@openclaw/matrix 2026.9.4 → 2026.9.6

package/node_modules/matrix-js-sdk/node_modules/matrix-widget-api/src/interfaces/RtcLivekitActions.ts

@@ -0,0 +1,80 @@
+/*
+ * Copyright 2026 The Matrix.org Foundation C.I.C.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { IWidgetApiRequest, IWidgetApiRequestData } from "./IWidgetApiRequest";
+import { IWidgetApiResponseData } from "./IWidgetApiResponse";
+import { WidgetApiFromWidgetAction } from "./WidgetApiAction";
+
+/**
+ * The MatrixRTC member a LiveKit request is made for.
+ * @see {@link https://github.com/matrix-org/matrix-spec-proposals/pull/4195|MSC4195}
+ */
+export interface IRtcLivekitMember {
+    /** The identifier of the member within the MatrixRTC session. */
+    id: string;
+    /** The device ID the member claims to be using. */
+    claimed_device_id?: string; // eslint-disable-line camelcase
+}
+
+export interface IRtcLivekitGetTokenFromWidgetRequestData extends IWidgetApiRequestData {
+    /** The name of the homeserver hosting the MatrixRTC session. */
+    server_name: string; // eslint-disable-line camelcase
+    /** The URL of the LiveKit SFU to obtain a token for. */
+    url: string;
+    /** The room the MatrixRTC session belongs to. */
+    room_id: string; // eslint-disable-line camelcase
+    /** The MatrixRTC session (slot) to join. */
+    slot_id: string; // eslint-disable-line camelcase
+    member: IRtcLivekitMember;
+}
+
+export interface IRtcLivekitGetTokenFromWidgetActionRequest extends IWidgetApiRequest {
+    action: WidgetApiFromWidgetAction.MSC4533RtcLivekitGetToken;
+    data: IRtcLivekitGetTokenFromWidgetRequestData;
+}
+
+export interface IRtcLivekitGetTokenFromWidgetResponseData extends IWidgetApiResponseData {
+    /** The JWT to authenticate against the SFU with. */
+    jwt: string;
+}
+
+export interface IRtcLivekitGetTokenFromWidgetActionResponse extends IRtcLivekitGetTokenFromWidgetActionRequest {
+    response: IRtcLivekitGetTokenFromWidgetResponseData;
+}
+
+export interface IRtcLivekitDelegateDelayedLeaveFromWidgetRequestData extends IWidgetApiRequestData {
+    /** The room the MatrixRTC session belongs to. */
+    room_id: string; // eslint-disable-line camelcase
+    /** The MatrixRTC session (slot) the delayed leave event belongs to. */
+    slot_id: string; // eslint-disable-line camelcase
+    member: IRtcLivekitMember;
+    /** The ID of the delayed leave event to hand over to the server. */
+    delay_id: string; // eslint-disable-line camelcase
+}
+
+export interface IRtcLivekitDelegateDelayedLeaveFromWidgetActionRequest extends IWidgetApiRequest {
+    action: WidgetApiFromWidgetAction.MSC4533RtcLivekitDelegateDelayedLeave;
+    data: IRtcLivekitDelegateDelayedLeaveFromWidgetRequestData;
+}
+
+export interface IRtcLivekitDelegateDelayedLeaveFromWidgetResponseData extends IWidgetApiResponseData {
+    // nothing
+}
+
+export interface IRtcLivekitDelegateDelayedLeaveFromWidgetActionResponse
+    extends IRtcLivekitDelegateDelayedLeaveFromWidgetActionRequest {
+    response: IRtcLivekitDelegateDelayedLeaveFromWidgetResponseData;
+}

package/node_modules/matrix-js-sdk/node_modules/matrix-widget-api/src/interfaces/WidgetApiAction.ts

@@ -97,6 +97,16 @@ export enum WidgetApiFromWidgetAction {
      * @experimental It is not recommended to rely on this existing - it can be removed without notice.
      */
     MSC4515GetRtcTransports = "org.matrix.msc4515.get_rtc_transports",
+
+    /**
+     * @experimental It is not recommended to rely on this existing - it can be removed without notice.
+     */
+    MSC4533RtcLivekitGetToken = "org.matrix.msc4533.rtc_livekit_get_token",
+
+    /**
+     * @experimental It is not recommended to rely on this existing - it can be removed without notice.
+     */
+    MSC4533RtcLivekitDelegateDelayedLeave = "org.matrix.msc4533.rtc_livekit_delegate_delayed_leave",
 }
 
 export type WidgetApiAction = WidgetApiToWidgetAction | WidgetApiFromWidgetAction | string;

package/node_modules/matrix-js-sdk/node_modules/p-retry/index.d.ts

@@ -138,7 +138,7 @@ export type Options = {
 	readonly shouldConsumeRetry?: (context: RetryContext) => boolean | Promise<boolean>;
 
 	/**
-	The maximum amount of times to retry the operation.
+	The maximum amount of times to retry the operation. Must be a non-negative integer or `Infinity`.
 
 	@default 10
 	*/

package/node_modules/matrix-js-sdk/node_modules/p-retry/index.js

@@ -9,6 +9,10 @@ function validateRetries(retries) {
 		if (Number.isNaN(retries)) {
 			throw new TypeError('Expected `retries` to be a valid number or Infinity, got NaN.');
 		}
+
+		if (Number.isFinite(retries) && !Number.isInteger(retries)) {
+			throw new TypeError('Expected `retries` to be a non-negative integer or Infinity.');
+		}
 	} else if (retries !== undefined) {
 		throw new TypeError('Expected `retries` to be a number or Infinity.');
 	}

package/node_modules/matrix-js-sdk/node_modules/p-retry/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "p-retry",
-	"version": "8.0.0",
+	"version": "8.0.1",
 	"description": "Retry a promise-returning or async function",
 	"license": "MIT",
 	"repository": "sindresorhus/p-retry",

package/node_modules/matrix-js-sdk/node_modules/p-retry/readme.md

@@ -164,7 +164,7 @@ In the example above, `RateLimitError`s will not decrement the available `retrie
 Type: `number`\
 Default: `10`
 
-The maximum amount of times to retry the operation.
+The maximum amount of times to retry the operation. Must be a non-negative integer or `Infinity`.
 
 ##### factor
 

package/node_modules/matrix-js-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "matrix-js-sdk",
-  "version": "42.2.0",
+  "version": "42.3.0",
   "description": "Matrix Client-Server SDK for Javascript",
   "engines": {
     "node": ">=22.0.0"
@@ -79,7 +79,7 @@
     "knip": "^6.0.0",
     "lint-staged": "^17.0.0",
     "matrix-mock-request": "^2.5.0",
-    "oxfmt": "^0.61.0",
+    "oxfmt": "^0.63.0",
     "oxlint": "^1.70.0",
     "oxlint-tsgolint": "^7.0.0",
     "typedoc": "^0.28.1",

package/node_modules/matrix-js-sdk/src/client.ts

@@ -7383,10 +7383,9 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @see https://github.com/tcpipuk/matrix-spec-proposals/blob/main/proposals/4133-extended-profiles.md
      * @param userId The user ID to fetch the profile of.
      * @param key The key of the property to fetch.
-     * @returns The property value.
+     * @returns The property value, or `undefined` if the key was not set OR the profile could not be found.
      *
      * @throws An error if the server does not support MSC4133.
-     * @throws A M_NOT_FOUND error if the key was not set OR the profile could not be found.
      */
     public async getExtendedProfileProperty(userId: string, key: string): Promise<unknown> {
         if (!(await this.doesServerSupportExtendedProfiles())) {
@@ -7398,15 +7397,24 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         if (storedProfile?.[key] !== undefined) {
             return storedProfile[key];
         }
-        const profile = (await this.http.authedRequest(
-            Method.Get,
-            utils.encodeUri("/profile/$userId/$key", { $userId: userId, $key: key }),
-            undefined,
-            undefined,
-            {
-                prefix: await this.getExtendedProfileRequestPrefix(),
-            },
-        )) as SyncUserProfile;
+        let profile: SyncUserProfile;
+        try {
+            profile = (await this.http.authedRequest(
+                Method.Get,
+                utils.encodeUri("/profile/$userId/$key", { $userId: userId, $key: key }),
+                undefined,
+                undefined,
+                {
+                    prefix: await this.getExtendedProfileRequestPrefix(),
+                },
+            )) as SyncUserProfile;
+        } catch (e) {
+            if (e instanceof MatrixError && e.httpStatus === 404 && e.errcode === "M_NOT_FOUND") {
+                // The key is not set on the profile (or the profile does not exist).
+                return undefined;
+            }
+            throw e;
+        }
 
         // write through to the cache
         await this.store.storeUserProfiles(

package/node_modules/matrix-js-sdk/src/http-api/errors.ts

@@ -19,6 +19,7 @@ import { type IMatrixApiError as IWidgetMatrixError } from "matrix-widget-api";
 import { type IUsageLimit } from "../@types/partials.ts";
 import { type MatrixEvent } from "../models/event.ts";
 import { NamespacedValue } from "../NamespacedValue.ts";
+import { hasRequiredStringProperty, isRecord } from "../@types/type-guards.ts";
 
 interface IErrorJson extends Partial<IUsageLimit> {
     [key: string]: any; // extensible
@@ -80,6 +81,21 @@ export class HTTPError extends Error {
     }
 }
 
+/**
+ * Check if the given (JSON-parsed) response body looks like a Matrix error
+ * response as specified in https://spec.matrix.org/v1.19/client-server-api/#standard-error-response
+ *
+ * @param response - the parsed response body to check
+ * @returns whether the response is a valid {@link MatrixError}
+ */
+export function isMatrixErrorResponse(response: unknown): response is MatrixError {
+    return (
+        isRecord(response) &&
+        hasRequiredStringProperty(response, "error") &&
+        hasRequiredStringProperty(response, "errcode")
+    );
+}
+
 export class MatrixError extends HTTPError {
     // The Matrix 'errcode' value, e.g. "M_FORBIDDEN".
     public readonly errcode?: string;

package/node_modules/matrix-js-sdk/src/matrixrtc/MatrixRTCSession.ts

@@ -96,6 +96,12 @@ export interface SessionConfig {
      * Determines the kind of call this will be.
      */
     callIntent?: RTCCallIntent;
+
+    /**
+     * How long (in milliseconds) the callee's client should keep ringing/waiting for an
+     * answer before the sender gives up and the call notification is considered timed out.
+     */
+    notificationLifetimeMs?: number;
 }
 
 // The names follow these principles:
@@ -697,6 +703,7 @@ export class MatrixRTCSession extends TypedEventEmitter<
         notificationType: RTCNotificationType,
         callIntent?: RTCCallIntent,
     ): void {
+        const lifetime = this.joinConfig?.notificationLifetimeMs ?? 90_000;
         const sendNotificationEvent = async (): Promise<{
             response: ISendEventResponse;
             content: IRTCNotificationContent;
@@ -709,7 +716,7 @@ export class MatrixRTCSession extends TypedEventEmitter<
                     rel_type: RelationType.Reference,
                 },
                 "sender_ts": Date.now(),
-                "lifetime": 30_000, // 30 seconds
+                "lifetime": lifetime,
             };
             if (callIntent) {
                 content["m.call.intent"] = callIntent;

package/node_modules/matrix-js-sdk/src/oauth/authorize.ts

@@ -15,7 +15,7 @@ limitations under the License.
 */
 
 import { secureRandomString } from "../randomstring.ts";
-import { OAuth2Error } from "./error.ts";
+import { OAuth2Error, type OAuth2ErrorResponse } from "./error.ts";
 import { type ValidatedAuthMetadata } from "./discover.ts";
 import {
     hasOptionalNumberProperty,
@@ -127,10 +127,7 @@ export function isValidDeviceAccessTokenResponse(response: unknown): response is
 /**
  * Error from the OAuth2 token endpoint when exchanging a token for grant_type device_code.
  */
-export interface DeviceAccessTokenError {
-    error: string;
-    error_description?: string;
-    error_uri?: string;
+export interface DeviceAccessTokenError extends OAuth2ErrorResponse {
     session_state?: string;
 }
 

package/node_modules/matrix-js-sdk/src/oauth/error.ts

@@ -14,6 +14,9 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+import { hasOptionalStringProperty, hasRequiredStringProperty, isRecord } from "../@types/type-guards.ts";
+import { HTTPError } from "../http-api/errors.ts";
+
 /**
  * Errors expected to be encountered during OAuth2 discovery, client registration, and authentication.
  * Not intended to be displayed directly to the user.
@@ -32,3 +35,69 @@ export enum OAuth2Error {
     RevokeTokenFailed = "Failed to revoke token",
     DeviceAuthorizationGrantFailed = "Failed to perform device authorization grant",
 }
+
+/**
+ * An error response from an OAuth 2.0 endpoint,
+ * as specified in https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ */
+export interface OAuth2ErrorResponse {
+    /** A single ASCII error code, e.g. `invalid_grant`. */
+    error: string;
+    /** Human-readable ASCII text providing additional information about the error. */
+    error_description?: string;
+    /** A URI identifying a human-readable web page with information about the error. */
+    error_uri?: string;
+}
+
+/**
+ * Check whether the given (JSON-parsed) response body is an OAuth 2.0 error response
+ * as specified in https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ * @param response - the parsed response body to check
+ * @returns whether the response is a valid {@link OAuth2ErrorResponse}
+ */
+export function isOAuth2ErrorResponse(response: unknown): response is OAuth2ErrorResponse {
+    return (
+        isRecord(response) &&
+        hasRequiredStringProperty(response, "error") &&
+        hasOptionalStringProperty(response, "error_description") &&
+        hasOptionalStringProperty(response, "error_uri")
+    );
+}
+
+/**
+ * An error thrown when a request to an OAuth 2.0 endpoint fails with a body matching the error
+ * response format specified in [RFC 6749 section 5.2](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2).
+ */
+export class OAuth2HTTPError extends HTTPError implements OAuth2ErrorResponse {
+    /**
+     * RFC 6749 section 5.2 error code, e.g. `invalid_grant`
+     *
+     * IANA matains a registry of valid values at
+     * https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#extensions-error
+     */
+    public error: string;
+
+    /**
+     * RFC 6749 section 5.2 human-readable ASCII text providing additional information about the error.
+     * This field is optional and may be omitted by the endpoint.
+     */
+    public error_description?: string;
+
+    /**
+     * RFC 6749 section 5.2 URI identifying a human-readable web page with information about the error.
+     * This field is optional and may be omitted by the endpoint.
+     */
+    public error_uri?: string;
+
+    public constructor(
+        msg: string,
+        httpStatus: number | undefined,
+        httpHeaders: Headers | undefined,
+        { error, error_description, error_uri }: OAuth2ErrorResponse,
+    ) {
+        super(msg, httpStatus, httpHeaders);
+        this.error = error;
+        this.error_description = error_description;
+        this.error_uri = error_uri;
+    }
+}

package/node_modules/matrix-js-sdk/src/oauth/index.ts

@@ -34,9 +34,9 @@ import {
 } from "./register.ts";
 import { encodeUnpaddedBase64Url } from "../base64.ts";
 import { sha256 } from "../digest.ts";
-import { HTTPError, Method } from "../http-api/index.ts";
+import { HTTPError, isMatrixErrorResponse, MatrixError, Method } from "../http-api/index.ts";
 import { logger } from "../logger.ts";
-import { OAuth2Error } from "./error.ts";
+import { isOAuth2ErrorResponse, OAuth2Error, OAuth2HTTPError } from "./error.ts";
 import { secureRandomString } from "../randomstring.ts";
 import { type NonEmptyArray } from "../@types/common.ts";
 
@@ -289,6 +289,23 @@ export class OAuth2 {
         });
 
         if (res.status >= 400) {
+            let body: unknown;
+            try {
+                body = await res.json();
+            } catch {
+                // The endpoint didn't give us a JSON body, so we can't determine the error type. We'll throw a generic
+                // HTTPError below.
+            }
+            // Because the Matrix C-S API error response format is so similar to the OAuth 2.0 error response format
+            // the ordering of these checks is important. We want to check for a Matrix error response first, and only
+            // if it isn't one do we check for an OAuth 2.0 error response.
+            // This essentially relies on `errcode` not being present in an OAuth 2.0 error response.
+            if (isMatrixErrorResponse(body)) {
+                throw new MatrixError(body, res.status, undefined, undefined, res.headers);
+            }
+            if (isOAuth2ErrorResponse(body)) {
+                throw new OAuth2HTTPError(error, res.status, res.headers, body);
+            }
             throw new HTTPError(error, res.status, res.headers);
         }
 

package/node_modules/matrix-js-sdk/src/oauth/tokenRefresher.ts

@@ -15,6 +15,7 @@ limitations under the License.
 */
 
 import { type AccessTokens, HTTPError, type TokenRefreshFunction, TokenRefreshLogoutError } from "../http-api/index.ts";
+import { OAuth2HTTPError } from "./error.ts";
 import { type OAuth2 } from "./index.ts";
 
 /**
@@ -54,8 +55,14 @@ export class TokenRefresher {
     };
 
     private shouldLogoutOnError(error: HTTPError): boolean {
-        // As per https://spec.matrix.org/v1.18/client-server-api/#refresh-token-grant
-        return typeof error.httpStatus === "number" && error.httpStatus < 500 && error.httpStatus >= 400;
+        // Treat as logout as per https://spec.matrix.org/v1.18/client-server-api/#refresh-token-grant
+        // after making sure it is an RFC 6749 section 5.2 error response
+        return (
+            error instanceof OAuth2HTTPError &&
+            typeof error.httpStatus === "number" &&
+            error.httpStatus < 500 &&
+            error.httpStatus >= 400
+        );
     }
 
     private async getNewTokens(refreshToken: string): Promise<AccessTokens> {

package/node_modules/matrix-js-sdk/src/secret-storage.ts

@@ -21,8 +21,7 @@ limitations under the License.
  */
 
 import { type TypedEventEmitter } from "./models/typed-event-emitter.ts";
-import { ClientEvent, type ClientEventHandlerMap } from "./client.ts";
-import { type MatrixEvent } from "./models/event.ts";
+import { type ClientEvent, type ClientEventHandlerMap } from "./client.ts";
 import { secureRandomString } from "./randomstring.ts";
 import { logger } from "./logger.ts";
 import encryptAESSecretStorageItem from "./utils/encryptAESSecretStorageItem.ts";
@@ -370,35 +369,13 @@ export class ServerSideSecretStorageImpl implements ServerSideSecretStorage {
     /**
      * Implementation of {@link ServerSideSecretStorage#setDefaultKeyId}.
      */
-    public setDefaultKeyId(keyId: string | null): Promise<void> {
-        return new Promise<void>((resolve, reject) => {
-            const listener = (ev: MatrixEvent): void => {
-                if (ev.getType() !== "m.secret_storage.default_key") {
-                    //  Different account data item
-                    return;
-                }
-
-                // If keyId === null, the content should be an empty object.
-                // Otherwise, the `key` in the content object should match keyId.
-                const content = ev.getContent();
-                const isSameKey = keyId === null ? Object.keys(content).length === 0 : content.key === keyId;
-                if (isSameKey) {
-                    this.accountDataAdapter.removeListener(ClientEvent.AccountData, listener);
-                    resolve();
-                }
-            };
-            this.accountDataAdapter.on(ClientEvent.AccountData, listener);
-
-            // The spec [1] says that the value of the account data entry should be an object with a `key` property.
-            // It doesn't specify how to delete the default key; we do it by setting the account data to an empty object.
-            //
-            // [1]: https://spec.matrix.org/v1.13/client-server-api/#key-storage
-            const newValue: Record<string, never> | { key: string } = keyId === null ? {} : { key: keyId };
-            this.accountDataAdapter.setAccountData("m.secret_storage.default_key", newValue).catch((e) => {
-                this.accountDataAdapter.removeListener(ClientEvent.AccountData, listener);
-                reject(e);
-            });
-        });
+    public async setDefaultKeyId(keyId: string | null): Promise<void> {
+        // The spec [1] says that the value of the account data entry should be an object with a `key` property.
+        // It doesn't specify how to delete the default key; we do it by setting the account data to an empty object.
+        //
+        // [1]: https://spec.matrix.org/v1.13/client-server-api/#key-storage
+        const newValue: Record<string, never> | { key: string } = keyId === null ? {} : { key: keyId };
+        await this.accountDataAdapter.setAccountData("m.secret_storage.default_key", newValue);
     }
 
     /**

package/node_modules/matrix-js-sdk/src/sliding-sync-sdk.ts

@@ -35,6 +35,8 @@ import {
     type IMinimalEvent,
     type IRoomEvent,
     type IStateEvent,
+    type IStickyEvent,
+    type IStickyStateEvent,
     type IStrippedState,
     type ISyncResponse,
     type ReceivedToDeviceMessage,
@@ -311,6 +313,73 @@ class ExtensionReceipts implements Extension<ExtensionReceiptsRequest, Extension
     }
 }
 
+type ExtensionStickyEventsRequest = {
+    enabled: boolean;
+    /** Max events per response; the server may return fewer. */
+    limit?: number;
+    /** The `next_batch` of the previous response. */
+    since?: string;
+};
+
+type ExtensionStickyEventsResponse = {
+    /** Only sent when there were changes. */
+    next_batch?: string;
+    rooms?: Record<string, { events: Array<IStickyEvent | IStickyStateEvent> }>;
+};
+
+/**
+ * Delivers sticky events (MSC4354) over sliding sync.
+ * https://github.com/matrix-org/matrix-spec-proposals/pull/4480
+ *
+ * Sticky events expire after a duration instead of living in the timeline forever, and the server
+ * re-sends the unexpired ones (e.g. on join) so late joiners still see them.
+ *
+ * The server sends them for every room matched by a list or subscription, even rooms currently
+ * outside the list window. Sticky events already in a room's timeline are excluded here, so
+ * `processRoomData` picks those up separately.
+ */
+class ExtensionStickyEvents implements Extension<ExtensionStickyEventsRequest, ExtensionStickyEventsResponse> {
+    private nextBatch?: string;
+
+    public constructor(private readonly client: MatrixClient) {}
+
+    public name(): string {
+        // Keeps MSC4354's number, as the extension was originally specified there.
+        return "org.matrix.msc4354.sticky_events";
+    }
+
+    public when(): ExtensionState {
+        // Sticky events are stored on a Room, so the room has to exist first.
+        return ExtensionState.PostProcess;
+    }
+
+    public async onRequest(isInitial: boolean): Promise<ExtensionStickyEventsRequest> {
+        return {
+            enabled: true,
+            limit: 100,
+            // Undefined until the first response, which asks for all unexpired sticky events.
+            since: this.nextBatch,
+        };
+    }
+
+    public async onResponse(data: ExtensionStickyEventsResponse): Promise<void> {
+        for (const [roomId, roomData] of Object.entries(data?.rooms ?? {})) {
+            const room = this.client.getRoom(roomId);
+            if (!room) {
+                // Dropping is safe: unexpired sticky events are re-sent once we know the room.
+                logger.debug(`Ignoring sticky events for unknown room ${roomId}`);
+                continue;
+            }
+            room._unstable_addStickyEvents(mapEvents(this.client, roomId, roomData.events ?? []));
+        }
+
+        // next_batch is only returned when there were changes, and must be echoed back as `since`.
+        if (data?.next_batch) {
+            this.nextBatch = data.next_batch;
+        }
+    }
+}
+
 /**
  * A copy of SyncApi such that it can be used as a drop-in replacement for sync v2. For the actual
  * sliding sync API, see sliding-sync.ts or the class SlidingSync.
@@ -344,6 +413,7 @@ export class SlidingSyncSdk {
             new ExtensionAccountData(this.client),
             new ExtensionTyping(this.client),
             new ExtensionReceipts(this.client),
+            new ExtensionStickyEvents(this.client),
         ];
         if (this.syncOpts.cryptoCallbacks) {
             extensions.push(new ExtensionE2EE(this.syncOpts.cryptoCallbacks));
@@ -705,6 +775,10 @@ export class SlidingSyncSdk {
 
         room.setMSC4186SummaryData(roomData.heroes, roomData.joined_count, roomData.invited_count);
 
+        // The MSC4480 extension excludes sticky events already present in the timeline, so we have
+        // to pick those up here. See ExtensionStickyEvents for the rest.
+        room._unstable_addStickyEvents(timelineEvents.filter((e) => e.unstableStickyInfo !== undefined));
+
         room.recalculate();
         if (roomData.initial) {
             client.store.storeRoom(room);

package/node_modules/music-metadata/node_modules/file-type/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "file-type",
-	"version": "22.0.2",
+	"version": "22.1.0",
 	"description": "Detect the file type of a file, stream, or data",
 	"license": "MIT",
 	"repository": "sindresorhus/file-type",
@@ -228,7 +228,8 @@
 		"dat",
 		"key",
 		"numbers",
-		"pages"
+		"pages",
+		"iso"
 	],
 	"dependencies": {
 		"@tokenizer/inflate": "^0.4.1",

package/node_modules/music-metadata/node_modules/file-type/readme.md

@@ -464,6 +464,7 @@ MIME media subtypes prefixed with `x-ft-` are custom and defined by us. They are
 - [`ico`](https://en.wikipedia.org/wiki/ICO_(file_format)) - Windows icon file
 - [`ics`](https://en.wikipedia.org/wiki/ICalendar#Data_format) - iCalendar
 - [`indd`](https://en.wikipedia.org/wiki/Adobe_InDesign#File_format) - Adobe InDesign document
+- [`iso`](https://en.wikipedia.org/wiki/ISO_9660) - ISO 9660 disc image
 - [`it`](https://wiki.openmpt.org/Manual:_Module_formats#The_Impulse_Tracker_format_.28.it.29) - Audio module format: Impulse Tracker
 - [`j2c`](https://en.wikipedia.org/wiki/JPEG_2000) - JPEG 2000
 - [`jar`](https://en.wikipedia.org/wiki/JAR_(file_format)) - Java archive
@@ -578,6 +579,8 @@ MIME media subtypes prefixed with `x-ft-` are custom and defined by us. They are
 - [`zip`](https://en.wikipedia.org/wiki/Zip_(file_format)) - Archive file
 - [`zst`](https://en.wikipedia.org/wiki/Zstandard) - Archive file
 
+ISO 9660 requires random-access input or `fileTypeStream()` with `sampleSize >= 32_774`; `fileTypeFromStream()` is unsupported.
+
 *[Pull requests](.github/pull_request_template.md) are welcome for additional commonly used file types.*
 
 The following file types will not be accepted, but most of them are supported by [third-party detectors](#available-third-party-file-type-detectors).

package/node_modules/music-metadata/node_modules/file-type/source/index.js

@@ -64,7 +64,7 @@ function getKnownFileSizeOrMaximum(fileSize) {
 
 // Keep the specifier non-literal at the call site so browser bundlers do not try to resolve Node-only imports.
 function importAtRuntime(specifier) {
-	return import(specifier);
+	return import(/* @vite-ignore */ /* webpackIgnore: true */ specifier);
 }
 
 // Wrap stream in an identity TransformStream to avoid BYOB readers.
@@ -1689,6 +1689,33 @@ export class FileTypeParser {
 				mime: 'application/pgp-encrypted',
 			};
 		}
+
+		// ISO 9660 optical disc image: the Volume Descriptor Set starts at sector 16 (2048-byte
+		// sectors). Every descriptor in that set carries the 5-byte standard identifier `CD001`
+		// at offset 1, regardless of descriptor type, so checking the first one is sufficient.
+		// Only attempted for random-access inputs (buffer/file/blob, or a stream sampled with a
+		// large enough `sampleSize`): on an unknown-size stream this offset is far past what's
+		// reasonable to buffer just to rule out one format, so it's left undetected there.
+		const isoStandardIdentifierOffset = 32_769;
+		const isoStandardIdentifierLength = 5;
+		if (
+			tokenizer.supportsRandomAccess()
+			&& tokenizer.fileInfo.size >= (isoStandardIdentifierOffset + isoStandardIdentifierLength)
+		) {
+			const isoStandardIdentifier = new Uint8Array(isoStandardIdentifierLength);
+			await tokenizer.peekBuffer(isoStandardIdentifier, {
+				position: isoStandardIdentifierOffset,
+				length: isoStandardIdentifierLength,
+				mayBeLess: true,
+			});
+
+			if (checkBytes(isoStandardIdentifier, stringToBytes('CD001'))) {
+				return {
+					ext: 'iso',
+					mime: 'application/x-iso9660-image',
+				};
+			}
+		}
 	};
 	// Detections with limited supporting data, resulting in a higher likelihood of false positives
 	detectImprecise = async tokenizer => {