v1.12.14

Upgrade dependency to matrix-js-sdk@41.3.0
v1.12.14-rc.0
2026-04-07 13:23:44 +00:00 · 2026-04-07 13:18:51 +00:00 · 2026-03-31 12:48:12 +00:00 · 2026-03-31 12:35:09 +00:00 · 2026-03-31 10:49:57 +00:00 · 2026-03-31 11:32:04 +01:00
1293 changed files with 52108 additions and 13589 deletions
@@ -1,6 +1,6 @@
 *                         @element-hq/element-web-reviewers
 /.github/workflows/**     @element-hq/element-web-team
-package.json              @element-hq/element-web-team
+**/package.json           @element-hq/element-web-team
 /pnpm-lock.yaml           @element-hq/element-web-team

 /apps/web/src/SecurityManager.ts                                                 @element-hq/element-crypto-web-reviewers
@@ -26,8 +26,10 @@ package.json              @element-hq/element-web-team

 # Ignore translations as those will be updated by GHA for Localazy download
 /apps/web/src/i18n/strings
+/apps/desktop/src/i18n/strings
 /packages/shared-components/src/i18n/strings
 /apps/web/src/i18n/strings/en_EN.json                    @element-hq/element-web-reviewers
+/apps/desktop/src/i18n/strings/en_EN.json                @element-hq/element-web-reviewers
 /packages/shared-components/src/i18n/strings/en_EN.json  @element-hq/element-web-reviewers

 # Ignore the synapse & mas plugins as this is updated by GHA for docker image updating
@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGBzCCA++gAwIBAgIIaI6ivggL++4wDQYJKoZIhvcNAQELBQAwgZAxCzAJBgNV
+BAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UE
+CgwPU1NMIENvcnBvcmF0aW9uMUUwQwYDVQQDDDxTU0wuY29tIEVWIFJvb3QgQ2Vy
+dGlmaWNhdGlvbiBBdXRob3JpdHkgUlNBIFIyIC0gRGV2ZWxvcG1lbnQwHhcNMTgw
+MTE2MTIxNjM2WhcNNDMwMTE1MTIxNjM2WjCBkDELMAkGA1UEBhMCVVMxDjAMBgNV
+BAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQKDA9TU0wgQ29ycG9y
+YXRpb24xRTBDBgNVBAMMPFNTTC5jb20gRVYgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1
+dGhvcml0eSBSU0EgUjIgLSBEZXZlbG9wbWVudDCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAK/qcD65JCkueKp0+KXG2kAw8euDHuraLR3lJoUFz4ilGK1M
+t+RjSuY6dHQw8ku7TnW9ejWoSFjCBSDx7tP/fzOwOxmBW6+F1NDuV/IaUtn3G2lk
+CZglVk9z3n1HuWDN10xNiLoo5nzeIlvNAoDbXDGhI4Y6Z0qouAIS607JpJMWHOqZ
+OUiiOuM11gI5Kz9GtVttXCjRmwlkU8WiJVIUuVedQAQt2FChrzNQewGFFi0uIau/
+wFRclx6hd4JRIImC6VMJd9lcitWsqMcM94pD3fX2ozNgWX+MVlmcDYFSN9Sv8tG4
+yCj4ONS8HZGzbxeyQXJhEJSi2FnBi0j6MD/d4DNFj0hCg9wz3fgVLDGCO0pNMO0Y
+oXdrzfoj1/zEv0Ibgh7zKG2JHkPfapn3ExFI5d6xi66u5tPVI8cvLxqrgybRPs7Z
+y1dQA7ew3LyTPAHoGtbTMvewtx1TkTtRxxhRRm0l58owqSVbSYrixFtosNobCERo
+uiknaQqoY1ZDsdKsaqFoZDbntNRYhN3Ea4OPWVqDUU5ZPz9MTIRAi3MIq854yyQo
+BjX9nv+kYa+Esr19pxUW0z7BWFhbXsMVpt0QMVyhwgzXvEreaZHFwHHaGb9d5x5P
+VBDhsigMmtzBk9NlbCsy+uGXWHgZA/DVefueEq0sv38VoU30uYa5Tj0FLm09AgMB
+AAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUI9PCucv3G9fRoTDu
+ZQ4Hw6g4PkIwHQYDVR0OBBYEFCPTwrnL9xvX0aEw7mUOB8OoOD5CMA4GA1UdDwEB
+/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAk43CCrC0Zbvi7YUsSePKi+KzvyQ9
+mjKa5NBU/A5/sLeZS3R+wqCX7l5euYVDsUuNgNVD/QL9jNIonuHBrvKaxkmqxE1r
+IcDEaUdjy2lQ0uqD7UDoS3ctrjGkPpUahrTdr3gaKcQBtUhn9v4Y2OBm6J1hDVwI
+CIKcxIzRv6AUpApOtk+++m5tzDU48t8+GzrVl1hkspSYcumA+zuHllbPDL1ADdo5
+kK/bBQtZrGqzPqKzeqaB1A5Wm0Igwf++7nyzdKNdjxtv907D9vg8EB4Swavuv/Ne
+5/jbpI32pz0NIzzSl5ARAHuFhILsO/cEAlloDoTHzibHqFDIeU9/59HMUsJYMOtD
+Ii0/LmQ6dBE4TeukCCLJwtkFYZ2eBgDjF/LHBB+z/UBs4milRgwx+Pe5UDUEjtGe
+G/XMVnTSKZTy9jMaXJD5EmfP+Cfh8EEgFgjg4AmLUbEo9gXzPxyXSLgd8JGSsjg8
+EV/Ri4Mmmt4XUwlSVvEOezxxDGd17gwbottCIC+rqPHonHkGmKpLMH80Bk0uOOCs
+ui1oVwSifMyIcudgCcOfRLUf/f2j2NW7N7E7Vw/Zqfn+pqp/EG0KCqOM2vfJAc0s
+u3rSrOJZGtB6txgtmTjoadxApWf4U/FCi3uArt6gS5MJqZjuiRNXs/K3SlSAqLGl
+5UiG52ew+VdBHzE=
+-----END CERTIFICATE-----
@@ -1,6 +1,8 @@
 name: Backport
 on:
-    pull_request_target:
+    # Privilege escalation necessary to enable backporting PRs from forks
+    # 🚨 We must not execute any checked out code here.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
        types:
            - closed
            - labeled
@@ -44,9 +44,11 @@ jobs:
                shell: bash
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  # Disable cache on Windows as it is slower than not caching
                  # https://github.com/actions/setup-node/issues/975
@@ -64,10 +66,10 @@ jobs:
              working-directory: apps/web
              env:
                  CI_PACKAGE: true
-              run: VERSION=$(scripts/get-version-from-git.sh) pnpm build
+              run: VERSION=$(scripts/get-version-from-git.sh) pnpm run build

            - name: Upload Artifact
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: webapp-${{ matrix.image }}
                  path: apps/web/webapp
@@ -15,6 +15,8 @@ jobs:
            VERSION: ${{ github.ref_name }}
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

            - name: Download package
              working-directory: apps/web
@@ -67,7 +69,7 @@ jobs:
                  dpkg-gencontrol -v"$VERSION" -ldebian/tmp/DEBIAN/changelog
                  dpkg-deb -Zxz --root-owner-group --build debian/tmp element-web.deb

-            - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: element-web.deb
                  path: apps/web/element-web.deb
@@ -75,7 +77,7 @@ jobs:

            - name: Publish to packages.element.io
              if: github.event.release.prerelease == false
-              uses: element-hq/packages.element.io@master
+              uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
              with:
                  file: apps/web/element-web.deb
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -0,0 +1,313 @@
+name: Build and Deploy
+on:
+    # Nightly build
+    schedule:
+        - cron: "0 9 * * *"
+    # Release build
+    release:
+        types: [published]
+    # Manual nightly & release
+    workflow_dispatch:
+        inputs:
+            mode:
+                description: What type of build to trigger. Release builds MUST be ran from the `master` branch.
+                required: true
+                default: nightly
+                type: choice
+                options:
+                    - nightly
+                    - release
+            macos:
+                description: Build macOS
+                required: true
+                type: boolean
+                default: true
+            windows:
+                description: Build Windows
+                required: true
+                type: boolean
+                default: true
+            linux:
+                description: Build Linux
+                required: true
+                type: boolean
+                default: true
+            deploy:
+                description: Deploy artifacts
+                required: true
+                type: boolean
+                default: true
+run-name: Element ${{ inputs.mode != 'release' && github.event_name != 'release' && 'Nightly' || 'Desktop' }}
+concurrency: ${{ github.workflow }}
+env:
+    R2_BUCKET: ${{ vars.R2_BUCKET }}
+permissions: {} # Uses ELEMENT_BOT_TOKEN
+jobs:
+    prepare:
+        uses: ./.github/workflows/build_desktop_prepare.yaml
+        permissions:
+            contents: read
+        with:
+            config: element.io/${{ inputs.mode || (github.event_name == 'release' && 'release') || 'nightly' }}
+            version: ${{ (inputs.mode != 'release' && github.event_name != 'release') && 'develop' || '' }}
+            nightly: ${{ inputs.mode != 'release' && github.event_name != 'release' }}
+            deploy: ${{ inputs.deploy || (github.event_name != 'workflow_dispatch' && github.event.release.prerelease != true) }}
+        secrets:
+            CF_R2_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+            CF_R2_TOKEN: ${{ secrets.CF_R2_TOKEN }}
+
+    trigger-pro-pipeline:
+        name: Trigger Pro pipeline
+        needs: prepare
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
+              with:
+                  repository: element-hq/element-web-pro
+                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  event-type: trigger-pipeline
+                  client-payload: |-
+                      {
+                          "base-ref": "${{ github.ref_name }}"
+                      }
+
+    windows:
+        if: github.event_name != 'workflow_dispatch' || inputs.windows
+        needs: prepare
+        name: Windows ${{ matrix.arch }}
+        strategy:
+            matrix:
+                arch: [x64, arm64]
+        uses: ./.github/workflows/build_desktop_windows.yaml
+        secrets: inherit # zizmor: ignore[secrets-inherit]
+        with:
+            sign: true
+            arch: ${{ matrix.arch }}
+            version: ${{ needs.prepare.outputs.nightly-version }}
+
+    macos:
+        if: github.event_name != 'workflow_dispatch' || inputs.macos
+        needs: prepare
+        name: macOS
+        uses: ./.github/workflows/build_desktop_macos.yaml
+        secrets: inherit # zizmor: ignore[secrets-inherit]
+        with:
+            sign: true
+            base-url: https://packages.element.io/${{ needs.prepare.outputs.packages-dir }}
+            version: ${{ needs.prepare.outputs.nightly-version }}
+
+    linux:
+        if: github.event_name != 'workflow_dispatch' || inputs.linux
+        needs: prepare
+        name: Linux ${{ matrix.arch }} (sqlcipher ${{ matrix.sqlcipher }})
+        strategy:
+            matrix:
+                arch: [amd64, arm64]
+                sqlcipher: [static]
+        uses: ./.github/workflows/build_desktop_linux.yaml
+        with:
+            arch: ${{ matrix.arch }}
+            sqlcipher: ${{ matrix.sqlcipher }}
+            version: ${{ needs.prepare.outputs.nightly-version }}
+
+    deploy:
+        needs:
+            - prepare
+            - macos
+            - linux
+            - windows
+        runs-on: ubuntu-24.04
+        name: ${{ needs.prepare.outputs.deploy == 'true' && 'Deploy' || 'Deploy (dry-run)' }}
+        if: always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled')
+        environment: ${{ needs.prepare.outputs.deploy == 'true' && 'packages.element.io' || '' }}
+        steps:
+            - name: Download artifacts
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+
+            - name: Prepare artifacts for deployment
+              run: |
+                  set -ex
+
+                  # Windows
+                  for arch in x64 arm64
+                  do
+                      if [ -d "win-$arch" ]; then
+                          mkdir -p packages.element.io/{install,update}/win32/$arch
+                          mv win-$arch/squirrel-windows*/*.exe "packages.element.io/install/win32/$arch/"
+                          mv win-$arch/squirrel-windows*/*.nupkg "packages.element.io/update/win32/$arch/"
+                          mv win-$arch/squirrel-windows*/RELEASES "packages.element.io/update/win32/$arch/"
+                      fi
+                  done
+
+                  # macOS
+                  if [ -d macos ]; then
+                      mkdir -p packages.element.io/{install,update}/macos
+                      mv macos/*.dmg packages.element.io/install/macos/
+                      mv macos/*-mac.zip packages.element.io/update/macos/
+                      mv macos/*.json packages.element.io/update/macos/
+                  fi
+
+                  # Linux
+                  if [ -d linux-amd64-sqlcipher-static ]; then
+                      mkdir -p packages.element.io/install/linux/glibc-x86-64
+                      mv linux-amd64-sqlcipher-static/*.tar.gz packages.element.io/install/linux/glibc-x86-64
+                  fi
+                  if [ -d linux-arm64-sqlcipher-static ]; then
+                      mkdir -p packages.element.io/install/linux/glibc-aarch64
+                      mv linux-arm64-sqlcipher-static/*.tar.gz packages.element.io/install/linux/glibc-aarch64
+                  fi
+
+            # We don't wish to store the installer for every nightly ever, so we only keep the latest
+            - name: "[Nightly] Strip version from installer file"
+              if: needs.prepare.outputs.nightly-version != ''
+              run: |
+                  set -ex
+
+                  # Windows
+                  for arch in x64 arm64
+                  do
+                      if [ -d "win-$arch" ]; then mv packages.element.io/install/win32/$arch/{*,"Element Nightly Setup"}.exe; fi
+                  done
+
+                  # macOS
+                  if [ -d macos ]; then mv packages.element.io/install/macos/{*,"Element Nightly"}.dmg; fi
+
+                  # Linux
+                  if [ -d linux-amd64-sqlcipher-static ]; then mv packages.element.io/install/linux/glibc-x86-64/{*,element-desktop-nightly}.tar.gz; fi
+                  if [ -d linux-arm64-sqlcipher-static ]; then mv packages.element.io/install/linux/glibc-aarch64/{*,element-desktop-nightly}.tar.gz; fi
+
+            - name: "[Release] Prepare release latest symlink"
+              if: needs.prepare.outputs.nightly-version == ''
+              run: |
+                  set -ex
+
+                  # Windows
+                  for arch in x64 arm64
+                  do
+                      if [ -d "win-$arch" ]; then
+                          pushd packages.element.io/install/win32/$arch
+                          ln -s "$(find . -type f -iname "*.exe" | xargs -0 -n1 -- basename)" "Element Setup.exe"
+                          popd
+                      fi
+                  done
+
+                  # macOS
+                  if [ -d macos ]; then
+                      pushd packages.element.io/install/macos
+                      ln -s "$(find . -type f -iname "*.dmg" | xargs -0 -n1 -- basename)" "Element.dmg"
+                      popd
+                  fi
+
+                  # Linux
+                  if [ -d linux-amd64-sqlcipher-static ]; then
+                      pushd packages.element.io/install/linux/glibc-x86-64
+                      ln -s "$(find . -type f -iname "*.tar.gz" | xargs -0 -n1 -- basename)" "element-desktop.tar.gz"
+                      popd
+                  fi
+                  if [ -d linux-arm64-sqlcipher-static ]; then
+                      pushd packages.element.io/install/linux/glibc-aarch64
+                      ln -s "$(find . -type f -iname "*.tar.gz" | xargs -0 -n1 -- basename)" "element-desktop.tar.gz"
+                      popd
+                  fi
+
+            - name: Stash packages.element.io
+              if: needs.prepare.outputs.deploy == 'false'
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: packages.element.io
+                  path: packages.element.io
+
+            # Checksum algorithm specified as per https://developers.cloudflare.com/r2/examples/aws/aws-cli/
+            - name: Deploy artifacts
+              if: needs.prepare.outputs.deploy == 'true'
+              run: |
+                  set -x
+                  aws s3 cp --recursive packages.element.io/ s3://$R2_BUCKET/$DEPLOYMENT_DIR --endpoint-url $R2_URL --region auto --checksum-algorithm CRC32
+              env:
+                  AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
+                  R2_URL: ${{ vars.CF_R2_S3_API }}
+                  DEPLOYMENT_DIR: ${{ needs.prepare.outputs.packages-dir }}
+
+            - name: Notify packages.element.io of new files
+              if: needs.prepare.outputs.deploy == 'true'
+              uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
+              with:
+                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  repository: element-hq/packages.element.io
+                  event-type: packages-index
+
+            - name: Find debs
+              id: deb
+              if: needs.linux.result == 'success'
+              run: |
+                  set -x
+
+                  for arch in amd64 arm64
+                  do
+                      echo "$arch=$(ls linux-$arch-sqlcipher-static/*.deb | tail -n1)" >> $GITHUB_OUTPUT
+                  done
+
+            - name: Stash debs
+              if: needs.prepare.outputs.deploy == 'false' && needs.linux.result == 'success'
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: debs
+                  path: |
+                      ${{ steps.deb.outputs.amd64 }}
+                      ${{ steps.deb.outputs.arm64 }}
+
+            - name: Publish amd64 deb to packages.element.io
+              uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
+              if: needs.prepare.outputs.deploy == 'true' && needs.linux.result == 'success'
+              with:
+                  file: ${{ steps.deb.outputs.amd64 }}
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  bucket-api: ${{ vars.CF_R2_S3_API }}
+                  bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  bucket-access-key: ${{ secrets.CF_R2_TOKEN }}
+
+            - name: Publish arm64 deb to packages.element.io
+              uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
+              if: needs.prepare.outputs.deploy == 'true' && needs.linux.result == 'success'
+              with:
+                  file: ${{ steps.deb.outputs.arm64 }}
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  bucket-api: ${{ vars.CF_R2_S3_API }}
+                  bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  bucket-access-key: ${{ secrets.CF_R2_TOKEN }}
+
+    deploy-ess:
+        needs: deploy
+        runs-on: ubuntu-24.04
+        name: Deploy builds to ESS
+        if: needs.prepare.outputs.deploy == 'true' && github.event_name == 'release'
+        env:
+            BUCKET_NAME: "element-desktop-msi.onprem.element.io"
+            AWS_REGION: "eu-central-1"
+        permissions:
+            id-token: write # This is required for requesting the JWT
+        steps:
+            - name: Configure AWS credentials
+              uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6
+              with:
+                  role-to-assume: arn:aws:iam::264135176173:role/Push-ElementDesktop-MSI
+                  role-session-name: githubaction-run-${{ github.run_id }}
+                  aws-region: ${{ env.AWS_REGION }}
+
+            - name: Download artifacts
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+              with:
+                  pattern: win-*
+
+            - name: Copy files to S3
+              run: |
+                  set -x
+
+                  PREFIX="${VERSION%.*}"
+                  for file in win-*/*.msi; do
+                      filename=$(basename "$file")
+                      aws s3 cp "$file" "s3://${{ env.BUCKET_NAME }}/$PREFIX/$filename"
+                  done
+              env:
+                  VERSION: ${{ github.event.release.tag_name }}
@@ -0,0 +1,89 @@
+name: Build and Test
+on:
+    pull_request: {}
+    push:
+        branches: [develop, staging, master]
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+permissions: {} # No permissions required
+jobs:
+    fetch:
+        uses: ./.github/workflows/build_desktop_prepare.yaml
+        permissions:
+            contents: read
+        with:
+            config: ${{ (github.event.pull_request.base.ref || github.ref_name) == 'develop' && 'element.io/nightly' || 'element.io/release' }}
+            version: ${{ (github.event.pull_request.base.ref || github.ref_name) == 'develop' && 'develop' || '' }}
+            branch-matching: true
+
+    windows:
+        needs: fetch
+        name: Windows
+        uses: ./.github/workflows/build_desktop_windows.yaml
+        strategy:
+            matrix:
+                arch: [x64, ia32, arm64]
+        with:
+            arch: ${{ matrix.arch }}
+            blob_report: true
+
+    linux:
+        needs: fetch
+        name: "Linux (${{ matrix.arch }}) (sqlcipher: ${{ matrix.sqlcipher }})"
+        uses: ./.github/workflows/build_desktop_linux.yaml
+        strategy:
+            matrix:
+                sqlcipher: [system, static]
+                arch: [amd64, arm64]
+        with:
+            sqlcipher: ${{ matrix.sqlcipher }}
+            arch: ${{ matrix.arch }}
+            blob_report: true
+
+    macos:
+        needs: fetch
+        name: macOS
+        uses: ./.github/workflows/build_desktop_macos.yaml
+        with:
+            blob_report: true
+
+    tests-done:
+        needs: [windows, linux, macos]
+        runs-on: ubuntu-24.04
+        if: ${{ !cancelled() }}
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+              with:
+                  cache: "pnpm"
+                  node-version: "lts/*"
+
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+
+            - name: Download blob reports from GitHub Actions Artifacts
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+              with:
+                  pattern: blob-report-*
+                  path: apps/desktop/all-blob-reports
+                  merge-multiple: true
+
+            - name: Merge into HTML Report
+              working-directory: apps/desktop
+              run: pnpm playwright merge-reports -c ./playwright.config.ts --reporter=html ./all-blob-reports
+
+            - name: Upload HTML report
+              if: always()
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: html-report
+                  path: apps/desktop/playwright-report
+                  retention-days: 14
+
+            - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+              run: exit 1
@@ -0,0 +1,279 @@
+# This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
+# Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
+# the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
+on:
+    workflow_call:
+        inputs:
+            ref:
+                type: string
+                required: false
+                description: "The git ref to checkout, defaults to the default branch"
+            arch:
+                type: string
+                required: true
+                description: "The architecture to build for, one of 'amd64' | 'arm64'"
+            version:
+                type: string
+                required: false
+                description: "Version string to override the one in package.json, used for non-release builds"
+            sqlcipher:
+                type: string
+                required: true
+                description: "How to link sqlcipher, one of 'system' | 'static'"
+            blob_report:
+                type: boolean
+                required: false
+                description: "Whether to run the blob report"
+            prepare-artifact-name:
+                type: string
+                required: false
+                description: |
+                    The name of the prepare artifact to use, defaults to 'webapp'.
+                    The artifact must contain the following:
+                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
+                    + electronVersion - the version of electron to use for cache keying
+                    + hakHash - the hash of the .hak directory to use for cache keying
+                    + changelog.Debian - the changelog file to embed in the Debian package
+                    + variant.json - the variant configuration to use for the build
+
+                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
+                    for example icons in the `build/` directory to override the app icons.
+                default: "webapp"
+            test:
+                type: boolean
+                required: false
+                default: true
+                description: "Whether to run the test stage after building"
+            test-args:
+                type: string
+                required: false
+                description: "Additional arguments to pass to playwright"
+            runs-on:
+                type: string
+                required: false
+                description: "The runner image to use, normally set for you, may be needed for running in private repos."
+            artifact-prefix:
+                type: string
+                required: false
+                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
+                default: ""
+            targets:
+                type: string
+                required: false
+                description: "List of targets to build"
+                default: "tar.gz deb"
+env:
+    SQLCIPHER_BUNDLED: ${{ inputs.sqlcipher == 'static' && '1' || '' }}
+    MAX_GLIBC: 2.31 # bullseye-era glibc, used by glibc-check.sh
+permissions: {} # No permissions required
+jobs:
+    build:
+        name: Build Linux ${{ inputs.arch }} SQLCipher ${{ inputs.sqlcipher }}
+        # We build on native infrastructure as matrix-seshat fails to cross-compile properly
+        # https://github.com/matrix-org/seshat/issues/135
+        runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
+        env:
+            HAK_DOCKER_IMAGE: ghcr.io/element-hq/element-web/desktop-build-env
+        steps:
+            - name: Resolve docker image tag for push
+              if: github.event_name == 'push'
+              run: echo "HAK_DOCKER_IMAGE=$HAK_DOCKER_IMAGE:$REF" >> $GITHUB_ENV
+              env:
+                  REF: ${{ inputs.ref || github.ref_name }}
+            - name: Resolve docker image tag for release
+              if: github.event_name == 'release'
+              run: echo "HAK_DOCKER_IMAGE=$HAK_DOCKER_IMAGE:staging" >> $GITHUB_ENV
+            - name: Resolve docker image tag for other triggers
+              if: github.event_name != 'push' && github.event_name != 'release'
+              run: echo "HAK_DOCKER_IMAGE=$HAK_DOCKER_IMAGE:develop" >> $GITHUB_ENV
+
+            - uses: nbucic/variable-mapper@0673f6891a0619ba7c002ecfed0f9f4f39017b6f
+              id: config
+              with:
+                  key: "${{ inputs.arch }}"
+                  export_to: output
+                  map: |
+                      {
+                        "amd64": {
+                          "target": "x86_64-unknown-linux-gnu",
+                          "arch": "x86-64"
+                        },
+                        "arm64": {
+                          "target": "aarch64-unknown-linux-gnu",
+                          "arch": "aarch64",
+                          "build-args": "--arm64"
+                        }
+                      }
+
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  repository: element-hq/element-web
+                  ref: ${{ inputs.ref }}
+                  persist-credentials: false
+
+            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+              with:
+                  name: ${{ inputs.prepare-artifact-name }}
+                  path: apps/desktop
+
+            - name: Cache .hak
+              id: cache
+              uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+              with:
+                  key: ${{ runner.os }}-${{ github.ref_name }}-${{ inputs.sqlcipher }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion', 'dockerbuild/*') }}
+                  path: |
+                      apps/desktop/.hak
+
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+              with:
+                  node-version-file: apps/desktop/.node-version
+                  cache: "pnpm"
+              env:
+                  # Workaround for https://github.com/actions/setup-node/issues/317
+                  FORCE_COLOR: 0
+
+            - name: Install Deps
+              working-directory: apps/desktop
+              run: pnpm install --frozen-lockfile
+
+            - name: "Get modified files"
+              id: changed_files
+              if: steps.cache.outputs.cache-hit != 'true' && github.event_name == 'pull_request' && github.repository == 'element-hq/element-web'
+              uses: tj-actions/changed-files@823fcebdb31bb35fdf2229d9f769b400309430d0 # v46
+              with:
+                  files: |
+                      apps/desktop/dockerbuild/**
+
+            # This allows contributors to test changes to the dockerbuild image within a pull request
+            - name: Build docker image
+              uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
+              if: steps.changed_files.outputs.any_modified == 'true'
+              with:
+                  file: apps/desktop/dockerbuild/Dockerfile
+                  context: apps/desktop
+                  load: true
+                  platforms: linux/${{ inputs.arch }}
+                  tags: ${{ env.HAK_DOCKER_IMAGE }}
+
+            - name: Build Natives
+              if: steps.cache.outputs.cache-hit != 'true'
+              run: |
+                  docker run \
+                    -v ${{ github.workspace }}:/work -w /work \
+                    -e SQLCIPHER_BUNDLED \
+                    -e CI=1 \
+                    $HAK_DOCKER_IMAGE \
+                    pnpm -C apps/desktop run build:native
+
+            - name: Fix permissions
+              run: |
+                  # For .hak
+                  sudo chown -R $USER:$USER apps/desktop/.hak
+                  # For node_modules pnpm strict security
+                  sudo chmod +x node_modules/7zip-bin/linux/*/7za
+
+            - name: Check native libraries in hak dependencies
+              working-directory: apps/desktop
+              run: |
+                  shopt -s globstar
+
+                  for filename in ./.hak/hakModules/**/*.node; do
+                      ./scripts/glibc-check.sh $filename
+                  done
+
+            - name: Generate debian files and arguments
+              working-directory: apps/desktop
+              run: |
+                  if [ -f changelog.Debian ]; then
+                      echo "ED_DEBIAN_CHANGELOG=changelog.Debian" >> $GITHUB_ENV
+                  fi
+
+            - name: Build App
+              working-directory: apps/desktop
+              run: pnpm run build --publish never $BUILD_ARGS -l $TARGETS
+              env:
+                  VARIANT_PATH: variant.json
+                  # Only set for Nightly builds
+                  VERSION: ${{ inputs.version }}
+                  # Workaround for https://github.com/electron-userland/electron-builder/issues/5721
+                  USE_HARD_LINKS: false
+                  BUILD_ARGS: ${{ steps.config.outputs.build-args }}
+                  TARGETS: ${{ inputs.targets }}
+
+            - name: Check native libraries
+              working-directory: apps/desktop
+              run: |
+                  set -x
+                  shopt -s globstar
+
+                  FILES=$(file dist/**/*.node)
+                  echo $FILES
+
+                  ! echo "$FILES" | grep -v "$ARCH"
+
+                  LIBS=$(readelf -d dist/**/*.node | grep NEEDED)
+                  echo "$LIBS"
+
+                  set +x
+                  assert_contains_string() { [[ "$1" == *"$2"* ]]; }
+                  ! assert_contains_string "$LIBS" "libcrypto.so.1.1"
+                  if [ "$SQLCIPHER_BUNDLED" == "1" ]; then
+                      ! assert_contains_string "$LIBS" "libsqlcipher.so.0"
+                  else
+                      assert_contains_string "$LIBS" "libsqlcipher.so.0"
+                  fi
+
+                  ./scripts/glibc-check.sh dist/linux-*unpacked/element-desktop*
+              env:
+                  ARCH: ${{ steps.config.outputs.arch }}
+
+            # We exclude *-unpacked as it loses permissions and the tarball contains it with correct permissions
+            - name: Upload Artifacts
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: ${{ inputs.artifact-prefix }}linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
+                  path: |
+                      apps/desktop/dist
+                      !apps/desktop/dist/*-unpacked/**
+                  retention-days: 1
+
+            - name: Assert deb is present and valid
+              if: contains(inputs.targets, 'deb')
+              working-directory: apps/desktop
+              run: |
+                  test -f ./dist/element-desktop*$ARCH.deb
+
+                  DEB_LISTING=$(dpkg-deb --fsys-tarfile ./dist/element-desktop*.deb | tar -tv)
+                  echo "deb listing: "
+                  echo "$DEB_LISTING"
+                  ! echo "$DEB_LISTING" | grep '^h'
+              env:
+                  ARCH: ${{ inputs.arch }}
+
+            - name: Assert tar.gz is present
+              if: contains(inputs.targets, 'tar.gz')
+              working-directory: apps/desktop
+              run: |
+                  test -f ./dist/element-desktop*.tar.gz
+
+                  TAR_GZ_LISTING=$(tar -tvf ./dist/element-desktop*.tar.gz)
+                  echo "tar.gz listing: "
+                  echo "$TAR_GZ_LISTING"
+                  ! echo "$TAR_GZ_LISTING" | grep '^h'
+
+    test:
+        name: Test Linux ${{ inputs.arch }} SQLCipher ${{ inputs.sqlcipher }}
+        needs: build
+        if: inputs.test && contains(inputs.targets, 'deb')
+        uses: ./.github/workflows/build_desktop_test.yaml
+        with:
+            project: linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
+            artifact: ${{ inputs.artifact-prefix }}linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
+            runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
+            executable: /opt/Element*/element-desktop*
+            prepare_cmd: |
+                sudo apt-get -qq update
+                sudo apt install ./dist/*.deb
+            blob_report: ${{ inputs.blob_report }}
+            args: ${{ inputs.test-args }}
@@ -0,0 +1,234 @@
+# This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
+# Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
+# the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
+on:
+    workflow_call:
+        secrets:
+            APPLE_ID:
+                required: false
+            APPLE_ID_PASSWORD:
+                required: false
+            APPLE_CSC_KEY_PASSWORD:
+                required: false
+            APPLE_CSC_LINK:
+                required: false
+        inputs:
+            ref:
+                type: string
+                required: false
+                description: "The git ref to checkout, defaults to the default branch"
+            version:
+                type: string
+                required: false
+                description: "Version string to override the one in package.json, used for non-release builds"
+            sign:
+                type: string
+                required: false
+                description: "Whether to sign & notarise the build, requires 'Desktop Apple' environment"
+            base-url:
+                type: string
+                required: false
+                description: "The URL to which the output will be deployed."
+            blob_report:
+                type: boolean
+                required: false
+                description: "Whether to run the blob report"
+            prepare-artifact-name:
+                type: string
+                required: false
+                description: |
+                    The name of the prepare artifact to use, defaults to 'webapp'.
+                    The artifact must contain the following:
+                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
+                    + electronVersion - the version of electron to use for cache keying
+                    + hakHash - the hash of the .hak directory to use for cache keying
+                    + variant.json - the variant configuration to use for the build
+
+                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
+                    for example icons in the `build/` directory to override the app icons.
+                default: "webapp"
+            test:
+                type: boolean
+                required: false
+                default: true
+                description: "Whether to run the test stage after building"
+            test-args:
+                type: string
+                required: false
+                description: "Additional arguments to pass to playwright"
+            artifact-prefix:
+                type: string
+                required: false
+                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
+                default: ""
+            targets:
+                type: string
+                required: false
+                description: "List of targets to build"
+                default: "dmg zip"
+permissions: {} # No permissions required
+jobs:
+    build:
+        name: Build macOS Universal
+        runs-on: macos-15 # M1
+        environment: ${{ inputs.sign && 'Desktop Apple' || '' }}
+        steps:
+            - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
+              with:
+                  xcode-version: latest-stable
+
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  repository: element-hq/element-web
+                  ref: ${{ inputs.ref }}
+                  persist-credentials: false
+
+            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+              with:
+                  name: ${{ inputs.prepare-artifact-name }}
+                  path: apps/desktop
+
+            - name: Cache .hak
+              id: cache
+              uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+              with:
+                  key: ${{ runner.os }}-${{ hashFiles('hakHash', 'electronVersion') }}
+                  path: |
+                      apps/desktop/.hak
+
+            - name: Install Rust
+              if: steps.cache.outputs.cache-hit != 'true'
+              run: |
+                  rustup toolchain install stable --profile minimal --no-self-update
+                  rustup default stable
+                  rustup target add aarch64-apple-darwin
+                  rustup target add x86_64-apple-darwin
+
+            # M1 macos-14 comes without Python preinstalled
+            - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+              with:
+                  python-version: "3.13"
+
+            # Install Quartz for DMG badges
+            # https://github.com/electron-userland/electron-builder/issues/9511#issuecomment-3774092888
+            - run: sudo pip3 install pyobjc-framework-Quartz
+
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+              with:
+                  node-version-file: apps/desktop/.node-version
+                  cache: "pnpm"
+
+            - name: Install Deps
+              working-directory: apps/desktop
+              run: "pnpm install --frozen-lockfile"
+
+            - name: Build Natives
+              if: steps.cache.outputs.cache-hit != 'true'
+              working-directory: apps/desktop
+              run: pnpm run build:native:universal
+
+            # We split these because electron-builder gets upset if we set CSC_LINK even to an empty string
+            - name: "[Signed] Build App"
+              if: inputs.sign != ''
+              working-directory: apps/desktop
+              run: |
+                  pnpm run build:universal --publish never -m ${TARGETS}
+              env:
+                  APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+                  APPLE_ID: ${{ secrets.APPLE_ID }}
+                  APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+                  CSC_KEY_PASSWORD: ${{ secrets.APPLE_CSC_KEY_PASSWORD }}
+                  CSC_LINK: ${{ secrets.APPLE_CSC_LINK }}
+                  VARIANT_PATH: variant.json
+                  # Only set for Nightly builds
+                  VERSION: ${{ inputs.version }}
+                  TARGETS: ${{ inputs.targets }}
+
+            - name: Check app was signed & notarised successfully
+              if: inputs.sign != ''
+              working-directory: apps/desktop
+              run: |
+                  hdiutil attach dist/*.dmg -mountpoint /Volumes/Element
+                  codesign -dv --verbose=4 /Volumes/Element/*.app
+                  spctl -a -vvv -t install /Volumes/Element/*.app
+                  hdiutil detach /Volumes/Element
+
+            - name: "[Unsigned] Build App"
+              if: inputs.sign == ''
+              working-directory: apps/desktop
+              run: |
+                  pnpm run build:universal --publish never -m ${TARGETS}
+              env:
+                  CSC_IDENTITY_AUTO_DISCOVERY: false
+                  VARIANT_PATH: variant.json
+                  TARGETS: ${{ inputs.targets }}
+
+            - name: Generate releases.json
+              if: inputs.base-url
+              working-directory: apps/desktop
+              run: |
+                  PKG_JSON_VERSION=$(cat package.json | jq -r .version)
+                  LATEST=$(find dist -type f -iname "*-mac.zip" | xargs -0 -n1 -- basename)
+                  # Encode spaces in the URL as Squirrel.Mac complains about bad JSON otherwise
+                  URL="${BASE_URL}/update/macos/${LATEST// /%20}"
+
+                  jq -n --arg version "${VERSION:-$PKG_JSON_VERSION}" --arg url "$URL" '
+                    {
+                      currentRelease: $version,
+                      releases: [{
+                        version: $version,
+                        updateTo: {
+                          version: $version,
+                          url: $url,
+                        },
+                      }],
+                    }
+                  ' > dist/releases.json
+                  jq -n --arg url "$URL" '
+                    { url: $url }
+                  ' > dist/releases-legacy.json
+              env:
+                  VERSION: ${{ inputs.version }}
+                  BASE_URL: ${{ inputs.base-url }}
+
+            # We exclude mac-universal as the unpacked app takes forever to upload and zip and dmg already contains it
+            - name: Upload Artifacts
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: ${{ inputs.artifact-prefix }}macos
+                  path: |
+                      apps/desktop/dist
+                      !apps/desktop/dist/mac-universal/**
+                  retention-days: 1
+
+            - name: Assert zip is present
+              if: contains(inputs.targets, 'zip')
+              working-directory: apps/desktop
+              run: |
+                  test -f ./dist/Element*-mac.zip
+
+            - name: Assert dmg is present
+              if: contains(inputs.targets, 'dmg')
+              working-directory: apps/desktop
+              run: |
+                  test -f ./dist/Element*.dmg
+
+    test:
+        name: Test macOS Universal
+        needs: build
+        if: inputs.test && contains(inputs.targets, 'dmg')
+        uses: ./.github/workflows/build_desktop_test.yaml
+        with:
+            project: macos
+            artifact: ${{ inputs.artifact-prefix }}macos
+            runs-on: macos-14
+            executable: /Users/runner/Applications/Element*.app/Contents/MacOS/Element*
+            # We need to mount the DMG and copy the app to the Applications folder as a mounted DMG is
+            # read-only and thus would not allow us to override the fuses as is required for Playwright.
+            prepare_cmd: |
+                hdiutil attach ./dist/*.dmg -mountpoint /Volumes/Element &&
+                rsync -a /Volumes/Element/Element*.app ~/Applications/ &&
+                hdiutil detach /Volumes/Element
+            blob_report: ${{ inputs.blob_report }}
+            args: ${{ inputs.test-args }}
@@ -0,0 +1,199 @@
+# This action helps perform common actions before the build_* actions are started in parallel.
+on:
+    workflow_call:
+        inputs:
+            config:
+                type: string
+                required: true
+                description: "The config directory to use"
+            version:
+                type: string
+                required: false
+                description: "The version tag to fetch, or 'develop', will pick automatically if not passed"
+            nightly:
+                type: boolean
+                required: false
+                default: false
+                description: "Whether the build is a Nightly and to calculate the version strings new builds should use"
+            deploy:
+                type: boolean
+                required: false
+                default: false
+                description: "Whether the build should be deployed to production"
+            branch-matching:
+                type: boolean
+                required: false
+                default: false
+                description: "Whether the branch name should be matched to find the element-web commit"
+        secrets:
+            # Required if `nightly` is set
+            CF_R2_ACCESS_KEY_ID:
+                required: false
+            # Required if `nightly` is set
+            CF_R2_TOKEN:
+                required: false
+        outputs:
+            nightly-version:
+                description: "The version string the next Nightly should use, only output for nightly"
+                value: ${{ jobs.prepare.outputs.nightly-version }}
+            packages-dir:
+                description: "The directory non-deb packages for this run should live in within packages.element.io"
+                value: ${{ inputs.nightly && 'nightly' || 'desktop' }}
+            # This is just a simple pass-through of the input to simplify reuse of complex inline conditions
+            deploy:
+                description: "Whether the build should be deployed to production"
+                value: ${{ inputs.deploy }}
+permissions: {}
+jobs:
+    prepare:
+        name: Prepare
+        environment: ${{ inputs.nightly && 'packages.element.io' || '' }}
+        runs-on: ubuntu-24.04
+        permissions:
+            contents: read
+        outputs:
+            nightly-version: ${{ steps.versions.outputs.nightly }}
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+              with:
+                  node-version-file: apps/desktop/.node-version
+                  cache: "pnpm"
+
+            - name: Install Deps
+              working-directory: apps/desktop
+              run: "pnpm install --frozen-lockfile"
+
+            - name: Fetch Element Web (matching branch)
+              id: branch-matching
+              if: inputs.branch-matching
+              working-directory: apps/desktop
+              continue-on-error: true
+              run: |
+                  scripts/branch-match.sh
+                  cp "$CONFIG_DIR/config.json" element-web/
+                  pnpm --cwd element-web install --frozen-lockfile
+                  pnpm --cwd element-web run build
+                  mv element-web/webapp .
+                  pnpm run asar-webapp
+              env:
+                  # These must be set for branch-match.sh to get the right branch
+                  REPOSITORY: ${{ github.repository }}
+                  PR_NUMBER: ${{ github.event.pull_request.number }}
+                  CONFIG_DIR: ${{ inputs.config }}
+
+            - name: Fetch Element Web (${{ inputs.version }})
+              if: steps.branch-matching.outcome == 'failure' || steps.branch-matching.outcome == 'skipped'
+              working-directory: apps/desktop
+              run: pnpm run fetch --noverify -d ${CONFIG} ${VERSION}
+              env:
+                  CONFIG: ${{ inputs.config }}
+                  VERSION: ${{ inputs.version }}
+
+            - name: Copy variant config
+              working-directory: apps/desktop
+              run: cp "$CONFIG_DIR/build.json" variant.json
+              env:
+                  CONFIG_DIR: ${{ inputs.config }}
+
+            # We split this out to save the build_* scripts having to do it to make use of `hashFiles` in the cache action
+            - name: Generate cache hash files
+              working-directory: apps/desktop
+              run: |
+                  set -ex
+                  # Add --no-sandbox as otherwise it fails because the helper isn't setuid root. It's only getting the version.
+                  pnpm --silent electron --no-sandbox --version > electronVersion
+                  cat package.json | jq -c .hakDependencies | sha1sum > hakHash
+                  find hak -type f -print0 | xargs -0 sha1sum >> hakHash
+                  find scripts/hak -type f -print0 | xargs -0 sha1sum >> hakHash
+
+            - name: "[Nightly] Calculate version"
+              id: versions
+              if: inputs.nightly
+              working-directory: apps/desktop
+              run: |
+                  set -e
+
+                  # Find all latest Nightly versions
+                  aws s3 cp s3://$R2_BUCKET/nightly/update/macos/releases.json - --endpoint-url $R2_URL --region auto | jq -r .currentRelease >> VERSIONS
+                  aws s3 cp s3://$R2_BUCKET/debian/dists/default/main/binary-amd64/Packages - --endpoint-url $R2_URL --region auto | grep "Package: element-nightly" -A 50 | grep Version -m1 | sed -n 's/Version: //p' >> VERSIONS
+                  aws s3 cp s3://$R2_BUCKET/debian/dists/default/main/binary-arm64/Packages - --endpoint-url $R2_URL --region auto | grep "Package: element-nightly" -A 50 | grep Version -m1 | sed -n 's/Version: //p' >> VERSIONS
+                  aws s3 cp s3://$R2_BUCKET/nightly/update/win32/x64/RELEASES - --endpoint-url $R2_URL --region auto | awk '{print $2}' | cut -d "-" -f 5 | cut -c 8- >> VERSIONS
+                  aws s3 cp s3://$R2_BUCKET/nightly/update/win32/arm64/RELEASES - --endpoint-url $R2_URL --region auto | awk '{print $2}' | cut -d "-" -f 5 | cut -c 8- >> VERSIONS
+
+                  # Pick the greatest one
+                  VERSION=$(cat VERSIONS | sort -uf | tail -n1)
+                  echo "Found latest nightly version $VERSION"
+                  # Increment it
+                  echo "nightly=$(scripts/generate-nightly-version.ts --latest $VERSION)" >> $GITHUB_OUTPUT
+              env:
+                  AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
+                  R2_BUCKET: ${{ vars.R2_BUCKET }}
+                  R2_URL: ${{ vars.CF_R2_S3_API }}
+
+            - name: Check version
+              id: package
+              working-directory: apps/desktop
+              run: |
+                  echo "version=$(cat package.json | jq -r .version)" >> $GITHUB_OUTPUT
+
+            - name: "[Release] Fetch release"
+              id: release
+              if: ${{ !inputs.nightly && inputs.version != 'develop' }}
+              uses: cardinalby/git-get-release-action@5172c3a026600b1d459b117738c605fabc9e4e44 # 1.2.5
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
+              with:
+                  tag: v${{ steps.package.outputs.version }}
+
+            - name: "[Release] Write changelog"
+              if: ${{ !inputs.nightly && inputs.version != 'develop' }}
+              working-directory: apps/desktop
+              run: |
+                  TIME=$(date -d "$PUBLISHED_AT" -R)
+                  echo "element-desktop ($VERSION) default; urgency=medium" >> changelog.Debian
+                  echo "$BODY" | sed 's/^##/\n  */g;s/^\*/  */g' | perl -pe 's/\[.+?]\((.+?)\)/\1/g' >> changelog.Debian
+                  echo "" >> changelog.Debian
+                  echo " -- $ACTOR <support@element.io>  $TIME" >> changelog.Debian
+              env:
+                  ACTOR: ${{ github.actor }}
+                  VERSION: v${{ steps.package.outputs.version }}
+                  BODY: ${{ steps.release.outputs.body }}
+                  PUBLISHED_AT: ${{ steps.release.outputs.published_at }}
+
+            - name: "[Nightly] Write summary"
+              if: inputs.nightly
+              working-directory: apps/desktop
+              run: |
+                  set -e
+
+                  BUNDLE_HASH=$(npx asar l webapp.asar | grep /bundles/ | head -n 1 | sed 's|.*/||')
+                  WEBAPP_VERSION=$(./scripts/get-version.ts)
+                  WEB_VERSION=${WEBAPP_VERSION:0:12}
+                  JS_VERSION=${WEBAPP_VERSION:16:12}
+
+                  echo "### Nightly build ${NIGHTLY_VERSION}" >> $GITHUB_STEP_SUMMARY
+                  echo "" >> $GITHUB_STEP_SUMMARY
+                  echo "| Component   | Version |" >> $GITHUB_STEP_SUMMARY
+                  echo "| ----------- | ------- |" >> $GITHUB_STEP_SUMMARY
+                  echo "| Bundle Hash | $BUNDLE_HASH |" >> $GITHUB_STEP_SUMMARY
+                  echo "| Element Web | [$WEB_VERSION](https://github.com/element-hq/element-web/commit/$WEB_VERSION) |" >> $GITHUB_STEP_SUMMARY
+                  echo "| JS SDK      | [$JS_VERSION](https://github.com/matrix-org/matrix-js-sdk/commit/$JS_VERSION) |" >> $GITHUB_STEP_SUMMARY
+              env:
+                  NIGHTLY_VERSION: ${{ steps.versions.outputs.nightly }}
+
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: webapp
+                  retention-days: 1
+                  path: |
+                      apps/desktop/webapp.asar
+                      apps/desktop/electronVersion
+                      apps/desktop/hakHash
+                      apps/desktop/changelog.Debian
+                      apps/desktop/variant.json
@@ -0,0 +1,109 @@
+# This action helps run Playwright tests within one of the build_* stages.
+on:
+    workflow_call:
+        inputs:
+            runs-on:
+                type: string
+                required: true
+                description: "The runner image to use"
+            artifact:
+                type: string
+                required: true
+                description: "The name of the artifact to download"
+            project:
+                type: string
+                required: true
+                description: "The Playwright project to use for testing"
+            executable:
+                type: string
+                required: true
+                description: "Path to the executable to test"
+            prepare_cmd:
+                type: string
+                required: false
+                description: "Command to run to prepare the executable or environment for testing"
+            blob_report:
+                type: boolean
+                default: false
+                description: "Whether to upload a blob report instead of the HTML report"
+            args:
+                type: string
+                required: false
+                description: "Additional arguments to pass to playwright, for e.g. skipping specific tests"
+permissions: {}
+jobs:
+    test:
+        name: Test ${{ inputs.project }}
+        runs-on: ${{ inputs.runs-on }}
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  repository: ${{ github.repository == 'element-hq/element-web-pro' && 'element-hq/element-web' || github.repository }}
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+              with:
+                  node-version-file: apps/desktop/.node-version
+                  cache: "pnpm"
+
+            - name: Install Deps
+              working-directory: apps/desktop
+              run: "pnpm install --frozen-lockfile"
+
+            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+              with:
+                  name: ${{ inputs.artifact }}
+                  path: apps/desktop/dist
+
+            - name: Prepare for tests
+              working-directory: apps/desktop
+              # This is set by the caller of the reusable workflow, they have the ability to run the command they specify
+              # directly without our help so this is fine.
+              run: ${{ inputs.prepare_cmd }} # zizmor: ignore[template-injection]
+              if: inputs.prepare_cmd
+
+            - name: Expand executable path
+              id: executable
+              working-directory: apps/desktop
+              shell: bash
+              env:
+                  EXECUTABLE: ${{ inputs.executable }}
+              run: |
+                  FILES=($EXECUTABLE)
+                  echo "path=${FILES[0]}" >> $GITHUB_OUTPUT
+
+            # We previously disabled the `EnableNodeCliInspectArguments` fuse, but Playwright requires
+            # it to be enabled to test Electron apps, so turn it back on.
+            - name: Set EnableNodeCliInspectArguments fuse enabled
+              run: $RUN_AS npx @electron/fuses write --app "$EXECUTABLE" EnableNodeCliInspectArguments=on
+              working-directory: apps/desktop
+              shell: bash
+              env:
+                  # We need sudo on Linux as it is installed in /opt/
+                  RUN_AS: ${{ runner.os == 'Linux' && 'sudo' || '' }}
+                  EXECUTABLE: ${{ steps.executable.outputs.path }}
+
+            - name: Run tests
+              uses: coactions/setup-xvfb@6b00cf1889f4e1d5a48635647013c0508128ee1a
+              timeout-minutes: 20
+              with:
+                  run: pnpm -C apps/desktop test --project=${{ inputs.project }} ${{ runner.os != 'Linux' && '--ignore-snapshots' || '' }} ${{ inputs.blob_report == false && '--reporter=html' || '' }} ${{ inputs.args }}
+              env:
+                  ELEMENT_DESKTOP_EXECUTABLE: ${{ steps.executable.outputs.path }}
+
+            - name: Upload blob report
+              if: always() && inputs.blob_report
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: blob-report-${{ inputs.artifact }}
+                  path: apps/desktop/blob-report
+                  retention-days: 1
+
+            - name: Upload HTML report
+              if: always() && inputs.blob_report == false
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: ${{ inputs.artifact }}-test
+                  path: apps/desktop/playwright-report
+                  retention-days: 14
@@ -0,0 +1,314 @@
+# This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
+# Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
+# the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
+
+# Windows GHA runner by default uses the pwsh shell which breaks codeSigningCert in the workflow
+# We always sign using eSignerCKA to ensure it keeps working, but aside from release & nightlies we use demo credentials
+# which do not yield trusted signatures.
+defaults:
+    run:
+        shell: powershell
+on:
+    workflow_call:
+        secrets:
+            ESIGNER_USER_NAME:
+                required: false
+            ESIGNER_USER_PASSWORD:
+                required: false
+            ESIGNER_USER_TOTP:
+                required: false
+        inputs:
+            ref:
+                type: string
+                required: false
+                description: "The git ref to checkout, defaults to the default branch"
+            arch:
+                type: string
+                required: true
+                description: "The architecture to build for, one of 'x64' | 'ia32' | 'arm64'"
+            version:
+                type: string
+                required: false
+                description: "Version string to override the one in package.json, used for non-release builds"
+            sign:
+                type: string
+                required: false
+                description: "Whether to sign & notarise the build, requires 'Desktop eSigner' environment"
+            blob_report:
+                type: boolean
+                required: false
+                description: "Whether to run the blob report"
+            prepare-artifact-name:
+                type: string
+                required: false
+                description: |
+                    The name of the prepare artifact to use, defaults to 'webapp'.
+                    The artifact must contain the following:
+                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
+                    + electronVersion - the version of electron to use for cache keying
+                    + hakHash - the hash of the .hak directory to use for cache keying
+                    + variant.json - the variant configuration to use for the build
+
+
+                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
+                    for example icons in the `build/` directory to override the app icons.
+                default: "webapp"
+            test:
+                type: boolean
+                required: false
+                default: true
+                description: "Whether to run the test stage after building"
+            test-runs-on:
+                type: string
+                required: false
+                description: "The runner image to use for testing, normally set for you, may be needed for running in private repos."
+            test-args:
+                type: string
+                required: false
+                description: "Additional arguments to pass to playwright"
+            artifact-prefix:
+                type: string
+                required: false
+                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
+                default: ""
+            targets:
+                type: string
+                required: false
+                description: "List of targets to build"
+                default: "squirrel msi"
+permissions: {} # No permissions required
+jobs:
+    build:
+        name: Build Windows ${{ inputs.arch }}
+        runs-on: windows-2025
+        environment: ${{ inputs.sign && 'Desktop eSigner' || '' }}
+        env:
+            SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.26100.0/x86/signtool.exe"
+        steps:
+            - uses: nbucic/variable-mapper@0673f6891a0619ba7c002ecfed0f9f4f39017b6f
+              id: config
+              with:
+                  key: "${{ inputs.arch }}"
+                  export_to: output
+                  map: |
+                      {
+                        "x64": {
+                          "target": "x86_64-pc-windows-msvc"
+                        },
+                        "arm64": {
+                          "target": "aarch64-pc-windows-msvc",
+                          "build-args": "--arm64",
+                          "arch": "amd64_arm64"
+                        },
+                        "ia32": {
+                          "target": "i686-pc-windows-msvc",
+                          "build-args": "--ia32",
+                          "arch": "x86",
+                          "extra_config": "{\"user_notice\": {\"title\": \"Your desktop environment is unsupported.\",\"description\": \"Support for 32-bit Windows installations has ended. Transition to the web or mobile app for continued access.\"}}"
+                        }
+                      }
+
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  repository: element-hq/element-web
+                  ref: ${{ inputs.ref }}
+                  persist-credentials: false
+
+            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+              with:
+                  name: ${{ inputs.prepare-artifact-name }}
+                  path: apps/desktop/
+
+            - name: Cache .hak
+              id: cache
+              uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+              with:
+                  key: ${{ runner.os }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion') }}
+                  path: |
+                      apps/desktop/.hak
+
+            # ActiveTCL package on choco is from 2015,
+            # this one is newer but includes more than we need
+            - name: Choco install tclsh
+              if: steps.cache.outputs.cache-hit != 'true'
+              shell: pwsh
+              run: |
+                  choco install -y magicsplat-tcl-tk --no-progress
+                  echo "${HOME}/AppData/Local/Apps/Tcl86/bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+            - name: Choco install NetWide Assembler
+              if: steps.cache.outputs.cache-hit != 'true'
+              shell: pwsh
+              run: |
+                  choco install -y nasm --no-progress
+                  echo "C:/Program Files/NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+            - name: Install Rust
+              if: steps.cache.outputs.cache-hit != 'true'
+              run: |
+                  rustup toolchain install stable --profile minimal --no-self-update
+                  rustup default stable
+                  rustup target add $env:TARGET
+              env:
+                  TARGET: ${{ steps.config.outputs.target }}
+
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+              with:
+                  node-version-file: apps/desktop/.node-version
+                  cache: "pnpm"
+
+            - name: Install Deps
+              working-directory: apps/desktop
+              run: "pnpm install --frozen-lockfile"
+
+            - name: Insert config snippet
+              if: steps.config.outputs.extra_config != ''
+              working-directory: apps/desktop
+              shell: bash
+              run: |
+                  mkdir config-edit
+                  pnpm asar extract webapp.asar config-edit
+                  cd config-edit
+                  mv config.json old-config.json
+                  echo '${{ steps.config.outputs.extra_config }}' | jq -s '.[0] * .[1]' old-config.json - > config.json
+                  rm old-config.json
+                  cd ..
+                  rm webapp.asar
+                  pnpm asar pack config-edit/ webapp.asar
+
+            - name: Set up sqlcipher macros
+              if: steps.cache.outputs.cache-hit != 'true' && contains(inputs.arch, 'arm')
+              shell: pwsh
+              run: |
+                  echo "NCC=${{ github.workspace }}\scripts\cl.bat" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+            - name: Set up build tools
+              if: steps.cache.outputs.cache-hit != 'true'
+              uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
+              with:
+                  arch: ${{ steps.config.outputs.arch || inputs.arch }}
+
+            - name: Build Natives
+              if: steps.cache.outputs.cache-hit != 'true'
+              working-directory: apps/desktop
+              run: |
+                  refreshenv
+                  pnpm run build:native --target $env:TARGET
+              env:
+                  TARGET: ${{ steps.config.outputs.target }}
+
+            - name: Install and configure eSigner CKA
+              run: |
+                  Set-StrictMode -Version 'Latest'
+
+                  # Download, extract, and rename
+                  Invoke-WebRequest -OutFile eSigner_CKA.zip "$env:ESIGNER_URL"
+                  Expand-Archive -Path eSigner_CKA.zip -DestinationPath .
+                  Get-ChildItem -Path * -Include "*_build_*.exe" | Rename-Item -NewName eSigner_CKA.exe
+
+                  # Install
+                  New-Item -ItemType Directory -Force -Path "$env:INSTALL_DIR"
+                  ./eSigner_CKA.exe /CURRENTUSER /VERYSILENT /SUPPRESSMSGBOXES /DIR="${{ env.INSTALL_DIR }}" | Out-Null
+
+                  # Disable logger
+                  $LogConfig = Get-Content -Path ${{ env.INSTALL_DIR }}/log4net.config
+                  $LogConfig[0] = '<log4net threshold="OFF">'
+                  $LogConfig | Set-Content -Path ${{ env.INSTALL_DIR }}/log4net.config
+
+                  # Configure - default credentials from https://www.ssl.com/guide/esigner-demo-credentials-and-certificates/
+                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe config `
+                      -mode "$env:ESIGNER_MODE" `
+                      -user "${{ secrets.ESIGNER_USER_NAME || 'esigner_demo' }}" `
+                      -pass "${{ secrets.ESIGNER_USER_PASSWORD || 'esignerDemo#1' }}" `
+                      -totp "${{ secrets.ESIGNER_USER_TOTP || 'RDXYgV9qju+6/7GnMf1vCbKexXVJmUVr+86Wq/8aIGg=' }}" `
+                      -key "${{ env.MASTER_KEY_FILE }}" -r
+                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe unload
+                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe load
+
+                  # Find certificate
+                  $CodeSigningCert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1
+                  echo Certificate: $CodeSigningCert
+
+                  # Extract thumbprint and subject name
+                  $Thumbprint = $CodeSigningCert.Thumbprint
+                  $SubjectName = ($CodeSigningCert.Subject -replace ", ?", "`n" | ConvertFrom-StringData).CN
+
+                  echo "ED_SIGNTOOL_THUMBPRINT=$Thumbprint" >> $env:GITHUB_ENV
+                  echo "ED_SIGNTOOL_SUBJECT_NAME=$SubjectName" >> $env:GITHUB_ENV
+              env:
+                  ESIGNER_MODE: ${{ vars.ESIGNER_MODE || 'sandbox' }}
+                  ESIGNER_URL: https://github.com/SSLcom/eSignerCKA/releases/download/v1.0.6/SSL.COM-eSigner-CKA_1.0.6.zip
+                  INSTALL_DIR: C:\Users\runneradmin\eSignerCKA
+                  MASTER_KEY_FILE: C:\Users\runneradmin\eSignerCKA\master.key
+
+            - name: Build App
+              working-directory: apps/desktop
+              run: pnpm run build --publish never $BUILD_ARGS -w $TARGETS
+              shell: bash
+              env:
+                  VARIANT_PATH: variant.json
+                  # Only set for Nightly builds
+                  # The windows packager relies on parsing this as semver, so we have to make it look like one.
+                  # This will give our update packages really stupid names, but we probably can't change that either
+                  # because squirrel windows parses them for the version too. We don't really care: nobody sees them.
+                  # We just give the installer a static name, so you'll just see this in the 'about' dialog.
+                  # Turns out if you use 0.0.0 here it makes Squirrel windows crash, so we use 0.0.1.
+                  VERSION: ${{ inputs.version && format('0.0.1-nightly.{0}', inputs.version) || '' }}
+                  BUILD_ARGS: ${{ steps.config.outputs.build-args }}
+                  TARGETS: ${{ inputs.targets }}
+
+            - name: Trust eSigner sandbox cert
+              if: inputs.sign == ''
+              run: |
+                  Set-StrictMode -Version 'Latest'
+                  Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root -FilePath .github/SSLcom-sandbox.crt
+
+            - name: Check app was signed successfully
+              working-directory: apps/desktop
+              run: |
+                  Set-StrictMode -Version 'Latest'
+                  Get-ChildItem `
+                      -Recurse dist `
+                      -Include *.exe, *.msi `
+                  | ForEach-Object -Process {. $env:SIGNTOOL_PATH verify /pa $_.FullName; if(!$?) { throw }}
+
+            - name: Upload Artifacts
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: ${{ inputs.artifact-prefix }}win-${{ inputs.arch }}
+                  path: |
+                      apps/desktop/dist
+                  retention-days: 1
+
+            - name: Assert executable is present
+              working-directory: apps/desktop
+              run: |
+                  Test-Path './dist/win-*unpacked/Element*.exe'
+
+            - name: Assert all Squirrel files are present
+              if: contains(inputs.targets, 'squirrel')
+              working-directory: apps/desktop
+              run: |
+                  Test-Path './dist/squirrel-windows*/Element Setup*.exe'
+                  Test-Path './dist/squirrel-windows*/element-desktop-*-full.nupkg'
+                  Test-Path './dist/squirrel-windows*/RELEASES'
+
+            - name: Assert MSI is present
+              if: contains(inputs.targets, 'msi')
+              working-directory: apps/desktop
+              run: |
+                  Test-Path './dist/Element*.msi'
+
+    test:
+        name: Test Windows ${{ inputs.arch }}
+        needs: build
+        if: inputs.test
+        uses: ./.github/workflows/build_desktop_test.yaml
+        with:
+            project: win-${{ inputs.arch }}
+            artifact: ${{ inputs.artifact-prefix }}win-${{ inputs.arch }}
+            runs-on: ${{ inputs.test-runs-on || (inputs.arch == 'arm64' && 'windows-11-arm' || 'windows-2022') }}
+            executable: ./dist/win*-unpacked/Element*.exe
+            blob_report: ${{ inputs.blob_report }}
+            args: ${{ inputs.test-args }}
@@ -29,9 +29,11 @@ jobs:
            R2_PUBLIC_URL: "https://element-web-develop.element.io"
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  cache: "pnpm"
                  node-version: "lts/*"
@@ -58,7 +60,7 @@ jobs:
            - run: mv dist/element-*.tar.gz dist/develop.tar.gz
              working-directory: apps/web

-            - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: webapp
                  path: apps/web/dist/develop.tar.gz
@@ -134,4 +136,6 @@ jobs:
                  gitHubToken: ${{ secrets.GITHUB_TOKEN }}

            - run: |
-                  echo "Deployed to ${{ steps.cfp.outputs.url }}" >> $GITHUB_STEP_SUMMARY
+                  echo "Deployed to ${STEPS_CFP_OUTPUTS_URL}" >> $GITHUB_STEP_SUMMARY
+              env:
+                  STEPS_CFP_OUTPUTS_URL: ${{ steps.cfp.outputs.url }}
@@ -1,12 +1,12 @@
 name: CD # Continuous Delivery
 on:
    push:
-        branches: [develop]
+        branches: [master, staging, develop]
 concurrency: ${{ github.workflow }}-${{ github.ref_name }}

 permissions: {}
 env:
-    NX_DEFAULT_OUTPUT_STYLE: static
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes

 jobs:
    docker:
@@ -19,31 +19,22 @@ jobs:
            contents: read
            actions: read
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
-                  # We need to fetch all branches and commits so that Nx affected has a base to compare against.
-                  fetch-depth: 0
-                  # reduce the size of the checkout with tree filtering,
-                  # see https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/
-                  filter: tree:0
-
-            - name: Prepare nx
-              uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4
-              with:
-                  main-branch-name: develop
+                  persist-credentials: false

            - name: Install Cosign
              uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3

            - name: Set up QEMU
-              uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+              uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4

            - name: Set up Docker Buildx
              id: builder
-              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+              uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  node-version-file: package.json
                  cache: "pnpm"
@@ -52,13 +43,14 @@ jobs:
              run: "pnpm install --frozen-lockfile"

            - name: Login to GitHub Container Registry
-              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
              with:
                  registry: ghcr.io
                  username: ${{ github.repository_owner }}
                  password: ${{ secrets.GITHUB_TOKEN }}

-            - run: pnpm nx affected -t docker:build
+            - run: pnpm nx run-many --nxBail -t docker:build
+              id: build
              env:
                  INPUT_PUSH: true
                  INPUT_LOAD: false
@@ -66,13 +58,11 @@ jobs:
                  INPUT_BUILDER: ${{ steps.builder.outputs.name }}

            - name: Sign the images with GitHub OIDC token
-              env:
-                  PATTERN: "^ghcr.io/element-hq/element-web*"
              run: |
-                  docker image ls --digests --format '{{.Repository}}@{{.Digest}}' | grep "$PATTERN" | while read -r TARGET; do
-                    # Check if digest is valid (not <none>)
-                    if [[ "$TARGET" != *"@<none>"* ]]; then
+                  shopt -s globstar
+
+                  for FILE in ./node_modules/.cache/nx-container/**/metadata; do
+                      TARGET=$(jq -r '(.["image.name"] | split(",") | last) + "@" + .["containerimage.digest"]' "$FILE")
                      echo "Signing $TARGET..."
                      cosign sign --yes "$TARGET"
-                    fi
                  done
@@ -35,6 +35,8 @@ jobs:
            SITE: ${{ inputs.site || 'staging.element.io' }}
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

            - name: Load GPG key
              run: |
@@ -23,22 +23,23 @@ jobs:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  fetch-depth: 0 # needed for docker-package to be able to calculate the version
+                  persist-credentials: false

            - name: Install Cosign
              uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
              if: github.event_name != 'pull_request'

            - name: Set up QEMU
-              uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+              uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4

            - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+              uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
              with:
                  install: true

            - name: Build and load
              id: test-build
-              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+              uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
              with:
                  context: .
                  file: apps/web/Dockerfile
@@ -82,7 +83,7 @@ jobs:

            - name: Docker meta
              id: meta
-              uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
+              uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
              if: github.event_name != 'pull_request'
              with:
                  images: |
@@ -96,14 +97,14 @@ jobs:
                      latest=${{ contains(github.ref_name, '-rc.') && 'false' || 'auto' }}

            - name: Login to Docker Hub
-              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
              if: github.event_name != 'pull_request'
              with:
                  username: ${{ secrets.DOCKERHUB_USERNAME }}
                  password: ${{ secrets.DOCKERHUB_TOKEN }}

            - name: Login to GitHub Container Registry
-              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
              if: github.event_name != 'pull_request'
              with:
                  registry: ghcr.io
@@ -111,7 +112,7 @@ jobs:
                  password: ${{ secrets.GITHUB_TOKEN }}

            - name: Connect to Tailscale
-              uses: tailscale/github-action@53acf823325fe9ca47f4cdaa951f90b4b0de5bb9 # v4
+              uses: tailscale/github-action@306e68a486fd2350f2bfc3b19fcd143891a4a2d8 # v4
              if: github.event_name != 'pull_request'
              with:
                  oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
@@ -139,7 +140,7 @@ jobs:
                      services/web-repositories/secret/data/oci.element.io password | OCI_PASSWORD ;

            - name: Login to oci.element.io Registry
-              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
              if: github.event_name != 'pull_request'
              with:
                  registry: oci-push.vpn.infra.element.io
@@ -148,7 +149,7 @@ jobs:

            - name: Build and push
              id: build-and-push
-              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+              uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
              if: github.event_name != 'pull_request'
              with:
                  context: .
@@ -16,84 +16,29 @@ jobs:
        name: GitHub Pages
        runs-on: ubuntu-24.04
        steps:
-            - name: Fetch element-desktop
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
-                  repository: element-hq/element-desktop
-                  path: element-desktop
+                  persist-credentials: false

-            - name: Fetch element-web
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
              with:
-                  path: element-web
-
-            - name: Fetch matrix-js-sdk
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-              with:
-                  repository: matrix-org/matrix-js-sdk
-                  path: matrix-js-sdk
-
-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-              with:
-                  package_json_file: element-web/package.json
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+                  package_json_file: package.json
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  cache: "pnpm"
-                  cache-dependency-path: element-web/pnpm-lock.yaml
+                  cache-dependency-path: pnpm-lock.yaml
                  node-version: "lts/*"

-            - name: Generate automations docs
-              working-directory: element-web
-              run: |
-                  pnpm install --frozen-lockfile
-                  pnpm node ./scripts/gen-workflow-mermaid.ts ../element-desktop ../element-web ../matrix-js-sdk > docs/automations.md
-                  echo "-   [Automations](automations.md)" >> docs/SUMMARY.md
-
-            - name: Setup mdBook
-              uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2
-              with:
-                  mdbook-version: "0.5.1"
-
-            - name: Install mdbook extensions
-              run: cargo install mdbook-combiner mdbook-mermaid
-
-            - name: Prepare docs
-              run: |
-                  mkdir docs
-
-                  mv element-desktop/README.md element-desktop/docs/
-                  mv element-desktop/docs "docs/Element Desktop"
-
-                  mv element-web/README.md element-web/docs/
-                  mv element-web/docs/lib docs/
-                  mv element-web/docs "docs/Element Web"
-
-                  mv matrix-js-sdk/README.md matrix-js-sdk/docs/
-                  mv matrix-js-sdk/docs "docs/Matrix JS SDK"
-
-                  sed -i -e 's/\.\.\/README.md/README.md/' docs/**/SUMMARY.md
-
-                  mdbook-combiner -m docs
-                  sed -i -E 's/^\t# (.+)$/- [\1]()/gm;t' SUMMARY.md
-                  sed -i -E 's/^- \[(.+)]\(<>\)$/---\n# \1/gm;t' SUMMARY.md
-                  sed -i -E 's/\t- \[Introduction]/- [Introduction]/gm;t' SUMMARY.md
-
-                  cat <<EOF > docs/SUMMARY.md
-                  # Summary
-                  - [Introduction](<Element Web/README.md>)
-
-                  EOF
-                  cat SUMMARY.md >> docs/SUMMARY.md
-
-                  mv element-web/book.toml .
+            - name: Fetch layered build
+              run: ./scripts/layered.sh

            - name: Build docs
-              run: mdbook build
+              run: pnpm run docs:build

            - name: Upload artifact
              uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
              with:
-                  path: ./book
+                  path: ./docs/.vitepress/dist

    deploy:
        environment:
@@ -107,4 +52,4 @@ jobs:
        steps:
            - name: Deploy to GitHub Pages
              id: deployment
-              uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+              uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
@@ -2,7 +2,9 @@
 # taking the artifact and uploading it to Netlify for easier viewing
 name: Upload End to End Test report to Netlify
 on:
-    workflow_run:
+    # Privilege escalation necessary to publish to Netlify
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
        workflows: ["End to End Tests"]
        types:
            - completed
@@ -25,7 +27,7 @@ jobs:
            actions: read
        steps:
            - name: Download HTML report
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  run-id: ${{ github.event.workflow_run.id }}
@@ -54,9 +54,10 @@ jobs:
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: element-hq/element-web
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  cache: "pnpm"
                  node-version: "lts/*"
@@ -75,10 +76,10 @@ jobs:
              env:
                  CI_PACKAGE: true
              working-directory: apps/web
-              run: VERSION=$(scripts/get-version-from-git.sh) pnpm build
+              run: VERSION=$(scripts/get-version-from-git.sh) pnpm run build

            - name: Upload Artifact
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: webapp
                  path: apps/web/webapp
@@ -132,13 +133,13 @@ jobs:
                  repository: element-hq/element-web

            - name: 📥 Download artifact
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  name: webapp
                  path: apps/web/webapp

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  cache: "pnpm"
                  cache-dependency-path: pnpm-lock.yaml
@@ -149,10 +150,10 @@ jobs:

            - name: Get installed Playwright version
              id: playwright
-              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT
+              run: echo "version=$(pnpm --silent -- playwright --version | awk '{print $2}')" >> $GITHUB_OUTPUT

            - name: Cache playwright binaries
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
              id: playwright-cache
              with:
                  path: ~/.cache/ms-playwright
@@ -160,11 +161,13 @@ jobs:

            - name: Install Playwright browsers
              if: steps.playwright-cache.outputs.cache-hit != 'true'
+              working-directory: apps/web
              run: pnpm playwright install --with-deps --no-shell

            - name: Install system dependencies for WebKit
              # Some WebKit dependencies seem to lay outside the cache and will need to be installed separately
              if: matrix.project == 'WebKit' && steps.playwright-cache.outputs.cache-hit == 'true'
+              working-directory: apps/web
              run: pnpm playwright install-deps webkit

            # We skip tests tagged with @mergequeue when running on PRs, but run them in MQ and everywhere else
@@ -172,13 +175,15 @@ jobs:
              working-directory: apps/web
              run: |
                  pnpm playwright test \
-                      --shard "${{ matrix.runner }}/${{ needs.build.outputs.num-runners }}" \
+                      --shard "$SHARD" \
                      --project="${{ matrix.project }}" \
                      ${{ (github.event_name == 'pull_request' && matrix.runAllTests == false ) && '--grep-invert @mergequeue' || '' }}
+              env:
+                  SHARD: ${{ format('{0}/{1}', matrix.runner, needs.build.outputs.num-runners) }}

            - name: Upload blob report to GitHub Actions Artifacts
              if: always()
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: all-blob-reports-${{ matrix.project }}-${{ matrix.runner }}
                  path: apps/web/blob-report
@@ -188,7 +193,7 @@ jobs:
        name: Downstream Playwright tests [element-modules]
        needs: build
        if: inputs.skip != true && github.event_name == 'merge_group'
-        uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main
+        uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main # zizmor: ignore[unpinned-uses]
        with:
            webapp-artifact: webapp

@@ -206,9 +211,9 @@ jobs:
                  persist-credentials: false
                  repository: element-hq/element-web

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
              if: inputs.skip != true
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              if: inputs.skip != true
              with:
                  cache: "pnpm"
@@ -220,27 +225,30 @@ jobs:

            - name: Download blob reports from GitHub Actions Artifacts
              if: inputs.skip != true
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  pattern: all-blob-reports-*
-                  path: all-blob-reports
+                  path: apps/web/all-blob-reports
                  merge-multiple: true

            - name: Merge into HTML Report
              if: inputs.skip != true
-              run: pnpm playwright merge-reports --reporter=html,./apps/web/playwright/flaky-reporter.ts,@element-hq/element-web-playwright-common/lib/stale-screenshot-reporter.js ./all-blob-reports
+              working-directory: apps/web
+              run: pnpm playwright merge-reports --reporter=html,./playwright/flaky-reporter.ts,@element-hq/element-web-playwright-common/lib/stale-screenshot-reporter.js ./all-blob-reports
              env:
                  # Only pass creds to the flaky-reporter on main branch runs
                  GITHUB_TOKEN: ${{ github.ref_name == 'develop' && secrets.ELEMENT_BOT_TOKEN || '' }}
+                  PLAYWRIGHT_HTML_TITLE: ${{ case(github.event_name == 'pull_request', format('EW Playwright Report PR-{0}', env.PR_NUMBER), 'EW Playwright Report') }}

            # Upload the HTML report even if one of our reporters fails, this can happen when stale screenshots are detected
            - name: Upload HTML report
              if: always() && inputs.skip != true
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: html-report
-                  path: playwright-report
+                  path: apps/web/playwright-report
                  retention-days: 14
+                  if-no-files-found: error

            - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
              run: exit 1
@@ -7,7 +7,7 @@ permissions:
    pull-requests: write # needed to auto-approve PRs
 jobs:
    download:
-        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
        with:
            packageManager: pnpm
        secrets:
@@ -9,6 +9,6 @@ on:
 permissions: {} # No permissions needed
 jobs:
    upload:
-        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
        secrets:
            LOCALAZY_WRITE_KEY: ${{ secrets.LOCALAZY_WRITE_KEY }}
@@ -2,7 +2,9 @@
 # and uploading it to netlify
 name: Upload Preview Build to Netlify
 on:
-    workflow_run:
+    # Privilege escalation necessary to publish to Netlify
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
        workflows: ["Build"]
        types:
            - completed
@@ -28,7 +30,7 @@ jobs:
                      Exercise caution. Use test accounts.

            - name: 📥 Download artifact
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  run-id: ${{ github.event.workflow_run.id }}
@@ -1,13 +1,15 @@
 name: Pull Request
 on:
-    pull_request_target:
+    # Privilege escalation necessary access members of the review teams
+    # 🚨 We must not execute any checked out code here, and be careful around use of user-controlled inputs.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
        types: [opened, edited, labeled, unlabeled, synchronize]
    merge_group:
        types: [checks_requested]
 permissions: {}
 jobs:
    action:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            pull-requests: write
        secrets:
@@ -9,4 +9,4 @@ jobs:
    draft:
        permissions:
            contents: write
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop # zizmor: ignore[unpinned-uses]
@@ -7,10 +7,11 @@ concurrency: ${{ github.repository }}-${{ github.workflow }}
 permissions: {} # We use ELEMENT_BOT_TOKEN instead
 jobs:
    merge:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop # zizmor: ignore[unpinned-uses]
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
        with:
+            # This relates to the directory in which to reset dependencies, only web needs this
            dir: apps/web
            dependencies: |
                matrix-js-sdk
@@ -14,7 +14,7 @@ concurrency: ${{ github.workflow }}
 permissions: {}
 jobs:
    release:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            contents: write
            issues: write
@@ -29,22 +29,9 @@ jobs:
            gpg-fingerprint: ${{ vars.GPG_FINGERPRINT }}
            asset-path: dist/*.tar.gz
            expected-asset-count: 3
+            # Desktop has no dist script so we only target web here
            dir: apps/web

-    notify-downstream:
-        name: Trigger release drafter downstream
-        needs: release
-        runs-on: ubuntu-24.04
-        steps:
-            - name: Notify element-desktop repo that element-web release has completed to re-trigger release-drafter
-              uses: benc-uk/workflow-dispatch@e2e5e9a103e331dad343f381a29e654aea3cf8fc # v1
-              with:
-                  workflow: release-drafter.yml
-                  repo: element-hq/element-desktop
-                  ref: staging
-                  # Required when using the `repo` option. Either a PAT or a token generated from the GitHub app or CLI
-                  token: "${{ secrets.ELEMENT_BOT_TOKEN }}"
-
    check:
        name: Post release checks
        needs: release
@@ -69,3 +56,12 @@ jobs:
                  wait-interval: 10
                  check-name: Build package
                  allowed-conclusions: success
+
+            - name: Wait for desktop packaging
+              uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
+              with:
+                  ref: master
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  wait-interval: 10
+                  check-regexp: Prepare|Linux|macOS|Windows|Deploy|deploy
+                  allowed-conclusions: success
@@ -2,11 +2,6 @@ name: Cut branches
 on:
    workflow_dispatch:
        inputs:
-            element-desktop:
-                description: Prepare element-desktop
-                required: true
-                type: boolean
-                default: true
            element-web:
                description: Prepare element-web
                required: true
@@ -26,8 +21,7 @@ jobs:
                repo:
                    - matrix-org/matrix-js-sdk
                    - element-hq/element-web
-                    - element-hq/element-desktop
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop # zizmor: ignore[unpinned-uses]
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
        with:
@@ -38,18 +32,8 @@ jobs:
        needs: checks
        env:
            # The order is specified bottom-up to avoid any races for allchange
-            REPOS: matrix-js-sdk element-web element-desktop
+            REPOS: matrix-js-sdk element-web
        steps:
-            - name: Checkout Element Desktop
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-              if: inputs.element-desktop
-              with:
-                  repository: element-hq/element-desktop
-                  path: element-desktop
-                  ref: staging
-                  fetch-depth: 0
-                  fetch-tags: true
-                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
            - name: Checkout Element Web
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.element-web
@@ -60,6 +44,7 @@ jobs:
                  fetch-depth: 0
                  fetch-tags: true
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true
            - name: Checkout Matrix JS SDK
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.matrix-js-sdk
@@ -70,16 +55,13 @@ jobs:
                  fetch-depth: 0
                  fetch-tags: true
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true

            - name: Prepare Git
              run: |
                  git config --global user.email "releases@riot.im"
                  git config --global user.name "RiotRobot"

-            - name: Merge Element Desktop
-              if: inputs.element-desktop
-              run: |
-                  git -C "element-desktop" merge origin/develop
            - name: Merge Element Web
              if: inputs.element-web
              run: |
@@ -113,14 +95,3 @@ jobs:
                  wait-interval: 10
                  check-name: "draft / draft"
                  allowed-conclusions: success
-
-            - name: Wait for element-desktop draft
-              if: inputs.element-desktop
-              uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
-              with:
-                  ref: staging
-                  repo: element-hq/element-desktop
-                  repo-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  wait-interval: 10
-                  check-name: "draft / draft"
-                  allowed-conclusions: success
@@ -14,10 +14,12 @@ jobs:
        steps:
            - name: 🧮 Checkout code
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
            - name: 🔧 Set up node environment
-              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  cache: "pnpm"
                  node-version-file: ".node-version"
@@ -13,10 +13,12 @@ jobs:
        steps:
            - name: 🧮 Checkout code
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
            - name: 🔧 Pnpm cache
-              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  cache: "pnpm"
                  node-version-file: package.json
@@ -29,7 +31,7 @@ jobs:
              working-directory: packages/shared-components
              run: pnpm build:storybook

-            - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: shared-components-storybook
                  path: packages/shared-components/storybook-static
@@ -20,7 +20,7 @@ jobs:
        needs: build
        environment: SharedComponents
        steps:
-            - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  name: shared-components-storybook
                  path: storybook-static
@@ -27,7 +27,7 @@ jobs:
              run: "sudo apt-get install -y tree"

            - name: Download Diffs
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  run-id: ${{ github.event.workflow_run.id }}
@@ -26,8 +26,8 @@ jobs:
                  persist-credentials: false
                  repository: element-hq/element-web

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  cache: "pnpm"
                  node-version: "lts/*"
@@ -42,7 +42,7 @@ jobs:
              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT

            - name: Cache playwright binaries
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
              id: playwright-cache
              with:
                  path: ~/.cache/ms-playwright
@@ -65,7 +65,7 @@ jobs:

            - name: Upload received images & diffs
              if: always()
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: received-images
                  path: packages/shared-components/__vis__/linux
@@ -12,7 +12,7 @@ jobs:
    sonarqube:
        name: 🩻 SonarQube
        if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'merge_group'
-        uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            actions: read
            statuses: write
@@ -22,3 +22,4 @@ jobs:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
        with:
            sharded: true
+            version-pkg-json-dir: ./apps/web
@@ -45,13 +45,18 @@ jobs:
                    - name: Rethemendex Check
                      command: "rethemendex"
                      assert-diff: true
+                    - name: Docs
+                      install: layered
+                      command: "docs:build"
        name: ${{ matrix.name }}
        runs-on: ubuntu-24.04
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              if: matrix.install != ''
              with:
                  cache: "pnpm"
@@ -73,6 +78,19 @@ jobs:
              run: git diff --exit-code
              if: matrix.assert-diff

+    zizmor:
+        name: Zizmor Github Actions lint
+        runs-on: ubuntu-24.04
+        permissions:
+            security-events: write
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
+
+            - name: Run zizmor
+              uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+
    i18n:
        strategy:
            fail-fast: false
@@ -92,10 +110,12 @@ jobs:
                          labs|sliding_sync_description
                          settings|voip|noise_suppression_description
                          settings|voip|echo_cancellation_description
+                    - name: Element Desktop
+                      path: "apps/desktop"
                    - name: Shared Components
                      path: "packages/shared-components"
        name: "i18n Check (${{ matrix.name }})"
-        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
        permissions:
            pull-requests: read
        with:
@@ -13,7 +13,7 @@ permissions: {} # We use ELEMENT_BOT_TOKEN instead

 jobs:
    sync-labels:
-        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@develop
+        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@7f2f93fb9b52ece7a0998f60e64862aa203c1746
        with:
            LABELS: |
                element-hq/element-meta
@@ -43,10 +43,11 @@ jobs:
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
            - name: pnpm cache
-              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  node-version: "lts/*"
                  cache: "pnpm"
@@ -57,7 +58,7 @@ jobs:
                  JS_SDK_GITHUB_BASE_REF: ${{ inputs.matrix-js-sdk-sha }}

            - name: Jest Cache
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
              with:
                  path: /tmp/jest_cache
                  key: ${{ hashFiles('**/pnpm-lock.yaml') }}
@@ -70,25 +71,29 @@ jobs:
              working-directory: apps/web
              run: |
                  pnpm test \
-                      --coverage=${{ env.ENABLE_COVERAGE }} \
+                      --coverage=$ENABLE_COVERAGE \
                      --ci \
-                      --max-workers ${{ steps.cpu-cores.outputs.count }} \
-                      --shard ${{ matrix.runner }}/${{ strategy.job-total }} \
+                      --max-workers $MAX_WORKERS \
+                      --shard "$SHARD" \
                      --cacheDirectory /tmp/jest_cache
              env:
                  JEST_SONAR_UNIQUE_OUTPUT_NAME: true

                  # tell jest to use coloured output
                  FORCE_COLOR: true
+                  MAX_WORKERS: ${{ steps.cpu-cores.outputs.count }}
+                  SHARD: ${{ format('{0}/{1}', matrix.runner, strategy.job-total) }}

            - name: Move coverage files into place
              if: env.ENABLE_COVERAGE == 'true'
              working-directory: apps/web
-              run: mv coverage/lcov.info coverage/${{ steps.setupNode.outputs.node-version }}-${{ matrix.runner }}.lcov.info
+              run: mv coverage/lcov.info coverage/$NODE_VERSION-${{ matrix.runner }}.lcov.info
+              env:
+                  NODE_VERSION: ${{ steps.setupNode.outputs.node-version }}

            - name: Upload Artifact
              if: env.ENABLE_COVERAGE == 'true'
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: coverage-${{ matrix.runner }}
                  path: |
@@ -125,10 +130,11 @@ jobs:
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
            - name: pnpm cache
-              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  node-version: "lts/*"
                  cache: "pnpm"
@@ -138,7 +144,7 @@ jobs:
              run: "pnpm install"

            - name: Cache storybook & vitest
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
              with:
                  path: |
                      packages/shared-components/node_modules/.cache
@@ -151,7 +157,7 @@ jobs:
              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT

            - name: Cache playwright binaries
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
              id: playwright-cache
              with:
                  path: ~/.cache/ms-playwright
@@ -164,11 +170,11 @@ jobs:

            - name: Run tests
              working-directory: "packages/shared-components"
-              run: pnpm test:unit --coverage=${{ env.ENABLE_COVERAGE }}
+              run: pnpm test:unit --coverage=$ENABLE_COVERAGE

            - name: Upload Artifact
              if: env.ENABLE_COVERAGE == 'true'
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: coverage-sharedcomponents
                  path: |
@@ -10,9 +10,11 @@ jobs:
        runs-on: ubuntu-24.04
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  cache: "pnpm"
                  node-version: "lts/*"
@@ -16,7 +16,6 @@ package-lock.json
 .env
 .env.*
 coverage
-/book
 /index.html
 # version file and tarball created by `npm pack` / `yarn pack`
 /git-revision.txt
@@ -28,6 +27,7 @@ storybook-static
 /packages/shared-components/node_modules
 /packages/shared-components/dist
 /packages/shared-components/src/i18nKeys.d.ts
+/packages/shared-components/.vitest-attachments

 # TSC incremental compilation information
 *.tsbuildinfo
@@ -38,3 +38,7 @@ storybook-static
 .nx/workspace-data

 .pnpm-store
+
+# vitepress
+/docs/.vitepress/dist
+/docs/.vitepress/cache
@@ -1,4 +1 @@
-#!/usr/bin/env sh
-. "$(dirname "$0")/_/husky.sh"
-
 npx lint-staged --concurrent false
@@ -1,3 +1,3 @@
 {
-    "*": "prettier --write"
+    "*": "prettier --write --ignore-unknown"
 }
@@ -18,7 +18,7 @@ coverage
 /apps/web/src/modules.ts
 /apps/web/src/modules.js
 src/i18n/strings
-/apps/web//build_config.yaml
+/apps/web/build_config.yaml
 # Raises an error because it contains a template var breaking the script tag
 /apps/web/src/vector/index.html
 /apps/web/src/vector/modernizr.cjs
@@ -29,7 +29,7 @@ debian/tmp
 package-lock.json

 # This file is owned, parsed, and generated by allchange, which doesn't comply with prettier
-/CHANGELOG.md
+CHANGELOG.md
 /docs/changelogs

 # Legacy skinning file that some people might still have
@@ -45,6 +45,15 @@ package-lock.json
 /apps/web/playwright/logs/
 /apps/web/playwright/snapshots/

+/apps/desktop/.hak/
+/apps/desktop/dist/
+/apps/desktop/build/
+/apps/desktop/dockerbuild/
+/apps/desktop/lib/
+/apps/desktop/webapp
+/apps/desktop/playwright/html-report
+/apps/desktop/playwright/test-results
+
 # Shared components generated files
 /packages/shared-components/dist/
 /packages/shared-components/src/i18n/i18nKeys.d.ts
@@ -1,3 +1,57 @@
+Changes in [1.12.14](https://github.com/element-hq/element-web/releases/tag/v1.12.14) (2026-04-07)
+==================================================================================================
+## ✨ Features
+
+* Add analytics tracking for URL previews ([#32659](https://github.com/element-hq/element-web/pull/32659)). Contributed by @Half-Shot.
+* Collapsible Room List - Clicking on separator should expand to last set width ([#32909](https://github.com/element-hq/element-web/pull/32909)). Contributed by @MidhunSureshR.
+* RoomList: improve performance ([#32919](https://github.com/element-hq/element-web/pull/32919)). Contributed by @florianduros.
+* Implement collapsible panels for the new room list ([#32742](https://github.com/element-hq/element-web/pull/32742)). Contributed by @MidhunSureshR.
+* Hide the names of banned users behind a spoiler tag (attempt 2) ([#32636](https://github.com/element-hq/element-web/pull/32636)). Contributed by @andybalaam.
+
+## 🐛 Bug Fixes
+
+* Use the code signing Subject Name as basis for Tray GUID on Windows ([#32939](https://github.com/element-hq/element-web/pull/32939)). Contributed by @t3chguy.
+* Ensure the incoming verification request appears above the please verify prompt ([#32931](https://github.com/element-hq/element-web/pull/32931)). Contributed by @andybalaam.
+* Collapsible Room List - Prevent any interaction with the separator when the panel is expanded ([#32910](https://github.com/element-hq/element-web/pull/32910)). Contributed by @MidhunSureshR.
+* Fix icon size of badges in right panel ([#32952](https://github.com/element-hq/element-web/pull/32952)). Contributed by @florianduros.
+* Fix room list often showing the wrong icons for calls ([#32881](https://github.com/element-hq/element-web/pull/32881)). Contributed by @robintown.
+* Fix emoticon slash commands including stale buffers ([#32928](https://github.com/element-hq/element-web/pull/32928)). Contributed by @t3chguy.
+* Fix presence indicators not showing without cache   ([#32880](https://github.com/element-hq/element-web/pull/32880)). Contributed by @DLCSharp.
+* Show space name instead of 'Empty room' after creation ([#32886](https://github.com/element-hq/element-web/pull/32886)). Contributed by @gugaribeiro05.
+* Strip ephemeral query params from OIDC redirect URI ([#32875](https://github.com/element-hq/element-web/pull/32875)). Contributed by @azmeuk.
+
+
+Changes in [1.12.13](https://github.com/element-hq/element-web/releases/tag/v1.12.13) (2026-03-24)
+==================================================================================================
+## 🦖 Deprecations
+
+* Remove automatic rageshakes on UTD labs feature ([#32778](https://github.com/element-hq/element-web/pull/32778)). Contributed by @Half-Shot.
+* Remove automaticErrorReporting labs feature ([#32781](https://github.com/element-hq/element-web/pull/32781)). Contributed by @Half-Shot.
+
+## ✨ Features
+
+* Upgrade Element Call for new picture-in-picture designs ([#32816](https://github.com/element-hq/element-web/pull/32816)). Contributed by @robintown.
+* Room list: add sections to shared components ([#32735](https://github.com/element-hq/element-web/pull/32735)). Contributed by @florianduros.
+* feat: Devtool for sticky events MSC4354 ([#32741](https://github.com/element-hq/element-web/pull/32741)). Contributed by @BillCarsonFr.
+* Port URL Preview components to MVVM ([#32525](https://github.com/element-hq/element-web/pull/32525)). Contributed by @Half-Shot.
+* Add support for Widget \& Room Header Buttons module APIs ([#32734](https://github.com/element-hq/element-web/pull/32734)). Contributed by @dbkr.
+* Port over linkifyJS to shared-components. ([#32731](https://github.com/element-hq/element-web/pull/32731)). Contributed by @Half-Shot.
+* Redesign widget pip and move into shared component ([#32654](https://github.com/element-hq/element-web/pull/32654)). Contributed by @toger5.
+* Implement customisations \& login component Module API 1.11.0 ([#32687](https://github.com/element-hq/element-web/pull/32687)). Contributed by @t3chguy.
+* Realign MessageActionBar to Figma designs ([#32722](https://github.com/element-hq/element-web/pull/32722)). Contributed by @t3chguy.
+* Implement new widget permissions module api ([#32565](https://github.com/element-hq/element-web/pull/32565)). Contributed by @langleyd.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix soft crash of room list when trying to open a room ([#32872](https://github.com/element-hq/element-web/pull/32872)). Contributed by @RiotRobot.
+* Fix "key storage out of sync" appearing when key storage is actually fine ([#32811](https://github.com/element-hq/element-web/pull/32811)). Contributed by @andybalaam.
+* Fix remove button styling in local address list of room settings ([#32798](https://github.com/element-hq/element-web/pull/32798)). Contributed by @florianduros.
+* Always check \& update the users timezone on their profile on startup ([#32764](https://github.com/element-hq/element-web/pull/32764)). Contributed by @Half-Shot.
+* Fix nx configuration to actually run type linter ([#32776](https://github.com/element-hq/element-web/pull/32776)). Contributed by @richvdh.
+* Fix expand space panel button not being shown on keyboard focus ([#32746](https://github.com/element-hq/element-web/pull/32746)). Contributed by @t3chguy.
+* Reset key storage if restoring from Recovery encounters the wrong decryption key ([#32668](https://github.com/element-hq/element-web/pull/32668)). Contributed by @andybalaam.
+
+
 Changes in [1.12.12](https://github.com/element-hq/element-web/releases/tag/v1.12.12) (2026-03-10)
 ==================================================================================================
 ## ✨ Features
@@ -46,6 +46,9 @@ As for your PR description, it should include these things:
 - Add comments to the diff for the reviewer that might help them to understand
  why the change is necessary or how they might better understand and review it.

+Please **_do not use force push_** in your PRs. Doing so means we can't see what
+has changed. We use squash merge to get a "clean" git history.
+
 ### Changelogs

 There's no need to manually add Changelog entries: we use information in the
@@ -68,25 +71,6 @@ the default for PRs labelled with `T-Task`):

 _Remove outdated comment from `Ungulates.ts`_

-```
-Notes: none
-```
-
-Sometimes, you're fixing a bug in a downstream project, in which case you want
-an entry in that project's changelog. You can do that too:
-
-_Fix another herding bug_
-
-```
-Notes: Fix a bug where the `herd()` function would only work on Tuesdays
-element-web notes: Fix a bug where the 'Herd' button only worked on Tuesdays
-```
-
-This example is for Element Web. You can specify:
-
- element-web
- element-desktop
-
 If your PR introduces a breaking change, use the `Notes` section in the same
 way, additionally adding the `X-Breaking-Change` label (see below). There's no need
 to specify in the notes that it's a breaking change - this will be added
@@ -72,7 +72,7 @@ Element can also be run as a desktop app, wrapped in Electron. You can download
 pre-built version from <https://element.io/get-started> or, if you prefer,
 build it yourself.

-To build it yourself, follow the instructions at <https://github.com/element-hq/element-desktop>.
+To build it yourself, follow the instructions at <https://github.com/element-hq/element-web/tree/develop/apps/desktop>.

 Many thanks to @aviraldg for the initial work on the Electron integration.

@@ -0,0 +1,90 @@
+module.exports = {
+    plugins: ["matrix-org", "n"],
+    extends: ["plugin:matrix-org/javascript"],
+    parserOptions: {
+        ecmaVersion: 2021,
+        project: ["tsconfig.json"],
+    },
+    env: {
+        es6: true,
+        node: true,
+        // we also have some browser code (ie. the preload script)
+        browser: true,
+    },
+    // NOTE: These rules are frozen and new rules should not be added here.
+    // New changes belong in https://github.com/matrix-org/eslint-plugin-matrix-org/
+    rules: {
+        "quotes": "off",
+        "indent": "off",
+        "prefer-promise-reject-errors": "off",
+        "no-async-promise-executor": "off",
+
+        "n/file-extension-in-import": ["error", "always"],
+        "unicorn/prefer-node-protocol": ["error"],
+    },
+    overrides: [
+        {
+            files: ["src/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+        {
+            files: ["hak/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            parserOptions: {
+                project: ["hak/tsconfig.json"],
+            },
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+                "n/file-extension-in-import": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+        {
+            files: ["scripts/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            parserOptions: {
+                project: ["scripts/tsconfig.json"],
+            },
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+                "n/file-extension-in-import": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+        {
+            files: ["playwright/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            parserOptions: {
+                project: ["playwright/tsconfig.json"],
+            },
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+    ],
+};
@@ -0,0 +1,22 @@
+/dist
+/lib
+/webapp
+/webapp.asar
+/packages
+/deploys
+node_modules/
+/pkg/control
+/.hak
+/.yarnrc
+/docker
+/.npmrc
+.vscode
+.vscode/
+/test_artifacts/
+/coverage/
+yarn-error.log
+/hak/**/*.js
+/scripts/hak/**/*.js
+.DS_Store
+/playwright-report
+.pnpm-store
@@ -0,0 +1,4 @@
+{
+    "*": "prettier --write --ignore-unknown",
+    "*.(ts|tsx)": ["eslint --fix"]
+}
@@ -0,0 +1 @@
+24.14.0
@@ -0,0 +1 @@
+module.exports = require("eslint-plugin-matrix-org/.prettierrc.js");
@@ -0,0 +1,173 @@
+![Build](https://github.com/vector-im/element-desktop/actions/workflows/build_desktop_and_deploy.yaml/badge.svg)
+![Static Analysis](https://github.com/vector-im/element-desktop/actions/workflows/static_analysis.yaml/badge.svg)
+[![Localazy](https://img.shields.io/endpoint?url=https%3A%2F%2Fconnect.localazy.com%2Fstatus%2Felement-web%2Fdata%3Fcontent%3Dall%26title%3Dlocalazy%26logo%3Dtrue)](https://localazy.com/p/element-web)
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=element-desktop&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=element-desktop)
+[![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=element-desktop&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=element-desktop)
+[![Bugs](https://sonarcloud.io/api/project_badges/measure?project=element-desktop&metric=bugs)](https://sonarcloud.io/summary/new_code?id=element-desktop)
+
+# Element Desktop
+
+Element Desktop is a Matrix client for desktop platforms with Element Web at its core.
+
+# First Steps
+
+Before you do anything else, fetch the dependencies:
+
+```
+pnpm install
+```
+
+# Fetching Element
+
+Since this package is just the Electron wrapper for Element Web, it doesn't contain any of the Element Web code,
+so the first step is to get a working copy of Element Web. There are a few ways of doing this:
+
+```
+# Fetch the prebuilt release Element package from the element-web GitHub releases page. The version
+# fetched will be the same as the local element-desktop package.
+# We're explicitly asking for no config, so the packaged Element will have no config.json.
+pnpm run fetch --noverify --cfgdir ""
+```
+
+...or if you'd like to use GPG to verify the downloaded package:
+
+```
+# Fetch the Element public key from the element.io web server over a secure connection and import
+# it into your local GPG keychain (you'll need GPG installed). You only need to to do this
+# once.
+pnpm run fetch --importkey
+# Fetch the package and verify the signature
+pnpm run fetch --cfgdir ""
+```
+
+...or either of the above, but fetching a specific version of Element:
+
+```
+# Fetch the prebuilt release Element package from the element-web GitHub releases page. The version
+# fetched will be the same as the local element-desktop package.
+pnpm run fetch --noverify --cfgdir "" v1.5.6
+```
+
+If you only want to run the app locally and don't need to build packages, you can
+provide the `webapp` directory directly:
+
+```
+ln -s ../web/webapp ./
+```
+
+[TODO: add support for fetching develop builds, arbitrary URLs and arbitrary paths]
+
+# Building
+
+## Native Build
+
+TODO: List native pre-requisites
+
+Optionally, [build the native modules](https://github.com/vector-im/element-desktop/blob/develop/docs/native-node-modules.md),
+which include support for searching in encrypted rooms and secure storage. Skipping this step is fine, you just won't have those features.
+
+Then, run
+
+```
+pnpm run build
+```
+
+This will do a couple of things:
+
+- Run the `setversion` script to set the local package version to match whatever
+  version of Element you installed above.
+- Run electron-builder to build a package. The package built will match the operating system
+  you're running the build process on.
+
+## Docker
+
+Alternatively, you can also build using docker, which will always produce the linux package:
+
+```
+# Run this once to make the docker image
+pnpm run docker:setup
+
+pnpm run docker:install
+# if you want to build the native modules (this will take a while)
+pnpm run docker:build:native
+pnpm run docker:build
+```
+
+After running, the packages should be in `dist/`.
+
+# Starting
+
+If you'd just like to run the electron app locally for development:
+
+```
+pnpm start
+```
+
+# Config
+
+If you'd like the packaged Element to have a configuration file, you can create a
+config directory and place `config.json` in there, then specify this directory
+with the `--cfgdir` option to `pnpm run fetch`, eg:
+
+```
+mkdir myconfig
+cp /path/to/my/config.json myconfig/
+pnpm run fetch --cfgdir myconfig
+```
+
+The config dir for the official Element app is in `element.io`. If you use this,
+your app will auto-update itself using builds from element.io.
+
+# Profiles
+
+To run multiple instances of the desktop app for different accounts, you can
+launch the executable with the `--profile` argument followed by a unique
+identifier, e.g `element-desktop --profile Work` for it to run a separate profile and
+not interfere with the default one.
+
+Alternatively, a custom location for the profile data can be specified using the
+`--profile-dir` flag followed by the desired path.
+
+# User-specified config.json
+
+- `%APPDATA%\$NAME\config.json` on Windows
+- `$XDG_CONFIG_HOME/$NAME/config.json` or `~/.config/$NAME/config.json` on Linux
+- `~/Library/Application Support/$NAME/config.json` on macOS
+
+In the paths above, `$NAME` is typically `Element`, unless you use `--profile
+$PROFILE` in which case it becomes `Element-$PROFILE`, or it is using one of
+the above created by a pre-1.7 install, in which case it will be `Riot` or
+`Riot-$PROFILE`.
+
+You may also specify a different path entirely for the `config.json` file by
+providing the `--config $YOUR_CONFIG_JSON_FILE` to the process, or via the
+`ELEMENT_DESKTOP_CONFIG_JSON` environment variable.
+
+# Translations
+
+To add a new translation, head to the [translating doc](https://github.com/vector-im/element-web/blob/develop/docs/translating.md).
+
+For a developer guide, see the [translating dev doc](https://github.com/vector-im/element-web/blob/develop/docs/translating-dev.md).
+
+# Report bugs & give feedback
+
+If you run into any bugs or have feedback you'd like to share, please let us know on GitHub.
+
+To help avoid duplicate issues, please [view existing issues](https://github.com/vector-im/element-web/issues?q=is%3Aopen+is%3Aissue+sort%3Areactions-%2B1-desc) first (and add a +1) or [create a new issue](https://github.com/vector-im/element-web/issues/new/choose) if you can't find it. Please note that this issue tracker is associated with the [element-web](https://github.com/vector-im/element-web) repo, but is also applied to the code in this repo as well.
+
+## Copyright & License
+
+Copyright (c) 2016-2017 OpenMarket Ltd
+
+Copyright (c) 2017 Vector Creations Ltd
+
+Copyright (c) 2017-2025 New Vector Ltd
+
+This software is multi licensed by New Vector Ltd (Element). It can be used either:
+
+(1) for free under the terms of the GNU Affero General Public License (as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version); OR
+
+(2) for free under the terms of the GNU General Public License (as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version); OR
+
+(3) under the terms of a paid-for Element Commercial License agreement between you and Element (the terms of which may vary depending on what you and Element have agreed to).
+Unless required by applicable law or agreed to in writing, software distributed under the Licenses is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the Licenses for the specific language governing permissions and limitations under the Licenses.
@@ -0,0 +1,3 @@
+module.exports = {
+    presets: [["@babel/preset-env", { targets: { node: "current" } }], "@babel/preset-typescript"],
+};
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- Entitlements from electron-builder's defaults
+         (https://github.com/electron-userland/electron-builder/blob/master/packages/app-builder-lib/templates/entitlements.mac.plist)
+         nb. This does *not* include the app sandbox: at the time of adding this file,
+         we were using electron-builder 21.2.0 which does not have the sandbox entitlement.
+         Latest electron-builder does, but it appears to be causing issues:
+         (https://github.com/electron-userland/electron-builder/issues/4390)
+    -->
+
+    <!-- https://github.com/electron/electron-notarize#prerequisites -->
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+
+    <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+
+    <!-- Our own additional entitlements (we need to access the camera and
+        mic for VoIP calls -->
+    <key>com.apple.security.device.camera</key>
+    <true/>
+    <key>com.apple.security.device.audio-input</key>
+    <true/>
+</dict>
+</plist>
@@ -0,0 +1,27 @@
+{
+    "fill": "automatic",
+    "groups": [
+        {
+            "layers": [
+                {
+                    "glass": false,
+                    "image-name": "element.png",
+                    "name": "element"
+                }
+            ],
+            "name": "Figma",
+            "shadow": {
+                "kind": "none",
+                "opacity": 0.5
+            },
+            "specular": false,
+            "translucency": {
+                "enabled": false,
+                "value": 0.5
+            }
+        }
+    ],
+    "supported-platforms": {
+        "squares": ["macOS"]
+    }
+}
@@ -0,0 +1,25 @@
+# Docker image to facilitate building Element Desktop's native bits using a glibc version (2.31)
+# with broader compatibility, down to Debian bullseye & Ubuntu focal.
+
+FROM rust:bullseye@sha256:16950191527a4cb9e0762d9d48b705a6315158e4035e64f7a93ce8656a1b053c
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get -qq update && apt-get -y -qq dist-upgrade && \
+  apt-get -y -qq install --no-install-recommends \
+  # tclsh is required for building SQLite as part of SQLCipher
+  tcl \
+  # Used by seshat (when not SQLCIPHER_STATIC) \
+  libsqlcipher-dev && \
+  apt-get purge -y --auto-remove && rm -rf /var/lib/apt/lists/*
+RUN ln -s /usr/bin/python3 /usr/bin/python & ln -s /usr/bin/pip3 /usr/bin/pip
+
+ENV DEBUG_COLORS=true
+ENV FORCE_COLOR=true
+
+WORKDIR /project
+
+ARG TARGETOS
+ARG TARGETARCH
+COPY .node-version dockerbuild/setup.sh /
+RUN /setup.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -x
+declare -A archMap=(["amd64"]="x64" ["arm64"]="arm64")
+ARCH="${archMap["$TARGETARCH"]}"
+# The .node-version file generally doesn't have the 'v' (renovate does not put the 'v' and will
+# strip it on upgrade if it's there) but the 'v' is also widely supported so we probably ought
+# to just work either way.
+NODE_VERSION=$(cat /.node-version | sed -e 's/^v//')
+curl --proto "=https" -L "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-$TARGETOS-$ARCH.tar.gz" | tar xz -C /usr/local --strip-components=1 && \
+  unlink /usr/local/CHANGELOG.md && unlink /usr/local/LICENSE && unlink /usr/local/README.md
+corepack enable
@@ -0,0 +1,234 @@
+import * as os from "node:os";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { type Configuration as BaseConfiguration } from "electron-builder";
+
+/**
+ * This script has different outputs depending on your os platform.
+ *
+ * On Windows:
+ *  Passes $ED_SIGNTOOL_THUMBPRINT and $ED_SIGNTOOL_SUBJECT_NAME to
+ *      build.win.signtoolOptions.signingHashAlgorithms and build.win.signtoolOptions.certificateSubjectName respectively if specified.
+ *
+ * On Linux:
+ *  Replaces spaces in the product name with dashes as spaces in paths can cause issues
+ *  Removes libsqlcipher0 recommended dependency if env SQLCIPHER_BUNDLED is asserted.
+ *  Passes $ED_DEBIAN_CHANGELOG to build.deb.fpm if specified
+ */
+
+/**
+ * Interface describing relevant fields of the package.json file.
+ */
+interface Pkg {
+    version: string;
+}
+
+/**
+ * Base metadata fields, used in both package.json and the variant configuration.
+ */
+interface Metadata {
+    name: string;
+    productName: string;
+    description: string;
+}
+
+/**
+ * Extra metadata fields that are injected into the build to pass to the app at runtime.
+ */
+interface ExtraMetadata extends Metadata {
+    electron_appId: string;
+    electron_protocol: string;
+    electron_windows_cert_sn?: string;
+}
+
+/**
+ * Interface describing the variant configuration format.
+ */
+interface Variant extends Metadata {
+    "appId": string;
+    "linux.executableName"?: string;
+    "linux.deb.name"?: string;
+    "protocols": string[];
+}
+
+type Writable<T> = NonNullable<
+    T extends Function ? T : T extends object ? { -readonly [K in keyof T]: Writable<T[K]> } : T
+>;
+
+// Load the default variant as a base configuration
+const DEFAULT_VARIANT = path.join("element.io", "release", "build.json");
+let variant: Variant = JSON.parse(fs.readFileSync(DEFAULT_VARIANT, "utf8"));
+
+/**
+ * If a variant is specified, we will use it to override the build-specific values.
+ * This allows us to have different builds for different purposes (e.g. stable, nightly).
+ */
+if (process.env.VARIANT_PATH) {
+    console.log(`Using variant configuration from '${process.env.VARIANT_PATH}':`);
+    variant = {
+        ...variant,
+        ...JSON.parse(fs.readFileSync(`${process.env.VARIANT_PATH}`, "utf8")),
+    };
+} else {
+    console.warn(`No VARIANT_PATH specified, using default variant configuration '${DEFAULT_VARIANT}':`);
+}
+
+for (const key in variant) {
+    console.log(`${key}: ${variant[key]}`);
+}
+
+interface Configuration extends BaseConfiguration {
+    extraMetadata: Partial<Pick<Pkg, "version">> & ExtraMetadata;
+    linux: BaseConfiguration["linux"];
+    win: BaseConfiguration["win"];
+    mac: BaseConfiguration["mac"];
+    deb: {
+        fpm: string[];
+    } & BaseConfiguration["deb"];
+}
+
+/**
+ * @type {import('electron-builder').Configuration}
+ * @see https://www.electron.build/configuration/configuration
+ */
+const config: Omit<Writable<Configuration>, "electronFuses"> & {
+    // Make all fuses required to ensure they are all explicitly specified
+    electronFuses: Required<Configuration["electronFuses"]>;
+} = {
+    appId: variant.appId,
+    asarUnpack: "**/*.node",
+    electronFuses: {
+        enableCookieEncryption: true,
+        onlyLoadAppFromAsar: true,
+        grantFileProtocolExtraPrivileges: false,
+
+        runAsNode: false,
+        enableNodeOptionsEnvironmentVariable: false,
+        enableNodeCliInspectArguments: false,
+        // We need to reset the signature if we are not signing on darwin otherwise it won't launch
+        resetAdHocDarwinSignature: !process.env.APPLE_TEAM_ID,
+
+        loadBrowserProcessSpecificV8Snapshot: false,
+        enableEmbeddedAsarIntegrityValidation: true,
+    },
+    files: [
+        "package.json",
+        {
+            from: ".hak/hakModules",
+            to: "node_modules",
+        },
+        "lib/**",
+    ],
+    extraResources: ["build/icon.*", "webapp.asar"],
+    extraMetadata: {
+        name: variant.name,
+        productName: variant.productName,
+        description: variant.description,
+        electron_appId: variant.appId,
+        electron_protocol: variant.protocols[0],
+    },
+    linux: {
+        target: ["tar.gz", "deb"],
+        category: "Network;InstantMessaging;Chat",
+        icon: "icon.png",
+        executableName: variant.name, // element-desktop or element-desktop-nightly
+    },
+    deb: {
+        packageCategory: "net",
+        depends: [
+            "libgtk-3-0",
+            "libnotify4",
+            "libnss3",
+            "libxss1",
+            "libxtst6",
+            "xdg-utils",
+            "libatspi2.0-0",
+            "libuuid1",
+            "libsecret-1-0",
+            "libasound2",
+            "libgbm1",
+        ],
+        recommends: ["libsqlcipher0", "element-io-archive-keyring"],
+        fpm: ["--deb-pre-depends", "libc6 (>= 2.31)"],
+    },
+    mac: {
+        target: ["dmg", "zip"],
+        category: "public.app-category.social-networking",
+        darkModeSupport: true,
+        hardenedRuntime: true,
+        gatekeeperAssess: true,
+        strictVerify: true,
+        entitlements: "./build/entitlements.mac.plist",
+        icon: "build/icon.icon",
+        mergeASARs: true,
+        x64ArchFiles: "**/matrix-seshat/*.node", // hak already runs lipo
+    },
+    dmg: {
+        badgeIcon: "build/icon.icon",
+    },
+    win: {
+        target: ["squirrel", "msi"],
+        signtoolOptions: {
+            signingHashAlgorithms: ["sha256"],
+        },
+        icon: "build/icon.ico",
+    },
+    msi: {
+        perMachine: true,
+    },
+    directories: {
+        output: "dist",
+    },
+    protocols: {
+        name: variant.productName,
+        schemes: variant.protocols,
+    },
+    nativeRebuilder: "sequential",
+    nodeGypRebuild: false,
+    npmRebuild: true,
+};
+
+/**
+ * Allow specifying the version via env var.
+ * If unspecified, it will default to the version in package.json.
+ * @param {string} process.env.VERSION
+ */
+if (process.env.VERSION) {
+    config.extraMetadata.version = process.env.VERSION;
+}
+
+if (variant["linux.deb.name"]) {
+    config.deb.fpm.push("--name", variant["linux.deb.name"]);
+}
+
+/**
+ * Allow specifying windows signing cert via env vars
+ * @param {string} process.env.ED_SIGNTOOL_SUBJECT_NAME
+ * @param {string} process.env.ED_SIGNTOOL_THUMBPRINT
+ */
+if (process.env.ED_SIGNTOOL_SUBJECT_NAME && process.env.ED_SIGNTOOL_THUMBPRINT) {
+    config.win.signtoolOptions!.certificateSubjectName = process.env.ED_SIGNTOOL_SUBJECT_NAME;
+    config.win.signtoolOptions!.certificateSha1 = process.env.ED_SIGNTOOL_THUMBPRINT;
+    config.extraMetadata.electron_windows_cert_sn = config.win.signtoolOptions!.certificateSubjectName;
+}
+
+if (os.platform() === "linux") {
+    // Electron crashes on debian if there's a space in the path.
+    // https://github.com/vector-im/element-web/issues/13171
+    config.extraMetadata.productName = config.extraMetadata.productName.replace(/ /g, "-");
+
+    /**
+     * Allow specifying deb changelog via env var
+     * @param {string} process.env.ED_DEB_CHANGELOG
+     */
+    if (process.env.ED_DEBIAN_CHANGELOG) {
+        config.deb.fpm.push(`--deb-changelog=${process.env.ED_DEBIAN_CHANGELOG}`);
+    }
+
+    if (process.env.SQLCIPHER_BUNDLED) {
+        // Remove sqlcipher dependency when using bundled
+        config.deb.recommends = config.deb.recommends?.filter((d) => d !== "libsqlcipher0");
+    }
+}
+
+export default config;
@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF8DCCBNigAwIBAgIRAIZSd8hNVs3w8AhJIsQSoYYwDQYJKoZIhvcNAQELBQAw
+gZExCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
+BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMTcwNQYD
+VQQDEy5DT01PRE8gUlNBIEV4dGVuZGVkIFZhbGlkYXRpb24gQ29kZSBTaWduaW5n
+IENBMB4XDTIwMDczMDAwMDAwMFoXDTIzMDczMDIzNTk1OVowgfMxETAPBgNVBAUT
+CDEwODczNjYxMRMwEQYLKwYBBAGCNzwCAQMTAkdCMR0wGwYDVQQPExRQcml2YXRl
+IE9yZ2FuaXphdGlvbjELMAkGA1UEBhMCR0IxDzANBgNVBBEMBlc0IDFRVTEYMBYG
+A1UECAwPTG9uZG9uLCBDaXR5IG9mMQ8wDQYDVQQHDAZMb25kb24xJzAlBgNVBAkM
+HjE0IFR1cm5oYW0gR3JlZW4sIFRlcnJhY2UgTWV3czEbMBkGA1UECgwSTmV3IFZl
+Y3RvciBMaW1pdGVkMRswGQYDVQQDDBJOZXcgVmVjdG9yIExpbWl0ZWQwggEiMA0G
+CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKDnGul2M7oCCN+3veGf7yfakSfMjK
+Kqeylyo0Nj8dUleNQvsRo0OHxIWJlbHDYglxebT109MqgyASr0SoeiqvXOSSFACD
+MYFoyerRGMnXEuomTU0y7+FE3p/hcim8+C5gS+rHr3YaJJuzzXRztjjCBGoY4was
+h9V8kYiyMMK0xi2WftOCBa1yYS32CInHIZVmdhzoK4k4YzSYIp57BWvnIUlDyCYk
+slNfp0SFbDrOGa7kbmy8HRfWPLjNmW5PPIrsf8LlnVRBfmTeUIJtV31w/FuMjeir
+pzYjzooXmpIrj96ecxdc9thP6etCUazvpowjfewu7UNWRUhGPtYn8v8rAgMBAAGj
+ggHdMIIB2TAfBgNVHSMEGDAWgBTfj/MgDOnKpgTYW1g3Kj2rRtyDSTAdBgNVHQ4E
+FgQUB9su4pCQXE5ZWFhB1eo48992LEcwDgYDVR0PAQH/BAQDAgeAMAwGA1UdEwEB
+/wQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEQYJYIZIAYb4QgEBBAQDAgQQMEkG
+A1UdIARCMEAwNQYMKwYBBAGyMQECAQYBMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8v
+c2VjdGlnby5jb20vQ1BTMAcGBWeBDAEDMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6
+Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET1JTQUV4dGVuZGVkVmFsaWRhdGlvbkNv
+ZGVTaWduaW5nQ0EuY3JsMIGGBggrBgEFBQcBAQR6MHgwUAYIKwYBBQUHMAKGRGh0
+dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JTQUV4dGVuZGVkVmFsaWRhdGlv
+bkNvZGVTaWduaW5nQ0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21v
+ZG9jYS5jb20wJgYDVR0RBB8wHaAbBggrBgEFBQcIA6APMA0MC0dCLTEwODczNjYx
+MA0GCSqGSIb3DQEBCwUAA4IBAQBZ8/YtqW/+VUoV8knKpdhMR2uTn8AEyVmfmoZA
+Ly5kdCRoKvFm/z4VK4cqF7gsUDxRIgDuMKKbWTtr1FEXuaZkUkOjicNcdYxc0pDn
+nFKBWAv5pN5OmnC9cVqIG7PtvD+8bKVzDdQRjpGMy6PY4rN2PYGfQ7KGgddEDD6m
+oM51jI/OTvCeU0Tyl0bixKEmpUJvbeQM9Ul2Y1o5Enx1Q9uda8xATb0HCMKgJ+GC
+iFHL2DNC3j1xK4QoZEIYgbTscj9rK4OMEov3PT/e1FwQyB5V9xdJ5i1MDBDD9fAf
+OiVgf90SffT7TgWUbA4Z+PtQHq/qNma0+dZWyeq7zYn2IIX3
+-----END CERTIFICATE-----
@@ -0,0 +1,6 @@
+This directory contains the config file for the official element.io distribution
+of Element Desktop.
+
+You probably do not want to build with this config unless you're building the
+official element.io distribution, or you'll find your builds will replace
+themselves with the element.io build.
@@ -0,0 +1,9 @@
+{
+    "appId": "im.riot.nightly",
+    "name": "element-desktop-nightly",
+    "productName": "Element Nightly",
+    "description": "Element: the future of secure communication (nightly unstable build)",
+    "protocols": ["io.element.nightly", "element"],
+    "linux.executableName": "element-desktop-nightly",
+    "linux.deb.name": "element-nightly"
+}
@@ -0,0 +1,65 @@
+{
+    "update_base_url": "https://packages.element.io/nightly/update/",
+    "default_server_name": "matrix.org",
+    "default_server_config": {
+        "m.homeserver": {
+            "base_url": "https://matrix-client.matrix.org"
+        },
+        "m.identity_server": {
+            "base_url": "https://vector.im"
+        }
+    },
+    "brand": "Element Nightly",
+    "integrations_ui_url": "https://scalar.vector.im/",
+    "integrations_rest_url": "https://scalar.vector.im/api",
+    "integrations_widgets_urls": [
+        "https://scalar.vector.im/_matrix/integrations/v1",
+        "https://scalar.vector.im/api",
+        "https://scalar-staging.vector.im/_matrix/integrations/v1",
+        "https://scalar-staging.vector.im/api",
+        "https://scalar-staging.riot.im/scalar/api"
+    ],
+    "bug_report_endpoint_url": "https://rageshakes.element.io/api/submit",
+    "uisi_autorageshake_app": "element-auto-uisi",
+    "show_labs_settings": true,
+    "room_directory": {
+        "servers": ["matrix.org", "gitter.im"]
+    },
+    "enable_presence_by_hs_url": {
+        "https://matrix.org": false,
+        "https://matrix-client.matrix.org": false
+    },
+    "terms_and_conditions_links": [
+        {
+            "url": "https://element.io/privacy",
+            "text": "Privacy Policy"
+        },
+        {
+            "url": "https://element.io/cookie-policy",
+            "text": "Cookie Policy"
+        }
+    ],
+    "sentry": {
+        "dsn": "https://029a0eb289f942508ae0fb17935bd8c5@sentry.matrix.org/6",
+        "environment": "nightly"
+    },
+    "posthog": {
+        "project_api_key": "phc_Jzsm6DTm6V2705zeU5dcNvQDlonOR68XvX2sh1sEOHO",
+        "api_host": "https://posthog.element.io"
+    },
+    "privacy_policy_url": "https://element.io/cookie-policy",
+    "features": {
+        "threadsActivityCentre": true,
+        "feature_spotlight": true,
+        "feature_group_calls": true,
+        "feature_video_rooms": true,
+        "feature_element_call_video_rooms": true
+    },
+    "setting_defaults": {
+        "RustCrypto.staged_rollout_percent": 100
+    },
+    "element_call": {
+        "url": "https://call.element.dev"
+    },
+    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
+}
@@ -0,0 +1,7 @@
+{
+    "appId": "im.riot.app",
+    "name": "element-desktop",
+    "productName": "Element",
+    "description": "Element: the future of secure communication",
+    "protocols": ["io.element.desktop", "element"]
+}
@@ -0,0 +1,59 @@
+{
+    "update_base_url": "https://packages.element.io/desktop/update/",
+    "default_server_name": "matrix.org",
+    "default_server_config": {
+        "m.homeserver": {
+            "base_url": "https://matrix-client.matrix.org"
+        },
+        "m.identity_server": {
+            "base_url": "https://vector.im"
+        }
+    },
+    "brand": "Element",
+    "integrations_ui_url": "https://scalar.vector.im/",
+    "integrations_rest_url": "https://scalar.vector.im/api",
+    "integrations_widgets_urls": [
+        "https://scalar.vector.im/_matrix/integrations/v1",
+        "https://scalar.vector.im/api",
+        "https://scalar-staging.vector.im/_matrix/integrations/v1",
+        "https://scalar-staging.vector.im/api",
+        "https://scalar-staging.riot.im/scalar/api"
+    ],
+    "bug_report_endpoint_url": "https://rageshakes.element.io/api/submit",
+    "uisi_autorageshake_app": "element-auto-uisi",
+    "room_directory": {
+        "servers": ["matrix.org", "gitter.im"]
+    },
+    "show_labs_settings": false,
+    "enable_presence_by_hs_url": {
+        "https://matrix.org": false,
+        "https://matrix-client.matrix.org": false
+    },
+    "terms_and_conditions_links": [
+        {
+            "url": "https://element.io/privacy",
+            "text": "Privacy Policy"
+        },
+        {
+            "url": "https://element.io/cookie-policy",
+            "text": "Cookie Policy"
+        }
+    ],
+    "posthog": {
+        "project_api_key": "phc_Jzsm6DTm6V2705zeU5dcNvQDlonOR68XvX2sh1sEOHO",
+        "api_host": "https://posthog.element.io"
+    },
+    "privacy_policy_url": "https://element.io/cookie-policy",
+    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx",
+    "setting_defaults": {
+        "RustCrypto.staged_rollout_percent": 60
+    },
+    "features": {
+        "feature_video_rooms": true,
+        "feature_group_calls": true,
+        "feature_element_call_video_rooms": true
+    },
+    "element_call": {
+        "url": "https://call.element.io"
+    }
+}
@@ -0,0 +1,34 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2020, 2021 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import type HakEnv from "../../scripts/hak/hakEnv.ts";
+import type { DependencyInfo } from "../../scripts/hak/dep.ts";
+
+export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    const env = hakEnv.makeGypEnv();
+
+    if (!hakEnv.isHost()) {
+        env.CARGO_BUILD_TARGET = hakEnv.getTargetId();
+    }
+
+    console.log("Running yarn install");
+    await hakEnv.spawn("yarn", ["install"], {
+        cwd: moduleInfo.moduleBuildDir,
+        env,
+        shell: true,
+    });
+
+    const buildTarget = hakEnv.wantsStaticSqlCipher() ? "build-bundled" : "build";
+
+    console.log("Running yarn build");
+    await hakEnv.spawn("yarn", ["run", buildTarget], {
+        cwd: moduleInfo.moduleBuildDir,
+        env,
+        shell: true,
+    });
+}
@@ -0,0 +1,55 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2020, 2021 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import childProcess from "node:child_process";
+import fsProm from "node:fs/promises";
+
+import type HakEnv from "../../scripts/hak/hakEnv.ts";
+import type { Tool } from "../../scripts/hak/hakEnv.ts";
+import type { DependencyInfo } from "../../scripts/hak/dep.ts";
+
+export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    const tools: Tool[] = [
+        ["rustc", "--version"],
+        ["python", "--version"], // node-gyp uses python for reasons beyond comprehension
+    ];
+    if (hakEnv.isWin()) {
+        tools.push(["perl", "--version"]); // for openssl configure
+        tools.push(["nasm", "-v"]); // for openssl building
+        tools.push(["patch", "--version"]); // to patch sqlcipher Makefile.msc
+        tools.push(["nmake", "/?"]);
+    } else {
+        tools.push(["make", "--version"]);
+    }
+    await hakEnv.checkTools(tools);
+
+    // Ensure Rust target exists (nb. we avoid depending on rustup)
+    await new Promise((resolve, reject) => {
+        const rustc = childProcess.execFile(
+            "rustc",
+            ["--target", hakEnv.getTargetId(), "--emit=obj", "-o", "tmp", "-"],
+            (err, out) => {
+                if (err) {
+                    reject(
+                        "rustc can't build for target " +
+                            hakEnv.getTargetId() +
+                            ": ensure target is installed via `rustup target add " +
+                            hakEnv.getTargetId() +
+                            "` " +
+                            "or your package manager if not using `rustup`",
+                    );
+                }
+                fsProm.unlink("tmp").then(resolve);
+            },
+        );
+        rustc.stdin!.write("fn main() {}");
+        rustc.stdout!.pipe(process.stdout);
+        rustc.stderr!.pipe(process.stderr);
+        rustc.stdin!.end();
+    });
+}
@@ -0,0 +1,7 @@
+{
+    "scripts": {
+        "check": "check.ts",
+        "build": "build.ts"
+    },
+    "copy": "index.node"
+}
@@ -0,0 +1,13 @@
+{
+    "compilerOptions": {
+        "moduleResolution": "node",
+        "esModuleInterop": true,
+        "target": "es2022",
+        "sourceMap": false,
+        "strict": true,
+        "lib": ["es2022"],
+        "types": ["node"],
+        "allowImportingTsExtensions": true
+    },
+    "include": ["../scripts/@types/*.d.ts", "./**/*.ts"]
+}
@@ -0,0 +1,111 @@
+{
+    "name": "element-desktop",
+    "productName": "Element",
+    "main": "lib/electron-main.js",
+    "exports": "./lib/electron-main.js",
+    "version": "1.12.13",
+    "description": "Element: the future of secure communication",
+    "author": {
+        "name": "Element",
+        "email": "support@element.io"
+    },
+    "homepage": "https://element.io",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/vector-im/element-web"
+    },
+    "license": "SEE LICENSE IN README.md",
+    "type": "module",
+    "files": [],
+    "engines": {
+        "node": ">=22.18"
+    },
+    "scripts": {
+        "i18n": "matrix-gen-i18n && pnpm i18n:sort && pnpm i18n:lint",
+        "i18n:sort": "matrix-sort-i18n src/i18n/strings/en_EN.json",
+        "i18n:lint": "prettier --log-level=silent  --write src/i18n/strings/ --ignore-path /dev/null",
+        "i18n:diff": "cp src/i18n/strings/en_EN.json src/i18n/strings/en_EN_orig.json && pnpm i18n && matrix-compare-i18n-files src/i18n/strings/en_EN_orig.json src/i18n/strings/en_EN.json",
+        "mkdirs": "mkdirp packages deploys",
+        "fetch": "pnpm run mkdirs && node scripts/fetch-package.ts",
+        "asar-webapp": "asar p webapp webapp.asar",
+        "start": "pnpm run build:ts && pnpm run build:res && electron .",
+        "lint": "pnpm lint:types && pnpm lint:js",
+        "lint:js": "eslint --max-warnings 0 src hak playwright scripts",
+        "lint:js-fix": "eslint --fix --max-warnings 0 src hak playwright scripts && prettier --log-level=warn --write .",
+        "lint:types": "pnpm lint:types:src && pnpm lint:types:test && pnpm lint:types:scripts && pnpm lint:types:hak",
+        "lint:types:src": "tsc --noEmit",
+        "lint:types:test": "tsc --noEmit -p playwright/tsconfig.json",
+        "lint:types:scripts": "tsc --noEmit -p scripts/tsconfig.json",
+        "lint:types:hak": "tsc --noEmit -p hak/tsconfig.json",
+        "build:native": "pnpm run hak",
+        "build:native:universal": "pnpm run hak --target x86_64-apple-darwin fetchandbuild && pnpm run hak --target aarch64-apple-darwin fetchandbuild && pnpm run hak --target x86_64-apple-darwin --target aarch64-apple-darwin copyandlink",
+        "build:32": "pnpm run build:ts && pnpm run build:res && electron-builder --ia32",
+        "build:64": "pnpm run build:ts && pnpm run build:res && electron-builder --x64",
+        "build:universal": "pnpm run build:ts && pnpm run build:res && electron-builder --universal",
+        "build": "pnpm run build:ts && pnpm run build:res && electron-builder",
+        "build:ts": "tsc",
+        "build:res": "node scripts/copy-res.ts",
+        "docker:setup": "docker build --platform linux/amd64 -t element-desktop-dockerbuild -f dockerbuild/Dockerfile .",
+        "docker:build:native": "scripts/in-docker.sh pnpm run hak",
+        "docker:build": "scripts/in-docker.sh pnpm run build",
+        "docker:install": "scripts/in-docker.sh pnpm install",
+        "clean": "rimraf webapp.asar dist packages deploys lib",
+        "hak": "node scripts/hak/index.ts",
+        "test": "playwright test",
+        "test:open": "pnpm test --ui",
+        "test:screenshots:build": "docker build playwright -t element-desktop-playwright --platform linux/amd64",
+        "test:screenshots:run": "docker run --rm --network host -v $(pwd):/work/element-desktop -v element-desktop-playwright:/work/element-desktop/node_modules -v /var/run/docker.sock:/var/run/docker.sock --platform linux/amd64 -it element-desktop-playwright",
+        "sane-postinstall": "electron-builder install-app-deps"
+    },
+    "dependencies": {
+        "@sentry/electron": "^7.0.0",
+        "auto-launch": "^5.0.5",
+        "counterpart": "^0.18.6",
+        "electron-store": "^11.0.0",
+        "electron-window-state": "^5.0.3",
+        "minimist": "^1.2.6",
+        "png-to-ico": "^3.0.0",
+        "uuid": "^13.0.0"
+    },
+    "devDependencies": {
+        "@babel/core": "^7.18.10",
+        "@babel/preset-env": "^7.18.10",
+        "@babel/preset-typescript": "^7.18.6",
+        "@electron/asar": "4.1.0",
+        "@playwright/test": "catalog:",
+        "@stylistic/eslint-plugin": "^5.0.0",
+        "@types/auto-launch": "^5.0.1",
+        "@types/counterpart": "^0.18.1",
+        "@types/minimist": "^1.2.1",
+        "@types/node": "18.19.130",
+        "@types/pacote": "^11.1.1",
+        "@typescript-eslint/eslint-plugin": "^8.0.0",
+        "@typescript-eslint/parser": "^8.0.0",
+        "app-builder-lib": "26.8.2",
+        "chokidar": "^5.0.0",
+        "detect-libc": "^2.0.0",
+        "electron": "41.0.3",
+        "electron-builder": "26.8.2",
+        "electron-builder-squirrel-windows": "26.8.2",
+        "electron-devtools-installer": "^4.0.0",
+        "eslint": "^8.26.0",
+        "eslint-config-google": "^0.14.0",
+        "eslint-config-prettier": "^10.0.0",
+        "eslint-plugin-import": "^2.25.4",
+        "eslint-plugin-matrix-org": "^3.0.0",
+        "eslint-plugin-n": "^17.12.0",
+        "eslint-plugin-unicorn": "^56.0.0",
+        "glob": "^13.0.0",
+        "matrix-web-i18n": "catalog:",
+        "mkdirp": "^3.0.0",
+        "pacote": "^21.0.0",
+        "prettier": "^3.0.0",
+        "rimraf": "^6.0.0",
+        "tar": "^7.5.8",
+        "typescript": "5.9.3"
+    },
+    "hakDependencies": {
+        "matrix-seshat": "^4.0.1"
+    },
+    "packageManager": "pnpm@10.32.1+sha512.a706938f0e89ac1456b6563eab4edf1d1faf3368d1191fc5c59790e96dc918e4456ab2e67d613de1043d2e8c81f87303e6b40d4ffeca9df15ef1ad567348f2be"
+}
@@ -0,0 +1,43 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { defineConfig } from "@playwright/test";
+
+const projects = [
+    "macos",
+    "win-x64",
+    "win-ia32",
+    "win-arm64",
+    "linux-amd64-sqlcipher-system",
+    "linux-amd64-sqlcipher-static",
+    "linux-arm64-sqlcipher-system",
+    "linux-arm64-sqlcipher-static",
+];
+
+export default defineConfig({
+    // Allows the GitHub action to specify a project name (OS + arch) for the combined report to make sense
+    // workaround for https://github.com/microsoft/playwright/issues/33521
+    projects: process.env.CI
+        ? projects.map((name) => ({
+              name,
+          }))
+        : undefined,
+    use: {
+        viewport: { width: 1280, height: 720 },
+        video: "retain-on-failure",
+        trace: "on-first-retry",
+    },
+    testDir: "playwright/e2e",
+    outputDir: "playwright/test-results",
+    workers: 1,
+    retries: process.env.CI ? 2 : 0,
+    reporter: process.env.CI ? [["blob"], ["github"]] : [["html", { outputFolder: "playwright/html-report" }]],
+    snapshotDir: "playwright/snapshots",
+    snapshotPathTemplate: "{snapshotDir}/{testFilePath}/{arg}-{platform}{ext}",
+    timeout: 30 * 1000,
+});
@@ -0,0 +1,5 @@
+/test-results/
+/html-report/
+# Only commit snapshots from Linux
+/snapshots/**/*.png
+!/snapshots/**/*-linux.png
@@ -0,0 +1,13 @@
+FROM mcr.microsoft.com/playwright:v1.58.2-jammy@sha256:4698a73749c5848d3f5fcd42a2174d172fcad2b2283e087843b115424303a565
+
+WORKDIR /work/element-desktop
+
+RUN apt-get update && apt-get -y install xvfb dbus-x11 && apt-get purge -y --auto-remove && rm -rf /var/lib/apt/lists/*
+
+# Create node_modules & dist dirs so that the volumes have the correct permissions
+RUN mkdir node_modules dist && chown 1000:1000 node_modules dist
+
+USER 1000:1000
+
+COPY docker-entrypoint.sh /opt/docker-entrypoint.sh
+ENTRYPOINT ["bash", "/opt/docker-entrypoint.sh"]
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -e
+
+echo "Starting Xvfb"
+Xvfb :99 -ac &
+sleep 2
+
+export DISPLAY=:99
+
+pnpm install --frozen-lockfile
+pnpm build -l --dir
+
+PLAYWRIGHT_HTML_OPEN=never ELEMENT_DESKTOP_EXECUTABLE="./dist/linux-unpacked/element-desktop" \
+  npx playwright test --update-snapshots --reporter line,html "$1"
+
+# Clean up
+rm -R core qemu_* || exit 0
@@ -0,0 +1,44 @@
+/*
+Copyright 2024 New Vector Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { test, expect } from "../../element-desktop-test.js";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+test.describe("App config options", () => {
+    test.describe("Should load custom config via env", () => {
+        test.slow();
+        test.use({
+            extraEnv: {
+                ELEMENT_DESKTOP_CONFIG_JSON: resolve(__dirname, "../..", "fixtures/custom-config.json"),
+            },
+        });
+        test("should launch and use configured homeserver", async ({ page }) => {
+            await page.locator("#matrixchat").waitFor();
+            await page.locator(".mx_Welcome").waitFor();
+            await expect(page).toHaveURL("vector://vector/webapp/#/welcome");
+            await page.getByText("Sign in").click();
+            await page.getByText("matrix.example.org", { exact: true }).waitFor();
+        });
+    });
+    test.describe("Should load custom config via argument", () => {
+        test.slow();
+        test.use({
+            extraArgs: ["--config", resolve(__dirname, "../..", "fixtures/custom-config.json")],
+        });
+        test("should launch and use configured homeserver", async ({ page }) => {
+            await page.locator("#matrixchat").waitFor();
+            await page.locator(".mx_Welcome").waitFor();
+            await expect(page).toHaveURL("vector://vector/webapp/#/welcome");
+            await page.getByText("Sign in").click();
+            await page.getByText("matrix.example.org", { exact: true }).waitFor();
+        });
+    });
+});
@@ -0,0 +1,75 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2022, 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { test, expect } from "../../element-desktop-test.js";
+
+declare global {
+    interface ElectronPlatform {
+        getEventIndexingManager():
+            | {
+                  supportsEventIndexing(): Promise<boolean>;
+              }
+            | undefined;
+        getPickleKey(userId: string, deviceId: string): Promise<string | null>;
+        createPickleKey(userId: string, deviceId: string): Promise<string | null>;
+    }
+
+    interface Window {
+        mxPlatformPeg: {
+            get(): ElectronPlatform;
+        };
+    }
+}
+
+test.describe("App launch", () => {
+    test.slow();
+
+    test.beforeEach(async ({ page }) => {
+        await page.locator("#matrixchat").waitFor();
+        await page.locator(".mx_Welcome").waitFor();
+    });
+
+    test("should launch and render the welcome view successfully", async ({ page }) => {
+        await expect(page).toHaveURL("vector://vector/webapp/#/welcome");
+        await expect(page).toHaveScreenshot();
+    });
+
+    test("should launch and render the welcome view successfully and support seshat", async ({ page }) => {
+        await expect(
+            page.evaluate<boolean>(async () => {
+                return window.mxPlatformPeg.get().getEventIndexingManager()?.supportsEventIndexing();
+            }),
+        ).resolves.toBeTruthy();
+    });
+
+    test.describe("safeStorage", () => {
+        const userId = "@user:server";
+        const deviceId = "ABCDEF";
+
+        test("should be supported", async ({ page }) => {
+            await expect(
+                page.evaluate(
+                    ([userId, deviceId]) => window.mxPlatformPeg.get().createPickleKey(userId, deviceId),
+                    [userId, deviceId],
+                ),
+            ).resolves.not.toBeNull();
+        });
+    });
+
+    test.describe("--no-update", () => {
+        test.use({
+            extraArgs: ["--no-update"],
+        });
+
+        // XXX: this test works fine locally but in CI the app start races with the test plumbing up the stdout/stderr pipes
+        // which means the logs are missed, disabling for now.
+        test.skip("should respect option", async ({ page, stdout }) => {
+            expect(stdout.data.toString()).toContain("Auto update disabled via command line flag");
+        });
+    });
+});
@@ -0,0 +1,36 @@
+/*
+Copyright 2025 New Vector Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { test, expect } from "../../element-desktop-test.js";
+
+declare global {
+    interface ElectronPlatform {
+        getOidcCallbackUrl(): URL;
+    }
+
+    interface Window {
+        mxPlatformPeg: {
+            get(): ElectronPlatform;
+        };
+    }
+}
+
+test.describe("OIDC Native", () => {
+    test.slow();
+
+    test.beforeEach(async ({ page }) => {
+        await page.locator(".mx_Welcome").waitFor();
+    });
+
+    test("should use OIDC callback URL without authority component", async ({ page }) => {
+        await expect(
+            page.evaluate<string>(() => {
+                return window.mxPlatformPeg.get().getOidcCallbackUrl().toString();
+            }),
+        ).resolves.toMatch(/io\.element\.(desktop|nightly):\/vector\/webapp\//);
+    });
+});
@@ -0,0 +1,120 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { _electron as electron, test as base, expect as baseExpect, type ElectronApplication } from "@playwright/test";
+import fs from "node:fs/promises";
+import path, { dirname } from "node:path";
+import os from "node:os";
+import { fileURLToPath } from "node:url";
+import { PassThrough } from "node:stream";
+
+/**
+ * A PassThrough stream that captures all data written to it.
+ */
+class CapturedPassThrough extends PassThrough {
+    private _chunks = [];
+
+    public constructor() {
+        super();
+        super.on("data", this.onData);
+    }
+
+    private onData = (chunk): void => {
+        this._chunks.push(chunk);
+    };
+
+    public get data(): Buffer {
+        return Buffer.concat(this._chunks);
+    }
+}
+
+interface Fixtures {
+    app: ElectronApplication;
+    tmpDir: string;
+    extraEnv: Record<string, string>;
+    extraArgs: string[];
+
+    // Utilities to capture stdout and stderr for tests to make assertions against
+    stdout: CapturedPassThrough;
+    stderr: CapturedPassThrough;
+}
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+export const test = base.extend<Fixtures>({
+    extraEnv: {},
+    extraArgs: [],
+
+    // eslint-disable-next-line no-empty-pattern
+    stdout: async ({}, use) => {
+        await use(new CapturedPassThrough());
+    },
+    // eslint-disable-next-line no-empty-pattern
+    stderr: async ({}, use) => {
+        await use(new CapturedPassThrough());
+    },
+
+    // eslint-disable-next-line no-empty-pattern
+    tmpDir: async ({}, use) => {
+        const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "element-desktop-tests-"));
+        await use(tmpDir);
+        await fs.rm(tmpDir, { recursive: true });
+    },
+    app: async ({ tmpDir, extraEnv, extraArgs, stdout, stderr }, use) => {
+        const args = ["--profile-dir", tmpDir, ...extraArgs];
+
+        if (process.env.GITHUB_ACTIONS) {
+            if (process.platform === "linux") {
+                // GitHub Actions hosted runner lacks dbus and a compatible keyring, so we need to force plaintext storage
+                args.push("--storage-mode", "force-plaintext");
+            } else if (process.platform === "darwin") {
+                // GitHub Actions hosted runner has no working default keychain, so allow plaintext storage
+                args.push("--storage-mode", "allow-plaintext");
+            }
+        }
+
+        const executablePath = process.env["ELEMENT_DESKTOP_EXECUTABLE"];
+        if (!executablePath) {
+            // Unpackaged mode testing
+            args.unshift(path.join(__dirname, "..", "lib", "electron-main.js"));
+        }
+
+        console.log(`Launching '${executablePath || "electron"}' with args ${args.join(" ")}`);
+
+        const app = await electron.launch({
+            env: {
+                ...process.env,
+                ...extraEnv,
+            },
+            executablePath,
+            args,
+        });
+
+        app.process().stdout.pipe(stdout).pipe(process.stdout);
+        app.process().stderr.pipe(stderr).pipe(process.stderr);
+
+        await app.firstWindow();
+
+        // Block matrix.org access to ensure consistent tests
+        const context = app.context();
+        await context.route("https://matrix.org/**", async (route) => {
+            await route.abort();
+        });
+
+        await use(app);
+    },
+    page: async ({ app }, use) => {
+        const window = await app.firstWindow();
+        await use(window);
+        await app.close().catch((e) => {
+            console.error(e);
+        });
+    },
+});
+
+export const expect = baseExpect;
@@ -0,0 +1,10 @@
+{
+    "default_server_config": {
+        "m.homeserver": {
+            "base_url": "https://matrix.example.org"
+        },
+        "m.identity_server": {
+            "base_url": "https://identity.example.org"
+        }
+    }
+}
@@ -0,0 +1,12 @@
+{
+    "compilerOptions": {
+        "resolveJsonModule": true,
+        "moduleResolution": "node",
+        "esModuleInterop": true,
+        "target": "es2022",
+        "module": "es2022",
+        "lib": ["es2022", "dom"],
+        "types": ["node"]
+    },
+    "include": ["**/*.ts"]
+}
@@ -0,0 +1,23 @@
+{
+    "$schema": "../../node_modules/nx/schemas/project-schema.json",
+    "projectType": "app",
+    "root": "apps/desktop",
+    "targets": {
+        "docker:build": {
+            "executor": "@nx-tools/nx-container:build",
+            "options": {
+                "load": true,
+                "engine": "docker",
+                "platforms": ["linux/amd64", "linux/arm64"],
+                "provenance": "true",
+                "sbom": true,
+                "context": "{projectRoot}",
+                "file": "{projectRoot}/dockerbuild/Dockerfile",
+                "metadata": {
+                    "images": ["ghcr.io/element-hq/element-web/desktop-build-env"],
+                    "tags": ["type=ref,event=branch"]
+                }
+            }
+        }
+    }
+}
@@ -0,0 +1,48 @@
+#!/bin/bash
+
+# Script for downloading a branch of element-web matching the branch a PR is contributed from
+
+set -x
+
+deforg="element-hq"
+defrepo="element-web"
+
+# The PR_NUMBER variable must be set explicitly.
+default_org_repo=${GITHUB_REPOSITORY:-"$deforg/$defrepo"}
+PR_ORG=${PR_ORG:-${default_org_repo%%/*}}
+PR_REPO=${PR_REPO:-${default_org_repo##*/}}
+
+# A function that clones a branch of a repo based on the org, repo and branch
+clone() {
+    org=$1
+    repo=$2
+    branch=$3
+    if [ -n "$branch" ]
+    then
+        echo "Trying to use $org/$repo#$branch"
+        # Disable auth prompts: https://serverfault.com/a/665959
+        GIT_TERMINAL_PROMPT=0 git clone https://github.com/$org/$repo.git $repo --branch "$branch" --depth 1 && exit 0
+    fi
+}
+
+echo "Getting info about a PR with number $PR_NUMBER"
+apiEndpoint="https://api.github.com/repos/$PR_ORG/$PR_REPO/pulls/$PR_NUMBER"
+head=$(curl "$apiEndpoint" | jq -r '.head.label')
+
+# for forks, $head will be in the format "fork:branch", so we split it by ":"
+# into an array. On non-forks, this has the effect of splitting into a single
+# element array given ":" shouldn't appear in the head - it'll just be the
+# branch name. Based on the results, we clone.
+BRANCH_ARRAY=(${head//:/ })
+TRY_ORG=$deforg
+TRY_BRANCH=${BRANCH_ARRAY[0]}
+if [[ "$head" == *":"* ]]; then
+    # ... but only match that fork if it's a real fork
+    if [ "${BRANCH_ARRAY[0]}" != "$PR_ORG" ]; then
+        TRY_ORG=${BRANCH_ARRAY[0]}
+    fi
+    TRY_BRANCH=${BRANCH_ARRAY[1]}
+fi
+clone "$TRY_ORG" "$defrepo" "$TRY_BRANCH"
+
+exit 1
@@ -0,0 +1,7 @@
+REM Batch file to aid in cross-compiling sqlcipher for Windows ARM64
+REM Full path should be passed to Makefile.msc as NCC env var
+
+setlocal
+call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" %VSCMD_ARG_HOST_ARCH%
+cl.exe %*
+endlocal
@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+
+// copies resources into the lib directory.
+
+import parseArgs from "minimist";
+import * as chokidar from "chokidar";
+import * as path from "node:path";
+import * as fs from "node:fs";
+
+const argv = parseArgs(process.argv.slice(2), {});
+
+const watch = argv.w;
+const verbose = argv.v;
+
+function errCheck(err: unknown): void {
+    if (err) {
+        console.error(err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+}
+
+const I18N_BASE_PATH = "src/i18n/strings/";
+const INCLUDE_LANGS = fs.readdirSync(I18N_BASE_PATH).filter((fn) => fn.endsWith(".json"));
+
+// Ensure lib, lib/i18n and lib/i18n/strings all exist
+fs.mkdirSync("lib/i18n/strings", { recursive: true });
+
+type Translations = Record<string, Record<string, string> | string>;
+
+function genLangFile(file: string, dest: string): void {
+    const translations: Translations = {};
+    [file].forEach(function (f) {
+        if (fs.existsSync(f)) {
+            try {
+                Object.assign(translations, JSON.parse(fs.readFileSync(f).toString()));
+            } catch (e) {
+                console.error("Failed: " + f, e);
+                throw e;
+            }
+        }
+    });
+
+    const json = JSON.stringify(translations, null, 4);
+    const filename = path.basename(file);
+
+    fs.writeFileSync(dest + filename, json);
+    if (verbose) {
+        console.log("Generated language file: " + filename);
+    }
+}
+
+/*
+ watch the input files for a given language,
+ regenerate the file, and regenerating languages.json with the new filename
+ */
+function watchLanguage(file: string, dest: string): void {
+    // XXX: Use a debounce because for some reason if we read the language
+    // file immediately after the FS event is received, the file contents
+    // appears empty. Possibly https://github.com/nodejs/node/issues/6112
+    let makeLangDebouncer: NodeJS.Timeout | undefined;
+    const makeLang = (): void => {
+        if (makeLangDebouncer) {
+            clearTimeout(makeLangDebouncer);
+        }
+        makeLangDebouncer = setTimeout(() => {
+            genLangFile(file, dest);
+        }, 500);
+    };
+
+    chokidar.watch(file).on("add", makeLang).on("change", makeLang).on("error", errCheck);
+}
+
+// language resources
+const I18N_DEST = "lib/i18n/strings/";
+INCLUDE_LANGS.forEach((file): void => {
+    genLangFile(I18N_BASE_PATH + file, I18N_DEST);
+}, {});
+
+if (watch) {
+    INCLUDE_LANGS.forEach((file) => watchLanguage(I18N_BASE_PATH + file, I18N_DEST));
+}
@@ -0,0 +1,240 @@
+#!/usr/bin/env node
+
+import * as path from "node:path";
+import { createWriteStream, promises as fs } from "node:fs";
+import * as childProcess from "node:child_process";
+import * as tar from "tar";
+import * as asar from "@electron/asar";
+import { promises as stream } from "node:stream";
+
+import riotDesktopPackageJson from "../package.json" with { type: "json" };
+import { setPackageVersion } from "./set-version.ts";
+
+const PUB_KEY_URL = "https://packages.riot.im/element-release-key.asc";
+const PACKAGE_URL_PREFIX = "https://github.com/element-hq/element-web/releases/download/";
+const DEVELOP_TGZ_URL = "https://develop.element.io/develop.tar.gz";
+const ASAR_PATH = "webapp.asar";
+
+async function downloadToFile(url: string, filename: string): Promise<void> {
+    console.log("Downloading " + url + "...");
+
+    try {
+        const resp = await fetch(url);
+        if (!resp.ok) throw new Error(`unexpected response ${resp.statusText}`);
+        if (!resp.body) throw new Error(`unexpected response has no body ${resp.statusText}`);
+        await stream.pipeline(resp.body, createWriteStream(filename));
+    } catch (e) {
+        console.error(e);
+        try {
+            await fs.unlink(filename);
+        } catch {}
+        throw e;
+    }
+}
+
+async function verifyFile(filename: string): Promise<void> {
+    return new Promise<void>((resolve, reject) => {
+        childProcess.execFile("gpg", ["--verify", filename + ".asc", filename], (error) => {
+            if (error) {
+                reject(error);
+            } else {
+                resolve();
+            }
+        });
+    });
+}
+
+async function main(): Promise<number | undefined> {
+    let verify = true;
+    let importkey = false;
+    let pkgDir = "packages";
+    let deployDir = "deploys";
+    let cfgDir: string | undefined;
+    let targetVersion: string | undefined;
+    let filename: string | undefined;
+    let url: string | undefined;
+    let setVersion = false;
+
+    while (process.argv.length > 2) {
+        switch (process.argv[2]) {
+            case "--noverify":
+                verify = false;
+                break;
+            case "--importkey":
+                importkey = true;
+                break;
+            case "--packages":
+                process.argv.shift();
+                pkgDir = process.argv[2];
+                break;
+            case "--deploys":
+                process.argv.shift();
+                deployDir = process.argv[2];
+                break;
+            case "--cfgdir":
+            case "-d":
+                process.argv.shift();
+                cfgDir = process.argv[2];
+                break;
+            default:
+                targetVersion = process.argv[2];
+        }
+        process.argv.shift();
+    }
+
+    if (targetVersion === undefined) {
+        targetVersion = "v" + riotDesktopPackageJson.version;
+    } else if (targetVersion !== "develop") {
+        setVersion = true; // version was specified
+    }
+
+    if (targetVersion === "develop") {
+        filename = "develop.tar.gz";
+        url = DEVELOP_TGZ_URL;
+        verify = false; // develop builds aren't signed
+    } else if (targetVersion.includes("://")) {
+        filename = targetVersion.substring(targetVersion.lastIndexOf("/") + 1);
+        url = targetVersion;
+        verify = false; // manually verified
+    } else {
+        filename = `element-${targetVersion}.tar.gz`;
+        url = PACKAGE_URL_PREFIX + targetVersion + "/" + filename;
+    }
+
+    const haveGpg = await new Promise<boolean>((resolve) => {
+        childProcess.execFile("gpg", ["--version"], (error) => {
+            resolve(!error);
+        });
+    });
+
+    if (importkey) {
+        if (!haveGpg) {
+            console.log("Can't import key without working GPG binary: install GPG and try again");
+            return 1;
+        }
+
+        await new Promise<boolean>((resolve, reject) => {
+            const gpgProc = childProcess.execFile("gpg", ["--import"], (error) => {
+                if (error) {
+                    console.log("Failed to import key", error);
+                } else {
+                    console.log("Key imported!");
+                }
+                resolve(!error);
+            });
+            fetch(PUB_KEY_URL)
+                .then((resp) => {
+                    if (!resp.ok) throw new Error(`unexpected response ${resp.statusText}`);
+                    if (!resp.body) throw new Error(`unexpected response has no body ${resp.statusText}`);
+                    stream.pipeline(resp.body, gpgProc.stdin!).catch(reject);
+                })
+                .catch(reject);
+        });
+        return 0;
+    }
+
+    if (cfgDir === undefined) {
+        console.log("No config directory set");
+        console.log("Specify a config directory with --cfgdir or -d");
+        console.log("To build with no config (and no auto-update), pass the empty string (-d '')");
+        return 1;
+    }
+
+    if (verify && !haveGpg) {
+        console.log("No working GPG binary: install GPG or pass --noverify to skip verification");
+        return 1;
+    }
+
+    let haveDeploy = false;
+    let expectedDeployDir = path.join(deployDir, path.basename(filename).replace(/\.tar\.gz/, ""));
+    try {
+        await fs.opendir(expectedDeployDir);
+        console.log(expectedDeployDir + "already exists");
+        haveDeploy = true;
+    } catch {}
+
+    if (!haveDeploy) {
+        const outPath = path.join(pkgDir, filename);
+        try {
+            await fs.stat(outPath);
+            console.log("Already have " + filename + ": not redownloading");
+        } catch {
+            try {
+                await downloadToFile(url, outPath);
+            } catch (e) {
+                console.log("Failed to download " + url, e);
+                return 1;
+            }
+        }
+
+        if (verify) {
+            try {
+                await fs.stat(outPath + ".asc");
+                console.log("Already have " + filename + ".asc: not redownloading");
+            } catch {
+                try {
+                    await downloadToFile(url + ".asc", outPath + ".asc");
+                } catch (e) {
+                    console.log("Failed to download " + url, e);
+                    return 1;
+                }
+            }
+
+            try {
+                await verifyFile(outPath);
+                console.log(outPath + " downloaded and verified");
+            } catch (e) {
+                console.log("Signature verification failed!", e);
+                return 1;
+            }
+        } else {
+            console.log(outPath + " downloaded but NOT verified");
+        }
+
+        await tar.x({
+            file: outPath,
+            cwd: deployDir,
+            onentry: (entry) => {
+                // Find the appropriate extraction path, only needed for `develop` where the dir name is unknown
+                if (entry.type === "Directory" && !path.join(deployDir, entry.path).startsWith(expectedDeployDir)) {
+                    expectedDeployDir = path.join(deployDir, entry.path);
+                }
+            },
+        });
+    }
+
+    try {
+        await fs.stat(ASAR_PATH);
+        console.log(ASAR_PATH + " already present: removing");
+        await fs.unlink(ASAR_PATH);
+    } catch {}
+
+    if (cfgDir.length) {
+        const configJsonSource = path.join(cfgDir, "config.json");
+        const configJsonDest = path.join(expectedDeployDir, "config.json");
+        console.log(configJsonSource + " -> " + configJsonDest);
+        await fs.copyFile(configJsonSource, configJsonDest);
+    } else {
+        console.log("Skipping config file");
+    }
+
+    console.log("Pack " + expectedDeployDir + " -> " + ASAR_PATH);
+    await asar.createPackage(expectedDeployDir, ASAR_PATH);
+
+    if (setVersion) {
+        const semVer = (await fs.readFile(path.join(expectedDeployDir, "version"), "utf-8")).trim();
+        console.log("Updating version to " + semVer);
+        await setPackageVersion(semVer);
+    }
+
+    console.log("Done!");
+}
+
+main()
+    .then((ret) => {
+        process.exit(ret);
+    })
+    .catch((e) => {
+        console.error(e);
+        process.exit(1);
+    });
@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+
+/**
+ * Script to generate incremental Nightly build versions, based on the latest Nightly build version of that kind.
+ * The version format is YYYYMMDDNN where NN is in case we need to do multiple versions in a day.
+ *
+ * NB. on windows, squirrel will try to parse the version number parts, including this string, into 32-bit integers,
+ * which is fine as long as we only add two digits to the end...
+ */
+
+import parseArgs from "minimist";
+
+const argv = parseArgs<{
+    latest?: string;
+}>(process.argv.slice(2), {
+    string: ["latest"],
+});
+
+function parseVersion(version: string): [Date, number] {
+    const year = parseInt(version.slice(0, 4), 10);
+    const month = parseInt(version.slice(4, 6), 10);
+    const day = parseInt(version.slice(6, 8), 10);
+    const num = parseInt(version.slice(8, 10), 10);
+    return [new Date(year, month - 1, day), num];
+}
+
+const [latestDate, latestNum] = argv.latest ? parseVersion(argv.latest) : [];
+
+const now = new Date();
+const month = (now.getMonth() + 1).toString().padStart(2, "0");
+const date = now.getDate().toString().padStart(2, "0");
+let buildNum = 1;
+if (latestDate && new Date(latestDate).getDate().toString().padStart(2, "0") === date) {
+    buildNum = latestNum! + 1;
+}
+
+if (buildNum > 99) {
+    throw new Error("Maximum number of Nightlies exceeded on this day.");
+}
+
+console.log(now.getFullYear() + month + date + buildNum.toString().padStart(2, "0"));
@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+
+/*
+ * Checks for the presence of a webapp, inspects its version and prints it
+ */
+
+import url from "node:url";
+
+import { versionFromAsar } from "./set-version.ts";
+
+async function main(): Promise<number> {
+    const version = await versionFromAsar();
+    console.log(version);
+
+    return 0;
+}
+
+if (import.meta.url.startsWith("file:")) {
+    const modulePath = url.fileURLToPath(import.meta.url);
+    if (process.argv[1] === modulePath) {
+        main()
+            .then((ret) => {
+                process.exit(ret);
+            })
+            .catch((e) => {
+                console.error(e);
+                process.exit(1);
+            });
+    }
+}
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+
+# Source https://gist.github.com/vladimyr/9a03481154cd3048a486bdf71e5e1535/57e57a6ace6fb2c8bba948bce726df7a96c3f99f
+# This scripts lets you check which minimum GLIBC version an executable requires.
+# Simply run './glibc-check.sh path/to/your/binary'
+MAX_GLIBC="${MAX_GLIBC:-2.28}"
+
+BINARY="$1"
+
+# Version comparison function in bash
+vercomp() {
+  if [[ $1 == "$2" ]]; then
+    return 0
+  fi
+  local i ver1 ver2
+  IFS="." read -ra ver1 <<<"$1"
+  IFS="." read -ra ver2 <<<"$2"
+  # fill empty fields in ver1 with zeros
+  for ((i = ${#ver1[@]}; i < ${#ver2[@]}; i++)); do
+    ver1[i]=0
+  done
+  for ((i = 0; i < ${#ver1[@]}; i++)); do
+    if [[ -z ${ver2[i]} ]]; then
+      # fill empty fields in ver2 with zeros
+      ver2[i]=0
+    fi
+    if ((10#${ver1[i]} > 10#${ver2[i]})); then
+      return 1
+    fi
+    if ((10#${ver1[i]} < 10#${ver2[i]})); then
+      return 2
+    fi
+  done
+  return 0
+}
+
+IFS="
+"
+VERS=$(objdump -T "$BINARY" | grep GLIBC_ | sed 's/.*GLIBC_\([.0-9]*\).*/\1/g' | sort -u)
+
+for VER in $VERS; do
+  vercomp "$VER" "$MAX_GLIBC"
+  COMP=$?
+  if [[ $COMP -eq 1 ]]; then
+    echo "Error! ${BINARY} requests GLIBC ${VER}, which is higher than target ${MAX_GLIBC}"
+    echo "Affected symbols:"
+    objdump -T "$BINARY" | grep -F "GLIBC_${VER}"
+    echo "Looking for symbols in libraries..."
+    for LIBRARY in $(ldd "$BINARY" | cut -d ' ' -f 3); do
+      echo "$LIBRARY"
+      objdump -T "$LIBRARY" | grep -F "GLIBC_${VER}"
+    done
+    exit 27
+  else
+    echo "Found version ${VER}"
+  fi
+done
@@ -0,0 +1,78 @@
+# hak
+
+This tool builds native dependencies for element-desktop. Here follows some very minimal
+documentation for it.
+
+Goals:
+
+- Must build compiled native node modules in a shippable state
+  (ie. only dynamically linked against libraries that will be on the
+  target system, all unnecessary files removed).
+- Must be able to build any native module, no matter what build system
+  it uses (electron-rebuild is supposed to do this job but only works
+  for modules that use gyp).
+
+It's also loosely designed to be a general tool and agnostic to what it's
+actually building. It's used here to build modules for the electron app
+but should work equally well for building modules for normal node.
+
+# Running
+
+Hak is invoked with a command and a dependency, eg. `pnpm run hak fetch matrix-seshat`.
+If no dependencies are given, hak runs the command on all dependencies.
+
+# Files
+
+There are a lot of files involved:
+
+- scripts/hak/... - The tool itself
+- hak/[dependency] - Files provided by the app that tell hak how to build each of its native dependencies.
+  Contains a hak.json file and also some script files, each of which must be referenced in hak.json.
+- .hak/ - Files generated by hak in the course of doing its job. Includes the dependency module itself and
+  any of the native dependency's native dependencies.
+- .hak/[dependency]/build - An extracted copy of the dependency's node module used to build it.
+- .hak/[dependency]/out - Another extracted copy of the dependency, this one contains only what will be shipped.
+
+# Workings
+
+Hak works around native node modules that try to fetch or build their native component in
+the npm 'install' phase - modules that do this will typically end up with native components
+targeted to the build platform and the node that npm/pnpm is using, which is no good for an
+electron app.
+
+It does this by installing it with `--ignore-scripts` and then using `pnpm link` to keep the
+dependency module separate so pnpm doesn't try to run its install / postinstall script
+at other points (eg. whenever you `pnpm add` a random other dependency).
+
+This also means that the dependencies cannot be listed in `dependencies` or
+`devDependencies` in the project, since this would cause pnpm to install them and
+try to fetch their native parts. Instead, they are listed in `hakDependencies` which
+hak reads to install them for you.
+
+Hak will _not_ install dependencies for the copy of the module it links into your
+project, so if your native module has javascript dependencies that are actually needed at
+runtime (and not just to fetch / build the native parts), it won't work.
+
+# Lifecycle
+
+Hak is divided into lifecycle stages, in order:
+
+- fetch - Download and extract the source of the dependency
+- link - Link the copy of the dependency into your node_modules directory
+- build - The Good Stuff. Configure and build any native dependencies, then the module itself.
+- copy - Copy the built artifact from the module build directory to the module output directory.
+
+# hak.json
+
+The scripts section contains scripts used for lifecycle stages that need them (fetch, build).
+It also contains 'prune' and 'copy' which are globs of files to delete from the output module directory
+and copy over from the module build directory to the output module directory, respectively.
+
+# Shortcomings
+
+Hak doesn't know about dependencies between lifecycle stages, ie. it doesn't know that you need to
+'fetch' before you can 'build', etc. You get to run each individually, and remember
+the right order.
+
+There is also a _lot_ of duplication in the command execution: we should abstract away
+some of the boilerplate required to run commands & so forth.
@@ -0,0 +1,14 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2020 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import type { DependencyInfo } from "./dep.ts";
+import type HakEnv from "./hakEnv.ts";
+
+export default async function build(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    await moduleInfo.scripts.build(hakEnv, moduleInfo);
+}
@@ -0,0 +1,14 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2020 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import type { DependencyInfo } from "./dep.ts";
+import type HakEnv from "./hakEnv.ts";
+
+export default async function check(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    await moduleInfo.scripts.check?.(hakEnv, moduleInfo);
+}
@@ -0,0 +1,19 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2020 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import path from "node:path";
+import { rimraf } from "rimraf";
+
+import type { DependencyInfo } from "./dep.ts";
+import type HakEnv from "./hakEnv.ts";
+
+export default async function clean(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    await rimraf(moduleInfo.moduleDotHakDir);
+    await rimraf(path.join(hakEnv.dotHakDir, "links", moduleInfo.name));
+    await rimraf(path.join(hakEnv.projectRoot, "node_modules", moduleInfo.name));
+}
@@ -0,0 +1,62 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2020, 2021 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import path from "node:path";
+import fsProm from "node:fs/promises";
+import childProcess from "node:child_process";
+import { glob } from "glob";
+import { mkdirp } from "mkdirp";
+
+import type HakEnv from "./hakEnv.ts";
+import type { DependencyInfo } from "./dep.ts";
+
+export default async function copy(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    if (moduleInfo.cfg.copy) {
+        // If there are multiple moduleBuildDirs, singular moduleBuildDir
+        // is the same as moduleBuildDirs[0], so we're just listing the contents
+        // of the first one.
+        const files = await glob(moduleInfo.cfg.copy, {
+            cwd: moduleInfo.moduleBuildDir,
+        });
+
+        if (moduleInfo.moduleBuildDirs.length > 1) {
+            if (!hakEnv.isMac()) {
+                console.error(
+                    "You asked me to copy multiple targets but I've only been taught " + "how to do that on macOS.",
+                );
+                throw new Error("Can't copy multiple targets on this platform");
+            }
+
+            for (const f of files) {
+                const components = moduleInfo.moduleBuildDirs.map((dir) => path.join(dir, f));
+                const dst = path.join(moduleInfo.moduleOutDir, f);
+
+                await mkdirp(path.dirname(dst));
+                await new Promise<void>((resolve, reject) => {
+                    childProcess.execFile("lipo", ["-create", "-output", dst, ...components], (err) => {
+                        if (err) {
+                            reject(err);
+                        } else {
+                            resolve();
+                        }
+                    });
+                });
+            }
+        } else {
+            console.log("Copying files from " + moduleInfo.moduleBuildDir + " to " + moduleInfo.moduleOutDir);
+            for (const f of files) {
+                console.log("\t" + f);
+                const src = path.join(moduleInfo.moduleBuildDir, f);
+                const dst = path.join(moduleInfo.moduleOutDir, f);
+
+                await mkdirp(path.dirname(dst));
+                await fsProm.copyFile(src, dst);
+            }
+        }
+    }
+}
@@ -0,0 +1,24 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2021 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import type HakEnv from "./hakEnv.ts";
+
+export interface DependencyInfo {
+    name: string;
+    version: string;
+    cfg: Record<string, any>;
+    moduleHakDir: string;
+    moduleDotHakDir: string;
+    moduleTargetDotHakDir: string;
+    moduleBuildDir: string;
+    moduleBuildDirs: string[];
+    moduleOutDir: string;
+    nodeModuleBinDir: string;
+    depPrefix: string;
+    scripts: Record<string, (hakEnv: HakEnv, moduleInfo: DependencyInfo) => Promise<void>>;
+}
@@ -0,0 +1,59 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2020 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import fsProm from "node:fs/promises";
+import pacote from "pacote";
+import path from "node:path";
+
+import type HakEnv from "./hakEnv.ts";
+import type { DependencyInfo } from "./dep.ts";
+
+export default async function fetch(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    let haveModuleBuildDir;
+    try {
+        const stats = await fsProm.stat(moduleInfo.moduleBuildDir);
+        haveModuleBuildDir = stats.isDirectory();
+    } catch {
+        haveModuleBuildDir = false;
+    }
+
+    if (haveModuleBuildDir) return;
+
+    console.log("Fetching " + moduleInfo.name + "@" + moduleInfo.version);
+
+    const packumentCache = new Map();
+    await pacote.extract(`${moduleInfo.name}@${moduleInfo.version}`, moduleInfo.moduleBuildDir, {
+        packumentCache,
+    });
+
+    // Workaround for us switching to pnpm but matrix-seshat still using yarn classic
+    const packageJsonPath = path.join(moduleInfo.moduleBuildDir, "package.json");
+    const packageJson = await fsProm.readFile(packageJsonPath, "utf-8");
+    const packageJsonData = JSON.parse(packageJson);
+    packageJsonData["packageManager"] = "yarn@1.22.22";
+    await fsProm.writeFile(packageJsonPath, JSON.stringify(packageJsonData, null, 2), "utf-8");
+
+    console.log("Running yarn install in " + moduleInfo.moduleBuildDir);
+    await hakEnv.spawn("yarn", ["install", "--ignore-scripts"], {
+        cwd: moduleInfo.moduleBuildDir,
+    });
+
+    // also extract another copy to the output directory at this point
+    // nb. we do not yarn install in the output copy: we could install in
+    // production mode to get only runtime dependencies and not devDependencies,
+    // but usually native modules come with dependencies that are needed for
+    // building/fetching the native modules (eg. node-pre-gyp) rather than
+    // actually used at runtime: we do not want to bundle these into our app.
+    // We therefore just install no dependencies at all, and accept that any
+    // actual runtime dependencies will have to be added to the main app's
+    // dependencies. We can't tell what dependencies are real runtime deps
+    // and which are just used for native module building.
+    await pacote.extract(`${moduleInfo.name}@${moduleInfo.version}`, moduleInfo.moduleOutDir, {
+        packumentCache,
+    });
+}
@@ -0,0 +1,129 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2020, 2021 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import path from "node:path";
+import os from "node:os";
+import { getElectronVersionFromInstalled } from "app-builder-lib/out/electron/electronVersion.js";
+import childProcess, { type SpawnOptions } from "node:child_process";
+
+import { type Arch, type Target, TARGETS, getHost, isHostId, type TargetId } from "./target.ts";
+
+async function getRuntimeVersion(projectRoot: string): Promise<string> {
+    const electronVersion = await getElectronVersionFromInstalled(path.join(projectRoot, "..", ".."));
+    if (!electronVersion) {
+        throw new Error("Can't determine Electron version");
+    }
+    return electronVersion;
+}
+
+export type Tool = [cmd: string, ...args: string[]];
+
+export default class HakEnv {
+    public readonly target: Target;
+    public runtime: string = "electron";
+    public runtimeVersion?: string;
+    public dotHakDir: string;
+    public readonly projectRoot: string;
+
+    public constructor(projectRoot: string, targetId: TargetId | null) {
+        this.projectRoot = projectRoot;
+        const target = targetId ? TARGETS[targetId] : getHost();
+
+        if (!target) {
+            throw new Error(`Unknown target ${targetId}!`);
+        }
+        this.target = target;
+        this.dotHakDir = path.join(this.projectRoot, ".hak");
+    }
+
+    public async init(): Promise<void> {
+        this.runtimeVersion = await getRuntimeVersion(this.projectRoot);
+    }
+
+    public getTargetId(): TargetId {
+        return this.target.id;
+    }
+
+    public isWin(): boolean {
+        return this.target.platform === "win32";
+    }
+
+    public isMac(): boolean {
+        return this.target.platform === "darwin";
+    }
+
+    public isLinux(): boolean {
+        return this.target.platform === "linux";
+    }
+
+    public isFreeBSD(): boolean {
+        return this.target.platform === "freebsd";
+    }
+
+    public getTargetArch(): Arch {
+        return this.target.arch;
+    }
+
+    public isHost(): boolean {
+        return isHostId(this.target.id);
+    }
+
+    public makeGypEnv(): Record<string, string | undefined> {
+        return {
+            ...process.env,
+            npm_config_arch: this.target.arch,
+            npm_config_target_arch: this.target.arch,
+            npm_config_disturl: "https://electronjs.org/headers",
+            npm_config_runtime: this.runtime,
+            npm_config_target: this.runtimeVersion,
+            npm_config_build_from_source: "true",
+            npm_config_devdir: path.join(os.homedir(), ".electron-gyp"),
+        };
+    }
+
+    public wantsStaticSqlCipher(): boolean {
+        return !(this.isLinux() || this.isFreeBSD()) || process.env.SQLCIPHER_BUNDLED == "1";
+    }
+
+    public spawn(
+        cmd: string,
+        args: string[],
+        { ignoreWinCmdlet, ...options }: SpawnOptions & { ignoreWinCmdlet?: boolean } = {},
+    ): Promise<void> {
+        return new Promise((resolve, reject) => {
+            const proc = childProcess.spawn(cmd + (!ignoreWinCmdlet && this.isWin() ? ".cmd" : ""), args, {
+                stdio: "inherit",
+                // We need shell mode on Windows to be able to launch `.cmd` executables
+                // See https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+                shell: this.isWin(),
+                ...options,
+            });
+            proc.on("exit", (code) => {
+                if (code) {
+                    reject(code);
+                } else {
+                    resolve();
+                }
+            });
+        });
+    }
+
+    public async checkTools(tools: Tool[]): Promise<void> {
+        for (const [tool, ...args] of tools) {
+            try {
+                await this.spawn(tool, args, {
+                    ignoreWinCmdlet: true,
+                    stdio: ["ignore"],
+                    shell: false,
+                });
+            } catch {
+                throw new Error(`Can't find ${tool}`);
+            }
+        }
+    }
+}
@@ -0,0 +1,147 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2020, 2021 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import path, { dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import HakEnv from "./hakEnv.ts";
+import type { TargetId } from "./target.ts";
+import type { DependencyInfo } from "./dep.ts";
+import { loadJsonFile } from "../../src/utils.ts";
+import packageJson from "../../package.json" with { type: "json" };
+
+// These can only be run on specific modules
+const MODULECOMMANDS = ["check", "fetch", "link", "build", "copy", "clean"];
+
+// Shortcuts for multiple commands at once (useful for building universal binaries
+// because you can run the fetch/build for each arch and then copy/link once)
+const METACOMMANDS: Record<string, string[]> = {
+    fetchandbuild: ["check", "fetch", "build"],
+    copyandlink: ["copy", "link"],
+};
+
+// Scripts valid in a hak.json 'scripts' section
+const HAKSCRIPTS = ["check", "fetch", "build"];
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+async function main(): Promise<void> {
+    const prefix = path.join(__dirname, "..", "..");
+
+    const targetIds: TargetId[] = [];
+    // Apply `--target <target>` option if specified
+    // Can be specified multiple times for the copy command to bundle
+    // multiple arches into a single universal output module)
+    for (;;) {
+        // eslint-disable-line no-constant-condition
+        const targetIndex = process.argv.indexOf("--target");
+        if (targetIndex === -1) break;
+
+        if (targetIndex + 1 >= process.argv.length) {
+            console.error("--target option specified without a target");
+            process.exit(1);
+        }
+        // Extract target ID and remove from args
+        targetIds.push(process.argv.splice(targetIndex, 2)[1] as TargetId);
+    }
+
+    const hakEnvs = targetIds.map((tid) => new HakEnv(prefix, tid));
+    if (hakEnvs.length == 0) hakEnvs.push(new HakEnv(prefix, null));
+    for (const h of hakEnvs) {
+        await h.init();
+    }
+    const hakEnv = hakEnvs[0];
+
+    const deps: Record<string, DependencyInfo> = {};
+
+    const hakDepsCfg = packageJson.hakDependencies || {};
+
+    for (const dep in hakDepsCfg) {
+        const hakJsonPath = path.join(prefix, "hak", dep, "hak.json");
+        let hakJson: Record<string, any>;
+        try {
+            hakJson = loadJsonFile(hakJsonPath);
+        } catch {
+            console.error("No hak.json found for " + dep + ".");
+            console.log("Expecting " + hakJsonPath);
+            process.exit(1);
+        }
+        deps[dep] = {
+            name: dep,
+            version: hakDepsCfg[dep as keyof typeof hakDepsCfg],
+            cfg: hakJson,
+            moduleHakDir: path.join(prefix, "hak", dep),
+            moduleDotHakDir: path.join(hakEnv.dotHakDir, dep),
+            moduleTargetDotHakDir: path.join(hakEnv.dotHakDir, dep, hakEnv.getTargetId()),
+            moduleBuildDir: path.join(hakEnv.dotHakDir, dep, hakEnv.getTargetId(), "build"),
+            moduleBuildDirs: hakEnvs.map((h) => path.join(h.dotHakDir, dep, h.getTargetId(), "build")),
+            moduleOutDir: path.join(hakEnv.dotHakDir, "hakModules", dep),
+            nodeModuleBinDir: path.join(hakEnv.dotHakDir, dep, hakEnv.getTargetId(), "build", "node_modules", ".bin"),
+            depPrefix: path.join(hakEnv.dotHakDir, dep, hakEnv.getTargetId(), "opt"),
+            scripts: {},
+        };
+
+        for (const s of HAKSCRIPTS) {
+            if (hakJson.scripts?.[s]) {
+                // Shockingly, using path.join and backslashes here doesn't work on Windows
+                const scriptModule = await import(`../../hak/${dep}/${hakJson.scripts[s]}`);
+                if (scriptModule.default) {
+                    deps[dep].scripts[s] = scriptModule.default;
+                } else {
+                    deps[dep].scripts[s] = scriptModule;
+                }
+            }
+        }
+    }
+
+    let cmds: string[];
+    if (process.argv.length < 3) {
+        cmds = ["check", "fetch", "build", "copy", "link"];
+    } else if (METACOMMANDS[process.argv[2]]) {
+        cmds = METACOMMANDS[process.argv[2]];
+    } else {
+        cmds = [process.argv[2]];
+    }
+
+    if (hakEnvs.length > 1 && cmds.some((c) => !["copy", "link"].includes(c))) {
+        // We allow link here too for convenience because it's completely arch independent
+        console.error("Multiple targets only supported with the copy command");
+        return;
+    }
+
+    let modules = process.argv.slice(3);
+    if (modules.length === 0) modules = Object.keys(deps);
+
+    for (const cmd of cmds) {
+        if (!MODULECOMMANDS.includes(cmd)) {
+            console.error("Unknown command: " + cmd);
+            console.log("Commands I know about:");
+            for (const cmd of MODULECOMMANDS) {
+                console.log("\t" + cmd);
+            }
+            process.exit(1);
+        }
+
+        const cmdFunc = (await import(`./${cmd}.ts`)).default;
+
+        for (const mod of modules) {
+            const depInfo = deps[mod];
+            if (depInfo === undefined) {
+                console.log("Module " + mod + " not found - is it in hakDependencies " + "in your package.json?");
+                process.exit(1);
+            }
+            console.log("hak " + cmd + ": " + mod);
+            await cmdFunc(hakEnv, depInfo);
+        }
+    }
+}
+
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`module.exports = require("eslint-plugin-matrix-org/.prettierrc.js");`