLogoutOnError(error: HTTPError): boolean {
-        // As per https://spec.matrix.org/v1.18/client-server-api/#refresh-token-grant
-        return typeof error.httpStatus === "number" && error.httpStatus < 500 && error.httpStatus >= 400;
+        // Treat as logout as per https://spec.matrix.org/v1.18/client-server-api/#refresh-token-grant
+        // after making sure it is an RFC 6749 section 5.2 error response
+        return (
+            error instanceof OAuth2HTTPError &&
+            typeof error.httpStatus === "number" &&
+            error.httpStatus < 500 &&
+            error.httpStatus >= 400
+        );
     }
 
     private async getNewTokens(refreshToken: string): Promise<AccessTokens> {

package/node_modules/matrix-js-sdk/src/secret-storage.ts

@@ -21,8 +21,7 @@ limitations under the License.
  */
 
 import { type TypedEventEmitter } from "./models/typed-event-emitter.ts";
-import { ClientEvent, type ClientEventHandlerMap } from "./client.ts";
-import { type MatrixEvent } from "./models/event.ts";
+import { type ClientEvent, type ClientEventHandlerMap } from "./client.ts";
 import { secureRandomString } from "./randomstring.ts";
 import { logger } from "./logger.ts";
 import encryptAESSecretStorageItem from "./utils/encryptAESSecretStorageItem.ts";
@@ -370,35 +369,13 @@ export class ServerSideSecretStorageImpl implements ServerSideSecretStorage {
     /**
      * Implementation of {@link ServerSideSecretStorage#setDefaultKeyId}.
      */
-    public setDefaultKeyId(keyId: string | null): Promise<void> {
-        return new Promise<void>((resolve, reject) => {
-            const listener = (ev: MatrixEvent): void => {
-                if (ev.getType() !== "m.secret_storage.default_key") {
-                    //  Different account data item
-                    return;
-                }
-
-                // If keyId === null, the content should be an empty object.
-                // Otherwise, the `key` in the content object should match keyId.
-                const content = ev.getContent();
-                const isSameKey = keyId === null ? Object.keys(content).length === 0 : content.key === keyId;
-                if (isSameKey) {
-                    this.accountDataAdapter.removeListener(ClientEvent.AccountData, listener);
-                    resolve();
-                }
-            };
-            this.accountDataAdapter.on(ClientEvent.AccountData, listener);
-
-            // The spec [1] says that the value of the account data entry should be an object with a `key` property.
-            // It doesn't specify how to delete the default key; we do it by setting the account data to an empty object.
-            //
-            // [1]: https://spec.matrix.org/v1.13/client-server-api/#key-storage
-            const newValue: Record<string, never> | { key: string } = keyId === null ? {} : { key: keyId };
-            this.accountDataAdapter.setAccountData("m.secret_storage.default_key", newValue).catch((e) => {
-                this.accountDataAdapter.removeListener(ClientEvent.AccountData, listener);
-                reject(e);
-            });
-        });
+    public async setDefaultKeyId(keyId: string | null): Promise<void> {
+        // The spec [1] says that the value of the account data entry should be an object with a `key` property.
+        // It doesn't specify how to delete the default key; we do it by setting the account data to an empty object.
+        //
+        // [1]: https://spec.matrix.org/v1.13/client-server-api/#key-storage
+        const newValue: Record<string, never> | { key: string } = keyId === null ? {} : { key: keyId };
+        await this.accountDataAdapter.setAccountData("m.secret_storage.default_key", newValue);
     }
 
     /**

package/node_modules/matrix-js-sdk/src/sliding-sync-sdk.ts

@@ -35,6 +35,8 @@ import {
     type IMinimalEvent,
     type IRoomEvent,
     type IStateEvent,
+    type IStickyEvent,
+    type IStickyStateEvent,
     type IStrippedState,
     type ISyncResponse,
     type ReceivedToDeviceMessage,
@@ -311,6 +313,73 @@ class ExtensionReceipts implements Extension<ExtensionReceiptsRequest, Extension
     }
 }
 
+type ExtensionStickyEventsRequest = {
+    enabled: boolean;
+    /** Max events per response; the server may return fewer. */
+    limit?: number;
+    /** The `next_batch` of the previous response. */
+    since?: string;
+};
+
+type ExtensionStickyEventsResponse = {
+    /** Only sent when there were changes. */
+    next_batch?: string;
+    rooms?: Record<string, { events: Array<IStickyEvent | IStickyStateEvent> }>;
+};
+
+/**
+ * Delivers sticky events (MSC4354) over sliding sync.
+ * https://github.com/matrix-org/matrix-spec-proposals/pull/4480
+ *
+ * Sticky events expire after a duration instead of living in the timeline forever, and the server
+ * re-sends the unexpired ones (e.g. on join) so late joiners still see them.
+ *
+ * The server sends them for every room matched by a list or subscription, even rooms currently
+ * outside the list window. Sticky events already in a room's timeline are excluded here, so
+ * `processRoomData` picks those up separately.
+ */
+class ExtensionStickyEvents implements Extension<ExtensionStickyEventsRequest, ExtensionStickyEventsResponse> {
+    private nextBatch?: string;
+
+    public constructor(private readonly client: MatrixClient) {}
+
+    public name(): string {
+        // Keeps MSC4354's number, as the extension was originally specified there.
+        return "org.matrix.msc4354.sticky_events";
+    }
+
+    public when(): ExtensionState {
+        // Sticky events are stored on a Room, so the room has to exist first.
+        return ExtensionState.PostProcess;
+    }
+
+    public async onRequest(isInitial: boolean): Promise<ExtensionStickyEventsRequest> {
+        return {
+            enabled: true,
+            limit: 100,
+            // Undefined until the first response, which asks for all unexpired sticky events.
+            since: this.nextBatch,
+        };
+    }
+
+    public async onResponse(data: ExtensionStickyEventsResponse): Promise<void> {
+        for (const [roomId, roomData] of Object.entries(data?.rooms ?? {})) {
+            const room = this.client.getRoom(roomId);
+            if (!room) {
+                // Dropping is safe: unexpired sticky events are re-sent once we know the room.
+                logger.debug(`Ignoring sticky events for unknown room ${roomId}`);
+                continue;
+            }
+            room._unstable_addStickyEvents(mapEvents(this.client, roomId, roomData.events ?? []));
+        }
+
+        // next_batch is only returned when there were changes, and must be echoed back as `since`.
+        if (data?.next_batch) {
+            this.nextBatch = data.next_batch;
+        }
+    }
+}
+
 /**
  * A copy of SyncApi such that it can be used as a drop-in replacement for sync v2. For the actual
  * sliding sync API, see sliding-sync.ts or the class SlidingSync.
@@ -344,6 +413,7 @@ export class SlidingSyncSdk {
             new ExtensionAccountData(this.client),
             new ExtensionTyping(this.client),
             new ExtensionReceipts(this.client),
+            new ExtensionStickyEvents(this.client),
         ];
         if (this.syncOpts.cryptoCallbacks) {
             extensions.push(new ExtensionE2EE(this.syncOpts.cryptoCallbacks));
@@ -705,6 +775,10 @@ export class SlidingSyncSdk {
 
         room.setMSC4186SummaryData(roomData.heroes, roomData.joined_count, roomData.invited_count);
 
+        // The MSC4480 extension excludes sticky events already present in the timeline, so we have
+        // to pick those up here. See ExtensionStickyEvents for the rest.
+        room._unstable_addStickyEvents(timelineEvents.filter((e) => e.unstableStickyInfo !== undefined));
+
         room.recalculate();
         if (roomData.initial) {
             client.store.storeRoom(room);

package/node_modules/typebox/build/compile/validator.d.mts

@@ -18,7 +18,7 @@ export declare class Validator<Context extends TProperties = TProperties, Type e
     Check(value: unknown): value is Encode;
     /** Validates a value and returns it. Will throw if invalid. */
     Parse(value: unknown): Encode;
-    /** Inspects a value and returns a detailed list of validation errors. */
+    /** Returns an array of validation errors for the given value. */
     Errors(value: unknown): TLocalizedValidationError[];
     /** Cleans a value using the Validator type. */
     Clean(value: unknown): unknown;

package/node_modules/typebox/build/compile/validator.mjs

@@ -53,7 +53,7 @@ export class Validator {
             return Parser(this.Context(), this.Type(), value);
         throw new ParseError(value, this.Errors(value));
     }
-    /** Inspects a value and returns a detailed list of validation errors. */
+    /** Returns an array of validation errors for the given value. */
     Errors(value) {
         if (this.IsAccelerated() && this.Check(value))
             return [];

package/node_modules/typebox/build/format/idna/idn-hostname.mjs

@@ -14,14 +14,16 @@ function IsLabel(value) {
 // ------------------------------------------------------------------
 // NormalizeHostname
 //
-// Normalizes a hostname for label validation. Normalizes for NFC
-// such that equivalent codepoint sequences can be uniformly
-// compared. It also removes codepoints that IDNA mapping ignores,
-// and converts full stop variants to ASCII '.' so the hostname can
-// be split into labels.
+// Normalizes a hostname for label validation. Maps fullwidth
+// codepoints to their ASCII equivalent (e.g. 'ａ' U+FF41 maps to
+// 'a'), then normalizes for NFC such that equivalent codepoint
+// sequences can be uniformly compared. It also removes codepoints
+// that IDNA mapping ignores, and converts full stop variants to
+// ASCII '.' so the hostname can be split into labels.
 // ------------------------------------------------------------------
 function NormalizeHostname(value) {
     return value
+        .replace(/[\uff01-\uff5e]/g, (char) => String.fromCharCode(char.charCodeAt(0) - 0xfee0)) // RE_FULLWIDTH_MAPPING
         .normalize('NFC')
         .replace(/[\u00ad\u034f\u180b-\u180d\u200b\ufe00-\ufe0f\u{e0100}-\u{e01ef}]/gu, '') // RE_IGNORED_MAPPING
         .replace(/[\u002E\u3002\uFF0E\uFF61]/g, '.'); // RE_FULL_STOP_MAPPING

package/node_modules/typebox/build/format/iri.mjs

@@ -2,6 +2,7 @@
 const IpvFutureMatchMaxLength = 2048;
 const IpvFutureMatch = /\[[vV][0-9a-fA-F]+\.[^\]]+\]/; // Guarded By IpvFutureMatchMaxLength
 const InvalidIriChars = /[\x00-\x20<>\^`{|}\\]/;
+const InvalidPercentEncoding = /%(?![0-9a-fA-F]{2})/;
 // ------------------------------------------------------------------
 // NarrowIpvFuture
 //
@@ -26,6 +27,9 @@ export function IsIri(value) {
     // 1. Reject strings containing unencoded whitespace or illegal control characters.
     if (InvalidIriChars.test(value))
         return false;
-    // 2. Delegate to the native URL parser, patching the IPvFuture edge case beforehand.
+    // 2. Reject malformed percent-encoding triplets.
+    if (InvalidPercentEncoding.test(value))
+        return false;
+    // 3. Delegate to the native URL parser, patching the IPvFuture edge case beforehand.
     return URL.canParse(NarrowIpvFuture(value));
 }