v34.3.0

Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>

.babelrc

@@ -1,22 +0,0 @@
-{
-    "sourceMaps": true,
-    "presets": [
-        [
-            "@babel/preset-env",
-            {
-                "targets": {
-                    "node": 10
-                },
-                "modules": "commonjs"
-            }
-        ],
-        "@babel/preset-typescript"
-    ],
-    "plugins": [
-        "@babel/plugin-proposal-numeric-separator",
-        "@babel/plugin-proposal-class-properties",
-        "@babel/plugin-proposal-object-rest-spread",
-        "@babel/plugin-syntax-dynamic-import",
-        "@babel/plugin-transform-runtime"
-    ]
-}

.eslintrc.js

@@ -49,6 +49,22 @@ module.exports = {
             },
         ],
 
+        "no-restricted-properties": [
+            "error",
+            {
+                object: "window",
+                property: "setImmediate",
+                message: "Use setTimeout instead.",
+            },
+        ],
+        "no-restricted-globals": [
+            "error",
+            {
+                name: "setImmediate",
+                message: "Use setTimeout instead.",
+            },
+        ],
+
         "import/no-restricted-paths": [
             "error",
             {

.github/labels.yml

@@ -0,0 +1,43 @@
+- name: "A-Element-R"
+  description: "Issues affecting the port of Element's crypto layer to Rust"
+  color: "bfd4f2"
+- name: "A-Packaging"
+  description: "Packaging, signing, releasing"
+  color: "bfd4f2"
+- name: "A-Technical-Debt"
+  color: "bfd4f2"
+- name: "A-Testing"
+  description: "Testing, code coverage, etc."
+  color: "bfd4f2"
+- name: "backport staging"
+  description: "Label to automatically backport PR to staging branch"
+  color: "B60205"
+- name: "Dependencies"
+  description: "Pull requests that update a dependency file"
+  color: "0366d6"
+- name: "Easy"
+  color: "5dc9f7"
+- name: "Sponsored"
+  color: "ffc8f4"
+- name: "T-Deprecation"
+  description: "A pull request that makes something deprecated"
+  color: "98e6ae"
+- name: "T-Other"
+  description: "Questions, user support, anything else"
+  color: "98e6ae"
+- name: "X-Blocked"
+  color: "ff7979"
+- name: "X-Breaking-Change"
+  color: "ff7979"
+- name: "X-Reverted"
+  description: "PR has been reverted"
+  color: "F68AA3"
+- name: "X-Upcoming-Release-Blocker"
+  description: "This does not affect the current release cycle but will affect the next one"
+  color: "e99695"
+- name: "Z-Community-PR"
+  description: "Issue is solved by a community member's PR"
+  color: "ededed"
+- name: "Z-Flaky-Test"
+  description: "A test is raising false alarms"
+  color: "ededed"

.github/workflows/downstream-end-to-end-tests.yml

@@ -27,6 +27,7 @@ jobs:
             issues: read
             pull-requests: read
         with:
+            matrix-js-sdk-sha: ${{ github.sha }}
             react-sdk-repository: matrix-org/matrix-react-sdk
             # We only want to run the playwright tests on merge queue to prevent regressions
             # from creeping in. They take a long time to run and consume multiple concurrent runners.

.github/workflows/notify-downstream.yaml

@@ -12,7 +12,7 @@ jobs:
             fail-fast: false
             matrix:
                 include:
-                    - repo: vector-im/element-web
+                    - repo: element-hq/element-web
                       event: element-web-notify
                     - repo: matrix-org/matrix-react-sdk
                       event: upstream-sdk-notify

.github/workflows/pull_request.yaml

@@ -14,7 +14,7 @@ jobs:
         name: Preview Changelog
         runs-on: ubuntu-latest
         steps:
-            - uses: mheap/github-action-required-labels@132879b972cb7f2ac593006455875098e73cc7f2 # v5
+            - uses: mheap/github-action-required-labels@5847eef68201219cf0a4643ea7be61e77837bbce # v5
               if: github.event_name != 'merge_group'
               with:
                   labels: |

.github/workflows/release-gitflow.yml

@@ -34,6 +34,7 @@ jobs:
             - uses: actions/setup-node@v4
               with:
                   cache: "yarn"
+                  node-version-file: package.json
 
             - name: Install Deps
               run: "yarn install --frozen-lockfile"

.github/workflows/release-make.yml

@@ -24,10 +24,6 @@ on:
                 description: List of github projects (owner/repo) which should have their dependency bumped to the newly released version (in JSON string array string syntax)
                 type: string
                 required: false
-            include-changes:
-                description: Project to include changelog entries from in this release.
-                type: string
-                required: false
             gpg-fingerprint:
                 description: Fingerprint of the GPG key to use for signing the git tag and assets, if any.
                 type: string
@@ -120,6 +116,7 @@ jobs:
             - uses: actions/setup-node@v4
               with:
                   cache: "yarn"
+                  node-version-file: package.json
 
             - name: Install dependencies
               run: "yarn install --frozen-lockfile"
@@ -319,6 +316,11 @@ jobs:
                   ref: staging
                   token: ${{ secrets.ELEMENT_BOT_TOKEN }}
 
+            - uses: actions/setup-node@v4
+              with:
+                  cache: "yarn"
+                  node-version: "lts/*"
+
             - name: Bump dependency
               env:
                   DEPENDENCY: ${{ needs.npm.outputs.id }}

.github/workflows/release-npm.yml

@@ -25,6 +25,7 @@ jobs:
               with:
                   cache: "yarn"
                   registry-url: "https://registry.npmjs.org"
+                  node-version-file: package.json
 
             - name: 🔨 Install dependencies
               run: "yarn install --frozen-lockfile"

.github/workflows/release.yml

@@ -43,6 +43,7 @@ jobs:
               uses: actions/setup-node@v4
               with:
                   cache: "yarn"
+                  node-version-file: package.json
 
             - name: 🔨 Install dependencies
               run: "yarn install --frozen-lockfile"

.github/workflows/sonarcloud.yml

@@ -30,7 +30,7 @@ jobs:
                   target_url: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
 
             - name: "🧮 Checkout code"
-              uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+              uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
               with:
                   repository: ${{ github.event.workflow_run.head_repository.full_name }}
                   ref: ${{ github.event.workflow_run.head_branch }} # checkout commit that triggered this workflow

.github/workflows/static_analysis.yml

@@ -18,6 +18,7 @@ jobs:
             - uses: actions/setup-node@v4
               with:
                   cache: "yarn"
+                  node-version-file: package.json
 
             - name: Install Deps
               run: "yarn install"
@@ -44,6 +45,7 @@ jobs:
             - uses: actions/setup-node@v4
               with:
                   cache: "yarn"
+                  node-version-file: package.json
 
             - name: Install Deps
               run: "yarn install"
@@ -60,6 +62,7 @@ jobs:
             - uses: actions/setup-node@v4
               with:
                   cache: "yarn"
+                  node-version-file: package.json
 
             - name: Install Deps
               run: "yarn install --frozen-lockfile"
@@ -76,12 +79,13 @@ jobs:
             - uses: actions/setup-node@v4
               with:
                   cache: "yarn"
+                  node-version-file: package.json
 
             - name: Install Deps
               run: "yarn install"
 
             - name: Generate Docs
-              run: "yarn run gendoc --treatWarningsAsErrors"
+              run: "yarn run gendoc --treatWarningsAsErrors --suppressCommentWarningsInDeclarationFiles"
 
             - name: Upload Artifact
               uses: actions/upload-artifact@v4
@@ -100,6 +104,7 @@ jobs:
             - uses: actions/setup-node@v4
               with:
                   cache: "yarn"
+                  node-version-file: package.json
 
             - name: Install Deps
               run: "yarn install --frozen-lockfile"

.github/workflows/sync-labels.yml

@@ -0,0 +1,21 @@
+name: Sync labels
+on:
+    workflow_dispatch: {}
+    schedule:
+        - cron: "0 1 * * *" # 1am every day
+    push:
+        branches:
+            - develop
+        paths:
+            - .github/labels.yml
+jobs:
+    sync-labels:
+        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@develop
+        with:
+            LABELS: |
+                element-hq/element-meta
+                .github/labels.yml
+            DELETE: true
+            WET: true
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/tests.yml

@@ -18,7 +18,7 @@ jobs:
         strategy:
             matrix:
                 specs: [integ, unit]
-                node: [18, "lts/*", 21]
+                node: ["lts/*", 22]
         steps:
             - name: Checkout code
               uses: actions/checkout@v4
@@ -63,6 +63,16 @@ jobs:
                       coverage
                       !coverage/lcov-report
 
+    # Dummy completion job to simplify branch protections
+    jest-complete:
+        name: Jest tests
+        needs: jest
+        if: always()
+        runs-on: ubuntu-latest
+        steps:
+            - if: needs.jest.result != 'skipped' && needs.jest.result != 'success'
+              run: exit 1
+
     matrix-react-sdk:
         name: Downstream test matrix-react-sdk
         if: github.event_name == 'merge_group'
@@ -71,6 +81,24 @@ jobs:
             disable_coverage: true
             matrix-js-sdk-sha: ${{ github.sha }}
 
+    complement-crypto:
+        name: "Run Complement Crypto tests"
+        if: github.event_name == 'merge_group'
+        uses: matrix-org/complement-crypto/.github/workflows/single_sdk_tests.yml@main
+        with:
+            use_js_sdk: "."
+
+    # we need this so the job is reported properly when run in a merge queue
+    downstream-complement-crypto:
+        name: Downstream Complement Crypto tests
+        runs-on: ubuntu-latest
+        if: always()
+        needs:
+            - complement-crypto
+        steps:
+            - if: needs.complement-crypto.result != 'skipped' && needs.complement-crypto.result != 'success'
+              run: exit 1
+
     # Hook for branch protection to skip downstream testing outside of merge queues
     # and skip sonarcloud coverage within merge queues
     downstream:

.github/workflows/triage-labelled.yml

@@ -6,6 +6,6 @@ on:
 
 jobs:
     call-triage-labelled:
-        uses: vector-im/element-web/.github/workflows/triage-labelled.yml@develop
+        uses: element-hq/element-web/.github/workflows/triage-labelled.yml@develop
         secrets:
             ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}

CHANGELOG.md

@@ -1,3 +1,126 @@
+Changes in [34.3.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.3.0) (2024-08-13)
+==================================================================================================
+## ✨ Features
+
+* Bump matrix-widget-api ([#4336](https://github.com/matrix-org/matrix-js-sdk/pull/4336)). Contributed by @AndrewFerr.
+* Also check for MSC3757 for session state keys ([#4334](https://github.com/matrix-org/matrix-js-sdk/pull/4334)). Contributed by @AndrewFerr.
+* Support Futures via widgets ([#4311](https://github.com/matrix-org/matrix-js-sdk/pull/4311)). Contributed by @AndrewFerr.
+* Support MSC4140: Delayed events (Futures) ([#4294](https://github.com/matrix-org/matrix-js-sdk/pull/4294)). Contributed by @AndrewFerr.
+* Handle late-arriving `m.room_key.withheld` messages ([#4310](https://github.com/matrix-org/matrix-js-sdk/pull/4310)). Contributed by @richvdh.
+* Be specific about what is considered a MSC4143 call member event. ([#4328](https://github.com/matrix-org/matrix-js-sdk/pull/4328)). Contributed by @toger5.
+* Add index.ts for matrixrtc module ([#4314](https://github.com/matrix-org/matrix-js-sdk/pull/4314)). Contributed by @toger5.
+
+## 🐛 Bug Fixes
+
+* Fix hashed ID server lookups with no Olm ([#4333](https://github.com/matrix-org/matrix-js-sdk/pull/4333)). Contributed by @dbkr.
+
+
+Changes in [34.2.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.2.0) (2024-07-30)
+==================================================================================================
+## 🐛 Bug Fixes
+
+* Element-R: detect "withheld key" UTD errors, and mark them as such ([#4302](https://github.com/matrix-org/matrix-js-sdk/pull/4302)). Contributed by @richvdh.
+
+
+Changes in [34.1.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.1.0) (2024-07-16)
+==================================================================================================
+## ✨ Features
+
+* Add ability to choose how many timeline events to sync when peeking ([#4300](https://github.com/matrix-org/matrix-js-sdk/pull/4300)). Contributed by @jgarplind.
+* Remove redundant hack for using the old pickle key in rust crypto ([#4282](https://github.com/matrix-org/matrix-js-sdk/pull/4282)). Contributed by @richvdh.
+* Add fetching the well known in embedded mode. ([#4259](https://github.com/matrix-org/matrix-js-sdk/pull/4259)). Contributed by @toger5.
+
+## 🐛 Bug Fixes
+
+* Fix room state being updated with old (now overwritten) state and emitting for those updates. ([#4242](https://github.com/matrix-org/matrix-js-sdk/pull/4242)). Contributed by @toger5.
+* Fix incorrect "Olm is not available" errors ([#4301](https://github.com/matrix-org/matrix-js-sdk/pull/4301)). Contributed by @richvdh.
+* Fix build for example script ([#4286](https://github.com/matrix-org/matrix-js-sdk/pull/4286)). Contributed by @richvdh.
+* Declare matrix-js-sdk as an ES module ([#4285](https://github.com/matrix-org/matrix-js-sdk/pull/4285)). Contributed by @richvdh.
+
+
+Changes in [34.0.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.0.0) (2024-07-08)
+==================================================================================================
+## 🚨 BREAKING CHANGES
+
+* Fetch capabilities in the background ([#4246](https://github.com/matrix-org/matrix-js-sdk/pull/4246)). Contributed by @dbkr.
+
+## ✨ Features
+
+* Prefix the user+device state key if needed ([#4262](https://github.com/matrix-org/matrix-js-sdk/pull/4262)). Contributed by @AndrewFerr.
+* Use legacy call membership if anyone else is ([#4260](https://github.com/matrix-org/matrix-js-sdk/pull/4260)). Contributed by @AndrewFerr.
+* Fetch capabilities in the background ([#4246](https://github.com/matrix-org/matrix-js-sdk/pull/4246)). Contributed by @dbkr.
+* Use server name instead of homeserver url to allow well-known lookups during QR OIDC reciprocation ([#4233](https://github.com/matrix-org/matrix-js-sdk/pull/4233)). Contributed by @t3chguy.
+* Add via parameter for MSC4156 ([#4247](https://github.com/matrix-org/matrix-js-sdk/pull/4247)). Contributed by @Johennes.
+* Make the js-sdk compatible with MSC preferred foci and active focus. ([#4195](https://github.com/matrix-org/matrix-js-sdk/pull/4195)). Contributed by @toger5.
+* Replace usages of setImmediate with setTimeout for wider compatibility ([#4240](https://github.com/matrix-org/matrix-js-sdk/pull/4240)). Contributed by @t3chguy.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix "Unable to restore session" error ([#4299](https://github.com/matrix-org/matrix-js-sdk/pull/4299)). Contributed by @RiotRobot.
+* [Backport staging] Fix error when sending encrypted messages in large rooms ([#4297](https://github.com/matrix-org/matrix-js-sdk/pull/4297)). Contributed by @RiotRobot.
+* Element-R: Fix resource leaks in verification logic ([#4263](https://github.com/matrix-org/matrix-js-sdk/pull/4263)). Contributed by @richvdh.
+* Upgrade Rust Crypto SDK to 6.1.0 ([#4261](https://github.com/matrix-org/matrix-js-sdk/pull/4261)). Contributed by @richvdh.
+* Correctly transform base64 with multiple instances of + or / ([#4252](https://github.com/matrix-org/matrix-js-sdk/pull/4252)). Contributed by @robintown.
+* Work around spec bug for m.room.avatar state event content type ([#4245](https://github.com/matrix-org/matrix-js-sdk/pull/4245)). Contributed by @t3chguy.
+
+
+Changes in [33.1.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v33.1.0) (2024-06-18)
+==================================================================================================
+## ✨ Features
+
+* MSC4108 support OIDC QR code login ([#4134](https://github.com/matrix-org/matrix-js-sdk/pull/4134)). Contributed by @t3chguy.
+* Add crypto methods for export and import of secrets bundle ([#4227](https://github.com/matrix-org/matrix-js-sdk/pull/4227)). Contributed by @t3chguy.
+
+## 🐛 Bug Fixes
+
+* Fix screen sharing in recent Chrome ([#4243](https://github.com/matrix-org/matrix-js-sdk/pull/4243)). Contributed by @RiotRobot.
+* Fix incorrect assumptions about required fields in /search response ([#4228](https://github.com/matrix-org/matrix-js-sdk/pull/4228)). Contributed by @t3chguy.
+* Fix the queueToDevice tests for the new fakeindexeddb ([#4225](https://github.com/matrix-org/matrix-js-sdk/pull/4225)). Contributed by @dbkr.
+
+
+Changes in [33.0.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v33.0.0) (2024-06-04)
+==================================================================================================
+## 🚨 BREAKING CHANGES
+
+* Remove more deprecated methods, fields, and exports ([#4217](https://github.com/matrix-org/matrix-js-sdk/pull/4217)). Contributed by @t3chguy.
+* Remove deprecated methods and fields ([#4201](https://github.com/matrix-org/matrix-js-sdk/pull/4201)). Contributed by @t3chguy.
+
+## 🦖 Deprecations
+
+* Remove more deprecated methods, fields, and exports ([#4217](https://github.com/matrix-org/matrix-js-sdk/pull/4217)). Contributed by @t3chguy.
+* Remove deprecated methods and fields ([#4201](https://github.com/matrix-org/matrix-js-sdk/pull/4201)). Contributed by @t3chguy.
+
+## ✨ Features
+
+* `initRustCrypto`: allow app to pass in the store key directly ([#4210](https://github.com/matrix-org/matrix-js-sdk/pull/4210)). Contributed by @richvdh.
+* Preserve ESM for async imports to work correctly ([#4187](https://github.com/matrix-org/matrix-js-sdk/pull/4187)). Contributed by @ms-dosx86.
+
+## 🐛 Bug Fixes
+
+* Don't run migration for Rust crypto if the legacy store is empty ([#4218](https://github.com/matrix-org/matrix-js-sdk/pull/4218)). Contributed by @andybalaam.
+* Bump matrix-sdk-crypto-wasm to 5.0.0 ([#4216](https://github.com/matrix-org/matrix-js-sdk/pull/4216)). Contributed by @richvdh.
+* Wire up verification cancel \& mismatch for rust crypto ([#4202](https://github.com/matrix-org/matrix-js-sdk/pull/4202)). Contributed by @t3chguy.
+* Only pass id\_server if we had one to begin with ([#4200](https://github.com/matrix-org/matrix-js-sdk/pull/4200)). Contributed by @t3chguy.
+
+
+Changes in [32.4.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v32.4.0) (2024-05-22)
+==================================================================================================
+* No changes
+
+
+Changes in [32.3.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v32.3.0) (2024-05-21)
+==================================================================================================
+## ✨ Features
+
+* Simplify OIDC types \& export `decodeIdToken` ([#4193](https://github.com/matrix-org/matrix-js-sdk/pull/4193)). Contributed by @t3chguy.
+* Add helpers for authenticated media, and associated documentation ([#4185](https://github.com/matrix-org/matrix-js-sdk/pull/4185)). Contributed by @turt2live.
+
+## 🐛 Bug Fixes
+
+* Fix state\_events.ts types ([#4196](https://github.com/matrix-org/matrix-js-sdk/pull/4196)). Contributed by @t3chguy.
+* Fix sendEventHttpRequest for `m.room.redaction` events without `redacts` ([#4192](https://github.com/matrix-org/matrix-js-sdk/pull/4192)). Contributed by @t3chguy.
+
+
 Changes in [32.2.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v32.2.0) (2024-05-07)
 ==================================================================================================
 ## ✨ Features

README.md

@@ -21,6 +21,10 @@ endpoints from before Matrix 1.1, for example.
 
 # Quickstart
 
+> [!IMPORTANT]
+> Servers may require or use authenticated endpoints for media (images, files, avatars, etc). See the
+> [Authenticated Media](#authenticated-media) section for information on how to enable support for this.
+
 Using `yarn` instead of `npm` is recommended. Please see the Yarn [install guide](https://classic.yarnpkg.com/en/docs/install)
 if you do not have it already.
 
@@ -35,7 +39,7 @@ client.publicRooms(function (err, data) {
 ```
 
 See below for how to include libolm to enable end-to-end-encryption. Please check
-[the Node.js terminal app](examples/node) for a more complex example.
+[the Node.js terminal app](examples/node/README.md) for a more complex example.
 
 To start the client:
 
@@ -89,6 +93,34 @@ Object.keys(client.store.rooms).forEach((roomId) => {
 });
 ```
 
+## Authenticated media
+
+Servers supporting [MSC3916](https://github.com/matrix-org/matrix-spec-proposals/pull/3916) (Matrix 1.11) will require clients, like
+yours, to include an `Authorization` header when `/download`ing or `/thumbnail`ing media. For NodeJS environments this
+may be as easy as the following code snippet, though web browsers may need to use [Service Workers](https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API)
+to append the header when using the endpoints in `<img />` elements and similar.
+
+```javascript
+const downloadUrl = client.mxcUrlToHttp(
+    /*mxcUrl=*/ "mxc://example.org/abc123", // the MXC URI to download/thumbnail, typically from an event or profile
+    /*width=*/ undefined, // part of the thumbnail API. Use as required.
+    /*height=*/ undefined, // part of the thumbnail API. Use as required.
+    /*resizeMethod=*/ undefined, // part of the thumbnail API. Use as required.
+    /*allowDirectLinks=*/ false, // should generally be left `false`.
+    /*allowRedirects=*/ true, // implied supported with authentication
+    /*useAuthentication=*/ true, // the flag we're after in this example
+);
+const img = await fetch(downloadUrl, {
+    headers: {
+        Authorization: `Bearer ${client.getAccessToken()}`,
+    },
+});
+// Do something with `img`.
+```
+
+> [!WARNING]
+> In future the js-sdk will _only_ return authentication-required URLs, mandating population of the `Authorization` header.
+
 ## What does this SDK do?
 
 This SDK provides a full object model around the Matrix Client-Server API and emits

babel.config.cjs

@@ -0,0 +1,26 @@
+module.exports = {
+    sourceMaps: true,
+    presets: [
+        [
+            "@babel/preset-env",
+            {
+                targets: {
+                    esmodules: true,
+                },
+                // We want to output ES modules for the final build (mostly to ensure that
+                // async imports work correctly). However, jest doesn't support ES modules very
+                // well yet (see https://github.com/jestjs/jest/issues/9430), so we use commonjs
+                // when testing.
+                modules: process.env.NODE_ENV === "test" ? "commonjs" : false,
+            },
+        ],
+        "@babel/preset-typescript",
+    ],
+    plugins: [
+        "@babel/plugin-transform-numeric-separator",
+        "@babel/plugin-transform-class-properties",
+        "@babel/plugin-transform-object-rest-spread",
+        "@babel/plugin-syntax-dynamic-import",
+        "@babel/plugin-transform-runtime",
+    ],
+};

examples/node/package.json

@@ -3,12 +3,10 @@
     "version": "0.0.0",
     "description": "",
     "main": "app.js",
-    "scripts": {
-        "preinstall": "npm install ../.."
-    },
     "author": "",
     "license": "Apache 2.0",
     "dependencies": {
-        "cli-color": "^1.0.0"
+        "cli-color": "^1.0.0",
+        "matrix-js-sdk": "^32.0.0"
     }
 }

package.json

@@ -1,9 +1,9 @@
 {
     "name": "matrix-js-sdk",
-    "version": "32.2.0",
+    "version": "34.3.0",
     "description": "Matrix Client-Server SDK for Javascript",
     "engines": {
-        "node": ">=18.0.0"
+        "node": ">=20.0.0"
     },
     "scripts": {
         "prepack": "yarn build",
@@ -53,19 +53,20 @@
     ],
     "dependencies": {
         "@babel/runtime": "^7.12.5",
-        "@matrix-org/matrix-sdk-crypto-wasm": "^4.9.0",
+        "@matrix-org/matrix-sdk-crypto-wasm": "^7.0.0",
+        "@matrix-org/olm": "3.2.15",
         "another-json": "^0.2.0",
-        "bs58": "^5.0.0",
+        "bs58": "^6.0.0",
         "content-type": "^1.0.4",
         "jwt-decode": "^4.0.0",
         "loglevel": "^1.7.1",
         "matrix-events-sdk": "0.0.1",
-        "matrix-widget-api": "^1.6.0",
+        "matrix-widget-api": "^1.8.2",
         "oidc-client-ts": "^3.0.1",
         "p-retry": "4",
         "sdp-transform": "^2.14.1",
         "unhomoglyph": "^1.0.6",
-        "uuid": "9"
+        "uuid": "10"
     },
     "devDependencies": {
         "@action-validator/cli": "^0.6.0",
@@ -74,29 +75,26 @@
         "@babel/core": "^7.12.10",
         "@babel/eslint-parser": "^7.12.10",
         "@babel/eslint-plugin": "^7.12.10",
-        "@babel/plugin-proposal-class-properties": "^7.12.1",
-        "@babel/plugin-proposal-numeric-separator": "^7.12.7",
-        "@babel/plugin-proposal-object-rest-spread": "^7.12.1",
         "@babel/plugin-syntax-dynamic-import": "^7.8.3",
+        "@babel/plugin-transform-class-properties": "^7.12.1",
+        "@babel/plugin-transform-numeric-separator": "^7.12.7",
+        "@babel/plugin-transform-object-rest-spread": "^7.12.1",
         "@babel/plugin-transform-runtime": "^7.12.10",
         "@babel/preset-env": "^7.12.11",
         "@babel/preset-typescript": "^7.12.7",
         "@casualbot/jest-sonar-reporter": "2.2.7",
-        "@matrix-org/olm": "3.2.15",
         "@peculiar/webcrypto": "^1.4.5",
         "@types/bs58": "^4.0.1",
         "@types/content-type": "^1.1.5",
         "@types/debug": "^4.1.7",
-        "@types/domexception": "^4.0.0",
         "@types/jest": "^29.0.0",
         "@types/node": "18",
         "@types/sdp-transform": "^2.4.5",
-        "@types/uuid": "9",
+        "@types/uuid": "10",
         "@typescript-eslint/eslint-plugin": "^7.0.0",
         "@typescript-eslint/parser": "^7.0.0",
         "babel-jest": "^29.0.0",
         "debug": "^4.3.4",
-        "domexception": "^4.0.0",
         "eslint": "8.57.0",
         "eslint-config-google": "^0.14.0",
         "eslint-config-prettier": "^9.0.0",
@@ -105,10 +103,10 @@
         "eslint-plugin-jest": "^28.0.0",
         "eslint-plugin-jsdoc": "^48.0.0",
         "eslint-plugin-matrix-org": "^1.0.0",
-        "eslint-plugin-tsdoc": "^0.2.17",
-        "eslint-plugin-unicorn": "^52.0.0",
+        "eslint-plugin-tsdoc": "^0.3.0",
+        "eslint-plugin-unicorn": "^54.0.0",
         "fake-indexeddb": "^5.0.2",
-        "fetch-mock": "9.11.0",
+        "fetch-mock": "10.1.0",
         "fetch-mock-jest": "^1.5.1",
         "husky": "^9.0.0",
         "jest": "^29.0.0",
@@ -119,13 +117,13 @@
         "lint-staged": "^15.0.2",
         "matrix-mock-request": "^2.5.0",
         "node-fetch": "^2.7.0",
-        "prettier": "3.2.5",
-        "rimraf": "^5.0.0",
+        "prettier": "3.3.3",
+        "rimraf": "^6.0.0",
         "ts-node": "^10.9.2",
-        "typedoc": "^0.25.10",
+        "typedoc": "^0.26.0",
         "typedoc-plugin-coverage": "^3.0.0",
         "typedoc-plugin-mdn-links": "^3.0.3",
-        "typedoc-plugin-missing-exports": "^2.0.0",
+        "typedoc-plugin-missing-exports": "^3.0.0",
         "typescript": "^5.3.3"
     },
     "@casualbot/jest-sonar-reporter": {

scripts/release/merge-release-notes.js

@@ -112,7 +112,14 @@ const main = async ({ github, releaseId, dependencies }) => {
     const { GITHUB_REPOSITORY } = process.env;
     const [owner, repo] = GITHUB_REPOSITORY.split("/");
 
+    const { data: release } = await github.rest.repos.getRelease({
+        owner,
+        repo,
+        release_id: releaseId,
+    });
+
     const sections = Object.fromEntries(categories.map((cat) => [cat, []]));
+    parseReleaseNotes(release.body, sections);
     for (const dependency of dependencies) {
         const releases = await getReleases(github, dependency);
         for (const release of releases) {
@@ -120,12 +127,6 @@ const main = async ({ github, releaseId, dependencies }) => {
         }
     }
 
-    const { data: release } = await github.rest.repos.getRelease({
-        owner,
-        repo,
-        release_id: releaseId,
-    });
-
     const intro = release.body.split(HEADING_PREFIX, 2)[0].trim();
 
     let output = "";

scripts/switch_package_to_release.js

@@ -11,6 +11,11 @@ async function main() {
             pkgJson[field] = pkgJson["matrix_lib_" + field];
         }
     }
+
+    // matrix-js-sdk is built into ECMAScript modules. Make sure we declare it as such.
+    // See https://nodejs.org/api/packages.html#type.
+    pkgJson["type"] = "module";
+
     await fsProm.writeFile(PKGJSON, JSON.stringify(pkgJson, null, 2));
 }
 

spec/integ/crypto/crypto.spec.ts

@@ -19,7 +19,7 @@ import anotherjson from "another-json";
 import fetchMock from "fetch-mock-jest";
 import "fake-indexeddb/auto";
 import { IDBFactory } from "fake-indexeddb";
-import { MockResponse, MockResponseFunction } from "fetch-mock";
+import FetchMock from "fetch-mock";
 import Olm from "@matrix-org/olm";
 
 import * as testUtils from "../../test-utils/test-utils";
@@ -157,7 +157,7 @@ async function expectSendRoomKey(
     return await new Promise<Olm.InboundGroupSession>((resolve) => {
         fetchMock.putOnce(
             new RegExp("/sendToDevice/m.room.encrypted/"),
-            (url: string, opts: RequestInit): MockResponse => {
+            (url: string, opts: RequestInit): FetchMock.MockResponse => {
                 const content = JSON.parse(opts.body as string);
                 resolve(onSendRoomKey(content));
                 return {};
@@ -291,7 +291,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
      * @param response - the response to return from the request. Normally an {@link IClaimOTKsResult}
      *   (or a function that returns one).
      */
-    function expectAliceKeyClaim(response: MockResponse | MockResponseFunction) {
+    function expectAliceKeyClaim(response: FetchMock.MockResponse | FetchMock.MockResponseFunction) {
         const rootRegexp = escapeRegExp(new URL("/_matrix/client/", aliceClient.getHomeserverUrl()).toString());
         fetchMock.postOnce(new RegExp(rootRegexp + "(r0|v3)/keys/claim"), response);
     }
@@ -630,6 +630,27 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
                 expect(ev.decryptionFailureReason).toEqual(DecryptionFailureCode.HISTORICAL_MESSAGE_USER_NOT_JOINED);
             });
 
+            newBackendOnly(
+                "fails with NOT_JOINED if user is not member of room (MSC4115 unstable prefix)",
+                async () => {
+                    fetchMock.get("path:/_matrix/client/v3/room_keys/version", {
+                        status: 404,
+                        body: { errcode: "M_NOT_FOUND", error: "No current backup version." },
+                    });
+                    expectAliceKeyQuery({ device_keys: { "@alice:localhost": {} }, failures: {} });
+                    await startClientAndAwaitFirstSync();
+
+                    const ev = await sendEventAndAwaitDecryption({
+                        unsigned: {
+                            [UNSIGNED_MEMBERSHIP_FIELD.altName!]: "leave",
+                        },
+                    });
+                    expect(ev.decryptionFailureReason).toEqual(
+                        DecryptionFailureCode.HISTORICAL_MESSAGE_USER_NOT_JOINED,
+                    );
+                },
+            );
+
             newBackendOnly(
                 "fails with another error when the server reports user was a member of the room",
                 async () => {
@@ -654,6 +675,30 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
                 },
             );
 
+            newBackendOnly(
+                "fails with another error when the server reports user was a member of the room (MSC4115 unstable prefix)",
+                async () => {
+                    // This tests that when the server reports that the user
+                    // was invited at the time the event was sent, then we
+                    // don't get a HISTORICAL_MESSAGE_USER_NOT_JOINED error,
+                    // and instead get some other error, since the user should
+                    // have gotten the key for the event.
+                    fetchMock.get("path:/_matrix/client/v3/room_keys/version", {
+                        status: 404,
+                        body: { errcode: "M_NOT_FOUND", error: "No current backup version." },
+                    });
+                    expectAliceKeyQuery({ device_keys: { "@alice:localhost": {} }, failures: {} });
+                    await startClientAndAwaitFirstSync();
+
+                    const ev = await sendEventAndAwaitDecryption({
+                        unsigned: {
+                            [UNSIGNED_MEMBERSHIP_FIELD.altName!]: "invite",
+                        },
+                    });
+                    expect(ev.decryptionFailureReason).toEqual(DecryptionFailureCode.HISTORICAL_MESSAGE_NO_KEY_BACKUP);
+                },
+            );
+
             newBackendOnly(
                 "fails with another error when the server reports user was a member of the room",
                 async () => {
@@ -676,6 +721,29 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
                     expect(ev.decryptionFailureReason).toEqual(DecryptionFailureCode.HISTORICAL_MESSAGE_NO_KEY_BACKUP);
                 },
             );
+
+            newBackendOnly(
+                "fails with another error when the server reports user was a member of the room (MSC4115 unstable prefix)",
+                async () => {
+                    // This tests that when the server reports the user's
+                    // membership, and reports that the user was joined, then we
+                    // don't get a HISTORICAL_MESSAGE_USER_NOT_JOINED error, and
+                    // instead get some other error.
+                    fetchMock.get("path:/_matrix/client/v3/room_keys/version", {
+                        status: 404,
+                        body: { errcode: "M_NOT_FOUND", error: "No current backup version." },
+                    });
+                    expectAliceKeyQuery({ device_keys: { "@alice:localhost": {} }, failures: {} });
+                    await startClientAndAwaitFirstSync();
+
+                    const ev = await sendEventAndAwaitDecryption({
+                        unsigned: {
+                            [UNSIGNED_MEMBERSHIP_FIELD.altName!]: "join",
+                        },
+                    });
+                    expect(ev.decryptionFailureReason).toEqual(DecryptionFailureCode.HISTORICAL_MESSAGE_NO_KEY_BACKUP);
+                },
+            );
         });
 
         it("Decryption fails with Unable to decrypt for other errors", async () => {
@@ -1351,7 +1419,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
 
         fetchMock.putOnce(
             { url: new RegExp("/send/"), name: "send-event" },
-            (url: string, opts: RequestInit): MockResponse => {
+            (url: string, opts: RequestInit): FetchMock.MockResponse => {
                 const content = JSON.parse(opts.body as string);
                 logger.log("/send:", content);
                 // make sure that a new session is used
@@ -1416,7 +1484,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
 
         // mark the device as known, and resend.
         aliceClient.setDeviceKnown(aliceClient.getUserId()!, "DEVICE_ID");
-        expectAliceKeyClaim((url: string, opts: RequestInit): MockResponse => {
+        expectAliceKeyClaim((url: string, opts: RequestInit): FetchMock.MockResponse => {
             const content = JSON.parse(opts.body as string);
             expect(content.one_time_keys[aliceClient.getUserId()!].DEVICE_ID).toEqual("signed_curve25519");
             return getTestKeysClaimResponse(aliceClient.getUserId()!);
@@ -2112,11 +2180,11 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
             const inboundGroupSessionPromise = expectSendRoomKey("@bob:xyz", testOlmAccount);
 
             // ... and finally, send the room key. We block the response until `sendRoomMessageDefer` completes.
-            const sendRoomMessageDefer = defer<MockResponse>();
+            const sendRoomMessageDefer = defer<FetchMock.MockResponse>();
             const reqProm = new Promise<IContent>((resolve) => {
                 fetchMock.putOnce(
                     new RegExp("/send/m.room.encrypted/"),
-                    async (url: string, opts: RequestInit): Promise<MockResponse> => {
+                    async (url: string, opts: RequestInit): Promise<FetchMock.MockResponse> => {
                         resolve(JSON.parse(opts.body as string));
                         return await sendRoomMessageDefer.promise;
                     },
@@ -2265,8 +2333,84 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
     });
 
     describe("m.room_key.withheld handling", () => {
-        // TODO: there are a bunch more tests for this sort of thing in spec/unit/crypto/algorithms/megolm.spec.ts.
-        //   They should be converted to integ tests and moved.
+        describe.each([
+            ["m.blacklisted", "The sender has blocked you.", DecryptionFailureCode.MEGOLM_KEY_WITHHELD],
+            [
+                "m.unverified",
+                "The sender has disabled encrypting to unverified devices.",
+                DecryptionFailureCode.MEGOLM_KEY_WITHHELD_FOR_UNVERIFIED_DEVICE,
+            ],
+        ])(
+            "Decryption fails with withheld error if a withheld notice with code '%s' is received",
+            (withheldCode, expectedMessage, expectedErrorCode) => {
+                it.each(["before", "after"])("%s the event", async (when) => {
+                    expectAliceKeyQuery({ device_keys: { "@alice:localhost": {} }, failures: {} });
+                    await startClientAndAwaitFirstSync();
+
+                    // A promise which resolves, with the MatrixEvent which wraps the event, once the decryption fails.
+                    let awaitDecryption = emitPromise(aliceClient, MatrixEventEvent.Decrypted);
+
+                    // Send Alice an encrypted room event which looks like it was encrypted with a megolm session
+                    async function sendEncryptedEvent() {
+                        const event = {
+                            ...testData.ENCRYPTED_EVENT,
+                            origin_server_ts: Date.now(),
+                        };
+                        const syncResponse = {
+                            next_batch: 1,
+                            rooms: { join: { [ROOM_ID]: { timeline: { events: [event] } } } },
+                        };
+
+                        syncResponder.sendOrQueueSyncResponse(syncResponse);
+                        await syncPromise(aliceClient);
+                    }
+
+                    // Send Alice a withheld notice
+                    async function sendWithheldMessage() {
+                        const withheldMessage = {
+                            type: "m.room_key.withheld",
+                            sender: "@bob:example.com",
+                            content: {
+                                algorithm: "m.megolm.v1.aes-sha2",
+                                room_id: ROOM_ID,
+                                sender_key: testData.ENCRYPTED_EVENT.content!.sender_key,
+                                session_id: testData.ENCRYPTED_EVENT.content!.session_id,
+                                code: withheldCode,
+                                reason: "zzz",
+                            },
+                        };
+
+                        syncResponder.sendOrQueueSyncResponse({
+                            next_batch: 1,
+                            to_device: { events: [withheldMessage] },
+                        });
+                        await syncPromise(aliceClient);
+                    }
+
+                    if (when === "before") {
+                        await sendWithheldMessage();
+                        await sendEncryptedEvent();
+                    } else {
+                        await sendEncryptedEvent();
+                        // Make sure that the first attempt to decrypt has happened before the withheld arrives
+                        await awaitDecryption;
+                        awaitDecryption = emitPromise(aliceClient, MatrixEventEvent.Decrypted);
+                        await sendWithheldMessage();
+                    }
+
+                    const ev = await awaitDecryption;
+                    expect(ev.getContent()).toEqual({
+                        body: `** Unable to decrypt: DecryptionError: ${expectedMessage} **`,
+                        msgtype: "m.bad.encrypted",
+                    });
+
+                    expect(ev.decryptionFailureReason).toEqual(expectedErrorCode);
+
+                    // `isEncryptedDisabledForUnverifiedDevices` should be true for `m.unverified` and false for other errors.
+                    expect(ev.isEncryptedDisabledForUnverifiedDevices).toEqual(withheldCode === "m.unverified");
+                });
+            },
+        );
 
         oldBackendOnly("does not block decryption on an 'm.unavailable' report", async function () {
             // there may be a key downloads for alice

spec/integ/crypto/megolm-backup.spec.ts

@@ -21,7 +21,7 @@ import { Mocked } from "jest-mock";
 
 import {
     createClient,
-    CryptoApi,
+    Crypto,
     CryptoEvent,
     ICreateClientOpts,
     IEvent,
@@ -310,7 +310,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("megolm-keys backup (%s)", (backe
     });
 
     describe("recover from backup", () => {
-        let aliceCrypto: CryptoApi;
+        let aliceCrypto: Crypto.CryptoApi;
 
         beforeEach(async () => {
             fetchMock.get("path:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA);
@@ -796,7 +796,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("megolm-keys backup (%s)", (backe
 
             const result = await aliceCrypto.checkKeyBackupAndEnable();
             expect(result).toBeTruthy();
-            jest.runAllTimers();
+            jest.advanceTimersByTime(10 * 60 * 1000);
             await failurePromise;
 
             // Fix the endpoint to do successful uploads
@@ -829,7 +829,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("megolm-keys backup (%s)", (backe
             });
 
             // run the timers, which will make the backup loop redo the request
-            await jest.runAllTimersAsync();
+            await jest.advanceTimersByTimeAsync(10 * 60 * 1000);
             await successPromise;
             await allKeysUploadedPromise;
         });

spec/integ/crypto/rust-crypto.spec.ts

@@ -23,6 +23,7 @@ import { populateStore } from "../../test-utils/test_indexeddb_cryptostore_dump"
 import { MSK_NOT_CACHED_DATASET } from "../../test-utils/test_indexeddb_cryptostore_dump/no_cached_msk_dump";
 import { IDENTITY_NOT_TRUSTED_DATASET } from "../../test-utils/test_indexeddb_cryptostore_dump/unverified";
 import { FULL_ACCOUNT_DATASET } from "../../test-utils/test_indexeddb_cryptostore_dump/full_account";
+import { EMPTY_ACCOUNT_DATASET } from "../../test-utils/test_indexeddb_cryptostore_dump/empty_account";
 
 jest.setTimeout(15000);
 
@@ -65,18 +66,36 @@ describe("MatrixClient.initRustCrypto", () => {
         expect(databaseNames).toEqual(expect.arrayContaining(["matrix-js-sdk::matrix-sdk-crypto"]));
     });
 
-    it("should create the meta db if given a pickleKey", async () => {
+    it("should create the meta db if given a storageKey", async () => {
         const matrixClient = createClient({
             baseUrl: "http://test.server",
             userId: "@alice:localhost",
             deviceId: "aliceDevice",
-            pickleKey: "testKey",
         });
 
         // No databases.
         expect(await indexedDB.databases()).toHaveLength(0);
 
-        await matrixClient.initRustCrypto();
+        await matrixClient.initRustCrypto({ storageKey: new Uint8Array(32) });
+
+        // should have two indexed dbs now
+        const databaseNames = (await indexedDB.databases()).map((db) => db.name);
+        expect(databaseNames).toEqual(
+            expect.arrayContaining(["matrix-js-sdk::matrix-sdk-crypto", "matrix-js-sdk::matrix-sdk-crypto-meta"]),
+        );
+    });
+
+    it("should create the meta db if given a storagePassword", async () => {
+        const matrixClient = createClient({
+            baseUrl: "http://test.server",
+            userId: "@alice:localhost",
+            deviceId: "aliceDevice",
+        });
+
+        // No databases.
+        expect(await indexedDB.databases()).toHaveLength(0);
+
+        await matrixClient.initRustCrypto({ storagePassword: "the cow is on the moon" });
 
         // should have two indexed dbs now
         const databaseNames = (await indexedDB.databases()).map((db) => db.name);
@@ -266,6 +285,38 @@ describe("MatrixClient.initRustCrypto", () => {
             });
         });
 
+        it("should not migrate if account data is missing", async () => {
+            // See https://github.com/element-hq/element-web/issues/27447
+
+            // Given we have an almost-empty legacy account in the database
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", {
+                status: 404,
+                body: { errcode: "M_NOT_FOUND", error: "No backup found" },
+            });
+            fetchMock.post("path:/_matrix/client/v3/keys/query", EMPTY_ACCOUNT_DATASET.keyQueryResponse);
+
+            const testStoreName = "test-store";
+            await populateStore(testStoreName, EMPTY_ACCOUNT_DATASET.dumpPath);
+            const cryptoStore = new IndexedDBCryptoStore(indexedDB, testStoreName);
+
+            const matrixClient = createClient({
+                baseUrl: "http://test.server",
+                userId: EMPTY_ACCOUNT_DATASET.userId,
+                deviceId: EMPTY_ACCOUNT_DATASET.deviceId,
+                cryptoStore,
+                pickleKey: EMPTY_ACCOUNT_DATASET.pickleKey,
+            });
+
+            // When we start Rust crypto, potentially triggering an upgrade
+            const progressListener = jest.fn();
+            matrixClient.addListener(CryptoEvent.LegacyCryptoStoreMigrationProgress, progressListener);
+
+            await matrixClient.initRustCrypto();
+
+            // Then no error occurs, and no upgrade happens
+            expect(progressListener.mock.calls.length).toBe(0);
+        }, 60000);
+
         describe("Legacy trust migration", () => {
             async function populateAndStartLegacyCryptoStore(dumpPath: string): Promise<IndexedDBCryptoStore> {
                 const testStoreName = "test-store";
@@ -399,10 +450,9 @@ describe("MatrixClient.clearStores", () => {
             baseUrl: "http://test.server",
             userId: "@alice:localhost",
             deviceId: "aliceDevice",
-            pickleKey: "testKey",
         });
 
-        await matrixClient.initRustCrypto();
+        await matrixClient.initRustCrypto({ storagePassword: "testKey" });
         expect(await indexedDB.databases()).toHaveLength(2);
         await matrixClient.stopClient();
 

spec/integ/crypto/verification.spec.ts

@@ -17,7 +17,7 @@ limitations under the License.
 import "fake-indexeddb/auto";
 
 import anotherjson from "another-json";
-import { MockResponse } from "fetch-mock";
+import FetchMock from "fetch-mock";
 import fetchMock from "fetch-mock-jest";
 import { IDBFactory } from "fake-indexeddb";
 import { createHash } from "crypto";
@@ -1511,7 +1511,7 @@ function expectSendToDeviceMessage(msgtype: string): Promise<{ messages: any }>
     return new Promise((resolve) => {
         fetchMock.putOnce(
             new RegExp(`/_matrix/client/(r0|v3)/sendToDevice/${escapeRegExp(msgtype)}`),
-            (url: string, opts: RequestInit): MockResponse => {
+            (url: string, opts: RequestInit): FetchMock.MockResponse => {
                 resolve(JSON.parse(opts.body as string));
                 return {};
             },
@@ -1535,7 +1535,7 @@ function mockSecretRequestAndGetPromises(): Map<string, Promise<string>> {
 
     fetchMock.put(
         new RegExp(`/_matrix/client/(r0|v3)/sendToDevice/m.secret.request`),
-        (url: string, opts: RequestInit): MockResponse => {
+        (url: string, opts: RequestInit): FetchMock.MockResponse => {
             const messages = JSON.parse(opts.body as string).messages[TEST_USER_ID];
             // rust crypto broadcasts to all devices, old crypto to a specific device, take the first one
             const content = Object.values(messages)[0] as any;

spec/integ/matrix-client-methods.spec.ts

@@ -257,7 +257,7 @@ describe("MatrixClient", function () {
                 .when("POST", "/knock/" + encodeURIComponent(roomId))
                 .check((request) => {
                     expect(request.data).toEqual({ reason: opts.reason });
-                    expect(request.queryParams).toEqual({ server_name: opts.viaServers });
+                    expect(request.queryParams).toEqual({ server_name: opts.viaServers, via: opts.viaServers });
                 })
                 .respond(200, { room_id: roomId });
 
@@ -1293,18 +1293,109 @@ describe("MatrixClient", function () {
     });
 
     describe("getCapabilities", () => {
-        it("should cache by default", async () => {
+        it("should return cached capabilities if present", async () => {
+            const capsObject = {
+                "m.change_password": false,
+            };
+
+            httpBackend!.when("GET", "/versions").respond(200, {});
+            httpBackend!.when("GET", "/pushrules").respond(200, {});
+            httpBackend!.when("POST", "/filter").respond(200, { filter_id: "a filter id" });
             httpBackend.when("GET", "/capabilities").respond(200, {
-                capabilities: {
-                    "m.change_password": false,
-                },
+                capabilities: capsObject,
             });
-            const prom = httpBackend.flushAllExpected();
-            const capabilities1 = await client.getCapabilities();
-            const capabilities2 = await client.getCapabilities();
+
+            client.startClient();
+            await httpBackend!.flushAllExpected();
+
+            expect(await client.getCapabilities()).toEqual(capsObject);
+        });
+
+        it("should fetch capabilities if cache not present", async () => {
+            const capsObject = {
+                "m.change_password": false,
+            };
+
+            httpBackend.when("GET", "/capabilities").respond(200, {
+                capabilities: capsObject,
+            });
+
+            const capsPromise = client.getCapabilities();
+            await httpBackend!.flushAllExpected();
+
+            expect(await capsPromise).toEqual(capsObject);
+        });
+    });
+
+    describe("getCachedCapabilities", () => {
+        it("should return cached capabilities or undefined", async () => {
+            const capsObject = {
+                "m.change_password": false,
+            };
+
+            httpBackend!.when("GET", "/versions").respond(200, {});
+            httpBackend!.when("GET", "/pushrules").respond(200, {});
+            httpBackend!.when("POST", "/filter").respond(200, { filter_id: "a filter id" });
+            httpBackend.when("GET", "/capabilities").respond(200, {
+                capabilities: capsObject,
+            });
+
+            expect(client.getCachedCapabilities()).toBeUndefined();
+
+            client.startClient();
+
+            await httpBackend!.flushAllExpected();
+
+            expect(client.getCachedCapabilities()).toEqual(capsObject);
+        });
+    });
+
+    describe("fetchCapabilities", () => {
+        const capsObject = {
+            "m.change_password": false,
+        };
+
+        beforeEach(() => {
+            httpBackend.when("GET", "/capabilities").respond(200, {
+                capabilities: capsObject,
+            });
+        });
+
+        afterEach(() => {
+            jest.useRealTimers();
+        });
+
+        it("should always fetch capabilities and then cache", async () => {
+            const prom = client.fetchCapabilities();
+            await httpBackend.flushAllExpected();
+            const caps = await prom;
+
+            expect(caps).toEqual(capsObject);
+        });
+
+        it("should write-through the cache", async () => {
+            httpBackend!.when("GET", "/versions").respond(200, {});
+            httpBackend!.when("GET", "/pushrules").respond(200, {});
+            httpBackend!.when("POST", "/filter").respond(200, { filter_id: "a filter id" });
+
+            client.startClient();
+            await httpBackend!.flushAllExpected();
+
+            expect(client.getCachedCapabilities()).toEqual(capsObject);
+
+            const newCapsObject = {
+                "m.change_password": true,
+            };
+
+            httpBackend.when("GET", "/capabilities").respond(200, {
+                capabilities: newCapsObject,
+            });
+
+            const prom = client.fetchCapabilities();
+            await httpBackend.flushAllExpected();
             await prom;
 
-            expect(capabilities1).toStrictEqual(capabilities2);
+            expect(client.getCachedCapabilities()).toEqual(newCapsObject);
         });
     });
 
@@ -1825,7 +1916,6 @@ function withThreadId(event: MatrixEvent, newThreadId: string): MatrixEvent {
 
 const buildEventMessageInThread = (root: MatrixEvent) =>
     new MatrixEvent({
-        age: 80098509,
         content: {
             "algorithm": "m.megolm.v1.aes-sha2",
             "ciphertext": "ENCRYPTEDSTUFF",
@@ -1846,12 +1936,10 @@ const buildEventMessageInThread = (root: MatrixEvent) =>
         sender: "@andybalaam-test1:matrix.org",
         type: "m.room.encrypted",
         unsigned: { age: 80098509 },
-        user_id: "@andybalaam-test1:matrix.org",
     });
 
 const buildEventPollResponseReference = () =>
     new MatrixEvent({
-        age: 80098509,
         content: {
             "algorithm": "m.megolm.v1.aes-sha2",
             "ciphertext": "ENCRYPTEDSTUFF",
@@ -1869,7 +1957,6 @@ const buildEventPollResponseReference = () =>
         sender: "@andybalaam-test1:matrix.org",
         type: "m.room.encrypted",
         unsigned: { age: 80106237 },
-        user_id: "@andybalaam-test1:matrix.org",
     });
 
 const buildEventReaction = (event: MatrixEvent) =>
@@ -1909,7 +1996,6 @@ const buildEventRedaction = (event: MatrixEvent) =>
 
 const buildEventPollStartThreadRoot = () =>
     new MatrixEvent({
-        age: 80108647,
         content: {
             algorithm: "m.megolm.v1.aes-sha2",
             ciphertext: "ENCRYPTEDSTUFF",
@@ -1923,12 +2009,10 @@ const buildEventPollStartThreadRoot = () =>
         sender: "@andybalaam-test1:matrix.org",
         type: "m.room.encrypted",
         unsigned: { age: 80108647 },
-        user_id: "@andybalaam-test1:matrix.org",
     });
 
 const buildEventReply = (target: MatrixEvent) =>
     new MatrixEvent({
-        age: 80098509,
         content: {
             "algorithm": "m.megolm.v1.aes-sha2",
             "ciphertext": "ENCRYPTEDSTUFF",
@@ -1947,12 +2031,10 @@ const buildEventReply = (target: MatrixEvent) =>
         sender: "@andybalaam-test1:matrix.org",
         type: "m.room.encrypted",
         unsigned: { age: 80098509 },
-        user_id: "@andybalaam-test1:matrix.org",
     });
 
 const buildEventRoomName = () =>
     new MatrixEvent({
-        age: 80123249,
         content: {
             name: "1 poll, 1 vote, 1 thread",
         },
@@ -1963,12 +2045,10 @@ const buildEventRoomName = () =>
         state_key: "",
         type: "m.room.name",
         unsigned: { age: 80123249 },
-        user_id: "@andybalaam-test1:matrix.org",
     });
 
 const buildEventEncryption = () =>
     new MatrixEvent({
-        age: 80123383,
         content: {
             algorithm: "m.megolm.v1.aes-sha2",
         },
@@ -1979,12 +2059,10 @@ const buildEventEncryption = () =>
         state_key: "",
         type: "m.room.encryption",
         unsigned: { age: 80123383 },
-        user_id: "@andybalaam-test1:matrix.org",
     });
 
 const buildEventGuestAccess = () =>
     new MatrixEvent({
-        age: 80123473,
         content: {
             guest_access: "can_join",
         },
@@ -1995,12 +2073,10 @@ const buildEventGuestAccess = () =>
         state_key: "",
         type: "m.room.guest_access",
         unsigned: { age: 80123473 },
-        user_id: "@andybalaam-test1:matrix.org",
     });
 
 const buildEventHistoryVisibility = () =>
     new MatrixEvent({
-        age: 80123556,
         content: {
             history_visibility: "shared",
         },
@@ -2011,12 +2087,10 @@ const buildEventHistoryVisibility = () =>
         state_key: "",
         type: "m.room.history_visibility",
         unsigned: { age: 80123556 },
-        user_id: "@andybalaam-test1:matrix.org",
     });
 
 const buildEventJoinRules = () =>
     new MatrixEvent({
-        age: 80123696,
         content: {
             join_rule: KnownMembership.Invite,
         },
@@ -2027,12 +2101,10 @@ const buildEventJoinRules = () =>
         state_key: "",
         type: "m.room.join_rules",
         unsigned: { age: 80123696 },
-        user_id: "@andybalaam-test1:matrix.org",
     });
 
 const buildEventPowerLevels = () =>
     new MatrixEvent({
-        age: 80124105,
         content: {
             ban: 50,
             events: {
@@ -2063,12 +2135,10 @@ const buildEventPowerLevels = () =>
         state_key: "",
         type: "m.room.power_levels",
         unsigned: { age: 80124105 },
-        user_id: "@andybalaam-test1:matrix.org",
     });
 
 const buildEventMember = () =>
     new MatrixEvent({
-        age: 80125279,
         content: {
             avatar_url: "mxc://matrix.org/aNtbVcFfwotudypZcHsIcPOc",
             displayname: "andybalaam-test1",
@@ -2081,12 +2151,10 @@ const buildEventMember = () =>
         state_key: "@andybalaam-test1:matrix.org",
         type: "m.room.member",
         unsigned: { age: 80125279 },
-        user_id: "@andybalaam-test1:matrix.org",
     });
 
 const buildEventCreate = () =>
     new MatrixEvent({
-        age: 80126105,
         content: {
             room_version: "6",
         },
@@ -2097,7 +2165,6 @@ const buildEventCreate = () =>
         state_key: "",
         type: "m.room.create",
         unsigned: { age: 80126105 },
-        user_id: "@andybalaam-test1:matrix.org",
     });
 
 function assertObjectContains(obj: Record<string, any>, expected: any): void {

spec/integ/matrix-client-room-timeline.spec.ts

@@ -333,7 +333,7 @@ describe("MatrixClient room timelines", function () {
                 name: userName,
                 url: "mxc://some/url",
             });
-            oldMshipEvent.prev_content = {
+            oldMshipEvent.unsigned!.prev_content = {
                 displayname: "Old Alice",
                 avatar_url: undefined,
                 membership: KnownMembership.Join,

spec/integ/matrix-client-syncing-errors.spec.ts

@@ -105,13 +105,13 @@ describe("MatrixClient syncing errors", () => {
 
         await client!.startClient();
         expect(await syncEvents[0].promise).toBe(SyncState.Error);
-        jest.runAllTimers(); // this will skip forward to trigger the keepAlive/sync
+        jest.advanceTimersByTime(60 * 1000); // this will skip forward to trigger the keepAlive/sync
         expect(await syncEvents[1].promise).toBe(SyncState.Error);
-        jest.runAllTimers(); // this will skip forward to trigger the keepAlive/sync
+        jest.advanceTimersByTime(60 * 1000); // this will skip forward to trigger the keepAlive/sync
         expect(await syncEvents[2].promise).toBe(SyncState.Prepared);
-        jest.runAllTimers(); // this will skip forward to trigger the keepAlive/sync
+        jest.advanceTimersByTime(60 * 1000); // this will skip forward to trigger the keepAlive/sync
         expect(await syncEvents[3].promise).toBe(SyncState.Syncing);
-        jest.runAllTimers(); // this will skip forward to trigger the keepAlive/sync
+        jest.advanceTimersByTime(60 * 1000); // this will skip forward to trigger the keepAlive/sync
         expect(await syncEvents[4].promise).toBe(SyncState.Syncing);
     });
 
@@ -119,6 +119,7 @@ describe("MatrixClient syncing errors", () => {
         jest.useFakeTimers();
         fetchMock.config.overwriteRoutes = false;
         fetchMock
+            .get("end:capabilities", {})
             .getOnce("end:versions", {}) // first version check without credentials needs to succeed
             .get("end:versions", unknownTokenErrorData) // further version checks fails with 401
             .get("end:pushrules/", 401) // fails with 401 without an error. This does happen in practice e.g. with Synapse

spec/integ/matrix-client-syncing.spec.ts

@@ -2281,67 +2281,70 @@ describe("MatrixClient syncing", () => {
             httpBackend!.expectedRequests = [];
         });
 
-        it("should return a room based on the room initialSync API", async () => {
-            httpBackend!.when("GET", `/rooms/${encodeURIComponent(roomOne)}/initialSync`).respond(200, {
-                room_id: roomOne,
-                membership: KnownMembership.Leave,
-                messages: {
-                    start: "start",
-                    end: "end",
-                    chunk: [
+        it.each([undefined, 100])(
+            "should return a room based on the room initialSync API with limit %s",
+            async (limit) => {
+                httpBackend!.when("GET", `/rooms/${encodeURIComponent(roomOne)}/initialSync`).respond(200, {
+                    room_id: roomOne,
+                    membership: KnownMembership.Leave,
+                    messages: {
+                        start: "start",
+                        end: "end",
+                        chunk: [
+                            {
+                                content: { body: "Message 1" },
+                                type: "m.room.message",
+                                event_id: "$eventId1",
+                                sender: userA,
+                                origin_server_ts: 12313525,
+                                room_id: roomOne,
+                            },
+                            {
+                                content: { body: "Message 2" },
+                                type: "m.room.message",
+                                event_id: "$eventId2",
+                                sender: userB,
+                                origin_server_ts: 12315625,
+                                room_id: roomOne,
+                            },
+                        ],
+                    },
+                    state: [
                         {
-                            content: { body: "Message 1" },
-                            type: "m.room.message",
-                            event_id: "$eventId1",
+                            content: { name: "Room Name" },
+                            type: "m.room.name",
+                            event_id: "$eventId",
                             sender: userA,
-                            origin_server_ts: 12313525,
-                            room_id: roomOne,
-                        },
-                        {
-                            content: { body: "Message 2" },
-                            type: "m.room.message",
-                            event_id: "$eventId2",
-                            sender: userB,
-                            origin_server_ts: 12315625,
+                            origin_server_ts: 12314525,
+                            state_key: "",
                             room_id: roomOne,
                         },
                     ],
-                },
-                state: [
-                    {
-                        content: { name: "Room Name" },
-                        type: "m.room.name",
-                        event_id: "$eventId",
-                        sender: userA,
-                        origin_server_ts: 12314525,
-                        state_key: "",
-                        room_id: roomOne,
-                    },
-                ],
-                presence: [
-                    {
-                        content: {},
-                        type: "m.presence",
-                        sender: userA,
-                    },
-                ],
-            });
-            httpBackend!.when("GET", "/events").respond(200, { chunk: [] });
+                    presence: [
+                        {
+                            content: {},
+                            type: "m.presence",
+                            sender: userA,
+                        },
+                    ],
+                });
+                httpBackend!.when("GET", "/events").respond(200, { chunk: [] });
 
-            const prom = client!.peekInRoom(roomOne);
-            await httpBackend!.flushAllExpected();
-            const room = await prom;
+                const prom = client!.peekInRoom(roomOne, limit);
+                await httpBackend!.flushAllExpected();
+                const room = await prom;
 
-            expect(room.roomId).toBe(roomOne);
-            expect(room.getMyMembership()).toBe(KnownMembership.Leave);
-            expect(room.name).toBe("Room Name");
-            expect(room.currentState.getStateEvents("m.room.name", "")?.getId()).toBe("$eventId");
-            expect(room.timeline[0].getContent().body).toBe("Message 1");
-            expect(room.timeline[1].getContent().body).toBe("Message 2");
-            client?.stopPeeking();
-            httpBackend!.when("GET", "/events").respond(200, { chunk: [] });
-            await httpBackend!.flushAllExpected();
-        });
+                expect(room.roomId).toBe(roomOne);
+                expect(room.getMyMembership()).toBe(KnownMembership.Leave);
+                expect(room.name).toBe("Room Name");
+                expect(room.currentState.getStateEvents("m.room.name", "")?.getId()).toBe("$eventId");
+                expect(room.timeline[0].getContent().body).toBe("Message 1");
+                expect(room.timeline[1].getContent().body).toBe("Message 2");
+                client?.stopPeeking();
+                httpBackend!.when("GET", "/events").respond(200, { chunk: [] });
+                await httpBackend!.flushAllExpected();
+            },
+        );
     });
 
     describe("user account data", () => {

spec/integ/rendezvous/MSC4108SignInWithQR.spec.ts

@@ -0,0 +1,358 @@
+/*
+Copyright 2024 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { QrCodeData, QrCodeMode } from "@matrix-org/matrix-sdk-crypto-wasm";
+import { mocked } from "jest-mock";
+import fetchMock from "fetch-mock-jest";
+
+import {
+    MSC4108FailureReason,
+    MSC4108RendezvousSession,
+    MSC4108SecureChannel,
+    MSC4108SignInWithQR,
+    PayloadType,
+    RendezvousError,
+} from "../../../src/rendezvous";
+import { defer } from "../../../src/utils";
+import {
+    ClientPrefix,
+    DEVICE_CODE_SCOPE,
+    IHttpOpts,
+    IMyDevice,
+    MatrixClient,
+    MatrixError,
+    MatrixHttpApi,
+} from "../../../src";
+import { mockOpenIdConfiguration } from "../../test-utils/oidc";
+
+function makeMockClient(opts: { userId: string; deviceId: string; msc4108Enabled: boolean }): MatrixClient {
+    const baseUrl = "https://example.com";
+    const crypto = {
+        exportSecretsForQrLogin: jest.fn(),
+    };
+    const client = {
+        doesServerSupportUnstableFeature(feature: string) {
+            return Promise.resolve(opts.msc4108Enabled && feature === "org.matrix.msc4108");
+        },
+        getUserId() {
+            return opts.userId;
+        },
+        getDeviceId() {
+            return opts.deviceId;
+        },
+        baseUrl,
+        getDomain: () => "example.com",
+        getDevice: jest.fn(),
+        getCrypto: jest.fn(() => crypto),
+        getAuthIssuer: jest.fn().mockResolvedValue({ issuer: "https://issuer/" }),
+    } as unknown as MatrixClient;
+    client.http = new MatrixHttpApi<IHttpOpts & { onlyData: true }>(client, {
+        baseUrl: client.baseUrl,
+        prefix: ClientPrefix.Unstable,
+        onlyData: true,
+    });
+    return client;
+}
+
+describe("MSC4108SignInWithQR", () => {
+    beforeEach(() => {
+        fetchMock.get(
+            "https://issuer/.well-known/openid-configuration",
+            mockOpenIdConfiguration("https://issuer/", [DEVICE_CODE_SCOPE]),
+        );
+        fetchMock.get("https://issuer/jwks", {
+            status: 200,
+            headers: {
+                "Content-Type": "application/json",
+            },
+            keys: [],
+        });
+    });
+
+    afterEach(() => {
+        fetchMock.reset();
+    });
+
+    const url = "https://fallbackserver/rz/123";
+    const deviceId = "DEADB33F";
+    const verificationUri = "https://example.com/verify";
+    const verificationUriComplete = "https://example.com/verify/complete";
+
+    it("should generate qr code data as expected", async () => {
+        const session = new MSC4108RendezvousSession({
+            url,
+        });
+        const channel = new MSC4108SecureChannel(session);
+        const login = new MSC4108SignInWithQR(channel, false);
+
+        await login.generateCode();
+        const code = login.code;
+        expect(code).toHaveLength(71);
+        const text = new TextDecoder().decode(code);
+        expect(text.startsWith("MATRIX")).toBeTruthy();
+        expect(text.endsWith(url)).toBeTruthy();
+
+        // Assert that the code is stable
+        await login.generateCode();
+        expect(login.code).toEqual(code);
+    });
+
+    describe("should be able to connect as a reciprocating device", () => {
+        let client: MatrixClient;
+        let ourLogin: MSC4108SignInWithQR;
+        let opponentLogin: MSC4108SignInWithQR;
+
+        beforeEach(async () => {
+            let ourData = defer<string>();
+            let opponentData = defer<string>();
+
+            const ourMockSession = {
+                send: jest.fn(async (newData) => {
+                    ourData.resolve(newData);
+                }),
+                receive: jest.fn(() => {
+                    const prom = opponentData.promise;
+                    prom.then(() => {
+                        opponentData = defer();
+                    });
+                    return prom;
+                }),
+                url,
+                cancelled: false,
+                cancel: () => {
+                    // @ts-ignore
+                    ourMockSession.cancelled = true;
+                    ourData.resolve("");
+                },
+            } as unknown as MSC4108RendezvousSession;
+            const opponentMockSession = {
+                send: jest.fn(async (newData) => {
+                    opponentData.resolve(newData);
+                }),
+                receive: jest.fn(() => {
+                    const prom = ourData.promise;
+                    prom.then(() => {
+                        ourData = defer();
+                    });
+                    return prom;
+                }),
+                url,
+            } as unknown as MSC4108RendezvousSession;
+
+            client = makeMockClient({ userId: "@alice:example.com", deviceId: "alice", msc4108Enabled: true });
+
+            const ourChannel = new MSC4108SecureChannel(ourMockSession);
+            const qrCodeData = QrCodeData.fromBytes(
+                await ourChannel.generateCode(QrCodeMode.Reciprocate, client.getDomain()!),
+            );
+            const opponentChannel = new MSC4108SecureChannel(opponentMockSession, qrCodeData.publicKey);
+
+            ourLogin = new MSC4108SignInWithQR(ourChannel, true, client);
+            opponentLogin = new MSC4108SignInWithQR(opponentChannel, false);
+        });
+
+        it("should be able to connect with opponent and share server name & check code", async () => {
+            await Promise.all([
+                expect(ourLogin.negotiateProtocols()).resolves.toEqual({}),
+                expect(opponentLogin.negotiateProtocols()).resolves.toEqual({ serverName: client.getDomain() }),
+            ]);
+
+            expect(ourLogin.checkCode).toBe(opponentLogin.checkCode);
+        });
+
+        it("should be able to connect with opponent and share verificationUri", async () => {
+            await Promise.all([ourLogin.negotiateProtocols(), opponentLogin.negotiateProtocols()]);
+
+            mocked(client.getDevice).mockRejectedValue(new MatrixError({ errcode: "M_NOT_FOUND" }, 404));
+
+            await Promise.all([
+                expect(ourLogin.deviceAuthorizationGrant()).resolves.toEqual({
+                    verificationUri: verificationUriComplete,
+                }),
+                // We don't have the new device side of this flow implemented at this time so mock it
+                // @ts-ignore
+                opponentLogin.send({
+                    type: PayloadType.Protocol,
+                    protocol: "device_authorization_grant",
+                    device_authorization_grant: {
+                        verification_uri: verificationUri,
+                        verification_uri_complete: verificationUriComplete,
+                    },
+                    device_id: deviceId,
+                }),
+            ]);
+        });
+
+        it("should abort if device already exists", async () => {
+            await Promise.all([ourLogin.negotiateProtocols(), opponentLogin.negotiateProtocols()]);
+
+            mocked(client.getDevice).mockResolvedValue({} as IMyDevice);
+
+            await Promise.all([
+                expect(ourLogin.deviceAuthorizationGrant()).rejects.toThrow("Specified device ID already exists"),
+                // We don't have the new device side of this flow implemented at this time so mock it
+                // @ts-ignore
+                opponentLogin.send({
+                    type: PayloadType.Protocol,
+                    protocol: "device_authorization_grant",
+                    device_authorization_grant: {
+                        verification_uri: verificationUri,
+                    },
+                    device_id: deviceId,
+                }),
+            ]);
+        });
+
+        it("should abort on unsupported protocol", async () => {
+            await Promise.all([ourLogin.negotiateProtocols(), opponentLogin.negotiateProtocols()]);
+
+            await Promise.all([
+                expect(ourLogin.deviceAuthorizationGrant()).rejects.toThrow(
+                    "Received a request for an unsupported protocol",
+                ),
+                // We don't have the new device side of this flow implemented at this time so mock it
+                // @ts-ignore
+                opponentLogin.send({
+                    type: PayloadType.Protocol,
+                    protocol: "device_authorization_grant_v2",
+                    device_authorization_grant: {
+                        verification_uri: verificationUri,
+                    },
+                    device_id: deviceId,
+                }),
+            ]);
+        });
+
+        it("should be able to connect with opponent and share secrets", async () => {
+            await Promise.all([ourLogin.negotiateProtocols(), opponentLogin.negotiateProtocols()]);
+
+            // We don't have the new device side of this flow implemented at this time so mock it
+            // @ts-ignore
+            ourLogin.expectingNewDeviceId = "DEADB33F";
+
+            const ourProm = ourLogin.shareSecrets();
+
+            // Consume the ProtocolAccepted message which would normally be handled by step 4 which we do not have here
+            // @ts-ignore
+            await opponentLogin.receive();
+
+            mocked(client.getDevice).mockResolvedValue({} as IMyDevice);
+
+            const secrets = {
+                cross_signing: { master_key: "mk", user_signing_key: "usk", self_signing_key: "ssk" },
+            };
+            client.getCrypto()!.exportSecretsBundle = jest.fn().mockResolvedValue(secrets);
+
+            const payload = {
+                secrets: expect.objectContaining(secrets),
+            };
+            await Promise.all([
+                expect(ourProm).resolves.toEqual(payload),
+                expect(opponentLogin.shareSecrets()).resolves.toEqual(payload),
+            ]);
+        });
+
+        it("should abort if device doesn't come up by timeout", async () => {
+            jest.spyOn(global, "setTimeout").mockImplementation((fn) => {
+                (<Function>fn)();
+                // TODO: mock timers properly
+                return -1 as any;
+            });
+            jest.spyOn(Date, "now").mockImplementation(() => {
+                return 12345678 + mocked(setTimeout).mock.calls.length * 1000;
+            });
+
+            await Promise.all([ourLogin.negotiateProtocols(), opponentLogin.negotiateProtocols()]);
+
+            // We don't have the new device side of this flow implemented at this time so mock it
+            // @ts-ignore
+            ourLogin.expectingNewDeviceId = "DEADB33F";
+
+            // @ts-ignore
+            await opponentLogin.send({
+                type: PayloadType.Success,
+            });
+            mocked(client.getDevice).mockRejectedValue(new MatrixError({ errcode: "M_NOT_FOUND" }, 404));
+
+            const ourProm = ourLogin.shareSecrets();
+            await expect(ourProm).rejects.toThrow("New device not found");
+        });
+
+        it("should abort on unexpected errors", async () => {
+            await Promise.all([ourLogin.negotiateProtocols(), opponentLogin.negotiateProtocols()]);
+
+            // We don't have the new device side of this flow implemented at this time so mock it
+            // @ts-ignore
+            ourLogin.expectingNewDeviceId = "DEADB33F";
+
+            // @ts-ignore
+            await opponentLogin.send({
+                type: PayloadType.Success,
+            });
+            mocked(client.getDevice).mockRejectedValue(
+                new MatrixError({ errcode: "M_UNKNOWN", error: "The message" }, 500),
+            );
+
+            await expect(ourLogin.shareSecrets()).rejects.toThrow("The message");
+        });
+
+        it("should abort on declined login", async () => {
+            await Promise.all([ourLogin.negotiateProtocols(), opponentLogin.negotiateProtocols()]);
+
+            await ourLogin.declineLoginOnExistingDevice();
+            await expect(opponentLogin.shareSecrets()).rejects.toThrow(
+                new RendezvousError("Failed", MSC4108FailureReason.UserCancelled),
+            );
+        });
+
+        it("should not send secrets if user cancels", async () => {
+            jest.spyOn(global, "setTimeout").mockImplementation((fn) => {
+                (<Function>fn)();
+                // TODO: mock timers properly
+                return -1 as any;
+            });
+
+            await Promise.all([ourLogin.negotiateProtocols(), opponentLogin.negotiateProtocols()]);
+
+            // We don't have the new device side of this flow implemented at this time so mock it
+            // @ts-ignore
+            ourLogin.expectingNewDeviceId = "DEADB33F";
+
+            const ourProm = ourLogin.shareSecrets();
+            const opponentProm = opponentLogin.shareSecrets();
+
+            // Consume the ProtocolAccepted message which would normally be handled by step 4 which we do not have here
+            // @ts-ignore
+            await opponentLogin.receive();
+
+            const deferred = defer<IMyDevice>();
+            mocked(client.getDevice).mockReturnValue(deferred.promise);
+
+            ourLogin.cancel(MSC4108FailureReason.UserCancelled).catch(() => {});
+            deferred.resolve({} as IMyDevice);
+
+            const secrets = {
+                cross_signing: { master_key: "mk", user_signing_key: "usk", self_signing_key: "ssk" },
+            };
+            client.getCrypto()!.exportSecretsBundle = jest.fn().mockResolvedValue(secrets);
+
+            await Promise.all([
+                expect(ourProm).rejects.toThrow("User cancelled"),
+                expect(opponentProm).rejects.toThrow("Unexpected message received"),
+            ]);
+        });
+    });
+});

spec/setupTests.ts

@@ -14,10 +14,6 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import DOMException from "domexception";
-
-global.DOMException = DOMException as typeof global.DOMException;
-
 jest.mock("../src/http-api/utils", () => ({
     ...jest.requireActual("../src/http-api/utils"),
     // We mock timeoutSignal otherwise it causes tests to leave timers running

spec/test-utils/AccountDataAccumulator.ts

@@ -15,7 +15,6 @@ limitations under the License.
 */
 
 import fetchMock from "fetch-mock-jest";
-import { MockOptionsMethodPut } from "fetch-mock";
 
 import { ISyncResponder } from "./SyncResponder";
 
@@ -40,7 +39,10 @@ export class AccountDataAccumulator {
      * @param opts - options to pass to fetchMock
      * @returns a Promise which will resolve (with the content of the account data) once it is set.
      */
-    public interceptSetAccountData(accountDataType: string, opts?: MockOptionsMethodPut): Promise<any> {
+    public interceptSetAccountData(
+        accountDataType: string,
+        opts?: Parameters<(typeof fetchMock)["put"]>[2],
+    ): Promise<any> {
         return new Promise((resolve) => {
             // Called when the cross signing key is uploaded
             fetchMock.put(

spec/test-utils/SyncResponder.ts

@@ -17,7 +17,7 @@ limitations under the License.
 import debugFunc from "debug";
 import { Debugger } from "debug";
 import fetchMock from "fetch-mock-jest";
-import { MockResponse } from "fetch-mock";
+import FetchMock from "fetch-mock";
 
 /** Interface implemented by classes that intercept `/sync` requests from test clients
  *
@@ -80,7 +80,7 @@ export class SyncResponder implements ISyncResponder {
         );
     }
 
-    private async onSyncRequest(): Promise<MockResponse> {
+    private async onSyncRequest(): Promise<FetchMock.MockResponse> {
         switch (this.state) {
             case SyncResponderState.IDLE: {
                 this.debug("Got /sync request: waiting for response to be ready");

spec/test-utils/client.ts

@@ -88,6 +88,6 @@ export const mockClientMethodsEvents = () => ({
 export const mockClientMethodsServer = (): Partial<Record<MethodLikeKeys<MatrixClient>, unknown>> => ({
     getIdentityServerUrl: jest.fn(),
     getHomeserverUrl: jest.fn(),
-    getCapabilities: jest.fn().mockReturnValue({}),
+    getCachedCapabilities: jest.fn().mockReturnValue({}),
     doesServerSupportUnstableFeature: jest.fn().mockResolvedValue(false),
 });

spec/test-utils/oidc.ts

@@ -38,7 +38,10 @@ export const makeDelegatedAuthConfig = (issuer = "https://auth.org/"): OidcClien
  * @param issuer used as the base for all other urls
  * @returns ValidatedIssuerMetadata
  */
-export const mockOpenIdConfiguration = (issuer = "https://auth.org/"): ValidatedIssuerMetadata => ({
+export const mockOpenIdConfiguration = (
+    issuer = "https://auth.org/",
+    additionalGrantTypes: string[] = [],
+): ValidatedIssuerMetadata => ({
     issuer,
     revocation_endpoint: issuer + "revoke",
     token_endpoint: issuer + "token",
@@ -47,6 +50,6 @@ export const mockOpenIdConfiguration = (issuer = "https://auth.org/"): Validated
     device_authorization_endpoint: issuer + "device",
     jwks_uri: issuer + "jwks",
     response_types_supported: ["code"],
-    grant_types_supported: ["authorization_code", "refresh_token"],
+    grant_types_supported: ["authorization_code", "refresh_token", ...additionalGrantTypes],
     code_challenge_methods_supported: ["S256"],
 });

spec/test-utils/test-utils.ts

@@ -173,8 +173,10 @@ export function mkEvent(opts: IEventOpts & { event?: boolean }, client?: MatrixC
         room_id: opts.room,
         sender: opts.sender || opts.user, // opts.user for backwards-compat
         content: opts.content,
-        prev_content: opts.prev_content,
-        unsigned: opts.unsigned || {},
+        unsigned: {
+            ...opts.unsigned,
+            prev_content: opts.prev_content,
+        },
         event_id: "$" + testEventIndex++ + "-" + Math.random() + "-" + Math.random(),
         txn_id: "~" + Math.random(),
         redacts: opts.redacts,

spec/test-utils/test_indexeddb_cryptostore_dump/empty_account/README.md

@@ -0,0 +1,10 @@
+## Dump of an empty libolm indexeddb cryptostore to test skipping migration
+
+A dump of an account which is almost completely empty, and totally unsuitable
+for use as a real account.
+
+This dump was manually created by copying and editing full_account.
+
+Created to test
+["Unable to restore session" error due due to half-initialised legacy indexeddb crypto store #27447](https://github.com/element-hq/element-web/issues/27447).
+We should not launch the Rust migration code when we find a DB in this state.

spec/test-utils/test_indexeddb_cryptostore_dump/empty_account/dump.json

@@ -0,0 +1,14 @@
+{
+    "account": [],
+    "device_data": [],
+    "inbound_group_sessions": [],
+    "inbound_group_sessions_withheld": [],
+    "notified_error_devices": [],
+    "outgoingRoomKeyRequests": [],
+    "parked_shared_history": [],
+    "rooms": [],
+    "session_problems": [],
+    "sessions": [],
+    "sessions_needing_backup": [],
+    "shared_history_inbound_group_sessions": []
+}

spec/test-utils/test_indexeddb_cryptostore_dump/empty_account/index.ts

@@ -0,0 +1,35 @@
+/*
+Copyright 2024 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { DumpDataSetInfo } from "../index";
+
+/**
+ * A key query response containing the current keys of the tested user.
+ * To be used during tests with fetchmock.
+ */
+const KEYS_QUERY_RESPONSE = { device_keys: { "@emptyuser:example.com": {} } };
+
+/**
+ * A dataset containing the information for the tested user.
+ * To be used during tests.
+ */
+export const EMPTY_ACCOUNT_DATASET: DumpDataSetInfo = {
+    userId: "@emptyuser:example.com",
+    deviceId: "EMPTYDEVIC",
+    pickleKey: "+/bcdefghijklmnopqrstu1/zyxvutsrqponmlkjih2",
+    keyQueryResponse: KEYS_QUERY_RESPONSE,
+    dumpPath: "spec/test-utils/test_indexeddb_cryptostore_dump/empty_account/dump.json",
+};

spec/test-utils/test_indexeddb_cryptostore_dump/full_account/index.ts

@@ -1,3 +1,19 @@
+/*
+Copyright 2024 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
 import { DumpDataSetInfo } from "../index";
 
 /**

spec/test-utils/test_indexeddb_cryptostore_dump/no_cached_msk_dump/index.ts

@@ -1,3 +1,19 @@
+/*
+Copyright 2024 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
 import { KeyBackupInfo } from "../../../../src/crypto-api/keybackup";
 import { DumpDataSetInfo } from "../index";
 

spec/test-utils/test_indexeddb_cryptostore_dump/unverified/index.ts

@@ -1,3 +1,19 @@
+/*
+Copyright 2024 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
 import { DumpDataSetInfo } from "../index";
 
 /**

spec/unit/autodiscovery.spec.ts

@@ -857,7 +857,7 @@ describe("AutoDiscovery", function () {
                 const expected = {
                     "m.homeserver": {
                         state: AutoDiscoveryAction.FAIL_ERROR,
-                        error: AutoDiscovery.ERROR_HOMESERVER_TOO_OLD,
+                        error: AutoDiscovery.ERROR_UNSUPPORTED_HOMESERVER_SPEC_VERSION,
                         base_url: "https://example.org",
                     },
                     "m.identity_server": {

spec/unit/base64.spec.ts

@@ -50,17 +50,18 @@ describe.each(["browser", "node"])("Base64 encoding (%s)", (env) => {
     });
 
     it("Should encode unpadded URL-safe base64", () => {
-        const toEncode = "?????";
+        // Chosen to have padding and multiple instances of / and + in the base64
+        const toEncode = "???????⊕⊗⊗";
         const data = new TextEncoder().encode(toEncode);
 
         const encoded = encodeUnpaddedBase64Url(data);
-        expect(encoded).toEqual("Pz8_Pz8");
+        expect(encoded).toEqual("Pz8_Pz8_P-KKleKKl-KKlw");
     });
 
     it("Should decode URL-safe base64", () => {
-        const decoded = new TextDecoder().decode(decodeBase64("Pz8_Pz8="));
+        const decoded = new TextDecoder().decode(decodeBase64("Pz8_Pz8_P-KKleKKl-KKlw=="));
 
-        expect(decoded).toStrictEqual("?????");
+        expect(decoded).toStrictEqual("???????⊕⊗⊗");
     });
 
     it("Encode unpadded should not have padding", () => {

spec/unit/content-repo.spec.ts

@@ -76,5 +76,27 @@ describe("ContentRepo", function () {
                 baseUrl + "/_matrix/media/v3/download/server.name/resourceid#automade",
             );
         });
+
+        it("should return an authenticated URL when requested", function () {
+            const mxcUri = "mxc://server.name/resourceid";
+            expect(getHttpUriForMxc(baseUrl, mxcUri, undefined, undefined, undefined, undefined, true, true)).toEqual(
+                baseUrl + "/_matrix/client/v1/media/download/server.name/resourceid?allow_redirect=true",
+            );
+            expect(getHttpUriForMxc(baseUrl, mxcUri, 64, 64, "scale", undefined, true, true)).toEqual(
+                baseUrl +
+                    "/_matrix/client/v1/media/thumbnail/server.name/resourceid?width=64&height=64&method=scale&allow_redirect=true",
+            );
+        });
+
+        it("should force-enable allow_redirects when useAuthentication is set true", function () {
+            const mxcUri = "mxc://server.name/resourceid";
+            expect(getHttpUriForMxc(baseUrl, mxcUri, undefined, undefined, undefined, undefined, false, true)).toEqual(
+                baseUrl + "/_matrix/client/v1/media/download/server.name/resourceid?allow_redirect=true",
+            );
+            expect(getHttpUriForMxc(baseUrl, mxcUri, 64, 64, "scale", undefined, false, true)).toEqual(
+                baseUrl +
+                    "/_matrix/client/v1/media/thumbnail/server.name/resourceid?width=64&height=64&method=scale&allow_redirect=true",
+            );
+        });
     });
 });

spec/unit/crypto/cross-signing.spec.ts

@@ -23,12 +23,12 @@ import HttpBackend from "matrix-mock-request";
 import * as olmlib from "../../../src/crypto/olmlib";
 import { MatrixError } from "../../../src/http-api";
 import { logger } from "../../../src/logger";
-import { ICrossSigningKey, ICreateClientOpts, ISignedKey, MatrixClient } from "../../../src/client";
+import { ICreateClientOpts, ISignedKey, MatrixClient } from "../../../src/client";
 import { CryptoEvent } from "../../../src/crypto";
 import { IDevice } from "../../../src/crypto/deviceinfo";
 import { TestClient } from "../../TestClient";
 import { resetCrossSigningKeys } from "./crypto-utils";
-import { BootstrapCrossSigningOpts } from "../../../src/crypto-api";
+import { BootstrapCrossSigningOpts, CrossSigningKeyInfo } from "../../../src/crypto-api";
 
 const PUSH_RULES_RESPONSE: Response = {
     method: "GET",
@@ -377,7 +377,7 @@ describe("Cross Signing", function () {
         const bobSigning = new global.Olm.PkSigning();
         const bobPrivkey = bobSigning.generate_seed();
         const bobPubkey = bobSigning.init_with_seed(bobPrivkey);
-        const bobSSK: ICrossSigningKey = {
+        const bobSSK: CrossSigningKeyInfo = {
             user_id: "@bob:example.com",
             usage: ["self_signing"],
             keys: {
@@ -515,7 +515,7 @@ describe("Cross Signing", function () {
         };
         olmlib.pkSign(bobDevice, selfSigningKey as unknown as PkSigning, "@bob:example.com", "");
 
-        const bobMaster: ICrossSigningKey = {
+        const bobMaster: CrossSigningKeyInfo = {
             user_id: "@bob:example.com",
             usage: ["master"],
             keys: {
@@ -630,7 +630,7 @@ describe("Cross Signing", function () {
         const bobSigning = new global.Olm.PkSigning();
         const bobPrivkey = bobSigning.generate_seed();
         const bobPubkey = bobSigning.init_with_seed(bobPrivkey);
-        const bobSSK: ICrossSigningKey = {
+        const bobSSK: CrossSigningKeyInfo = {
             user_id: "@bob:example.com",
             usage: ["self_signing"],
             keys: {
@@ -696,7 +696,7 @@ describe("Cross Signing", function () {
         const bobSigning = new global.Olm.PkSigning();
         const bobPrivkey = bobSigning.generate_seed();
         const bobPubkey = bobSigning.init_with_seed(bobPrivkey);
-        const bobSSK: ICrossSigningKey = {
+        const bobSSK: CrossSigningKeyInfo = {
             user_id: "@bob:example.com",
             usage: ["self_signing"],
             keys: {
@@ -763,7 +763,7 @@ describe("Cross Signing", function () {
         const bobSigning2 = new global.Olm.PkSigning();
         const bobPrivkey2 = bobSigning2.generate_seed();
         const bobPubkey2 = bobSigning2.init_with_seed(bobPrivkey2);
-        const bobSSK2: ICrossSigningKey = {
+        const bobSSK2: CrossSigningKeyInfo = {
             user_id: "@bob:example.com",
             usage: ["self_signing"],
             keys: {
@@ -913,7 +913,7 @@ describe("Cross Signing", function () {
         const aliceSigning = new global.Olm.PkSigning();
         const alicePrivkey = aliceSigning.generate_seed();
         const alicePubkey = aliceSigning.init_with_seed(alicePrivkey);
-        const aliceSSK: ICrossSigningKey = {
+        const aliceSSK: CrossSigningKeyInfo = {
             user_id: "@alice:example.com",
             usage: ["self_signing"],
             keys: {
@@ -988,7 +988,7 @@ describe("Cross Signing", function () {
         const aliceSigning = new global.Olm.PkSigning();
         const alicePrivkey = aliceSigning.generate_seed();
         const alicePubkey = aliceSigning.init_with_seed(alicePrivkey);
-        const aliceSSK: ICrossSigningKey = {
+        const aliceSSK: CrossSigningKeyInfo = {
             user_id: "@alice:example.com",
             usage: ["self_signing"],
             keys: {
@@ -1048,7 +1048,7 @@ describe("Cross Signing", function () {
         const aliceSigning = new global.Olm.PkSigning();
         const alicePrivkey = aliceSigning.generate_seed();
         const alicePubkey = aliceSigning.init_with_seed(alicePrivkey);
-        const aliceSSK: ICrossSigningKey = {
+        const aliceSSK: CrossSigningKeyInfo = {
             user_id: "@alice:example.com",
             usage: ["self_signing"],
             keys: {

spec/unit/crypto/secrets.spec.ts

@@ -23,12 +23,13 @@ import { makeTestClients } from "./verification/util";
 import { encryptAES } from "../../../src/crypto/aes";
 import { createSecretStorageKey, resetCrossSigningKeys } from "./crypto-utils";
 import { logger } from "../../../src/logger";
-import { ClientEvent, ICreateClientOpts, ICrossSigningKey, MatrixClient } from "../../../src/client";
+import { ClientEvent, ICreateClientOpts, MatrixClient } from "../../../src/client";
 import { DeviceInfo } from "../../../src/crypto/deviceinfo";
 import { ISignatures } from "../../../src/@types/signed";
 import { ICurve25519AuthData } from "../../../src/crypto/keybackup";
 import { SecretStorageKeyDescription, SECRET_STORAGE_ALGORITHM_V1_AES } from "../../../src/secret-storage";
 import { decodeBase64 } from "../../../src/base64";
+import { CrossSigningKeyInfo } from "../../../src/crypto-api";
 
 async function makeTestClient(
     userInfo: { userId: string; deviceId: string },
@@ -475,7 +476,7 @@ describe("Secrets", function () {
                             [`ed25519:${XSPubKey}`]: XSPubKey,
                         },
                     },
-                    self_signing: sign<ICrossSigningKey>(
+                    self_signing: sign<CrossSigningKeyInfo>(
                         {
                             user_id: "@alice:example.com",
                             usage: ["self_signing"],
@@ -486,7 +487,7 @@ describe("Secrets", function () {
                         XSK,
                         "@alice:example.com",
                     ),
-                    user_signing: sign<ICrossSigningKey>(
+                    user_signing: sign<CrossSigningKeyInfo>(
                         {
                             user_id: "@alice:example.com",
                             usage: ["user_signing"],
@@ -631,7 +632,7 @@ describe("Secrets", function () {
                             [`ed25519:${XSPubKey}`]: XSPubKey,
                         },
                     },
-                    self_signing: sign<ICrossSigningKey>(
+                    self_signing: sign<CrossSigningKeyInfo>(
                         {
                             user_id: "@alice:example.com",
                             usage: ["self_signing"],
@@ -642,7 +643,7 @@ describe("Secrets", function () {
                         XSK,
                         "@alice:example.com",
                     ),
-                    user_signing: sign<ICrossSigningKey>(
+                    user_signing: sign<CrossSigningKeyInfo>(
                         {
                             user_id: "@alice:example.com",
                             usage: ["user_signing"],

spec/unit/digest.spec.ts

@@ -0,0 +1,40 @@
+/*
+Copyright 2024 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { encodeUnpaddedBase64Url } from "../../src";
+import { sha256 } from "../../src/digest";
+
+describe("sha256", () => {
+    it("should hash a string", async () => {
+        const hash = await sha256("test");
+        expect(encodeUnpaddedBase64Url(hash)).toBe("n4bQgYhMfWWaL-qgxVrQFaO_TxsrC4Is0V1sFbDwCgg");
+    });
+
+    it("should hash a string with emoji", async () => {
+        const hash = await sha256("test 🍱");
+        expect(encodeUnpaddedBase64Url(hash)).toBe("X2aDNrrwfq3nCTOl90R9qg9ynxhHnSzsMqtrdYX-SGw");
+    });
+
+    it("throws if webcrypto is not available", async () => {
+        const oldCrypto = global.crypto;
+        try {
+            global.crypto = {} as any;
+            await expect(sha256("test")).rejects.toThrow();
+        } finally {
+            global.crypto = oldCrypto;
+        }
+    });
+});

spec/unit/embedded.spec.ts

@@ -32,7 +32,7 @@ import {
     IOpenIDCredentials,
 } from "matrix-widget-api";
 
-import { createRoomWidgetClient, MsgType } from "../../src/matrix";
+import { createRoomWidgetClient, MsgType, UpdateDelayedEventAction } from "../../src/matrix";
 import { MatrixClient, ClientEvent, ITurnServer as IClientTurnServer } from "../../src/client";
 import { SyncState } from "../../src/sync";
 import { ICapabilities } from "../../src/embedded";
@@ -59,8 +59,26 @@ class MockWidgetApi extends EventEmitter {
     public requestCapabilityToReceiveState = jest.fn();
     public requestCapabilityToSendToDevice = jest.fn();
     public requestCapabilityToReceiveToDevice = jest.fn();
-    public sendRoomEvent = jest.fn(() => ({ event_id: `$${Math.random()}` }));
-    public sendStateEvent = jest.fn();
+    public sendRoomEvent = jest.fn(
+        (eventType: string, content: unknown, roomId?: string, delay?: number, parentDelayId?: string) =>
+            delay === undefined && parentDelayId === undefined
+                ? { event_id: `$${Math.random()}` }
+                : { delay_id: `id-${Math.random()}` },
+    );
+    public sendStateEvent = jest.fn(
+        (
+            eventType: string,
+            stateKey: string,
+            content: unknown,
+            roomId?: string,
+            delay?: number,
+            parentDelayId?: string,
+        ) =>
+            delay === undefined && parentDelayId === undefined
+                ? { event_id: `$${Math.random()}` }
+                : { delay_id: `id-${Math.random()}` },
+    );
+    public updateDelayedEvent = jest.fn();
     public sendToDevice = jest.fn();
     public requestOpenIDConnectToken = jest.fn(() => {
         return testOIDCToken;
@@ -125,6 +143,17 @@ describe("RoomWidgetClient", () => {
             );
         });
 
+        it("send handles wrong field in response", async () => {
+            await makeClient({ sendEvent: ["org.matrix.rageshake_request"] });
+            widgetApi.sendRoomEvent.mockResolvedValueOnce({
+                room_id: "!1:example.org",
+                delay_id: `id-${Math.random}`,
+            });
+            await expect(
+                client.sendEvent("!1:example.org", "org.matrix.rageshake_request", { request_id: 123 }),
+            ).rejects.toThrow();
+        });
+
         it("receives", async () => {
             const event = new MatrixEvent({
                 type: "org.matrix.rageshake_request",
@@ -160,6 +189,199 @@ describe("RoomWidgetClient", () => {
         });
     });
 
+    describe("delayed events", () => {
+        describe("when supported", () => {
+            const doesServerSupportUnstableFeatureMock = jest.fn((feature) =>
+                Promise.resolve(feature === "org.matrix.msc4140"),
+            );
+
+            beforeAll(() => {
+                MatrixClient.prototype.doesServerSupportUnstableFeature = doesServerSupportUnstableFeatureMock;
+            });
+
+            afterAll(() => {
+                doesServerSupportUnstableFeatureMock.mockReset();
+            });
+
+            it("sends delayed message events", async () => {
+                await makeClient({ sendDelayedEvents: true, sendEvent: ["org.matrix.rageshake_request"] });
+                expect(widgetApi.requestCapability).toHaveBeenCalledWith(MatrixCapabilities.MSC4157SendDelayedEvent);
+                await client._unstable_sendDelayedEvent(
+                    "!1:example.org",
+                    { delay: 2000 },
+                    null,
+                    "org.matrix.rageshake_request",
+                    { request_id: 123 },
+                );
+                expect(widgetApi.sendRoomEvent).toHaveBeenCalledWith(
+                    "org.matrix.rageshake_request",
+                    { request_id: 123 },
+                    "!1:example.org",
+                    2000,
+                    undefined,
+                );
+            });
+
+            it("sends child action delayed message events", async () => {
+                await makeClient({ sendDelayedEvents: true, sendEvent: ["org.matrix.rageshake_request"] });
+                expect(widgetApi.requestCapability).toHaveBeenCalledWith(MatrixCapabilities.MSC4157SendDelayedEvent);
+                const parentDelayId = `id-${Math.random()}`;
+                await client._unstable_sendDelayedEvent(
+                    "!1:example.org",
+                    { parent_delay_id: parentDelayId },
+                    null,
+                    "org.matrix.rageshake_request",
+                    { request_id: 123 },
+                );
+                expect(widgetApi.sendRoomEvent).toHaveBeenCalledWith(
+                    "org.matrix.rageshake_request",
+                    { request_id: 123 },
+                    "!1:example.org",
+                    undefined,
+                    parentDelayId,
+                );
+            });
+
+            it("sends delayed state events", async () => {
+                await makeClient({
+                    sendDelayedEvents: true,
+                    sendState: [{ eventType: "org.example.foo", stateKey: "bar" }],
+                });
+                expect(widgetApi.requestCapability).toHaveBeenCalledWith(MatrixCapabilities.MSC4157SendDelayedEvent);
+                await client._unstable_sendDelayedStateEvent(
+                    "!1:example.org",
+                    { delay: 2000 },
+                    "org.example.foo",
+                    { hello: "world" },
+                    "bar",
+                );
+                expect(widgetApi.sendStateEvent).toHaveBeenCalledWith(
+                    "org.example.foo",
+                    "bar",
+                    { hello: "world" },
+                    "!1:example.org",
+                    2000,
+                    undefined,
+                );
+            });
+
+            it("sends child action delayed state events", async () => {
+                await makeClient({
+                    sendDelayedEvents: true,
+                    sendState: [{ eventType: "org.example.foo", stateKey: "bar" }],
+                });
+                expect(widgetApi.requestCapability).toHaveBeenCalledWith(MatrixCapabilities.MSC4157SendDelayedEvent);
+                const parentDelayId = `fg-${Math.random()}`;
+                await client._unstable_sendDelayedStateEvent(
+                    "!1:example.org",
+                    { parent_delay_id: parentDelayId },
+                    "org.example.foo",
+                    { hello: "world" },
+                    "bar",
+                );
+                expect(widgetApi.sendStateEvent).toHaveBeenCalledWith(
+                    "org.example.foo",
+                    "bar",
+                    { hello: "world" },
+                    "!1:example.org",
+                    undefined,
+                    parentDelayId,
+                );
+            });
+
+            it("send delayed message events handles wrong field in response", async () => {
+                await makeClient({ sendDelayedEvents: true, sendEvent: ["org.matrix.rageshake_request"] });
+                widgetApi.sendRoomEvent.mockResolvedValueOnce({
+                    room_id: "!1:example.org",
+                    event_id: `$${Math.random()}`,
+                });
+                await expect(
+                    client._unstable_sendDelayedEvent(
+                        "!1:example.org",
+                        { delay: 2000 },
+                        null,
+                        "org.matrix.rageshake_request",
+                        { request_id: 123 },
+                    ),
+                ).rejects.toThrow();
+            });
+
+            it("send delayed state events handles wrong field in response", async () => {
+                await makeClient({
+                    sendDelayedEvents: true,
+                    sendState: [{ eventType: "org.example.foo", stateKey: "bar" }],
+                });
+                widgetApi.sendStateEvent.mockResolvedValueOnce({
+                    room_id: "!1:example.org",
+                    event_id: `$${Math.random()}`,
+                });
+                await expect(
+                    client._unstable_sendDelayedStateEvent(
+                        "!1:example.org",
+                        { delay: 2000 },
+                        "org.example.foo",
+                        { hello: "world" },
+                        "bar",
+                    ),
+                ).rejects.toThrow();
+            });
+
+            it("updates delayed events", async () => {
+                await makeClient({ updateDelayedEvents: true, sendEvent: ["org.matrix.rageshake_request"] });
+                expect(widgetApi.requestCapability).toHaveBeenCalledWith(MatrixCapabilities.MSC4157UpdateDelayedEvent);
+                for (const action of [
+                    UpdateDelayedEventAction.Cancel,
+                    UpdateDelayedEventAction.Restart,
+                    UpdateDelayedEventAction.Send,
+                ]) {
+                    await client._unstable_updateDelayedEvent("id", action);
+                    expect(widgetApi.updateDelayedEvent).toHaveBeenCalledWith("id", action);
+                }
+            });
+        });
+
+        describe("when unsupported", () => {
+            it("fails to send delayed message events", async () => {
+                await makeClient({ sendEvent: ["org.matrix.rageshake_request"] });
+                await expect(
+                    client._unstable_sendDelayedEvent(
+                        "!1:example.org",
+                        { delay: 2000 },
+                        null,
+                        "org.matrix.rageshake_request",
+                        { request_id: 123 },
+                    ),
+                ).rejects.toThrow("Server does not support");
+            });
+
+            it("fails to send delayed state events", async () => {
+                await makeClient({ sendState: [{ eventType: "org.example.foo", stateKey: "bar" }] });
+                await expect(
+                    client._unstable_sendDelayedStateEvent(
+                        "!1:example.org",
+                        { delay: 2000 },
+                        "org.example.foo",
+                        { hello: "world" },
+                        "bar",
+                    ),
+                ).rejects.toThrow("Server does not support");
+            });
+
+            it("fails to update delayed state events", async () => {
+                await makeClient({});
+                for (const action of [
+                    UpdateDelayedEventAction.Cancel,
+                    UpdateDelayedEventAction.Restart,
+                    UpdateDelayedEventAction.Send,
+                ]) {
+                    await expect(client._unstable_updateDelayedEvent("id", action)).rejects.toThrow(
+                        "Server does not support",
+                    );
+                }
+            });
+        });
+    });
+
     describe("initialization", () => {
         it("requests permissions for specific message types", async () => {
             await makeClient({ sendMessage: [MsgType.Text], receiveMessage: [MsgType.Text] });
@@ -211,6 +433,17 @@ describe("RoomWidgetClient", () => {
             );
         });
 
+        it("send handles incorrect response", async () => {
+            await makeClient({ sendState: [{ eventType: "org.example.foo", stateKey: "bar" }] });
+            widgetApi.sendStateEvent.mockResolvedValueOnce({
+                room_id: "!1:example.org",
+                delay_id: `id-${Math.random}`,
+            });
+            await expect(
+                client.sendStateEvent("!1:example.org", "org.example.foo", { hello: "world" }, "bar"),
+            ).rejects.toThrow();
+        });
+
         it("receives", async () => {
             await makeClient({ receiveState: [{ eventType: "org.example.foo", stateKey: "bar" }] });
             expect(widgetApi.requestCapabilityForRoomTimeline).toHaveBeenCalledWith("!1:example.org");

spec/unit/event-timeline-set.spec.ts

@@ -136,11 +136,6 @@ describe("EventTimelineSet", () => {
             expect(eventsInLiveTimeline.length).toStrictEqual(1);
             expect(eventsInLiveTimeline[0]).toStrictEqual(duplicateMessageEvent);
         });
-
-        it("Make sure legacy overload passing options directly as parameters still works", () => {
-            expect(() => eventTimelineSet.addLiveEvent(messageEvent, DuplicateStrategy.Replace, false)).not.toThrow();
-            expect(() => eventTimelineSet.addLiveEvent(messageEvent, DuplicateStrategy.Ignore, true)).not.toThrow();
-        });
     });
 
     describe("addEventToTimeline", () => {

spec/unit/matrix-client.spec.ts

@@ -57,6 +57,7 @@ import {
     Room,
     RuleId,
     TweakName,
+    UpdateDelayedEventAction,
 } from "../../src";
 import { supportsMatrixCall } from "../../src/webrtc/call";
 import { makeBeaconEvent } from "../test-utils/beacon";
@@ -97,7 +98,7 @@ type HttpLookup = {
     method: string;
     path: string;
     prefix?: string;
-    data?: Record<string, any>;
+    data?: Record<string, any> | Record<string, any>[];
     error?: object;
     expectBody?: Record<string, any>;
     expectQueryParams?: QueryDict;
@@ -298,7 +299,9 @@ describe("MatrixClient", function () {
             ...(opts || {}),
         });
         // FIXME: We shouldn't be yanking http like this.
-        client.http = (["authedRequest", "getContentUri", "request", "uploadContent"] as const).reduce((r, k) => {
+        client.http = (
+            ["authedRequest", "getContentUri", "request", "uploadContent", "idServerRequest"] as const
+        ).reduce((r, k) => {
             r[k] = jest.fn();
             return r;
         }, {} as MatrixHttpApi<any>);
@@ -386,6 +389,9 @@ describe("MatrixClient", function () {
             expect(client.mxcUrlToHttp(mxc, 32, 46, "scale", false, true)).toBe(
                 getHttpUriForMxc(client.baseUrl, mxc, 32, 46, "scale", false, true),
             );
+            expect(client.mxcUrlToHttp(mxc, 32, 46, "scale", false, true, true)).toBe(
+                getHttpUriForMxc(client.baseUrl, mxc, 32, 46, "scale", false, true, true),
+            );
         });
     });
 
@@ -701,6 +707,328 @@ describe("MatrixClient", function () {
         });
     });
 
+    describe("_unstable_sendDelayedEvent", () => {
+        const unstableMSC4140Prefix = `${ClientPrefix.Unstable}/org.matrix.msc4140`;
+
+        const roomId = "!room:example.org";
+        const body = "This is the body";
+        const content = { body, msgtype: MsgType.Text } satisfies RoomMessageEventContent;
+        const timeoutDelayOpts = { delay: 2000 };
+        const realTimeoutDelayOpts = { "org.matrix.msc4140.delay": 2000 };
+
+        beforeEach(() => {
+            unstableFeatures["org.matrix.msc4140"] = true;
+        });
+
+        it("throws when unsupported by server", async () => {
+            unstableFeatures["org.matrix.msc4140"] = false;
+            const errorMessage = "Server does not support";
+
+            await expect(
+                client._unstable_sendDelayedEvent(
+                    roomId,
+                    timeoutDelayOpts,
+                    null,
+                    EventType.RoomMessage,
+                    { ...content },
+                    client.makeTxnId(),
+                ),
+            ).rejects.toThrow(errorMessage);
+
+            await expect(
+                client._unstable_sendDelayedStateEvent(roomId, timeoutDelayOpts, EventType.RoomTopic, {
+                    topic: "topic",
+                }),
+            ).rejects.toThrow(errorMessage);
+
+            await expect(client._unstable_getDelayedEvents()).rejects.toThrow(errorMessage);
+
+            await expect(
+                client._unstable_updateDelayedEvent("anyDelayId", UpdateDelayedEventAction.Send),
+            ).rejects.toThrow(errorMessage);
+        });
+
+        it("works with null threadId", async () => {
+            httpLookups = [];
+
+            const timeoutDelayTxnId = client.makeTxnId();
+            httpLookups.push({
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/send/m.room.message/${timeoutDelayTxnId}`,
+                expectQueryParams: realTimeoutDelayOpts,
+                data: { delay_id: "id1" },
+                expectBody: content,
+            });
+
+            const { delay_id: timeoutDelayId } = await client._unstable_sendDelayedEvent(
+                roomId,
+                timeoutDelayOpts,
+                null,
+                EventType.RoomMessage,
+                { ...content },
+                timeoutDelayTxnId,
+            );
+
+            const actionDelayTxnId = client.makeTxnId();
+            httpLookups.push({
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/send/m.room.message/${actionDelayTxnId}`,
+                expectQueryParams: { "org.matrix.msc4140.parent_delay_id": timeoutDelayId },
+                data: { delay_id: "id2" },
+                expectBody: content,
+            });
+
+            await client._unstable_sendDelayedEvent(
+                roomId,
+                { parent_delay_id: timeoutDelayId },
+                null,
+                EventType.RoomMessage,
+                { ...content },
+                actionDelayTxnId,
+            );
+        });
+
+        it("works with non-null threadId", async () => {
+            httpLookups = [];
+            const threadId = "$threadId:server";
+            const expectBody = {
+                ...content,
+                "m.relates_to": {
+                    event_id: threadId,
+                    is_falling_back: true,
+                    rel_type: "m.thread",
+                },
+            };
+
+            const timeoutDelayTxnId = client.makeTxnId();
+            httpLookups.push({
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/send/m.room.message/${timeoutDelayTxnId}`,
+                expectQueryParams: realTimeoutDelayOpts,
+                data: { delay_id: "id1" },
+                expectBody,
+            });
+
+            const { delay_id: timeoutDelayId } = await client._unstable_sendDelayedEvent(
+                roomId,
+                timeoutDelayOpts,
+                threadId,
+                EventType.RoomMessage,
+                { ...content },
+                timeoutDelayTxnId,
+            );
+
+            const actionDelayTxnId = client.makeTxnId();
+            httpLookups.push({
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/send/m.room.message/${actionDelayTxnId}`,
+                expectQueryParams: { "org.matrix.msc4140.parent_delay_id": timeoutDelayId },
+                data: { delay_id: "id2" },
+                expectBody,
+            });
+
+            await client._unstable_sendDelayedEvent(
+                roomId,
+                { parent_delay_id: timeoutDelayId },
+                threadId,
+                EventType.RoomMessage,
+                { ...content },
+                actionDelayTxnId,
+            );
+        });
+
+        it("should add thread relation if threadId is passed and the relation is missing", async () => {
+            httpLookups = [];
+            const threadId = "$threadId:server";
+            const expectBody = {
+                ...content,
+                "m.relates_to": {
+                    "m.in_reply_to": {
+                        event_id: threadId,
+                    },
+                    "event_id": threadId,
+                    "is_falling_back": true,
+                    "rel_type": "m.thread",
+                },
+            };
+
+            const room = new Room(roomId, client, userId);
+            mocked(store.getRoom).mockReturnValue(room);
+
+            const rootEvent = new MatrixEvent({ event_id: threadId });
+            room.createThread(threadId, rootEvent, [rootEvent], false);
+
+            const timeoutDelayTxnId = client.makeTxnId();
+            httpLookups.push({
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/send/m.room.message/${timeoutDelayTxnId}`,
+                expectQueryParams: realTimeoutDelayOpts,
+                data: { delay_id: "id1" },
+                expectBody,
+            });
+
+            const { delay_id: timeoutDelayId } = await client._unstable_sendDelayedEvent(
+                roomId,
+                timeoutDelayOpts,
+                threadId,
+                EventType.RoomMessage,
+                { ...content },
+                timeoutDelayTxnId,
+            );
+
+            const actionDelayTxnId = client.makeTxnId();
+            httpLookups.push({
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/send/m.room.message/${actionDelayTxnId}`,
+                expectQueryParams: { "org.matrix.msc4140.parent_delay_id": timeoutDelayId },
+                data: { delay_id: "id2" },
+                expectBody,
+            });
+
+            await client._unstable_sendDelayedEvent(
+                roomId,
+                { parent_delay_id: timeoutDelayId },
+                threadId,
+                EventType.RoomMessage,
+                { ...content },
+                actionDelayTxnId,
+            );
+        });
+
+        it("should add thread relation if threadId is passed and the relation is missing with reply", async () => {
+            httpLookups = [];
+            const threadId = "$threadId:server";
+
+            const content = {
+                body,
+                "msgtype": MsgType.Text,
+                "m.relates_to": {
+                    "m.in_reply_to": {
+                        event_id: "$other:event",
+                    },
+                },
+            } satisfies RoomMessageEventContent;
+            const expectBody = {
+                ...content,
+                "m.relates_to": {
+                    "m.in_reply_to": {
+                        event_id: "$other:event",
+                    },
+                    "event_id": threadId,
+                    "is_falling_back": false,
+                    "rel_type": "m.thread",
+                },
+            };
+
+            const room = new Room(roomId, client, userId);
+            mocked(store.getRoom).mockReturnValue(room);
+
+            const rootEvent = new MatrixEvent({ event_id: threadId });
+            room.createThread(threadId, rootEvent, [rootEvent], false);
+
+            const timeoutDelayTxnId = client.makeTxnId();
+            httpLookups.push({
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/send/m.room.message/${timeoutDelayTxnId}`,
+                expectQueryParams: realTimeoutDelayOpts,
+                data: { delay_id: "id1" },
+                expectBody,
+            });
+
+            const { delay_id: timeoutDelayId } = await client._unstable_sendDelayedEvent(
+                roomId,
+                timeoutDelayOpts,
+                threadId,
+                EventType.RoomMessage,
+                { ...content },
+                timeoutDelayTxnId,
+            );
+
+            const actionDelayTxnId = client.makeTxnId();
+            httpLookups.push({
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/send/m.room.message/${actionDelayTxnId}`,
+                expectQueryParams: { "org.matrix.msc4140.parent_delay_id": timeoutDelayId },
+                data: { delay_id: "id2" },
+                expectBody,
+            });
+
+            await client._unstable_sendDelayedEvent(
+                roomId,
+                { parent_delay_id: timeoutDelayId },
+                threadId,
+                EventType.RoomMessage,
+                { ...content },
+                actionDelayTxnId,
+            );
+        });
+
+        it("can send a delayed state event", async () => {
+            httpLookups = [];
+            const content = { topic: "The year 2000" };
+
+            httpLookups.push({
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/state/m.room.topic/`,
+                expectQueryParams: realTimeoutDelayOpts,
+                data: { delay_id: "id1" },
+                expectBody: content,
+            });
+
+            const { delay_id: timeoutDelayId } = await client._unstable_sendDelayedStateEvent(
+                roomId,
+                timeoutDelayOpts,
+                EventType.RoomTopic,
+                { ...content },
+            );
+
+            httpLookups.push({
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/state/m.room.topic/`,
+                expectQueryParams: { "org.matrix.msc4140.parent_delay_id": timeoutDelayId },
+                data: { delay_id: "id2" },
+                expectBody: content,
+            });
+
+            await client._unstable_sendDelayedStateEvent(
+                roomId,
+                { parent_delay_id: timeoutDelayId },
+                EventType.RoomTopic,
+                { ...content },
+            );
+        });
+
+        it("can look up delayed events", async () => {
+            httpLookups = [
+                {
+                    method: "GET",
+                    prefix: unstableMSC4140Prefix,
+                    path: "/delayed_events",
+                    data: [],
+                },
+            ];
+
+            await client._unstable_getDelayedEvents();
+        });
+
+        it("can update delayed events", async () => {
+            const delayId = "id";
+            const action = UpdateDelayedEventAction.Restart;
+            httpLookups = [
+                {
+                    method: "POST",
+                    prefix: unstableMSC4140Prefix,
+                    path: `/delayed_events/${encodeURIComponent(delayId)}`,
+                    data: {
+                        action,
+                    },
+                },
+            ];
+
+            await client._unstable_updateDelayedEvent(delayId, action);
+        });
+    });
+
     it("should create (unstable) file trees", async () => {
         const userId = "@test:example.org";
         const roomId = "!room:example.org";
@@ -960,7 +1288,7 @@ describe("MatrixClient", function () {
             const filter = new Filter(client.credentials.userId);
 
             const filterId = await client.getOrCreateFilter(filterName, filter);
-            expect(filterId).toEqual(FILTER_RESPONSE.data?.filter_id);
+            expect(filterId).toEqual(!Array.isArray(FILTER_RESPONSE.data) && FILTER_RESPONSE.data?.filter_id);
         });
     });
 
@@ -1557,7 +1885,6 @@ describe("MatrixClient", function () {
                     },
                 },
                 event_id: "$ev1",
-                user_id: "@alice:matrix.org",
             });
 
             expect(rootEvent.isThreadRoot).toBe(true);
@@ -3033,4 +3360,45 @@ describe("MatrixClient", function () {
             expect(httpLookups.length).toEqual(0);
         });
     });
+
+    describe("identityHashedLookup", () => {
+        it("should return hashed lookup results", async () => {
+            const ID_ACCESS_TOKEN = "hello_id_server_please_let_me_make_a_request";
+
+            client.http.idServerRequest = jest.fn().mockImplementation((method, path, params) => {
+                if (method === "GET" && path === "/hash_details") {
+                    return { algorithms: ["sha256"], lookup_pepper: "carrot" };
+                } else if (method === "POST" && path === "/lookup") {
+                    return {
+                        mappings: {
+                            "WHA-MgrrsZACDI9F8OaVagpiyiV2sjZylGHJteT4OMU": "@bob:homeserver.dummy",
+                        },
+                    };
+                }
+
+                throw new Error("Test impl doesn't know about this request");
+            });
+
+            const lookupResult = await client.identityHashedLookup([["bob@email.dummy", "email"]], ID_ACCESS_TOKEN);
+
+            expect(client.http.idServerRequest).toHaveBeenCalledWith(
+                "GET",
+                "/hash_details",
+                undefined,
+                "/_matrix/identity/v2",
+                ID_ACCESS_TOKEN,
+            );
+
+            expect(client.http.idServerRequest).toHaveBeenCalledWith(
+                "POST",
+                "/lookup",
+                { pepper: "carrot", algorithm: "sha256", addresses: ["WHA-MgrrsZACDI9F8OaVagpiyiV2sjZylGHJteT4OMU"] },
+                "/_matrix/identity/v2",
+                ID_ACCESS_TOKEN,
+            );
+
+            expect(lookupResult).toHaveLength(1);
+            expect(lookupResult[0]).toEqual({ address: "bob@email.dummy", mxid: "@bob:homeserver.dummy" });
+        });
+    });
 });

spec/unit/matrixrtc/CallMembership.spec.ts

@@ -15,16 +15,7 @@ limitations under the License.
 */
 
 import { MatrixEvent } from "../../../src";
-import { CallMembership, CallMembershipData } from "../../../src/matrixrtc/CallMembership";
-
-const membershipTemplate: CallMembershipData = {
-    call_id: "",
-    scope: "m.room",
-    application: "m.call",
-    device_id: "AAAAAAA",
-    expires: 5000,
-    membershipID: "bloop",
-};
+import { CallMembership, CallMembershipDataLegacy, SessionMembershipData } from "../../../src/matrixrtc/CallMembership";
 
 function makeMockEvent(originTs = 0): MatrixEvent {
     return {
@@ -34,96 +25,175 @@ function makeMockEvent(originTs = 0): MatrixEvent {
 }
 
 describe("CallMembership", () => {
-    it("rejects membership with no expiry and no expires_ts", () => {
-        expect(() => {
-            new CallMembership(
-                makeMockEvent(),
-                Object.assign({}, membershipTemplate, { expires: undefined, expires_ts: undefined }),
+    describe("CallMembershipDataLegacy", () => {
+        const membershipTemplate: CallMembershipDataLegacy = {
+            call_id: "",
+            scope: "m.room",
+            application: "m.call",
+            device_id: "AAAAAAA",
+            expires: 5000,
+            membershipID: "bloop",
+            foci_active: [{ type: "livekit" }],
+        };
+        it("rejects membership with no expiry and no expires_ts", () => {
+            expect(() => {
+                new CallMembership(
+                    makeMockEvent(),
+                    Object.assign({}, membershipTemplate, { expires: undefined, expires_ts: undefined }),
+                );
+            }).toThrow();
+        });
+
+        it("rejects membership with no device_id", () => {
+            expect(() => {
+                new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { device_id: undefined }));
+            }).toThrow();
+        });
+
+        it("rejects membership with no call_id", () => {
+            expect(() => {
+                new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { call_id: undefined }));
+            }).toThrow();
+        });
+
+        it("allow membership with no scope", () => {
+            expect(() => {
+                new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { scope: undefined }));
+            }).not.toThrow();
+        });
+        it("rejects with malformatted expires_ts", () => {
+            expect(() => {
+                new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { expires_ts: "string" }));
+            }).toThrow();
+        });
+        it("rejects with malformatted expires", () => {
+            expect(() => {
+                new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { expires: "string" }));
+            }).toThrow();
+        });
+
+        it("uses event timestamp if no created_ts", () => {
+            const membership = new CallMembership(makeMockEvent(12345), membershipTemplate);
+            expect(membership.createdTs()).toEqual(12345);
+        });
+
+        it("uses created_ts if present", () => {
+            const membership = new CallMembership(
+                makeMockEvent(12345),
+                Object.assign({}, membershipTemplate, { created_ts: 67890 }),
             );
-        }).toThrow();
+            expect(membership.createdTs()).toEqual(67890);
+        });
+
+        it("computes absolute expiry time based on expires", () => {
+            const membership = new CallMembership(makeMockEvent(1000), membershipTemplate);
+            expect(membership.getAbsoluteExpiry()).toEqual(5000 + 1000);
+        });
+
+        it("computes absolute expiry time based on expires_ts", () => {
+            const membership = new CallMembership(
+                makeMockEvent(1000),
+                Object.assign({}, membershipTemplate, { expires_ts: 6000 }),
+            );
+            expect(membership.getAbsoluteExpiry()).toEqual(5000 + 1000);
+        });
+
+        it("considers memberships unexpired if local age low enough", () => {
+            const fakeEvent = makeMockEvent(1000);
+            fakeEvent.getLocalAge = jest.fn().mockReturnValue(3000);
+            const membership = new CallMembership(fakeEvent, membershipTemplate);
+            expect(membership.isExpired()).toEqual(false);
+        });
+
+        it("considers memberships expired when local age large", () => {
+            const fakeEvent = makeMockEvent(1000);
+            fakeEvent.localTimestamp = Date.now() - 6000;
+            const membership = new CallMembership(fakeEvent, membershipTemplate);
+            expect(membership.isExpired()).toEqual(true);
+        });
+
+        it("returns preferred foci", () => {
+            const fakeEvent = makeMockEvent();
+            const mockFocus = { type: "this_is_a_mock_focus" };
+            const membership = new CallMembership(
+                fakeEvent,
+                Object.assign({}, membershipTemplate, { foci_active: [mockFocus] }),
+            );
+            expect(membership.getPreferredFoci()).toEqual([mockFocus]);
+        });
     });
 
-    it("rejects membership with no device_id", () => {
-        expect(() => {
-            new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { device_id: undefined }));
-        }).toThrow();
-    });
+    describe("SessionMembershipData", () => {
+        const membershipTemplate: SessionMembershipData = {
+            call_id: "",
+            scope: "m.room",
+            application: "m.call",
+            device_id: "AAAAAAA",
+            focus_active: { type: "livekit" },
+            foci_preferred: [{ type: "livekit" }],
+        };
 
-    it("rejects membership with no call_id", () => {
-        expect(() => {
-            new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { call_id: undefined }));
-        }).toThrow();
-    });
+        it("rejects membership with no device_id", () => {
+            expect(() => {
+                new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { device_id: undefined }));
+            }).toThrow();
+        });
 
-    it("rejects membership with no scope", () => {
-        expect(() => {
-            new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { scope: undefined }));
-        }).toThrow();
-    });
-    it("rejects with malformatted expires_ts", () => {
-        expect(() => {
-            new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { expires_ts: "string" }));
-        }).toThrow();
-    });
-    it("rejects with malformatted expires", () => {
-        expect(() => {
-            new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { expires: "string" }));
-        }).toThrow();
-    });
+        it("rejects membership with no call_id", () => {
+            expect(() => {
+                new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { call_id: undefined }));
+            }).toThrow();
+        });
 
-    it("uses event timestamp if no created_ts", () => {
-        const membership = new CallMembership(makeMockEvent(12345), membershipTemplate);
-        expect(membership.createdTs()).toEqual(12345);
-    });
+        it("allow membership with no scope", () => {
+            expect(() => {
+                new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { scope: undefined }));
+            }).not.toThrow();
+        });
 
-    it("uses created_ts if present", () => {
-        const membership = new CallMembership(
-            makeMockEvent(12345),
-            Object.assign({}, membershipTemplate, { created_ts: 67890 }),
-        );
-        expect(membership.createdTs()).toEqual(67890);
-    });
+        it("uses event timestamp if no created_ts", () => {
+            const membership = new CallMembership(makeMockEvent(12345), membershipTemplate);
+            expect(membership.createdTs()).toEqual(12345);
+        });
 
-    it("computes absolute expiry time based on expires", () => {
-        const membership = new CallMembership(makeMockEvent(1000), membershipTemplate);
-        expect(membership.getAbsoluteExpiry()).toEqual(5000 + 1000);
-    });
+        it("uses created_ts if present", () => {
+            const membership = new CallMembership(
+                makeMockEvent(12345),
+                Object.assign({}, membershipTemplate, { created_ts: 67890 }),
+            );
+            expect(membership.createdTs()).toEqual(67890);
+        });
 
-    it("computes absolute expiry time based on expires_ts", () => {
-        const membership = new CallMembership(
-            makeMockEvent(1000),
-            Object.assign({}, membershipTemplate, { expires: undefined, expires_ts: 6000 }),
-        );
-        expect(membership.getAbsoluteExpiry()).toEqual(5000 + 1000);
-    });
+        it("considers memberships unexpired if local age low enough", () => {
+            const fakeEvent = makeMockEvent(1000);
+            fakeEvent.getLocalAge = jest.fn().mockReturnValue(3000);
+            const membership = new CallMembership(fakeEvent, membershipTemplate);
+            expect(membership.isExpired()).toEqual(false);
+        });
 
-    it("considers memberships unexpired if local age low enough", () => {
-        const fakeEvent = makeMockEvent(1000);
-        fakeEvent.getLocalAge = jest.fn().mockReturnValue(3000);
-        const membership = new CallMembership(fakeEvent, membershipTemplate);
-        expect(membership.isExpired()).toEqual(false);
-    });
-
-    it("considers memberships expired when local age large", () => {
-        const fakeEvent = makeMockEvent(1000);
-        fakeEvent.localTimestamp = Date.now() - 6000;
-        const membership = new CallMembership(fakeEvent, membershipTemplate);
-        expect(membership.isExpired()).toEqual(true);
-    });
-
-    it("returns active foci", () => {
-        const fakeEvent = makeMockEvent();
-        const mockFocus = { type: "this_is_a_mock_focus" };
-        const membership = new CallMembership(
-            fakeEvent,
-            Object.assign({}, membershipTemplate, { foci_active: [mockFocus] }),
-        );
-        expect(membership.getActiveFoci()).toEqual([mockFocus]);
+        it("returns preferred foci", () => {
+            const fakeEvent = makeMockEvent();
+            const mockFocus = { type: "this_is_a_mock_focus" };
+            const membership = new CallMembership(
+                fakeEvent,
+                Object.assign({}, membershipTemplate, { foci_preferred: [mockFocus] }),
+            );
+            expect(membership.getPreferredFoci()).toEqual([mockFocus]);
+        });
     });
 
     describe("expiry calculation", () => {
         let fakeEvent: MatrixEvent;
         let membership: CallMembership;
+        const membershipTemplate: CallMembershipDataLegacy = {
+            call_id: "",
+            scope: "m.room",
+            application: "m.call",
+            device_id: "AAAAAAA",
+            expires: 5000,
+            membershipID: "bloop",
+            foci_active: [{ type: "livekit" }],
+        };
 
         beforeEach(() => {
             // server origin timestamp for this event is 1000

spec/unit/matrixrtc/LivekitFocus.spec.ts

@@ -0,0 +1,60 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { isLivekitFocus, isLivekitFocusActive, isLivekitFocusConfig } from "../../../src/matrixrtc/LivekitFocus";
+
+describe("LivekitFocus", () => {
+    it("isLivekitFocus", () => {
+        expect(
+            isLivekitFocus({
+                type: "livekit",
+                livekit_service_url: "http://test.com",
+                livekit_alias: "test",
+            }),
+        ).toBeTruthy();
+        expect(isLivekitFocus({ type: "livekit" })).toBeFalsy();
+        expect(
+            isLivekitFocus({ type: "not-livekit", livekit_service_url: "http://test.com", livekit_alias: "test" }),
+        ).toBeFalsy();
+        expect(
+            isLivekitFocus({ type: "livekit", other_service_url: "http://test.com", livekit_alias: "test" }),
+        ).toBeFalsy();
+        expect(
+            isLivekitFocus({ type: "livekit", livekit_service_url: "http://test.com", other_alias: "test" }),
+        ).toBeFalsy();
+    });
+    it("isLivekitFocusActive", () => {
+        expect(
+            isLivekitFocusActive({
+                type: "livekit",
+                focus_selection: "oldest_membership",
+            }),
+        ).toBeTruthy();
+        expect(isLivekitFocusActive({ type: "livekit" })).toBeFalsy();
+        expect(isLivekitFocusActive({ type: "not-livekit", focus_selection: "oldest_membership" })).toBeFalsy();
+    });
+    it("isLivekitFocusConfig", () => {
+        expect(
+            isLivekitFocusConfig({
+                type: "livekit",
+                livekit_service_url: "http://test.com",
+            }),
+        ).toBeTruthy();
+        expect(isLivekitFocusConfig({ type: "livekit" })).toBeFalsy();
+        expect(isLivekitFocusConfig({ type: "not-livekit", livekit_service_url: "http://test.com" })).toBeFalsy();
+        expect(isLivekitFocusConfig({ type: "livekit", other_service_url: "oldest_membership" })).toBeFalsy();
+    });
+});

spec/unit/matrixrtc/MatrixRTCSession.spec.ts

@@ -16,7 +16,11 @@ limitations under the License.
 
 import { EventTimeline, EventType, MatrixClient, MatrixError, MatrixEvent, Room } from "../../../src";
 import { KnownMembership } from "../../../src/@types/membership";
-import { CallMembershipData } from "../../../src/matrixrtc/CallMembership";
+import {
+    CallMembershipData,
+    CallMembershipDataLegacy,
+    SessionMembershipData,
+} from "../../../src/matrixrtc/CallMembership";
 import { MatrixRTCSession, MatrixRTCSessionEvent } from "../../../src/matrixrtc/MatrixRTCSession";
 import { EncryptionKeysEventContent } from "../../../src/matrixrtc/types";
 import { randomString } from "../../../src/randomstring";
@@ -29,6 +33,7 @@ const membershipTemplate: CallMembershipData = {
     device_id: "AAAAAAA",
     expires: 60 * 60 * 1000,
     membershipID: "bloop",
+    foci_active: [{ type: "livekit", livekit_service_url: "https://lk.url" }],
 };
 
 const mockFocus = { type: "mock" };
@@ -41,6 +46,9 @@ describe("MatrixRTCSession", () => {
         client = new MatrixClient({ baseUrl: "base_url" });
         client.getUserId = jest.fn().mockReturnValue("@alice:example.org");
         client.getDeviceId = jest.fn().mockReturnValue("AAAAAAA");
+        client.doesServerSupportUnstableFeature = jest.fn((feature) =>
+            Promise.resolve(feature === "org.matrix.msc4140"),
+        );
     });
 
     afterEach(() => {
@@ -98,22 +106,33 @@ describe("MatrixRTCSession", () => {
     });
 
     it("safely ignores events with no memberships section", () => {
+        const roomId = randomString(8);
+        const event = {
+            getType: jest.fn().mockReturnValue(EventType.GroupCallMemberPrefix),
+            getContent: jest.fn().mockReturnValue({}),
+            getSender: jest.fn().mockReturnValue("@mock:user.example"),
+            getTs: jest.fn().mockReturnValue(1000),
+            getLocalAge: jest.fn().mockReturnValue(0),
+        };
         const mockRoom = {
             ...makeMockRoom([]),
-            roomId: randomString(8),
+            roomId,
             getLiveTimeline: jest.fn().mockReturnValue({
                 getState: jest.fn().mockReturnValue({
                     on: jest.fn(),
                     off: jest.fn(),
-                    getStateEvents: (_type: string, _stateKey: string) => [
-                        {
-                            getType: jest.fn().mockReturnValue(EventType.GroupCallMemberPrefix),
-                            getContent: jest.fn().mockReturnValue({}),
-                            getSender: jest.fn().mockReturnValue("@mock:user.example"),
-                            getTs: jest.fn().mockReturnValue(1000),
-                            getLocalAge: jest.fn().mockReturnValue(0),
-                        },
-                    ],
+                    getStateEvents: (_type: string, _stateKey: string) => [event],
+                    events: new Map([
+                        [
+                            EventType.GroupCallMemberPrefix,
+                            {
+                                size: () => true,
+                                has: (_stateKey: string) => true,
+                                get: (_stateKey: string) => event,
+                                values: () => [event],
+                            },
+                        ],
+                    ]),
                 }),
             }),
         };
@@ -122,22 +141,33 @@ describe("MatrixRTCSession", () => {
     });
 
     it("safely ignores events with junk memberships section", () => {
+        const roomId = randomString(8);
+        const event = {
+            getType: jest.fn().mockReturnValue(EventType.GroupCallMemberPrefix),
+            getContent: jest.fn().mockReturnValue({ memberships: ["i am a fish"] }),
+            getSender: jest.fn().mockReturnValue("@mock:user.example"),
+            getTs: jest.fn().mockReturnValue(1000),
+            getLocalAge: jest.fn().mockReturnValue(0),
+        };
         const mockRoom = {
             ...makeMockRoom([]),
-            roomId: randomString(8),
+            roomId,
             getLiveTimeline: jest.fn().mockReturnValue({
                 getState: jest.fn().mockReturnValue({
                     on: jest.fn(),
                     off: jest.fn(),
-                    getStateEvents: (_type: string, _stateKey: string) => [
-                        {
-                            getType: jest.fn().mockReturnValue(EventType.GroupCallMemberPrefix),
-                            getContent: jest.fn().mockReturnValue({ memberships: "i am a fish" }),
-                            getSender: jest.fn().mockReturnValue("@mock:user.example"),
-                            getTs: jest.fn().mockReturnValue(1000),
-                            getLocalAge: jest.fn().mockReturnValue(0),
-                        },
-                    ],
+                    getStateEvents: (_type: string, _stateKey: string) => [event],
+                    events: new Map([
+                        [
+                            EventType.GroupCallMemberPrefix,
+                            {
+                                size: () => true,
+                                has: (_stateKey: string) => true,
+                                get: (_stateKey: string) => event,
+                                values: () => [event],
+                            },
+                        ],
+                    ]),
                 }),
             }),
         };
@@ -185,6 +215,93 @@ describe("MatrixRTCSession", () => {
         expect(sess.memberships).toHaveLength(0);
     });
 
+    describe("updateCallMembershipEvent", () => {
+        const mockFocus = { type: "livekit", livekit_service_url: "https://test.org" };
+        const joinSessionConfig = { useLegacyMemberEvents: false };
+
+        const legacyMembershipData: CallMembershipDataLegacy = {
+            call_id: "",
+            scope: "m.room",
+            application: "m.call",
+            device_id: "AAAAAAA_legacy",
+            expires: 60 * 60 * 1000,
+            membershipID: "bloop",
+            foci_active: [mockFocus],
+        };
+
+        const expiredLegacyMembershipData: CallMembershipDataLegacy = {
+            ...legacyMembershipData,
+            device_id: "AAAAAAA_legacy_expired",
+            expires: 0,
+        };
+
+        const sessionMembershipData: SessionMembershipData = {
+            call_id: "",
+            scope: "m.room",
+            application: "m.call",
+            device_id: "AAAAAAA_session",
+            focus_active: mockFocus,
+            foci_preferred: [mockFocus],
+        };
+
+        let sendStateEventMock: jest.Mock;
+        let sendDelayedStateMock: jest.Mock;
+
+        let sentStateEvent: Promise<void>;
+        let sentDelayedState: Promise<void>;
+
+        beforeEach(() => {
+            sentStateEvent = new Promise((resolve) => {
+                sendStateEventMock = jest.fn(resolve);
+            });
+            sentDelayedState = new Promise((resolve) => {
+                sendDelayedStateMock = jest.fn(() => {
+                    resolve();
+                    return {
+                        delay_id: "id",
+                    };
+                });
+            });
+            client.sendStateEvent = sendStateEventMock;
+            client._unstable_sendDelayedStateEvent = sendDelayedStateMock;
+        });
+
+        async function testSession(
+            membershipData: CallMembershipData[] | SessionMembershipData,
+            shouldUseLegacy: boolean,
+        ): Promise<void> {
+            sess = MatrixRTCSession.roomSessionForRoom(client, makeMockRoom(membershipData));
+
+            const makeNewLegacyMembershipsMock = jest.spyOn(sess as any, "makeNewLegacyMemberships");
+            const makeNewMembershipMock = jest.spyOn(sess as any, "makeNewMembership");
+
+            sess.joinRoomSession([mockFocus], mockFocus, joinSessionConfig);
+            await Promise.race([sentStateEvent, new Promise((resolve) => setTimeout(resolve, 500))]);
+
+            expect(makeNewLegacyMembershipsMock).toHaveBeenCalledTimes(shouldUseLegacy ? 1 : 0);
+            expect(makeNewMembershipMock).toHaveBeenCalledTimes(shouldUseLegacy ? 0 : 1);
+
+            await Promise.race([sentDelayedState, new Promise((resolve) => setTimeout(resolve, 500))]);
+            expect(client._unstable_sendDelayedStateEvent).toHaveBeenCalledTimes(shouldUseLegacy ? 0 : 1);
+        }
+
+        it("uses legacy events if there are any active legacy calls", async () => {
+            await testSession([expiredLegacyMembershipData, legacyMembershipData, sessionMembershipData], true);
+        });
+
+        it('uses legacy events if a non-legacy call is in a "memberships" array', async () => {
+            await testSession([sessionMembershipData], true);
+        });
+
+        it("uses non-legacy events if all legacy calls are expired", async () => {
+            await testSession([expiredLegacyMembershipData], false);
+        });
+
+        it("uses non-legacy events if there are only non-legacy calls", async () => {
+            await testSession(sessionMembershipData, false);
+        });
+    });
+
     describe("getOldestMembership", () => {
         it("returns the oldest membership event", () => {
             const mockRoom = makeMockRoom([
@@ -198,15 +315,88 @@ describe("MatrixRTCSession", () => {
         });
     });
 
+    describe("getsActiveFocus", () => {
+        const activeFociConfig = { type: "livekit", livekit_service_url: "https://active.url" };
+        it("gets the correct active focus with oldest_membership", () => {
+            const mockRoom = makeMockRoom([
+                Object.assign({}, membershipTemplate, {
+                    device_id: "foo",
+                    created_ts: 500,
+                    foci_active: [activeFociConfig],
+                }),
+                Object.assign({}, membershipTemplate, { device_id: "old", created_ts: 1000 }),
+                Object.assign({}, membershipTemplate, { device_id: "bar", created_ts: 2000 }),
+            ]);
+
+            sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+
+            sess.joinRoomSession([{ type: "livekit", livekit_service_url: "htts://test.org" }], {
+                type: "livekit",
+                focus_selection: "oldest_membership",
+            });
+            expect(sess.getActiveFocus()).toBe(activeFociConfig);
+        });
+        it("does not provide focus if the selction method is unknown", () => {
+            const mockRoom = makeMockRoom([
+                Object.assign({}, membershipTemplate, {
+                    device_id: "foo",
+                    created_ts: 500,
+                    foci_active: [activeFociConfig],
+                }),
+                Object.assign({}, membershipTemplate, { device_id: "old", created_ts: 1000 }),
+                Object.assign({}, membershipTemplate, { device_id: "bar", created_ts: 2000 }),
+            ]);
+
+            sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+
+            sess.joinRoomSession([{ type: "livekit", livekit_service_url: "htts://test.org" }], {
+                type: "livekit",
+                focus_selection: "unknown",
+            });
+            expect(sess.getActiveFocus()).toBe(undefined);
+        });
+        it("gets the correct active focus legacy", () => {
+            const mockRoom = makeMockRoom([
+                Object.assign({}, membershipTemplate, {
+                    device_id: "foo",
+                    created_ts: 500,
+                    foci_active: [activeFociConfig],
+                }),
+                Object.assign({}, membershipTemplate, { device_id: "old", created_ts: 1000 }),
+                Object.assign({}, membershipTemplate, { device_id: "bar", created_ts: 2000 }),
+            ]);
+
+            sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+
+            sess.joinRoomSession([{ type: "livekit", livekit_service_url: "htts://test.org" }]);
+            expect(sess.getActiveFocus()).toBe(activeFociConfig);
+        });
+    });
+
     describe("joining", () => {
         let mockRoom: Room;
         let sendStateEventMock: jest.Mock;
+        let sendDelayedStateMock: jest.Mock;
         let sendEventMock: jest.Mock;
 
+        let sentStateEvent: Promise<void>;
+        let sentDelayedState: Promise<void>;
+
         beforeEach(() => {
-            sendStateEventMock = jest.fn();
+            sentStateEvent = new Promise((resolve) => {
+                sendStateEventMock = jest.fn(resolve);
+            });
+            sentDelayedState = new Promise((resolve) => {
+                sendDelayedStateMock = jest.fn(() => {
+                    resolve();
+                    return {
+                        delay_id: "id",
+                    };
+                });
+            });
             sendEventMock = jest.fn();
             client.sendStateEvent = sendStateEventMock;
+            client._unstable_sendDelayedStateEvent = sendDelayedStateMock;
             client.sendEvent = sendEventMock;
 
             mockRoom = makeMockRoom([]);
@@ -223,13 +413,15 @@ describe("MatrixRTCSession", () => {
         });
 
         it("shows joined once join is called", () => {
-            sess!.joinRoomSession([mockFocus]);
+            sess!.joinRoomSession([mockFocus], mockFocus);
             expect(sess!.isJoined()).toEqual(true);
         });
 
-        it("sends a membership event when joining a call", () => {
+        it("sends a membership event when joining a call", async () => {
+            const realSetTimeout = setTimeout;
             jest.useFakeTimers();
-            sess!.joinRoomSession([mockFocus]);
+            sess!.joinRoomSession([mockFocus], mockFocus);
+            await Promise.race([sentStateEvent, new Promise((resolve) => realSetTimeout(resolve, 500))]);
             expect(client.sendStateEvent).toHaveBeenCalledWith(
                 mockRoom!.roomId,
                 EventType.GroupCallMemberPrefix,
@@ -242,22 +434,65 @@ describe("MatrixRTCSession", () => {
                             device_id: "AAAAAAA",
                             expires: 3600000,
                             expires_ts: Date.now() + 3600000,
-                            foci_active: [{ type: "mock" }],
+                            foci_active: [mockFocus],
+
                             membershipID: expect.stringMatching(".*"),
                         },
                     ],
                 },
                 "@alice:example.org",
             );
+            await Promise.race([sentDelayedState, new Promise((resolve) => realSetTimeout(resolve, 500))]);
+            expect(client._unstable_sendDelayedStateEvent).toHaveBeenCalledTimes(0);
             jest.useRealTimers();
         });
 
+        describe("non-legacy calls", () => {
+            const activeFocusConfig = { type: "livekit", livekit_service_url: "https://active.url" };
+            const activeFocus = { type: "livekit", focus_selection: "oldest_membership" };
+
+            async function testJoin(useOwnedStateEvents: boolean): Promise<void> {
+                const realSetTimeout = setTimeout;
+                if (useOwnedStateEvents) {
+                    mockRoom.getVersion = jest.fn().mockReturnValue("org.matrix.msc3779.default");
+                }
+
+                jest.useFakeTimers();
+                sess!.joinRoomSession([activeFocusConfig], activeFocus, { useLegacyMemberEvents: false });
+                await Promise.race([sentStateEvent, new Promise((resolve) => realSetTimeout(resolve, 500))]);
+                expect(client.sendStateEvent).toHaveBeenCalledWith(
+                    mockRoom!.roomId,
+                    EventType.GroupCallMemberPrefix,
+                    {
+                        application: "m.call",
+                        scope: "m.room",
+                        call_id: "",
+                        device_id: "AAAAAAA",
+                        foci_preferred: [activeFocusConfig],
+                        focus_active: activeFocus,
+                    } satisfies SessionMembershipData,
+                    `${!useOwnedStateEvents ? "_" : ""}@alice:example.org_AAAAAAA`,
+                );
+                await Promise.race([sentDelayedState, new Promise((resolve) => realSetTimeout(resolve, 500))]);
+                expect(client._unstable_sendDelayedStateEvent).toHaveBeenCalledTimes(1);
+                jest.useRealTimers();
+            }
+
+            it("sends a membership event with session payload when joining a non-legacy call", async () => {
+                await testJoin(false);
+            });
+
+            it("does not prefix the state key with _ for rooms that support user-owned state events", async () => {
+                await testJoin(true);
+            });
+        });
+
         it("does nothing if join called when already joined", () => {
-            sess!.joinRoomSession([mockFocus]);
+            sess!.joinRoomSession([mockFocus], mockFocus);
 
             expect(client.sendStateEvent).toHaveBeenCalledTimes(1);
 
-            sess!.joinRoomSession([mockFocus]);
+            sess!.joinRoomSession([mockFocus], mockFocus);
             expect(client.sendStateEvent).toHaveBeenCalledTimes(1);
         });
 
@@ -274,15 +509,26 @@ describe("MatrixRTCSession", () => {
                 const sendStateEventMock = jest.fn().mockImplementation(resolveFn);
                 client.sendStateEvent = sendStateEventMock;
 
-                sess!.joinRoomSession([mockFocus]);
+                sess!.joinRoomSession([mockFocus], mockFocus);
 
                 const eventContent = await eventSentPromise;
 
                 // definitely should have renewed by 1 second before the expiry!
                 const timeElapsed = 60 * 60 * 1000 - 1000;
-                mockRoom.getLiveTimeline().getState(EventTimeline.FORWARDS)!.getStateEvents = jest
-                    .fn()
-                    .mockReturnValue(mockRTCEvent(eventContent.memberships, mockRoom.roomId, timeElapsed));
+                const event = mockRTCEvent(eventContent.memberships, mockRoom.roomId, timeElapsed);
+                const getState = mockRoom.getLiveTimeline().getState(EventTimeline.FORWARDS)!;
+                getState.getStateEvents = jest.fn().mockReturnValue(event);
+                getState.events = new Map([
+                    [
+                        event.getType(),
+                        {
+                            size: () => true,
+                            has: (_stateKey: string) => true,
+                            get: (_stateKey: string) => event,
+                            values: () => [event],
+                        } as unknown as Map<string, MatrixEvent>,
+                    ],
+                ]);
 
                 const eventReSentPromise = new Promise<Record<string, any>>((r) => {
                     resolveFn = (_roomId: string, _type: string, val: Record<string, any>) => {
@@ -308,7 +554,7 @@ describe("MatrixRTCSession", () => {
                                 device_id: "AAAAAAA",
                                 expires: 3600000 * 2,
                                 expires_ts: 1000 + 3600000 * 2,
-                                foci_active: [{ type: "mock" }],
+                                foci_active: [mockFocus],
                                 created_ts: 1000,
                                 membershipID: expect.stringMatching(".*"),
                             },
@@ -322,7 +568,7 @@ describe("MatrixRTCSession", () => {
         });
 
         it("creates a key when joining", () => {
-            sess!.joinRoomSession([mockFocus], true);
+            sess!.joinRoomSession([mockFocus], mockFocus, { manageMediaKeys: true });
             const keys = sess?.getKeysForParticipant("@alice:example.org", "AAAAAAA");
             expect(keys).toHaveLength(1);
 
@@ -336,7 +582,7 @@ describe("MatrixRTCSession", () => {
                 sendEventMock.mockImplementation(resolve);
             });
 
-            sess!.joinRoomSession([mockFocus], true);
+            sess!.joinRoomSession([mockFocus], mockFocus, { manageMediaKeys: true });
 
             await eventSentPromise;
 
@@ -372,7 +618,7 @@ describe("MatrixRTCSession", () => {
                     });
                 });
 
-                sess!.joinRoomSession([mockFocus], true);
+                sess!.joinRoomSession([mockFocus], mockFocus, { manageMediaKeys: true });
                 jest.advanceTimersByTime(10000);
 
                 await eventSentPromise;
@@ -394,7 +640,7 @@ describe("MatrixRTCSession", () => {
                 throw e;
             });
 
-            sess!.joinRoomSession([mockFocus], true);
+            sess!.joinRoomSession([mockFocus], mockFocus, { manageMediaKeys: true });
 
             expect(client.cancelPendingEvent).toHaveBeenCalledWith(eventSentinel);
         });
@@ -409,7 +655,7 @@ describe("MatrixRTCSession", () => {
                     sendEventMock.mockImplementation(resolve);
                 });
 
-                sess.joinRoomSession([mockFocus], true);
+                sess.joinRoomSession([mockFocus], mockFocus, { manageMediaKeys: true });
                 await keysSentPromise1;
 
                 sendEventMock.mockClear();
@@ -462,7 +708,7 @@ describe("MatrixRTCSession", () => {
                     sendEventMock.mockImplementation((_roomId, _evType, payload) => resolve(payload));
                 });
 
-                sess.joinRoomSession([mockFocus], true);
+                sess.joinRoomSession([mockFocus], mockFocus, { manageMediaKeys: true });
                 const firstKeysPayload = await keysSentPromise1;
                 expect(firstKeysPayload.keys).toHaveLength(1);
 
@@ -489,7 +735,7 @@ describe("MatrixRTCSession", () => {
         });
 
         it("Doesn't re-send key immediately", async () => {
-            const realSetImmediate = setImmediate;
+            const realSetTimeout = setTimeout;
             jest.useFakeTimers();
             try {
                 const mockRoom = makeMockRoom([membershipTemplate]);
@@ -499,7 +745,7 @@ describe("MatrixRTCSession", () => {
                     sendEventMock.mockImplementation(resolve);
                 });
 
-                sess.joinRoomSession([mockFocus], true);
+                sess.joinRoomSession([mockFocus], mockFocus, { manageMediaKeys: true });
                 await keysSentPromise1;
 
                 sendEventMock.mockClear();
@@ -517,7 +763,7 @@ describe("MatrixRTCSession", () => {
                 sess.onMembershipUpdate();
 
                 await new Promise((resolve) => {
-                    realSetImmediate(resolve);
+                    realSetTimeout(resolve);
                 });
 
                 expect(sendEventMock).not.toHaveBeenCalled();
@@ -595,7 +841,7 @@ describe("MatrixRTCSession", () => {
 
             jest.advanceTimersByTime(10000);
 
-            sess.joinRoomSession([mockFocus]);
+            sess.joinRoomSession([mockFocus], mockFocus);
 
             expect(client.sendStateEvent).toHaveBeenCalledWith(
                 mockRoomNoExpired!.roomId,
@@ -631,7 +877,7 @@ describe("MatrixRTCSession", () => {
         ]);
         sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
 
-        sess.joinRoomSession([mockFocus]);
+        sess.joinRoomSession([mockFocus], mockFocus);
 
         expect(client.sendStateEvent).toHaveBeenCalledWith(
             mockRoom!.roomId,
@@ -645,6 +891,7 @@ describe("MatrixRTCSession", () => {
                         device_id: "OTHERDEVICE",
                         expires: 3600000,
                         created_ts: 1000,
+                        foci_active: [{ type: "livekit", livekit_service_url: "https://lk.url" }],
                         membershipID: expect.stringMatching(".*"),
                     },
                     {

spec/unit/matrixrtc/MatrixRTCSessionManager.spec.ts

@@ -35,6 +35,7 @@ const membershipTemplate: CallMembershipData = {
     device_id: "AAAAAAA",
     expires: 60 * 60 * 1000,
     membershipID: "bloop",
+    foci_active: [{ type: "test" }],
 };
 
 describe("MatrixRTCSessionManager", () => {

spec/unit/matrixrtc/mocks.ts

@@ -15,24 +15,27 @@ limitations under the License.
 */
 
 import { EventType, MatrixEvent, Room } from "../../../src";
-import { CallMembershipData } from "../../../src/matrixrtc/CallMembership";
+import { CallMembershipData, SessionMembershipData } from "../../../src/matrixrtc/CallMembership";
 import { randomString } from "../../../src/randomstring";
 
-export function makeMockRoom(memberships: CallMembershipData[], localAge: number | null = null): Room {
+type MembershipData = CallMembershipData[] | SessionMembershipData;
+
+export function makeMockRoom(membershipData: MembershipData, localAge: number | null = null): Room {
     const roomId = randomString(8);
     // Caching roomState here so it does not get recreated when calling `getLiveTimeline.getState()`
-    const roomState = makeMockRoomState(memberships, roomId, localAge);
+    const roomState = makeMockRoomState(membershipData, roomId, localAge);
     return {
         roomId: roomId,
         hasMembershipState: jest.fn().mockReturnValue(true),
         getLiveTimeline: jest.fn().mockReturnValue({
             getState: jest.fn().mockReturnValue(roomState),
         }),
+        getVersion: jest.fn().mockReturnValue("default"),
     } as unknown as Room;
 }
 
-export function makeMockRoomState(memberships: CallMembershipData[], roomId: string, localAge: number | null = null) {
-    const event = mockRTCEvent(memberships, roomId, localAge);
+export function makeMockRoomState(membershipData: MembershipData, roomId: string, localAge: number | null = null) {
+    const event = mockRTCEvent(membershipData, roomId, localAge);
     return {
         on: jest.fn(),
         off: jest.fn(),
@@ -40,15 +43,30 @@ export function makeMockRoomState(memberships: CallMembershipData[], roomId: str
             if (stateKey !== undefined) return event;
             return [event];
         },
+        events: new Map([
+            [
+                event.getType(),
+                {
+                    size: () => true,
+                    has: (_stateKey: string) => true,
+                    get: (_stateKey: string) => event,
+                    values: () => [event],
+                },
+            ],
+        ]),
     };
 }
 
-export function mockRTCEvent(memberships: CallMembershipData[], roomId: string, localAge: number | null): MatrixEvent {
+export function mockRTCEvent(membershipData: MembershipData, roomId: string, localAge: number | null): MatrixEvent {
     return {
         getType: jest.fn().mockReturnValue(EventType.GroupCallMemberPrefix),
-        getContent: jest.fn().mockReturnValue({
-            memberships: memberships,
-        }),
+        getContent: jest.fn().mockReturnValue(
+            !Array.isArray(membershipData)
+                ? membershipData
+                : {
+                      memberships: membershipData,
+                  },
+        ),
         getSender: jest.fn().mockReturnValue("@mock:user.example"),
         getTs: jest.fn().mockReturnValue(1000),
         localTimestamp: Date.now() - (localAge ?? 10),

spec/unit/models/MSC3089Branch.spec.ts

@@ -16,11 +16,12 @@ limitations under the License.
 
 import { IContent, MatrixClient, MatrixEvent } from "../../../src";
 import { Room } from "../../../src/models/room";
-import { IEncryptedFile, RelationType, UNSTABLE_MSC3089_BRANCH } from "../../../src/@types/event";
+import { RelationType, UNSTABLE_MSC3089_BRANCH } from "../../../src/@types/event";
 import { EventTimelineSet } from "../../../src/models/event-timeline-set";
 import { EventTimeline } from "../../../src/models/event-timeline";
 import { MSC3089Branch } from "../../../src/models/MSC3089Branch";
 import { MSC3089TreeSpace } from "../../../src/models/MSC3089TreeSpace";
+import { EncryptedFile } from "../../../src/@types/media";
 
 describe("MSC3089Branch", () => {
     let client: MatrixClient;
@@ -254,7 +255,7 @@ describe("MSC3089Branch", () => {
     it("should create new versions of itself", async () => {
         const canaryName = "canary";
         const canaryContents = "contents go here";
-        const canaryFile = {} as IEncryptedFile;
+        const canaryFile = {} as EncryptedFile;
         const canaryAddl = { canary: true };
         indexEvent.getContent = () => ({ active: true, retained: true });
         const stateKeyOrder = [fileEventId2, fileEventId];
@@ -287,23 +288,21 @@ describe("MSC3089Branch", () => {
 
         const createFn = jest
             .fn()
-            .mockImplementation(
-                (name: string, contents: ArrayBuffer, info: Partial<IEncryptedFile>, addl: IContent) => {
-                    expect(name).toEqual(canaryName);
-                    expect(contents).toBe(canaryContents);
-                    expect(info).toBe(canaryFile);
-                    expect(addl).toMatchObject({
-                        ...canaryAddl,
-                        "m.new_content": true,
-                        "m.relates_to": {
-                            rel_type: RelationType.Replace,
-                            event_id: fileEventId,
-                        },
-                    });
+            .mockImplementation((name: string, contents: ArrayBuffer, info: Partial<EncryptedFile>, addl: IContent) => {
+                expect(name).toEqual(canaryName);
+                expect(contents).toBe(canaryContents);
+                expect(info).toBe(canaryFile);
+                expect(addl).toMatchObject({
+                    ...canaryAddl,
+                    "m.new_content": true,
+                    "m.relates_to": {
+                        rel_type: RelationType.Replace,
+                        event_id: fileEventId,
+                    },
+                });
 
-                    return Promise.resolve({ event_id: fileEventId2 });
-                },
-            );
+                return Promise.resolve({ event_id: fileEventId2 });
+            });
         directory.createFile = createFn;
 
         await branch.createNewVersion(canaryName, canaryContents, canaryFile, canaryAddl);

spec/unit/models/event.spec.ts

@@ -412,7 +412,12 @@ describe("MatrixEvent", () => {
             const crypto = {
                 decryptEvent: jest
                     .fn()
-                    .mockRejectedValue("DecryptionError: The sender has disabled encrypting to unverified devices."),
+                    .mockRejectedValue(
+                        new DecryptionError(
+                            DecryptionFailureCode.MEGOLM_KEY_WITHHELD_FOR_UNVERIFIED_DEVICE,
+                            "The sender has disabled encrypting to unverified devices.",
+                        ),
+                    ),
             } as unknown as Crypto;
 
             await encryptedEvent.attemptDecryption(crypto);

spec/unit/oidc/authorize.spec.ts

@@ -26,7 +26,6 @@ import { getRandomValues } from "node:crypto";
 import { TextEncoder } from "node:util";
 
 import { Method } from "../../../src";
-import * as crypto from "../../../src/crypto/crypto";
 import { logger } from "../../../src/logger";
 import {
     completeAuthorizationCodeGrant,
@@ -39,11 +38,6 @@ import { makeDelegatedAuthConfig, mockOpenIdConfiguration } from "../../test-uti
 
 jest.mock("jwt-decode");
 
-const webCrypto = new Crypto();
-
-// save for resetting mocks
-const realSubtleCrypto = crypto.subtleCrypto;
-
 describe("oidc authorization", () => {
     const delegatedAuthConfig = makeDelegatedAuthConfig();
     const authorizationEndpoint = delegatedAuthConfig.authorizationEndpoint;
@@ -62,7 +56,11 @@ describe("oidc authorization", () => {
             delegatedAuthConfig.metadata.issuer + ".well-known/openid-configuration",
             mockOpenIdConfiguration(),
         );
+        global.TextEncoder = TextEncoder;
+    });
 
+    beforeEach(() => {
+        const webCrypto = new Crypto();
         Object.defineProperty(window, "crypto", {
             value: {
                 getRandomValues,
@@ -70,12 +68,6 @@ describe("oidc authorization", () => {
                 subtle: webCrypto.subtle,
             },
         });
-        global.TextEncoder = TextEncoder;
-    });
-
-    afterEach(() => {
-        // @ts-ignore reset any ugly mocking we did
-        crypto.subtleCrypto = realSubtleCrypto;
     });
 
     it("should generate authorization params", () => {
@@ -97,11 +89,8 @@ describe("oidc authorization", () => {
 
     describe("generateAuthorizationUrl()", () => {
         it("should generate url with correct parameters", async () => {
-            // test the no crypto case here
-            // @ts-ignore mocking
-            crypto.subtleCrypto = undefined;
-
             const authorizationParams = generateAuthorizationParams({ redirectUri: baseUrl });
+            authorizationParams.codeVerifier = "test-code-verifier";
             const authUrl = new URL(
                 await generateAuthorizationUrl(authorizationEndpoint, clientId, authorizationParams),
             );
@@ -113,6 +102,18 @@ describe("oidc authorization", () => {
             expect(authUrl.searchParams.get("scope")).toEqual(authorizationParams.scope);
             expect(authUrl.searchParams.get("state")).toEqual(authorizationParams.state);
             expect(authUrl.searchParams.get("nonce")).toEqual(authorizationParams.nonce);
+            expect(authUrl.searchParams.get("code_challenge")).toEqual("0FLIKahrX7kqxncwhV5WD82lu_wi5GA8FsRSLubaOpU");
+        });
+
+        it("should log a warning if crypto is not available", async () => {
+            // test the no crypto case here
+            // @ts-ignore mocking
+            globalThis.crypto.subtle = undefined;
+
+            const authorizationParams = generateAuthorizationParams({ redirectUri: baseUrl });
+            const authUrl = new URL(
+                await generateAuthorizationUrl(authorizationEndpoint, clientId, authorizationParams),
+            );
 
             // crypto not available, plain text code_challenge is used
             expect(authUrl.searchParams.get("code_challenge")).toEqual(authorizationParams.codeVerifier);

spec/unit/queueToDevice.spec.ts

@@ -61,251 +61,293 @@ describe.each([[StoreType.Memory], [StoreType.IndexedDB]])("queueToDevice (%s st
     let httpBackend: MockHttpBackend;
     let client: MatrixClient;
 
-    beforeEach(async function () {
-        jest.runOnlyPendingTimers();
-        jest.useRealTimers();
-        httpBackend = new MockHttpBackend();
+    /**
+     * We need to split the tests into regular ones (these) and ones that use fake timers,
+     * because the fake indexeddb uses timers too and appears make tests cause other tests
+     * to fail if we keep enabling/disabling fake timers within the same test suite.
+     */
+    describe("non-timed tests", () => {
+        beforeEach(async function () {
+            httpBackend = new MockHttpBackend();
 
-        let store: IStore;
-        if (storeType === StoreType.IndexedDB) {
-            const idbStore = new IndexedDBStore({ indexedDB: fakeIndexedDB });
-            await idbStore.startup();
-            store = idbStore;
-        } else {
-            store = new MemoryStore();
-        }
+            let store: IStore;
+            if (storeType === StoreType.IndexedDB) {
+                const idbStore = new IndexedDBStore({ indexedDB: fakeIndexedDB });
+                await idbStore.startup();
+                store = idbStore;
+            } else {
+                store = new MemoryStore();
+            }
 
-        client = new MatrixClient({
-            baseUrl: "https://my.home.server",
-            accessToken: "my.access.token",
-            fetchFn: httpBackend.fetchFn as typeof global.fetch,
-            store,
-        });
-    });
-
-    afterEach(function () {
-        jest.useRealTimers();
-        client.stopClient();
-    });
-
-    it("sends a to-device message", async function () {
-        httpBackend
-            .when("PUT", "/sendToDevice/org.example.foo/")
-            .check((request) => {
-                expect(request.data).toEqual(EXPECTED_BODY);
-            })
-            .respond(200, {});
-
-        await client.queueToDevice({
-            eventType: "org.example.foo",
-            batch: [FAKE_MSG],
-        });
-
-        await httpBackend.flushAllExpected();
-        // let the code handle the response to the request so we don't get
-        // log output after the test has finished (apparently stopping the
-        // client in aftereach is not sufficient.)
-        await flushPromises();
-    });
-
-    it("retries on error", async function () {
-        jest.useFakeTimers();
-
-        httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(500);
-
-        httpBackend
-            .when("PUT", "/sendToDevice/org.example.foo/")
-            .check((request) => {
-                expect(request.data).toEqual(EXPECTED_BODY);
-            })
-            .respond(200, {});
-
-        await client.queueToDevice({
-            eventType: "org.example.foo",
-            batch: [FAKE_MSG],
-        });
-        await flushAndRunTimersUntil(() => httpBackend.requests.length > 0);
-        expect(httpBackend.flushSync(undefined, 1)).toEqual(1);
-
-        await flushAndRunTimersUntil(() => httpBackend.requests.length > 0);
-
-        expect(httpBackend.flushSync(undefined, 1)).toEqual(1);
-
-        // flush, as per comment in first test
-        await flushPromises();
-    });
-
-    it("stops retrying on 4xx errors", async function () {
-        jest.useFakeTimers();
-
-        httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(400);
-
-        await client.queueToDevice({
-            eventType: "org.example.foo",
-            batch: [FAKE_MSG],
-        });
-        await flushAndRunTimersUntil(() => httpBackend.requests.length > 0);
-        expect(httpBackend.flushSync(undefined, 1)).toEqual(1);
-
-        // Asserting that another request is never made is obviously
-        // a bit tricky - we just flush the queue what should hopefully
-        // be plenty of times and assert that nothing comes through.
-        let tries = 0;
-        await flushAndRunTimersUntil(() => ++tries === 10);
-
-        expect(httpBackend.requests.length).toEqual(0);
-    });
-
-    it("honours ratelimiting", async function () {
-        jest.useFakeTimers();
-
-        // pick something obscure enough it's unlikley to clash with a
-        // retry delay the algorithm uses anyway
-        const retryDelay = 279 * 1000;
-
-        httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(429, {
-            errcode: "M_LIMIT_EXCEEDED",
-            retry_after_ms: retryDelay,
-        });
-
-        httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(200, {});
-
-        await client.queueToDevice({
-            eventType: "org.example.foo",
-            batch: [FAKE_MSG],
-        });
-        await flushAndRunTimersUntil(() => httpBackend.requests.length > 0);
-        expect(httpBackend.flushSync(undefined, 1)).toEqual(1);
-        await flushPromises();
-
-        logger.info("Advancing clock to just before expected retry time...");
-
-        jest.advanceTimersByTime(retryDelay - 1000);
-        await flushPromises();
-
-        expect(httpBackend.requests.length).toEqual(0);
-
-        logger.info("Advancing clock past expected retry time...");
-
-        jest.advanceTimersByTime(2000);
-        await flushPromises();
-
-        expect(httpBackend.flushSync(undefined, 1)).toEqual(1);
-    });
-
-    it("retries on retryImmediately()", async function () {
-        httpBackend.when("GET", "/_matrix/client/versions").respond(200, {
-            versions: ["v1.1"],
-        });
-
-        await Promise.all([client.startClient(), httpBackend.flush(undefined, 1, 20)]);
-
-        httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(500);
-
-        httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(200, {});
-
-        await client.queueToDevice({
-            eventType: "org.example.foo",
-            batch: [FAKE_MSG],
-        });
-        expect(await httpBackend.flush(undefined, 1, 1)).toEqual(1);
-        await flushPromises();
-
-        client.retryImmediately();
-
-        // longer timeout here to try & avoid flakiness
-        expect(await httpBackend.flush(undefined, 1, 3000)).toEqual(1);
-    });
-
-    it("retries on when client is started", async function () {
-        httpBackend.when("GET", "/_matrix/client/versions").respond(200, {
-            versions: ["v1.1"],
-        });
-
-        await Promise.all([client.startClient(), httpBackend.flush("/_matrix/client/versions", 1, 20)]);
-
-        httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(500);
-
-        httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(200, {});
-
-        await client.queueToDevice({
-            eventType: "org.example.foo",
-            batch: [FAKE_MSG],
-        });
-        expect(await httpBackend.flush(undefined, 1, 1)).toEqual(1);
-        await flushPromises();
-
-        client.stopClient();
-        await Promise.all([client.startClient(), httpBackend.flush("/_matrix/client/versions", 1, 20)]);
-
-        expect(await httpBackend.flush(undefined, 1, 20)).toEqual(1);
-    });
-
-    it("retries when a message is retried", async function () {
-        httpBackend.when("GET", "/_matrix/client/versions").respond(200, {
-            versions: ["v1.1"],
-        });
-
-        await Promise.all([client.startClient(), httpBackend.flush(undefined, 1, 20)]);
-
-        httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(500);
-
-        httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(200, {});
-
-        await client.queueToDevice({
-            eventType: "org.example.foo",
-            batch: [FAKE_MSG],
-        });
-
-        expect(await httpBackend.flush(undefined, 1, 20)).toEqual(1);
-        await flushPromises();
-
-        const dummyEvent = new MatrixEvent({
-            event_id: "!fake:example.org",
-        });
-        const mockRoom = {
-            updatePendingEvent: jest.fn(),
-            hasEncryptionStateEvent: jest.fn().mockReturnValue(false),
-        } as unknown as Room;
-        client.resendEvent(dummyEvent, mockRoom);
-
-        expect(await httpBackend.flush(undefined, 1, 20)).toEqual(1);
-    });
-
-    it("splits many messages into multiple HTTP requests", async function () {
-        const batch: ToDeviceBatch = {
-            eventType: "org.example.foo",
-            batch: [],
-        };
-
-        for (let i = 0; i <= 20; ++i) {
-            batch.batch.push({
-                userId: `@user${i}:example.org`,
-                deviceId: FAKE_DEVICE_ID,
-                payload: FAKE_PAYLOAD,
+            client = new MatrixClient({
+                baseUrl: "https://my.home.server",
+                accessToken: "my.access.token",
+                fetchFn: httpBackend.fetchFn as typeof global.fetch,
+                store,
             });
-        }
+        });
 
-        const expectedCounts = [20, 1];
-        httpBackend
-            .when("PUT", "/sendToDevice/org.example.foo/")
-            .check((request) => {
-                expect(
-                    removeElement(expectedCounts, (c) => c === Object.keys(request.data.messages).length),
-                ).toBeTruthy();
-            })
-            .respond(200, {});
-        httpBackend
-            .when("PUT", "/sendToDevice/org.example.foo/")
-            .check((request) => {
-                expect(Object.keys(request.data.messages).length).toEqual(1);
-            })
-            .respond(200, {});
+        afterEach(function () {
+            client.stopClient();
+        });
 
-        await client.queueToDevice(batch);
-        await httpBackend.flushAllExpected();
+        it("sends a to-device message", async function () {
+            httpBackend
+                .when("PUT", "/sendToDevice/org.example.foo/")
+                .check((request) => {
+                    expect(request.data).toEqual(EXPECTED_BODY);
+                })
+                .respond(200, {});
 
-        // flush, as per comment in first test
-        await flushPromises();
+            await client.queueToDevice({
+                eventType: "org.example.foo",
+                batch: [FAKE_MSG],
+            });
+
+            await httpBackend.flushAllExpected();
+            // let the code handle the response to the request so we don't get
+            // log output after the test has finished (apparently stopping the
+            // client in aftereach is not sufficient.)
+            await flushPromises();
+        });
+
+        it("retries on retryImmediately()", async function () {
+            httpBackend.when("GET", "/_matrix/client/versions").respond(200, {
+                versions: ["v1.1"],
+            });
+
+            await Promise.all([client.startClient(), httpBackend.flush(undefined, 1, 20)]);
+
+            httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(500);
+
+            httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(200, {});
+
+            await client.queueToDevice({
+                eventType: "org.example.foo",
+                batch: [FAKE_MSG],
+            });
+            expect(await httpBackend.flush(undefined, 1, 1)).toEqual(1);
+            await flushPromises();
+
+            client.retryImmediately();
+
+            // longer timeout here to try & avoid flakiness
+            expect(await httpBackend.flush(undefined, 1, 3000)).toEqual(1);
+        });
+
+        it("retries on when client is started", async function () {
+            httpBackend.when("GET", "/_matrix/client/versions").respond(200, {
+                versions: ["v1.1"],
+            });
+
+            await Promise.all([client.startClient(), httpBackend.flush("/_matrix/client/versions", 1, 20)]);
+
+            httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(500);
+
+            httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(200, {});
+
+            await client.queueToDevice({
+                eventType: "org.example.foo",
+                batch: [FAKE_MSG],
+            });
+            expect(await httpBackend.flush(undefined, 1, 1)).toEqual(1);
+            await flushPromises();
+
+            client.stopClient();
+            await Promise.all([client.startClient(), httpBackend.flush("/_matrix/client/versions", 1, 20)]);
+
+            expect(await httpBackend.flush(undefined, 1, 20)).toEqual(1);
+        });
+
+        it("retries when a message is retried", async function () {
+            httpBackend.when("GET", "/_matrix/client/versions").respond(200, {
+                versions: ["v1.1"],
+            });
+
+            await Promise.all([client.startClient(), httpBackend.flush(undefined, 1, 20)]);
+
+            httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(500);
+
+            httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(200, {});
+
+            await client.queueToDevice({
+                eventType: "org.example.foo",
+                batch: [FAKE_MSG],
+            });
+
+            expect(await httpBackend.flush(undefined, 1, 20)).toEqual(1);
+            await flushPromises();
+
+            const dummyEvent = new MatrixEvent({
+                event_id: "!fake:example.org",
+            });
+            const mockRoom = {
+                updatePendingEvent: jest.fn(),
+                hasEncryptionStateEvent: jest.fn().mockReturnValue(false),
+            } as unknown as Room;
+            client.resendEvent(dummyEvent, mockRoom);
+
+            expect(await httpBackend.flush(undefined, 1, 20)).toEqual(1);
+        });
+
+        it("splits many messages into multiple HTTP requests", async function () {
+            const batch: ToDeviceBatch = {
+                eventType: "org.example.foo",
+                batch: [],
+            };
+
+            for (let i = 0; i <= 20; ++i) {
+                batch.batch.push({
+                    userId: `@user${i}:example.org`,
+                    deviceId: FAKE_DEVICE_ID,
+                    payload: FAKE_PAYLOAD,
+                });
+            }
+
+            const expectedCounts = [20, 1];
+            httpBackend
+                .when("PUT", "/sendToDevice/org.example.foo/")
+                .check((request) => {
+                    expect(
+                        removeElement(expectedCounts, (c) => c === Object.keys(request.data.messages).length),
+                    ).toBeTruthy();
+                })
+                .respond(200, {});
+            httpBackend
+                .when("PUT", "/sendToDevice/org.example.foo/")
+                .check((request) => {
+                    expect(Object.keys(request.data.messages).length).toEqual(1);
+                })
+                .respond(200, {});
+
+            await client.queueToDevice(batch);
+            await httpBackend.flushAllExpected();
+
+            // flush, as per comment in first test
+            await flushPromises();
+        });
+    });
+
+    describe("async tests", () => {
+        beforeAll(() => {
+            jest.useFakeTimers();
+        });
+
+        afterAll(() => {
+            jest.useRealTimers();
+        });
+
+        beforeEach(async function () {
+            httpBackend = new MockHttpBackend();
+
+            let store: IStore;
+            if (storeType === StoreType.IndexedDB) {
+                const idbStore = new IndexedDBStore({ indexedDB: fakeIndexedDB });
+                let storeStarted = false;
+                idbStore.startup().then(() => {
+                    storeStarted = true;
+                });
+                await flushAndRunTimersUntil(() => storeStarted);
+                store = idbStore;
+            } else {
+                store = new MemoryStore();
+            }
+
+            client = new MatrixClient({
+                baseUrl: "https://my.home.server",
+                accessToken: "my.access.token",
+                fetchFn: httpBackend.fetchFn as typeof global.fetch,
+                store,
+            });
+        });
+
+        afterEach(function () {
+            client.stopClient();
+        });
+
+        it("retries on error", async function () {
+            httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(500);
+
+            httpBackend
+                .when("PUT", "/sendToDevice/org.example.foo/")
+                .check((request) => {
+                    expect(request.data).toEqual(EXPECTED_BODY);
+                })
+                .respond(200, {});
+
+            client
+                .queueToDevice({
+                    eventType: "org.example.foo",
+                    batch: [FAKE_MSG],
+                })
+                .then();
+            await flushAndRunTimersUntil(() => httpBackend.requests.length > 0);
+            expect(httpBackend.flushSync(undefined, 1)).toEqual(1);
+
+            await flushAndRunTimersUntil(() => httpBackend.requests.length > 0);
+
+            expect(httpBackend.flushSync(undefined, 1)).toEqual(1);
+
+            // flush, as per comment in first test
+            await flushPromises();
+        });
+
+        it("stops retrying on 4xx errors", async function () {
+            httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(400);
+
+            client
+                .queueToDevice({
+                    eventType: "org.example.foo",
+                    batch: [FAKE_MSG],
+                })
+                .then();
+            await flushAndRunTimersUntil(() => httpBackend.requests.length > 0);
+            expect(httpBackend.flushSync(undefined, 1)).toEqual(1);
+
+            // Asserting that another request is never made is obviously
+            // a bit tricky - we just flush the queue what should hopefully
+            // be plenty of times and assert that nothing comes through.
+            let tries = 0;
+            await flushAndRunTimersUntil(() => ++tries === 10);
+
+            expect(httpBackend.requests.length).toEqual(0);
+        });
+
+        it("honours ratelimiting", async function () {
+            // pick something obscure enough it's unlikley to clash with a
+            // retry delay the algorithm uses anyway
+            const retryDelay = 279 * 1000;
+
+            httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(429, {
+                errcode: "M_LIMIT_EXCEEDED",
+                retry_after_ms: retryDelay,
+            });
+
+            httpBackend.when("PUT", "/sendToDevice/org.example.foo/").respond(200, {});
+
+            client
+                .queueToDevice({
+                    eventType: "org.example.foo",
+                    batch: [FAKE_MSG],
+                })
+                .then();
+            await flushAndRunTimersUntil(() => httpBackend.requests.length > 0);
+            expect(httpBackend.flushSync(undefined, 1)).toEqual(1);
+            await flushPromises();
+
+            logger.info("Advancing clock to just before expected retry time...");
+
+            jest.advanceTimersByTime(retryDelay - 1000);
+            await flushPromises();
+
+            expect(httpBackend.requests.length).toEqual(0);
+
+            logger.info("Advancing clock past expected retry time...");
+
+            jest.advanceTimersByTime(2000);
+            await flushPromises();
+
+            expect(httpBackend.flushSync(undefined, 1)).toEqual(1);
+        });
     });
 });

spec/unit/rendezvous/MSC4108RendezvousSession.spec.ts

@@ -0,0 +1,341 @@
+/*
+Copyright 2024 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import fetchMock from "fetch-mock-jest";
+
+import { ClientPrefix, IHttpOpts, MatrixClient, MatrixHttpApi } from "../../../src";
+import { ClientRendezvousFailureReason, MSC4108RendezvousSession } from "../../../src/rendezvous";
+
+function makeMockClient(opts: { userId: string; deviceId: string; msc4108Enabled: boolean }): MatrixClient {
+    const client = {
+        doesServerSupportUnstableFeature(feature: string) {
+            return Promise.resolve(opts.msc4108Enabled && feature === "org.matrix.msc4108");
+        },
+        getUserId() {
+            return opts.userId;
+        },
+        getDeviceId() {
+            return opts.deviceId;
+        },
+        baseUrl: "https://example.com",
+    } as unknown as MatrixClient;
+    client.http = new MatrixHttpApi<IHttpOpts & { onlyData: true }>(client, {
+        baseUrl: client.baseUrl,
+        prefix: ClientPrefix.Unstable,
+        onlyData: true,
+    });
+    return client;
+}
+
+fetchMock.config.overwriteRoutes = true;
+
+describe("MSC4108RendezvousSession", () => {
+    beforeEach(() => {
+        fetchMock.reset();
+    });
+
+    async function postAndCheckLocation(msc4108Enabled: boolean, fallbackRzServer: string, locationResponse: string) {
+        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc4108Enabled });
+        const transport = new MSC4108RendezvousSession({ client, fallbackRzServer });
+        {
+            // initial POST
+            const expectedPostLocation = msc4108Enabled
+                ? `${client.baseUrl}/_matrix/client/unstable/org.matrix.msc4108/rendezvous`
+                : fallbackRzServer;
+
+            fetchMock.postOnce(expectedPostLocation, {
+                status: 201,
+                body: { url: locationResponse },
+            });
+            await transport.send("data");
+        }
+
+        {
+            fetchMock.get(locationResponse, {
+                status: 200,
+                body: "data",
+                headers: {
+                    "content-type": "text/plain",
+                    "etag": "aaa",
+                },
+            });
+            await expect(transport.receive()).resolves.toEqual("data");
+        }
+    }
+
+    it("should use custom fetchFn if provided", async () => {
+        const sandbox = fetchMock.sandbox();
+        const fetchFn = jest.fn().mockImplementation(sandbox);
+        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc4108Enabled: false });
+        const transport = new MSC4108RendezvousSession({
+            client,
+            fetchFn,
+            fallbackRzServer: "https://fallbackserver/rz",
+        });
+        sandbox.postOnce("https://fallbackserver/rz", {
+            status: 201,
+            body: {
+                url: "https://fallbackserver/rz/123",
+            },
+        });
+        await transport.send("data");
+        await sandbox.flush(true);
+        expect(fetchFn).toHaveBeenCalledWith("https://fallbackserver/rz", expect.anything());
+    });
+
+    it("should throw an error when no server available", async function () {
+        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc4108Enabled: false });
+        const transport = new MSC4108RendezvousSession({ client });
+        await expect(transport.send("data")).rejects.toThrow("Invalid rendezvous URI");
+    });
+
+    it("POST to fallback server", async function () {
+        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc4108Enabled: false });
+        const transport = new MSC4108RendezvousSession({
+            client,
+            fallbackRzServer: "https://fallbackserver/rz",
+        });
+        fetchMock.postOnce("https://fallbackserver/rz", {
+            status: 201,
+            body: { url: "https://fallbackserver/rz/123" },
+        });
+        await fetchMock.flush(true);
+        await expect(transport.send("data")).resolves.toStrictEqual(undefined);
+    });
+
+    it("POST with no location", async function () {
+        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc4108Enabled: false });
+        const transport = new MSC4108RendezvousSession({
+            client,
+            fallbackRzServer: "https://fallbackserver/rz",
+        });
+        fetchMock.postOnce("https://fallbackserver/rz", {
+            status: 201,
+        });
+        await Promise.all([expect(transport.send("data")).rejects.toThrow(), fetchMock.flush(true)]);
+    });
+
+    it("POST with absolute path response", async function () {
+        await postAndCheckLocation(false, "https://fallbackserver/rz", "https://fallbackserver/123");
+    });
+
+    it("POST to built-in MSC3886 implementation", async function () {
+        await postAndCheckLocation(
+            true,
+            "https://fallbackserver/rz",
+            "https://example.com/_matrix/client/unstable/org.matrix.msc4108/rendezvous/123",
+        );
+    });
+
+    it("POST with relative path response including parent", async function () {
+        await postAndCheckLocation(false, "https://fallbackserver/rz/abc", "https://fallbackserver/rz/xyz/123");
+    });
+
+    // fetch-mock doesn't handle redirects properly, so we can't test this
+    it.skip("POST to follow 307 to other server", async function () {
+        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc4108Enabled: false });
+        const transport = new MSC4108RendezvousSession({
+            client,
+            fallbackRzServer: "https://fallbackserver/rz",
+        });
+        fetchMock.postOnce("https://fallbackserver/rz", {
+            status: 307,
+            redirectUrl: "https://redirected.fallbackserver/rz",
+            redirected: true,
+        });
+        fetchMock.postOnce("https://redirected.fallbackserver/rz", {
+            status: 201,
+            body: { url: "https://redirected.fallbackserver/rz/123" },
+            headers: { etag: "aaa" },
+        });
+        await fetchMock.flush(true);
+        await expect(transport.send("data")).resolves.toStrictEqual(undefined);
+    });
+
+    it("POST and GET", async function () {
+        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc4108Enabled: false });
+        const transport = new MSC4108RendezvousSession({
+            client,
+            fallbackRzServer: "https://fallbackserver/rz",
+        });
+        {
+            // initial POST
+            fetchMock.postOnce("https://fallbackserver/rz", {
+                status: 201,
+                body: { url: "https://fallbackserver/rz/123" },
+            });
+            await expect(transport.send("foo=baa")).resolves.toStrictEqual(undefined);
+            await fetchMock.flush(true);
+            expect(fetchMock).toHaveFetched("https://fallbackserver/rz", {
+                method: "POST",
+                headers: { "content-type": "text/plain" },
+                functionMatcher: (_, opts): boolean => {
+                    return opts.body === "foo=baa";
+                },
+            });
+        }
+        {
+            // first GET without etag
+            fetchMock.getOnce("https://fallbackserver/rz/123", {
+                status: 200,
+                body: "foo=baa",
+                headers: { "content-type": "text/plain", "etag": "aaa" },
+            });
+            await expect(transport.receive()).resolves.toEqual("foo=baa");
+            await fetchMock.flush(true);
+        }
+        {
+            // subsequent GET which should have etag from previous request
+            fetchMock.getOnce("https://fallbackserver/rz/123", {
+                status: 200,
+                body: "foo=baa",
+                headers: { "content-type": "text/plain", "etag": "bbb" },
+            });
+            await expect(transport.receive()).resolves.toEqual("foo=baa");
+            await fetchMock.flush(true);
+            expect(fetchMock).toHaveFetched("https://fallbackserver/rz/123", {
+                method: "GET",
+                headers: { "if-none-match": "aaa" },
+            });
+        }
+    });
+
+    it("POST and PUTs", async function () {
+        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc4108Enabled: false });
+        const transport = new MSC4108RendezvousSession({
+            client,
+            fallbackRzServer: "https://fallbackserver/rz",
+        });
+        {
+            // initial POST
+            fetchMock.postOnce("https://fallbackserver/rz", {
+                status: 201,
+                body: { url: "https://fallbackserver/rz/123" },
+                headers: { etag: "aaa" },
+            });
+            await transport.send("foo=baa");
+            await fetchMock.flush(true);
+            expect(fetchMock).toHaveFetched("https://fallbackserver/rz", {
+                method: "POST",
+                headers: { "content-type": "text/plain" },
+                functionMatcher: (_, opts): boolean => {
+                    return opts.body === "foo=baa";
+                },
+            });
+        }
+        {
+            // subsequent PUT which should have etag from previous request
+            fetchMock.putOnce("https://fallbackserver/rz/123", { status: 202, headers: { etag: "bbb" } });
+            await transport.send("c=d");
+            await fetchMock.flush(true);
+            expect(fetchMock).toHaveFetched("https://fallbackserver/rz/123", {
+                method: "PUT",
+                headers: { "if-match": "aaa" },
+            });
+        }
+    });
+
+    it("POST and DELETE", async function () {
+        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc4108Enabled: false });
+        const transport = new MSC4108RendezvousSession({
+            client,
+            fallbackRzServer: "https://fallbackserver/rz",
+        });
+        {
+            // Create
+            fetchMock.postOnce("https://fallbackserver/rz", {
+                status: 201,
+                body: { url: "https://fallbackserver/rz/123" },
+            });
+            await expect(transport.send("foo=baa")).resolves.toStrictEqual(undefined);
+            await fetchMock.flush(true);
+            expect(fetchMock).toHaveFetched("https://fallbackserver/rz", {
+                method: "POST",
+                headers: { "content-type": "text/plain" },
+                functionMatcher: (_, opts): boolean => {
+                    return opts.body === "foo=baa";
+                },
+            });
+        }
+        {
+            // Cancel
+            fetchMock.deleteOnce("https://fallbackserver/rz/123", { status: 204 });
+            await transport.cancel(ClientRendezvousFailureReason.UserDeclined);
+            await fetchMock.flush(true);
+        }
+    });
+
+    it("send after cancelled", async function () {
+        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc4108Enabled: false });
+        const transport = new MSC4108RendezvousSession({
+            client,
+            fallbackRzServer: "https://fallbackserver/rz",
+        });
+        await transport.cancel(ClientRendezvousFailureReason.UserDeclined);
+        await expect(transport.send("data")).resolves.toBeUndefined();
+    });
+
+    it("receive before ready", async function () {
+        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc4108Enabled: false });
+        const transport = new MSC4108RendezvousSession({
+            client,
+            fallbackRzServer: "https://fallbackserver/rz",
+        });
+        await expect(transport.receive()).rejects.toThrow();
+    });
+
+    it("404 failure callback", async function () {
+        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc4108Enabled: false });
+        const onFailure = jest.fn();
+        const transport = new MSC4108RendezvousSession({
+            client,
+            fallbackRzServer: "https://fallbackserver/rz",
+            onFailure,
+        });
+
+        fetchMock.postOnce("https://fallbackserver/rz", { status: 404 });
+        await Promise.all([expect(transport.send("foo=baa")).resolves.toBeUndefined(), fetchMock.flush(true)]);
+        expect(onFailure).toHaveBeenCalledWith(ClientRendezvousFailureReason.Unknown);
+    });
+
+    it("404 failure callback mapped to expired", async function () {
+        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc4108Enabled: false });
+        const onFailure = jest.fn();
+        const transport = new MSC4108RendezvousSession({
+            client,
+            fallbackRzServer: "https://fallbackserver/rz",
+            onFailure,
+        });
+
+        {
+            // initial POST
+            fetchMock.postOnce("https://fallbackserver/rz", {
+                status: 201,
+                body: { url: "https://fallbackserver/rz/123" },
+                headers: { expires: "Thu, 01 Jan 1970 00:00:00 GMT" },
+            });
+
+            await transport.send("foo=baa");
+            await fetchMock.flush(true);
+        }
+        {
+            // GET with 404 to simulate expiry
+            fetchMock.getOnce("https://fallbackserver/rz/123", { status: 404, body: "foo=baa" });
+            await Promise.all([expect(transport.receive()).resolves.toBeUndefined(), fetchMock.flush(true)]);
+            expect(onFailure).toHaveBeenCalledWith(ClientRendezvousFailureReason.Expired);
+        }
+    });
+});

spec/unit/rendezvous/channels/MSC4108SecureChannel.spec.ts

@@ -0,0 +1,126 @@
+/*
+Copyright 2024 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { EstablishedEcies, QrCodeData, QrCodeMode, Ecies } from "@matrix-org/matrix-sdk-crypto-wasm";
+import { mocked } from "jest-mock";
+
+import { MSC4108RendezvousSession, MSC4108SecureChannel, PayloadType } from "../../../../src/rendezvous";
+
+describe("MSC4108SecureChannel", () => {
+    const baseUrl = "https://example.com";
+    const url = "https://fallbackserver/rz/123";
+
+    it("should generate qr code data as expected", async () => {
+        const session = new MSC4108RendezvousSession({
+            url,
+        });
+        const channel = new MSC4108SecureChannel(session);
+
+        const code = await channel.generateCode(QrCodeMode.Login);
+        expect(code).toHaveLength(71);
+        const text = new TextDecoder().decode(code);
+        expect(text.startsWith("MATRIX")).toBeTruthy();
+        expect(text.endsWith(url)).toBeTruthy();
+    });
+
+    it("should throw error if attempt to connect multiple times", async () => {
+        const mockSession = {
+            send: jest.fn(),
+            receive: jest.fn(),
+            url,
+        } as unknown as MSC4108RendezvousSession;
+        const channel = new MSC4108SecureChannel(mockSession);
+
+        const qrCodeData = QrCodeData.fromBytes(await channel.generateCode(QrCodeMode.Reciprocate, baseUrl));
+        const { initial_message: ciphertext } = new Ecies().establish_outbound_channel(
+            qrCodeData.publicKey,
+            "MATRIX_QR_CODE_LOGIN_INITIATE",
+        );
+        mocked(mockSession.receive).mockResolvedValue(ciphertext);
+        await channel.connect();
+        await expect(channel.connect()).rejects.toThrow("Channel already connected");
+    });
+
+    it("should throw error on invalid initiate response", async () => {
+        const mockSession = {
+            send: jest.fn(),
+            receive: jest.fn(),
+            url,
+        } as unknown as MSC4108RendezvousSession;
+        const channel = new MSC4108SecureChannel(mockSession);
+
+        mocked(mockSession.receive).mockResolvedValue("");
+        await expect(channel.connect()).rejects.toThrow("No response from other device");
+
+        const qrCodeData = QrCodeData.fromBytes(await channel.generateCode(QrCodeMode.Reciprocate, baseUrl));
+        const { initial_message: ciphertext } = new Ecies().establish_outbound_channel(
+            qrCodeData.publicKey,
+            "NOT_REAL_MATRIX_QR_CODE_LOGIN_INITIATE",
+        );
+
+        mocked(mockSession.receive).mockResolvedValue(ciphertext);
+        await expect(channel.connect()).rejects.toThrow("Invalid response from other device");
+    });
+
+    describe("should be able to connect as a reciprocating device", () => {
+        let mockSession: MSC4108RendezvousSession;
+        let channel: MSC4108SecureChannel;
+        let opponentChannel: EstablishedEcies;
+
+        beforeEach(async () => {
+            mockSession = {
+                send: jest.fn(),
+                receive: jest.fn(),
+                url,
+            } as unknown as MSC4108RendezvousSession;
+            channel = new MSC4108SecureChannel(mockSession);
+
+            const qrCodeData = QrCodeData.fromBytes(await channel.generateCode(QrCodeMode.Reciprocate, baseUrl));
+            const { channel: _opponentChannel, initial_message: ciphertext } = new Ecies().establish_outbound_channel(
+                qrCodeData.publicKey,
+                "MATRIX_QR_CODE_LOGIN_INITIATE",
+            );
+            opponentChannel = _opponentChannel;
+
+            mocked(mockSession.receive).mockResolvedValue(ciphertext);
+            await channel.connect();
+            expect(opponentChannel.decrypt(mocked(mockSession.send).mock.calls[0][0])).toBe("MATRIX_QR_CODE_LOGIN_OK");
+            mocked(mockSession.send).mockReset();
+        });
+
+        it("should be able to securely send encrypted payloads", async () => {
+            const payload = {
+                type: PayloadType.Secrets,
+                protocols: ["a", "b", "c"],
+                homeserver: "https://example.org",
+            };
+            await channel.secureSend(payload);
+            expect(mockSession.send).toHaveBeenCalled();
+            expect(opponentChannel.decrypt(mocked(mockSession.send).mock.calls[0][0])).toBe(JSON.stringify(payload));
+        });
+
+        it("should be able to securely receive encrypted payloads", async () => {
+            const payload = {
+                type: PayloadType.Secrets,
+                protocols: ["a", "b", "c"],
+                homeserver: "https://example.org",
+            };
+            const ciphertext = opponentChannel.encrypt(JSON.stringify(payload));
+            mocked(mockSession.receive).mockResolvedValue(ciphertext);
+            await expect(channel.secureReceive()).resolves.toEqual(payload);
+        });
+    });
+});

spec/unit/rendezvous/ecdhv2.spec.ts

@@ -15,7 +15,7 @@ limitations under the License.
 */
 
 import "../../olm-loader";
-import { RendezvousFailureReason, RendezvousIntent } from "../../../src/rendezvous";
+import { LegacyRendezvousFailureReason as RendezvousFailureReason, RendezvousIntent } from "../../../src/rendezvous";
 import { MSC3903ECDHPayload, MSC3903ECDHv2RendezvousChannel } from "../../../src/rendezvous/channels";
 import { decodeBase64 } from "../../../src/base64";
 import { DummyTransport } from "./DummyTransport";

spec/unit/rendezvous/rendezvous.spec.ts

@@ -17,7 +17,12 @@ limitations under the License.
 import MockHttpBackend from "matrix-mock-request";
 
 import "../../olm-loader";
-import { MSC3906Rendezvous, RendezvousCode, RendezvousFailureReason, RendezvousIntent } from "../../../src/rendezvous";
+import {
+    MSC3906Rendezvous,
+    RendezvousCode,
+    LegacyRendezvousFailureReason as RendezvousFailureReason,
+    RendezvousIntent,
+} from "../../../src/rendezvous";
 import {
     ECDHv2RendezvousCode as ECDHRendezvousCode,
     MSC3903ECDHPayload,
@@ -111,7 +116,7 @@ function makeMockClient(opts: {
                     },
                 };
             },
-            getCapabilities() {
+            getCachedCapabilities() {
                 return opts.msc3882r0Only
                     ? {}
                     : {

spec/unit/rendezvous/simpleHttpTransport.spec.ts

@@ -17,7 +17,7 @@ limitations under the License.
 import MockHttpBackend from "matrix-mock-request";
 
 import type { MatrixClient } from "../../../src";
-import { RendezvousFailureReason } from "../../../src/rendezvous";
+import { LegacyRendezvousFailureReason as RendezvousFailureReason } from "../../../src/rendezvous";
 import { MSC3886SimpleHttpRendezvousTransport } from "../../../src/rendezvous/transports";
 
 function makeMockClient(opts: { userId: string; deviceId: string; msc3886Enabled: boolean }): MatrixClient {

spec/unit/room-state.spec.ts

@@ -1122,4 +1122,59 @@ describe("RoomState", function () {
             ).toBeFalsy();
         });
     });
+    describe("skipWrongOrderRoomStateInserts", () => {
+        const idNow = "now";
+        const idBefore = "before";
+        const endState = new RoomState(roomId);
+        const startState = new RoomState(roomId, undefined, true);
+
+        let onRoomStateEvent: (event: MatrixEvent, state: RoomState, lastStateEvent: MatrixEvent | null) => void;
+        const evNow = new MatrixEvent({
+            type: "m.call.member",
+            room_id: roomId,
+            state_key: "@user:example.org",
+            content: {},
+        });
+        evNow.event.unsigned = { replaces_state: idBefore };
+        evNow.event.event_id = idNow;
+
+        const evBefore = new MatrixEvent({
+            type: "m.call.member",
+            room_id: roomId,
+            state_key: "@user:example.org",
+            content: {},
+        });
+
+        const updatedStateWithBefore = jest.fn();
+        const updatedStateWithNow = jest.fn();
+
+        beforeEach(() => {
+            evBefore.event.event_id = idBefore;
+            onRoomStateEvent = (event, _state, _lastState) => {
+                if (event.event.event_id === idNow) {
+                    updatedStateWithNow();
+                } else if (event.event.event_id === idBefore) {
+                    updatedStateWithBefore();
+                }
+            };
+            endState.on(RoomStateEvent.Events, onRoomStateEvent);
+            startState.on(RoomStateEvent.Events, onRoomStateEvent);
+        });
+        afterEach(() => {
+            endState.off(RoomStateEvent.Events, onRoomStateEvent);
+            startState.off(RoomStateEvent.Events, onRoomStateEvent);
+            updatedStateWithNow.mockReset();
+            updatedStateWithBefore.mockReset();
+        });
+        it("should skip inserting state to the end of the timeline if the current endState events replaces_state id is the same as the inserted events id", () => {
+            endState.setStateEvents([evNow, evBefore]);
+            expect(updatedStateWithBefore).not.toHaveBeenCalled();
+            expect(updatedStateWithNow).toHaveBeenCalled();
+        });
+        it("should skip inserting state at the beginning of the timeline if the inserted events replaces_state is the event id of the current startState", () => {
+            startState.setStateEvents([evBefore, evNow]);
+            expect(updatedStateWithBefore).toHaveBeenCalled();
+            expect(updatedStateWithNow).not.toHaveBeenCalled();
+        });
+    });
 });

spec/unit/room.spec.ts

@@ -22,7 +22,7 @@ import { mocked } from "jest-mock";
 import { M_POLL_KIND_DISCLOSED, M_POLL_RESPONSE, M_POLL_START, Optional, PollStartEvent } from "matrix-events-sdk";
 
 import * as utils from "../test-utils/test-utils";
-import { emitPromise } from "../test-utils/test-utils";
+import { emitPromise, IMessageOpts } from "../test-utils/test-utils";
 import {
     Direction,
     DuplicateStrategy,
@@ -54,7 +54,6 @@ import { Crypto } from "../../src/crypto";
 import * as threadUtils from "../test-utils/thread";
 import { getMockClientWithEventEmitter, mockClientMethodsUser } from "../test-utils/client";
 import { logger } from "../../src/logger";
-import { IMessageOpts } from "../test-utils/test-utils";
 import { flushPromises } from "../test-utils/flushPromises";
 import { KnownMembership } from "../../src/@types/membership";
 
@@ -339,24 +338,6 @@ describe("Room", function () {
             }),
         ];
 
-        it("Make sure legacy overload passing options directly as parameters still works", async () => {
-            await expect(room.addLiveEvents(events, DuplicateStrategy.Replace, false)).resolves.not.toThrow();
-            await expect(room.addLiveEvents(events, DuplicateStrategy.Ignore, true)).resolves.not.toThrow();
-            await expect(
-                // @ts-ignore
-                room.addLiveEvents(events, "shouldfailbecauseinvalidduplicatestrategy", false),
-            ).rejects.toThrow();
-        });
-
-        it("should throw if duplicateStrategy isn't 'replace' or 'ignore'", async function () {
-            return expect(
-                // @ts-ignore
-                room.addLiveEvents(events, {
-                    duplicateStrategy: "foo",
-                }),
-            ).rejects.toThrow();
-        });
-
         it("should replace a timeline event if dupe strategy is 'replace'", async function () {
             // make a duplicate
             const dupe = utils.mkMessage({
@@ -387,7 +368,7 @@ describe("Room", function () {
             expect(room.timeline[0]).toEqual(events[0]);
             // @ts-ignore
             await room.addLiveEvents([dupe], {
-                duplicateStrategy: "ignore",
+                duplicateStrategy: DuplicateStrategy.Ignore,
             });
             expect(room.timeline[0]).toEqual(events[0]);
         });
@@ -4053,4 +4034,47 @@ describe("Room", function () {
             expect(room.getLastThread()).toBe(thread2);
         });
     });
+
+    describe("getRecommendedVersion", () => {
+        it("returns the server's recommended version from capabilities", async () => {
+            const client = new TestClient(userA).client;
+            client.getCapabilities = jest.fn().mockReturnValue({
+                ["m.room_versions"]: {
+                    default: "1",
+                    available: ["1", "2"],
+                },
+            });
+            const room = new Room(roomId, client, userA);
+            expect(await room.getRecommendedVersion()).toEqual({
+                version: "1",
+                needsUpgrade: false,
+                urgent: false,
+            });
+        });
+
+        it("force-refreshes versions to make sure an upgrade is necessary", async () => {
+            const client = new TestClient(userA).client;
+            client.getCapabilities = jest.fn().mockReturnValue({
+                ["m.room_versions"]: {
+                    default: "5",
+                    available: ["5"],
+                },
+            });
+
+            client.fetchCapabilities = jest.fn().mockResolvedValue({
+                ["m.room_versions"]: {
+                    default: "1",
+                    available: ["1"],
+                },
+            });
+
+            const room = new Room(roomId, client, userA);
+            expect(await room.getRecommendedVersion()).toEqual({
+                version: "1",
+                needsUpgrade: false,
+                urgent: false,
+            });
+            expect(client.fetchCapabilities).toHaveBeenCalled();
+        });
+    });
 });

spec/unit/rust-crypto/rust-crypto.spec.ts

@@ -95,6 +95,7 @@ describe("initRustCrypto", () => {
             deleteSecretsFromInbox: jest.fn(),
             registerReceiveSecretCallback: jest.fn(),
             registerDevicesUpdatedCallback: jest.fn(),
+            registerRoomKeysWithheldCallback: jest.fn(),
             outgoingRequests: jest.fn(),
             isBackupEnabled: jest.fn().mockResolvedValue(false),
             verifyBackup: jest.fn().mockResolvedValue({ trusted: jest.fn().mockReturnValue(false) }),
@@ -104,7 +105,7 @@ describe("initRustCrypto", () => {
         } as unknown as Mocked<OlmMachine>;
     }
 
-    it("passes through the store params", async () => {
+    it("passes through the store params (passphrase)", async () => {
         const mockStore = { free: jest.fn() } as unknown as StoreHandle;
         jest.spyOn(StoreHandle, "open").mockResolvedValue(mockStore);
 
@@ -126,7 +127,30 @@ describe("initRustCrypto", () => {
         expect(OlmMachine.initFromStore).toHaveBeenCalledWith(expect.anything(), expect.anything(), mockStore);
     });
 
-    it("suppresses the storePassphrase if storePrefix is unset", async () => {
+    it("passes through the store params (key)", async () => {
+        const mockStore = { free: jest.fn() } as unknown as StoreHandle;
+        jest.spyOn(StoreHandle, "openWithKey").mockResolvedValue(mockStore);
+
+        const testOlmMachine = makeTestOlmMachine();
+        jest.spyOn(OlmMachine, "initFromStore").mockResolvedValue(testOlmMachine);
+
+        const storeKey = new Uint8Array(32);
+        await initRustCrypto({
+            logger,
+            http: {} as MatrixClient["http"],
+            userId: TEST_USER,
+            deviceId: TEST_DEVICE_ID,
+            secretStorage: {} as ServerSideSecretStorage,
+            cryptoCallbacks: {} as CryptoCallbacks,
+            storePrefix: "storePrefix",
+            storeKey: storeKey,
+        });
+
+        expect(StoreHandle.openWithKey).toHaveBeenCalledWith("storePrefix", storeKey);
+        expect(OlmMachine.initFromStore).toHaveBeenCalledWith(expect.anything(), expect.anything(), mockStore);
+    });
+
+    it("suppresses the storePassphrase and storeKey if storePrefix is unset", async () => {
         const mockStore = { free: jest.fn() } as unknown as StoreHandle;
         jest.spyOn(StoreHandle, "open").mockResolvedValue(mockStore);
 
@@ -141,10 +165,11 @@ describe("initRustCrypto", () => {
             secretStorage: {} as ServerSideSecretStorage,
             cryptoCallbacks: {} as CryptoCallbacks,
             storePrefix: null,
+            storeKey: new Uint8Array(),
             storePassphrase: "storePassphrase",
         });
 
-        expect(StoreHandle.open).toHaveBeenCalledWith(undefined, undefined);
+        expect(StoreHandle.open).toHaveBeenCalledWith();
         expect(OlmMachine.initFromStore).toHaveBeenCalledWith(expect.anything(), expect.anything(), mockStore);
     });
 
@@ -1395,14 +1420,15 @@ describe("RustCrypto", () => {
             const rustCrypto = await makeTestRustCrypto();
             const olmMachine: OlmMachine = rustCrypto["olmMachine"];
 
+            const backupVersion = testData.SIGNED_BACKUP_DATA.version!;
             await olmMachine.enableBackupV1(
                 (testData.SIGNED_BACKUP_DATA.auth_data as Curve25519AuthData).public_key,
-                testData.SIGNED_BACKUP_DATA.version!,
+                backupVersion,
             );
 
             // we import two keys: one "from backup", and one "from export"
             const [backedUpRoomKey, exportedRoomKey] = testData.MEGOLM_SESSION_DATA_ARRAY;
-            await rustCrypto.importBackedUpRoomKeys([backedUpRoomKey]);
+            await rustCrypto.importBackedUpRoomKeys([backedUpRoomKey], backupVersion);
             await rustCrypto.importRoomKeys([exportedRoomKey]);
 
             // we ask for the keys that should be backed up
@@ -1437,16 +1463,17 @@ describe("RustCrypto", () => {
             const rustCrypto = await makeTestRustCrypto();
             const olmMachine: OlmMachine = rustCrypto["olmMachine"];
 
+            const backupVersion = testData.SIGNED_BACKUP_DATA.version!;
             await olmMachine.enableBackupV1(
                 (testData.SIGNED_BACKUP_DATA.auth_data as Curve25519AuthData).public_key,
-                testData.SIGNED_BACKUP_DATA.version!,
+                backupVersion,
             );
 
             const backup = Array.from(testData.MEGOLM_SESSION_DATA_ARRAY);
             // in addition to correct keys, we restore an invalid key
             backup.push({ room_id: "!roomid", session_id: "sessionid" } as IMegolmSessionData);
             const progressCallback = jest.fn();
-            await rustCrypto.importBackedUpRoomKeys(backup, { progressCallback });
+            await rustCrypto.importBackedUpRoomKeys(backup, backupVersion, { progressCallback });
             expect(progressCallback).toHaveBeenCalledWith({
                 total: 3,
                 successes: 0,
@@ -1489,6 +1516,44 @@ describe("RustCrypto", () => {
             expect(await rustCrypto.isDehydrationSupported()).toBe(true);
         });
     });
+
+    describe("import & export secrets bundle", () => {
+        let rustCrypto: RustCrypto;
+
+        beforeEach(async () => {
+            rustCrypto = await makeTestRustCrypto(
+                new MatrixHttpApi(new TypedEventEmitter<HttpApiEvent, HttpApiEventHandlerMap>(), {
+                    baseUrl: "http://server/",
+                    prefix: "",
+                    onlyData: true,
+                }),
+                testData.TEST_USER_ID,
+            );
+        });
+
+        it("should throw an error if there is nothing to export", async () => {
+            await expect(rustCrypto.exportSecretsBundle()).rejects.toThrow(
+                "The store doesn't contain any cross-signing keys",
+            );
+        });
+
+        it("should correctly import & export a secrets bundle", async () => {
+            const bundle = {
+                cross_signing: {
+                    master_key: "bMnVpkHI4S2wXRxy+IpaKM5PIAUUkl6DE+n0YLIW/qs",
+                    user_signing_key: "8tlgLjUrrb/zGJo4YKGhDTIDCEjtJTAS/Sh2AGNLuIo",
+                    self_signing_key: "pfDknmP5a0fVVRE54zhkUgJfzbNmvKcNfIWEW796bQs",
+                },
+                backup: {
+                    algorithm: "m.megolm_backup.v1.curve25519-aes-sha2",
+                    key: "bYYv3aFLQ49jMNcOjuTtBY9EKDby2x1m3gfX81nIKRQ",
+                    backup_version: "9",
+                },
+            };
+            await rustCrypto.importSecretsBundle(bundle);
+            await expect(rustCrypto.exportSecretsBundle()).resolves.toEqual(expect.objectContaining(bundle));
+        });
+    });
 });
 
 /** Build a MatrixHttpApi instance */

spec/unit/timeline-window.spec.ts

@@ -434,7 +434,7 @@ describe("TimelineWindow", function () {
     });
 
     function idsOf(events: Array<MatrixEvent>): Array<string> {
-        return events.map((e) => (e ? e.getId() ?? "MISSING_ID" : "MISSING_EVENT"));
+        return events.map((e) => (e ? (e.getId() ?? "MISSING_ID") : "MISSING_EVENT"));
     }
 
     describe("removing events", () => {

spec/unit/webrtc/groupCall.spec.ts

@@ -105,7 +105,7 @@ const mockGetStateEvents =
     (events: MatrixEvent[] = FAKE_STATE_EVENTS as MatrixEvent[]) =>
     (type: EventType, userId?: string): MatrixEvent[] | MatrixEvent | null => {
         if (type === EventType.GroupCallMemberPrefix) {
-            return userId === undefined ? events : events.find((e) => e.getStateKey() === userId) ?? null;
+            return userId === undefined ? events : (events.find((e) => e.getStateKey() === userId) ?? null);
         } else {
             const fakeEvent = { getContent: () => ({}), getTs: () => 0 } as MatrixEvent;
             return userId === undefined ? [fakeEvent] : fakeEvent;

src/@types/auth.ts

@@ -147,11 +147,6 @@ export interface LoginRequest {
      * The login type being used.
      */
     type: "m.login.password" | "m.login.token" | string;
-    /**
-     * Third-party identifier for the user.
-     * @deprecated in favour of `identifier`.
-     */
-    address?: string;
     /**
      * ID of the client device.
      * If this does not correspond to a known client device, a new device will be created.

src/@types/event.ts

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import { UnstableValue } from "../NamespacedValue";
+import { NamespacedValue, UnstableValue } from "../NamespacedValue";
 import {
     PolicyRuleEventContent,
     RoomAvatarEventContent,
@@ -56,8 +56,8 @@ import {
     SDPStreamMetadataKey,
 } from "../webrtc/callEventTypes";
 import { EncryptionKeysEventContent, ICallNotifyContent } from "../matrixrtc/types";
-import { EncryptedFile } from "./media";
 import { M_POLL_END, M_POLL_START, PollEndEventContent, PollStartEventContent } from "./polls";
+import { SessionMembershipData } from "../matrixrtc/CallMembership";
 
 export enum EventType {
     // Room state events
@@ -303,12 +303,7 @@ export const UNSIGNED_THREAD_ID_FIELD = new UnstableValue("thread_id", "org.matr
  *
  * @experimental
  */
-export const UNSIGNED_MEMBERSHIP_FIELD = new UnstableValue("membership", "io.element.msc4115.membership");
-
-/**
- * @deprecated in favour of {@link EncryptedFile}
- */
-export type IEncryptedFile = EncryptedFile;
+export const UNSIGNED_MEMBERSHIP_FIELD = new NamespacedValue("membership", "io.element.msc4115.membership");
 
 /**
  * Mapped type from event type to content type for all specified non-state room events.
@@ -362,7 +357,10 @@ export interface StateEvents {
 
     // MSC3401
     [EventType.GroupCallPrefix]: IGroupCallRoomState;
-    [EventType.GroupCallMemberPrefix]: XOR<IGroupCallRoomMemberState, ExperimentalGroupCallRoomMemberState>;
+    [EventType.GroupCallMemberPrefix]: XOR<
+        XOR<IGroupCallRoomMemberState, ExperimentalGroupCallRoomMemberState>,
+        XOR<SessionMembershipData, {}>
+    >;
 
     // MSC3089
     [UNSTABLE_MSC3089_BRANCH.name]: MSC3089EventContent;

src/@types/global.d.ts

@@ -29,20 +29,11 @@ declare global {
 
     namespace NodeJS {
         interface Global {
-            localStorage: Storage;
             // marker variable used to detect both the browser & node entrypoints being used at once
             __js_sdk_entrypoint: unknown;
         }
     }
 
-    interface Window {
-        webkitAudioContext: typeof AudioContext;
-    }
-
-    interface Crypto {
-        webkitSubtle?: Window["crypto"]["subtle"];
-    }
-
     interface MediaDevices {
         // This is experimental and types don't know about it yet
         // https://github.com/microsoft/TypeScript/issues/33232
@@ -76,40 +67,4 @@ declare global {
         // on webkit: we should check if we still need to do this
         webkitGetUserMedia: DummyInterfaceWeShouldntBeUsingThis;
     }
-
-    export interface ISettledFulfilled<T> {
-        status: "fulfilled";
-        value: T;
-    }
-    export interface ISettledRejected {
-        status: "rejected";
-        reason: any;
-    }
-
-    interface PromiseConstructor {
-        allSettled<T>(promises: Promise<T>[]): Promise<Array<ISettledFulfilled<T> | ISettledRejected>>;
-    }
-
-    interface RTCRtpTransceiver {
-        // This has been removed from TS
-        // (https://github.com/microsoft/TypeScript-DOM-lib-generator/issues/1029),
-        // but we still need this for MatrixCall::getRidOfRTXCodecs()
-        setCodecPreferences(codecs: RTCRtpCodecCapability[]): void;
-    }
-
-    interface RequestInit {
-        /**
-         * Specifies the priority of the fetch request relative to other requests of the same type.
-         * Must be one of the following strings:
-         *   high: A high priority fetch request relative to other requests of the same type.
-         *   low: A low priority fetch request relative to other requests of the same type.
-         *   auto: Automatically determine the priority of the fetch request relative to other requests of the same type (default).
-         *
-         * @see https://html.spec.whatwg.org/multipage/urls-and-fetching.html#fetch-priority-attribute
-         * @see https://github.com/microsoft/TypeScript/issues/54472
-         * @see https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API#browser_compatibility
-         * Not yet supported in Safari or Firefox
-         */
-        priority?: "high" | "low" | "auto";
-    }
 }

src/@types/matrix-sdk-crypto-wasm.d.ts

@@ -0,0 +1,44 @@
+/*
+Copyright 2024 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import type * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
+
+declare module "@matrix-org/matrix-sdk-crypto-wasm" {
+    interface OlmMachine {
+        importSecretsBundle(bundle: RustSdkCryptoJs.SecretsBundle): Promise<void>;
+        exportSecretsBundle(): Promise<RustSdkCryptoJs.SecretsBundle>;
+    }
+
+    interface SecretsBundle {
+        // eslint-disable-next-line @typescript-eslint/naming-convention
+        to_json(): Promise<{
+            cross_signing: {
+                master_key: string;
+                self_signing_key: string;
+                user_signing_key: string;
+            };
+            backup?: {
+                algorithm: string;
+                key: string;
+                backup_version: string;
+            };
+        }>;
+    }
+
+    interface Device {
+        requestVerification(methods?: any[]): [RustSdkCryptoJs.VerificationRequest, RustSdkCryptoJs.ToDeviceRequest];
+    }
+}

src/@types/partials.ts

@@ -45,14 +45,6 @@ export enum RestrictedAllowType {
     RoomMembership = "m.room_membership",
 }
 
-export interface IJoinRuleEventContent {
-    join_rule: JoinRule; // eslint-disable-line camelcase
-    allow?: {
-        type: RestrictedAllowType;
-        room_id: string; // eslint-disable-line camelcase
-    }[];
-}
-
 export enum GuestAccess {
     CanJoin = "can_join",
     Forbidden = "forbidden",

src/@types/registration.ts

@@ -52,21 +52,13 @@ export interface RegisterRequest {
      */
     initial_device_display_name?: string;
     /**
-     * @deprecated missing in the spec
+     * Guest users can also upgrade their account by going through the ordinary register flow,
+     * but specifying the additional POST parameter guest_access_token containing the guest’s access token.
+     * They are also required to specify the username parameter to the value of the local part of their username,
+     * which is otherwise optional.
+     * @see https://spec.matrix.org/v1.10/client-server-api/#guest-access
      */
     guest_access_token?: string;
-    /**
-     * @deprecated missing in the spec
-     */
-    x_show_msisdn?: boolean;
-    /**
-     * @deprecated missing in the spec
-     */
-    bind_msisdn?: boolean;
-    /**
-     * @deprecated missing in the spec
-     */
-    bind_email?: boolean;
 }
 
 /**
@@ -107,10 +99,4 @@ export interface RegisterResponse {
      * Omitted if the inhibit_login option is true.
      */
     refresh_token?: string;
-    /**
-     * The server_name of the homeserver on which the account has been registered.
-     *
-     * @deprecated Clients should extract the server_name from user_id (by splitting at the first colon) if they require it.
-     */
-    home_server?: string;
 }

src/@types/requests.ts

@@ -76,6 +76,56 @@ export interface ISendEventResponse {
     event_id: string;
 }
 
+export type TimeoutDelay = {
+    delay: number;
+};
+
+export type ParentDelayId = {
+    parent_delay_id: string;
+};
+
+export type SendTimeoutDelayedEventRequestOpts = TimeoutDelay & Partial<ParentDelayId>;
+export type SendActionDelayedEventRequestOpts = ParentDelayId;
+
+export type SendDelayedEventRequestOpts = SendTimeoutDelayedEventRequestOpts | SendActionDelayedEventRequestOpts;
+
+export type SendDelayedEventResponse = {
+    delay_id: string;
+};
+
+export enum UpdateDelayedEventAction {
+    Cancel = "cancel",
+    Restart = "restart",
+    Send = "send",
+}
+
+export type UpdateDelayedEventRequestOpts = SendDelayedEventResponse & {
+    action: UpdateDelayedEventAction;
+};
+
+type DelayedPartialTimelineEvent = {
+    room_id: string;
+    type: string;
+    content: IContent;
+};
+
+type DelayedPartialStateEvent = DelayedPartialTimelineEvent & {
+    state_key: string;
+    transaction_id: string;
+};
+
+type DelayedPartialEvent = DelayedPartialTimelineEvent | DelayedPartialStateEvent;
+
+export type DelayedEventInfo = {
+    delayed_events: DelayedPartialEvent &
+        SendDelayedEventResponse &
+        SendDelayedEventRequestOpts &
+        {
+            running_since: number;
+        }[];
+    next_batch?: string;
+};
+
 export interface IPresenceOpts {
     // One of "online", "offline" or "unavailable"
     presence: "online" | "offline" | "unavailable";

src/@types/search.ts

@@ -54,9 +54,9 @@ enum GroupKey {
 }
 
 export interface IResultRoomEvents {
-    count: number;
-    highlights: string[];
-    results: ISearchResult[];
+    count?: number;
+    highlights?: string[];
+    results?: ISearchResult[];
     state?: { [roomId: string]: IStateEventWithRoomId[] };
     groups?: {
         [groupKey in GroupKey]: {

src/@types/state_events.ts

@@ -15,7 +15,7 @@ limitations under the License.
 */
 
 import { RoomType } from "./event";
-import { GuestAccess, HistoryVisibility, RestrictedAllowType } from "./partials";
+import { GuestAccess, HistoryVisibility, JoinRule, RestrictedAllowType } from "./partials";
 import { ImageInfo } from "./media";
 import { PolicyRecommendation } from "../models/invites-ignorer";
 
@@ -36,6 +36,7 @@ export interface RoomCreateEventContent {
 }
 
 export interface RoomJoinRulesEventContent {
+    join_rule: JoinRule;
     allow?: {
         room_id: string;
         type: RestrictedAllowType;
@@ -94,7 +95,9 @@ export interface RoomTopicEventContent {
 
 export interface RoomAvatarEventContent {
     url?: string;
-    info?: ImageInfo;
+    // The spec says that an encrypted file can be used for the thumbnail but this isn't true
+    // https://github.com/matrix-org/matrix-spec/issues/562 so omit those fields
+    info?: Omit<ImageInfo, "thumbnail_file">;
 }
 
 export interface RoomPinnedEventsEventContent {

src/autodiscovery.ts

@@ -43,8 +43,6 @@ export enum AutoDiscoveryError {
     InvalidJson = "Invalid JSON",
     UnsupportedHomeserverSpecVersion = "The homeserver does not meet the version requirements",
 
-    /** @deprecated Replaced by `UnsupportedHomeserverSpecVersion` */
-    HomeserverTooOld = UnsupportedHomeserverSpecVersion,
     // TODO: Implement when Sydent supports the `/versions` endpoint - https://github.com/matrix-org/sydent/issues/424
     //IdentityServerTooOld = "The identity server does not meet the minimum version requirements",
 }
@@ -91,9 +89,6 @@ export class AutoDiscovery {
     public static readonly ERROR_UNSUPPORTED_HOMESERVER_SPEC_VERSION =
         AutoDiscoveryError.UnsupportedHomeserverSpecVersion;
 
-    /** @deprecated Replaced by ERROR_UNSUPPORTED_HOMESERVER_SPEC_VERSION */
-    public static readonly ERROR_HOMESERVER_TOO_OLD = AutoDiscovery.ERROR_UNSUPPORTED_HOMESERVER_SPEC_VERSION;
-
     public static readonly ALL_ERRORS = Object.keys(AutoDiscoveryError) as AutoDiscoveryError[];
 
     /**

src/base64.ts

@@ -59,7 +59,7 @@ export function encodeUnpaddedBase64(uint8Array: ArrayBuffer | Uint8Array): stri
  * @returns The unpadded base64.
  */
 export function encodeUnpaddedBase64Url(uint8Array: ArrayBuffer | Uint8Array): string {
-    return encodeUnpaddedBase64(uint8Array).replace("+", "-").replace("/", "_");
+    return encodeUnpaddedBase64(uint8Array).replace(/\+/g, "-").replace(/\//g, "_");
 }
 
 /**
@@ -75,7 +75,7 @@ export function decodeBase64(base64: string): Uint8Array {
         const itFunc = function* (): Generator<number> {
             const decoded = atob(
                 // built-in atob doesn't support base64url: convert so we support either
-                base64.replace("-", "+").replace("_", "/"),
+                base64.replace(/-/g, "+").replace(/_/g, "/"),
             );
             for (let i = 0; i < decoded.length; ++i) {
                 yield decoded.charCodeAt(i);

src/client.ts

@@ -47,7 +47,7 @@ import { Direction, EventTimeline } from "./models/event-timeline";
 import { IActionsObject, PushProcessor } from "./pushprocessor";
 import { AutoDiscovery, AutoDiscoveryAction } from "./autodiscovery";
 import * as olmlib from "./crypto/olmlib";
-import { decodeBase64, encodeBase64 } from "./base64";
+import { decodeBase64, encodeBase64, encodeUnpaddedBase64Url } from "./base64";
 import { IExportedDevice as IExportedOlmDevice } from "./crypto/OlmDevice";
 import { IOlmDevice } from "./crypto/algorithms/megolm";
 import { TypedReEmitter } from "./ReEmitter";
@@ -114,6 +114,7 @@ import { NotificationCountType, Room, RoomEvent, RoomEventHandlerMap, RoomNameSt
 import { RoomMemberEvent, RoomMemberEventHandlerMap } from "./models/room-member";
 import { IPowerLevelsContent, RoomStateEvent, RoomStateEventHandlerMap } from "./models/room-state";
 import {
+    DelayedEventInfo,
     IAddThreePidOnlyBody,
     IBindThreePidBody,
     IContextResponse,
@@ -134,6 +135,9 @@ import {
     IStatusResponse,
     ITagsResponse,
     KnockRoomOpts,
+    SendDelayedEventRequestOpts,
+    SendDelayedEventResponse,
+    UpdateDelayedEventAction,
 } from "./@types/requests";
 import {
     EventType,
@@ -226,6 +230,8 @@ import { getRelationsThreadFilter } from "./thread-utils";
 import { KnownMembership, Membership } from "./@types/membership";
 import { RoomMessageEventContent, StickerEventContent } from "./@types/events";
 import { ImageInfo } from "./@types/media";
+import { Capabilities, ServerCapabilities } from "./serverCapabilities";
+import { sha256 } from "./digest";
 
 export type Store = IStore;
 
@@ -233,7 +239,6 @@ export type ResetTimelineCallback = (roomId: string) => boolean;
 
 const SCROLLBACK_DELAY_MS = 3000;
 export const CRYPTO_ENABLED: boolean = isCryptoAvailable();
-const CAPABILITIES_CACHE_MS = 21600000; // 6 hours - an arbitrary value
 const TURN_CHECK_INTERVAL = 10 * 60 * 1000; // poll for turn credentials every 10 minutes
 
 export const UNSTABLE_MSC3852_LAST_SEEN_UA = new UnstableValue(
@@ -324,10 +329,13 @@ export interface ICreateClientOpts {
     localTimeoutMs?: number;
 
     /**
-     * Set to true to use
-     * Authorization header instead of query param to send the access token to the server.
+     * Set to false to send the access token to the server via a query parameter rather
+     * than the Authorization HTTP header.
      *
-     * Default false.
+     * Note that as of v1.11 of the Matrix spec, sending the access token via a query
+     * is deprecated.
+     *
+     * Default true.
      */
     useAuthorizationHeader?: boolean;
 
@@ -357,14 +365,14 @@ export interface ICreateClientOpts {
     deviceToImport?: IExportedDevice;
 
     /**
-     * Encryption key used for encrypting sensitive data (such as e2ee keys) in storage.
+     * Encryption key used for encrypting sensitive data (such as e2ee keys) in {@link ICreateClientOpts#cryptoStore}.
      *
      * This must be set to the same value every time the client is initialised for the same device.
      *
-     * If unset, either a hardcoded key or no encryption at all is used, depending on the Crypto implementation.
-     *
-     * No particular requirement is placed on the key data (it is fed into an HKDF to generate the actual encryption
-     * keys).
+     * This is only used for the legacy crypto implementation (as used by {@link MatrixClient#initCrypto}),
+     * but if you use the rust crypto implementation ({@link MatrixClient#initRustCrypto}) and the device
+     * previously used legacy crypto (so must be migrated), then this must still be provided, so that the
+     * data can be migrated from the legacy store.
      */
     pickleKey?: string;
 
@@ -518,26 +526,6 @@ export interface IStartClientOpts {
 
 export interface IStoredClientOpts extends IStartClientOpts {}
 
-export enum RoomVersionStability {
-    Stable = "stable",
-    Unstable = "unstable",
-}
-
-export interface IRoomVersionsCapability {
-    default: string;
-    available: Record<string, RoomVersionStability>;
-}
-
-export interface ICapability {
-    enabled: boolean;
-}
-
-export interface IChangePasswordCapability extends ICapability {}
-
-export interface IThreadsCapability extends ICapability {}
-
-export interface IGetLoginTokenCapability extends ICapability {}
-
 export const GET_LOGIN_TOKEN_CAPABILITY = new NamespacedValue(
     "m.get_login_token",
     "org.matrix.msc3882.get_login_token",
@@ -547,21 +535,7 @@ export const UNSTABLE_MSC2666_SHARED_ROOMS = "uk.half-shot.msc2666";
 export const UNSTABLE_MSC2666_MUTUAL_ROOMS = "uk.half-shot.msc2666.mutual_rooms";
 export const UNSTABLE_MSC2666_QUERY_MUTUAL_ROOMS = "uk.half-shot.msc2666.query_mutual_rooms";
 
-/**
- * A representation of the capabilities advertised by a homeserver as defined by
- * [Capabilities negotiation](https://spec.matrix.org/v1.6/client-server-api/#get_matrixclientv3capabilities).
- */
-export interface Capabilities {
-    [key: string]: any;
-    "m.change_password"?: IChangePasswordCapability;
-    "m.room_versions"?: IRoomVersionsCapability;
-    "io.element.thread"?: IThreadsCapability;
-    "m.get_login_token"?: IGetLoginTokenCapability;
-    "org.matrix.msc3882.get_login_token"?: IGetLoginTokenCapability;
-}
-
-/** @deprecated prefer {@link CrossSigningKeyInfo}. */
-export type ICrossSigningKey = CrossSigningKeyInfo;
+export const UNSTABLE_MSC4140_DELAYED_EVENTS = "org.matrix.msc4140";
 
 enum CrossSigningKeyType {
     MasterKey = "master_key",
@@ -569,7 +543,7 @@ enum CrossSigningKeyType {
     UserSigningKey = "user_signing_key",
 }
 
-export type CrossSigningKeys = Record<CrossSigningKeyType, ICrossSigningKey>;
+export type CrossSigningKeys = Record<CrossSigningKeyType, CrossSigningKeyInfo>;
 
 export type SendToDeviceContentMap = Map<string, Map<string, Record<string, any>>>;
 
@@ -581,7 +555,7 @@ export interface ISignedKey {
     device_id: string;
 }
 
-export type KeySignatures = Record<string, Record<string, ICrossSigningKey | ISignedKey>>;
+export type KeySignatures = Record<string, Record<string, CrossSigningKeyInfo | ISignedKey>>;
 export interface IUploadKeySignaturesResponse {
     failures: Record<
         string,
@@ -1111,7 +1085,7 @@ export type ClientEventHandlerMap = {
      * });
      * ```
      */
-    [ClientEvent.Sync]: (state: SyncState, lastState: SyncState | null, data?: ISyncStateData) => void;
+    [ClientEvent.Sync]: (state: SyncState, prevState: SyncState | null, data?: ISyncStateData) => void;
     /**
      * Fires whenever the SDK receives a new event.
      * <p>
@@ -1296,10 +1270,6 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     // TODO: This should expire: https://github.com/matrix-org/matrix-js-sdk/issues/1020
     protected serverVersionsPromise?: Promise<IServerVersions>;
 
-    public cachedCapabilities?: {
-        capabilities: Capabilities;
-        expiration: number;
-    };
     protected clientWellKnown?: IClientWellKnown;
     protected clientWellKnownPromise?: Promise<IClientWellKnown>;
     protected turnServers: ITurnServer[] = [];
@@ -1328,6 +1298,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
 
     public readonly matrixRTC: MatrixRTCSessionManager;
 
+    private serverCapabilitiesService: ServerCapabilities;
+
     public constructor(opts: IMatrixClientCreateOpts) {
         super();
 
@@ -1421,6 +1393,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         // the underlying session management and doesn't use any actual media capabilities
         this.matrixRTC = new MatrixRTCSessionManager(this);
 
+        this.serverCapabilitiesService = new ServerCapabilities(this.http);
+
         this.on(ClientEvent.Sync, this.fixupRoomNotifications);
 
         this.timelineSupport = Boolean(opts.timelineSupport);
@@ -1483,13 +1457,6 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
 
         this.on(ClientEvent.Sync, this.startMatrixRTC);
 
-        // backwards compat for when 'opts' was 'historyLen'.
-        if (typeof opts === "number") {
-            opts = {
-                initialSyncLimit: opts,
-            };
-        }
-
         // Create our own user object artificially (instead of waiting for sync)
         // so it's always available, even if the user is not in any rooms etc.
         const userId = this.getUserId();
@@ -1550,6 +1517,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         }
 
         this.toDeviceMessageQueue.start();
+        this.serverCapabilitiesService.start();
     }
 
     /**
@@ -1603,6 +1571,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         this.toDeviceMessageQueue.stop();
 
         this.matrixRTC.stop();
+
+        this.serverCapabilitiesService.stop();
     }
 
     /**
@@ -2105,47 +2075,35 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     }
 
     /**
-     * Gets the capabilities of the homeserver. Always returns an object of
-     * capability keys and their options, which may be empty.
-     * @param fresh - True to ignore any cached values.
-     * @returns Promise which resolves to the capabilities of the homeserver
-     * @returns Rejects: with an error response.
+     * Gets the cached capabilities of the homeserver, returning cached ones if available.
+     * If there are no cached capabilities and none can be fetched, throw an exception.
+     *
+     * @returns Promise resolving with The capabilities of the homeserver
      */
-    public getCapabilities(fresh = false): Promise<Capabilities> {
-        const now = new Date().getTime();
+    public async getCapabilities(): Promise<Capabilities> {
+        const caps = this.serverCapabilitiesService.getCachedCapabilities();
+        if (caps) return caps;
+        return this.serverCapabilitiesService.fetchCapabilities();
+    }
 
-        if (this.cachedCapabilities && !fresh) {
-            if (now < this.cachedCapabilities.expiration) {
-                this.logger.debug("Returning cached capabilities");
-                return Promise.resolve(this.cachedCapabilities.capabilities);
-            }
-        }
+    /**
+     * Gets the cached capabilities of the homeserver. If none have been fetched yet,
+     * return undefined.
+     *
+     * @returns The capabilities of the homeserver
+     */
+    public getCachedCapabilities(): Capabilities | undefined {
+        return this.serverCapabilitiesService.getCachedCapabilities();
+    }
 
-        type Response = {
-            capabilities?: Capabilities;
-        };
-        return this.http
-            .authedRequest<Response>(Method.Get, "/capabilities")
-            .catch((e: Error): Response => {
-                // We swallow errors because we need a default object anyhow
-                this.logger.error(e);
-                return {};
-            })
-            .then((r = {}) => {
-                const capabilities = r["capabilities"] || {};
-
-                // If the capabilities missed the cache, cache it for a shorter amount
-                // of time to try and refresh them later.
-                const cacheMs = Object.keys(capabilities).length ? CAPABILITIES_CACHE_MS : 60000 + Math.random() * 5000;
-
-                this.cachedCapabilities = {
-                    capabilities,
-                    expiration: now + cacheMs,
-                };
-
-                this.logger.debug("Caching capabilities: ", capabilities);
-                return capabilities;
-            });
+    /**
+     * Fetches the latest capabilities from the homeserver, ignoring any cached
+     * versions. The newly returned version is cached.
+     *
+     * @returns A promise which resolves to the capabilities of the homeserver
+     */
+    public fetchCapabilities(): Promise<Capabilities> {
+        return this.serverCapabilitiesService.fetchCapabilities();
     }
 
     /**
@@ -2232,17 +2190,24 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      *
      * An alternative to {@link initCrypto}.
      *
-     * *WARNING*: this API is very experimental, should not be used in production, and may change without notice!
-     *    Eventually it will be deprecated and `initCrypto` will do the same thing.
-     *
-     * @experimental
-     *
-     * @param useIndexedDB - True to use an indexeddb store, false to use an in-memory store. Defaults to 'true'.
+     * @param args.useIndexedDB - True to use an indexeddb store, false to use an in-memory store. Defaults to 'true'.
+     * @param args.storageKey - A key with which to encrypt the indexeddb store. If provided, it must be exactly
+     *    32 bytes of data, and must be the same each time the client is initialised for a given device.
+     *    If both this and `storagePassword` are unspecified, the store will be unencrypted.
+     * @param args.storagePassword - An alternative to `storageKey`. A password which will be used to derive a key to
+     *    encrypt the store with. Deriving a key from a password is (deliberately) a slow operation, so prefer
+     *    to pass a `storageKey` directly where possible.
      *
      * @returns a Promise which will resolve when the crypto layer has been
      *    successfully initialised.
      */
-    public async initRustCrypto({ useIndexedDB = true }: { useIndexedDB?: boolean } = {}): Promise<void> {
+    public async initRustCrypto(
+        args: {
+            useIndexedDB?: boolean;
+            storageKey?: Uint8Array;
+            storagePassword?: string;
+        } = {},
+    ): Promise<void> {
         if (this.cryptoBackend) {
             this.logger.warn("Attempt to re-initialise e2e encryption on MatrixClient");
             return;
@@ -2275,11 +2240,13 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             deviceId: deviceId,
             secretStorage: this.secretStorage,
             cryptoCallbacks: this.cryptoCallbacks,
-            storePrefix: useIndexedDB ? RUST_SDK_STORE_PREFIX : null,
-            storePassphrase: this.pickleKey,
+            storePrefix: args.useIndexedDB === false ? null : RUST_SDK_STORE_PREFIX,
+            storeKey: args.storageKey,
+            storePassphrase: args.storagePassword,
+
             legacyCryptoStore: this.cryptoStore,
             legacyPickleKey: this.pickleKey ?? "DEFAULT_KEY",
-            legacyMigrationProgressListener: (progress, total) => {
+            legacyMigrationProgressListener: (progress: number, total: number): void => {
                 this.emit(CryptoEvent.LegacyCryptoStoreMigrationProgress, progress, total);
             },
         });
@@ -2898,7 +2865,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      *
      * @param event - event to be checked
      * @returns The event information.
-     * @deprecated Prefer {@link CryptoApi.getEncryptionInfoForEvent | `CryptoApi.getEncryptionInfoForEvent`}.
+     * @deprecated Prefer {@link Crypto.CryptoApi.getEncryptionInfoForEvent | `CryptoApi.getEncryptionInfoForEvent`}.
      */
     public getEventEncryptionInfo(event: MatrixEvent): IEncryptedEventInfo {
         if (!this.cryptoBackend) {
@@ -3316,7 +3283,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      *     trust information (as returned by isKeyBackupTrusted)
      *     in trustInfo.
      *
-     * @deprecated Prefer {@link CryptoApi.checkKeyBackupAndEnable}.
+     * @deprecated Prefer {@link Crypto.CryptoApi.checkKeyBackupAndEnable}.
      */
     public checkKeyBackup(): Promise<IKeyBackupCheck | null> {
         if (!this.crypto) {
@@ -3373,7 +3340,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      *     the server, otherwise false. If we haven't completed a successful check
      *     of key backup status yet, returns null.
      *
-     * @deprecated Prefer direct access to {@link CryptoApi.getActiveSessionBackupVersion}:
+     * @deprecated Prefer direct access to {@link Crypto.CryptoApi.getActiveSessionBackupVersion}:
      *
      * ```javascript
      * let enabled = (await client.getCrypto().getActiveSessionBackupVersion()) !== null;
@@ -3393,7 +3360,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @param info - Backup information object as returned by getKeyBackupVersion
      * @returns Promise which resolves when complete.
      *
-     * @deprecated Do not call this directly. Instead call {@link CryptoApi.checkKeyBackupAndEnable}.
+     * @deprecated Do not call this directly. Instead call {@link Crypto.CryptoApi.checkKeyBackupAndEnable}.
      */
     public enableKeyBackup(info: IKeyBackupInfo): Promise<void> {
         if (!this.crypto) {
@@ -3855,12 +3822,13 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         if (!backupInfo.version) {
             throw new Error("Backup version must be defined");
         }
+        const backupVersion = backupInfo.version!;
 
         let totalKeyCount = 0;
         let totalFailures = 0;
         let totalImported = 0;
 
-        const path = this.makeKeyBackupPath(targetRoomId, targetSessionId, backupInfo.version);
+        const path = this.makeKeyBackupPath(targetRoomId, targetSessionId, backupVersion);
 
         const backupDecryptor = await this.cryptoBackend.getBackupDecryptor(backupInfo, privKey);
 
@@ -3874,7 +3842,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             // Cache the key, if possible.
             // This is async.
             this.cryptoBackend
-                .storeSessionBackupPrivateKey(privKey, backupInfo.version)
+                .storeSessionBackupPrivateKey(privKey, backupVersion)
                 .catch((e) => {
                     this.logger.warn("Error caching session backup key:", e);
                 })
@@ -3914,7 +3882,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
                     async (chunk) => {
                         // We have a chunk of decrypted keys: import them
                         try {
-                            await this.cryptoBackend!.importBackedUpRoomKeys(chunk, {
+                            const backupVersion = backupInfo.version!;
+                            await this.cryptoBackend!.importBackedUpRoomKeys(chunk, backupVersion, {
                                 untrusted,
                             });
                             totalImported += chunk.length;
@@ -3944,7 +3913,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
                 for (const k of keys) {
                     k.room_id = targetRoomId!;
                 }
-                await this.cryptoBackend.importBackedUpRoomKeys(keys, {
+                await this.cryptoBackend.importBackedUpRoomKeys(keys, backupVersion, {
                     progressCallback,
                     untrusted,
                 });
@@ -3958,7 +3927,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
                     key.room_id = targetRoomId!;
                     key.session_id = targetSessionId!;
 
-                    await this.cryptoBackend.importBackedUpRoomKeys([key], {
+                    await this.cryptoBackend.importBackedUpRoomKeys([key], backupVersion, {
                         progressCallback,
                         untrusted,
                     });
@@ -4316,9 +4285,13 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             signPromise = this.http.requestOtherUrl<IThirdPartySigned>(Method.Post, url);
         }
 
-        const queryString: Record<string, string | string[]> = {};
+        let queryParams: QueryDict = {};
         if (opts.viaServers) {
-            queryString["server_name"] = opts.viaServers;
+            queryParams.server_name = opts.viaServers;
+            queryParams.via = opts.viaServers;
+            if (this.canSupport.get(Feature.MigrateServerNameToVia) === ServerSupport.Unstable) {
+                queryParams = replaceParam("via", "org.matrix.msc4156.via", queryParams);
+            }
         }
 
         const data: IJoinRequestBody = {};
@@ -4328,7 +4301,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         }
 
         const path = utils.encodeUri("/join/$roomid", { $roomid: roomIdOrAlias });
-        const res = await this.http.authedRequest<{ room_id: string }>(Method.Post, path, queryString, data);
+        const res = await this.http.authedRequest<{ room_id: string }>(Method.Post, path, queryParams, data);
 
         const roomId = res.room_id;
         // In case we were originally given an alias, check the room cache again
@@ -4361,9 +4334,13 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
 
         const path = utils.encodeUri("/knock/$roomIdOrAlias", { $roomIdOrAlias: roomIdOrAlias });
 
-        const queryParams: Record<string, string | string[]> = {};
+        let queryParams: QueryDict = {};
         if (opts.viaServers) {
             queryParams.server_name = opts.viaServers;
+            queryParams.via = opts.viaServers;
+            if (this.canSupport.get(Feature.MigrateServerNameToVia) === ServerSupport.Unstable) {
+                queryParams = replaceParam("via", "org.matrix.msc4156.via", queryParams);
+            }
         }
 
         const body: Record<string, string> = {};
@@ -4603,12 +4580,19 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             threadId = threadIdOrEventType;
         }
 
-        // If we expect that an event is part of a thread but is missing the relation
-        // we need to add it manually, as well as the reply fallback
-        if (threadId && !content!["m.relates_to"]?.rel_type) {
-            const isReply = !!content!["m.relates_to"]?.["m.in_reply_to"];
-            content!["m.relates_to"] = {
-                ...content!["m.relates_to"],
+        this.addThreadRelationIfNeeded(content, threadId, roomId);
+        return this.sendCompleteEvent(roomId, threadId, { type: eventType, content }, txnId);
+    }
+
+    /**
+     * If we expect that an event is part of a thread but is missing the relation
+     * we need to add it manually, as well as the reply fallback
+     */
+    private addThreadRelationIfNeeded(content: IContent, threadId: string | null, roomId: string): void {
+        if (threadId && !content["m.relates_to"]?.rel_type) {
+            const isReply = !!content["m.relates_to"]?.["m.in_reply_to"];
+            content["m.relates_to"] = {
+                ...content["m.relates_to"],
                 rel_type: THREAD_RELATION_TYPE.name,
                 event_id: threadId,
                 // Set is_falling_back to true unless this is actually intended to be a reply
@@ -4616,7 +4600,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             };
             const thread = this.getRoom(roomId)?.getThread(threadId);
             if (thread && !isReply) {
-                content!["m.relates_to"]["m.in_reply_to"] = {
+                content["m.relates_to"]["m.in_reply_to"] = {
                     event_id:
                         thread
                             .lastReply((ev: MatrixEvent) => {
@@ -4626,8 +4610,6 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
                 };
             }
         }
-
-        return this.sendCompleteEvent(roomId, threadId, { type: eventType, content }, txnId);
     }
 
     /**
@@ -4641,7 +4623,38 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         threadId: string | null,
         eventObject: Partial<IEvent>,
         txnId?: string,
-    ): Promise<ISendEventResponse> {
+    ): Promise<ISendEventResponse>;
+    /**
+     * Sends a delayed event (MSC4140).
+     * @param eventObject - An object with the partial structure of an event, to which event_id, user_id, room_id and origin_server_ts will be added.
+     * @param delayOpts - Properties of the delay for this event.
+     * @param txnId - Optional.
+     * @returns Promise which resolves: to an empty object `{}`
+     * @returns Rejects: with an error response.
+     */
+    private sendCompleteEvent(
+        roomId: string,
+        threadId: string | null,
+        eventObject: Partial<IEvent>,
+        delayOpts: SendDelayedEventRequestOpts,
+        txnId?: string,
+    ): Promise<SendDelayedEventResponse>;
+    private sendCompleteEvent(
+        roomId: string,
+        threadId: string | null,
+        eventObject: Partial<IEvent>,
+        delayOptsOrTxnId?: SendDelayedEventRequestOpts | string,
+        txnIdOrVoid?: string,
+    ): Promise<ISendEventResponse | SendDelayedEventResponse> {
+        let delayOpts: SendDelayedEventRequestOpts | undefined;
+        let txnId: string | undefined;
+        if (typeof delayOptsOrTxnId === "string") {
+            txnId = delayOptsOrTxnId;
+        } else {
+            delayOpts = delayOptsOrTxnId;
+            txnId = txnIdOrVoid;
+        }
+
         if (!txnId) {
             txnId = this.makeTxnId();
         }
@@ -4664,9 +4677,11 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             localEvent.setThread(thread);
         }
 
-        // set up re-emitter for this new event - this is normally the job of EventMapper but we don't use it here
-        this.reEmitter.reEmit(localEvent, [MatrixEventEvent.Replaced, MatrixEventEvent.VisibilityChange]);
-        room?.reEmitter.reEmit(localEvent, [MatrixEventEvent.BeforeRedaction]);
+        if (!delayOpts) {
+            // set up re-emitter for this new event - this is normally the job of EventMapper but we don't use it here
+            this.reEmitter.reEmit(localEvent, [MatrixEventEvent.Replaced, MatrixEventEvent.VisibilityChange]);
+            room?.reEmitter.reEmit(localEvent, [MatrixEventEvent.BeforeRedaction]);
+        }
 
         // if this is a relation or redaction of an event
         // that hasn't been sent yet (e.g. with a local id starting with a ~)
@@ -4681,29 +4696,56 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         }
 
         const type = localEvent.getType();
-        this.logger.debug(`sendEvent of type ${type} in ${roomId} with txnId ${txnId}`);
+        this.logger.debug(
+            `sendEvent of type ${type} in ${roomId} with txnId ${txnId}${delayOpts ? " (delayed event)" : ""}`,
+        );
 
         localEvent.setTxnId(txnId);
         localEvent.setStatus(EventStatus.SENDING);
 
-        // add this event immediately to the local store as 'sending'.
-        room?.addPendingEvent(localEvent, txnId);
+        // TODO: separate store for delayed events?
+        if (!delayOpts) {
+            // add this event immediately to the local store as 'sending'.
+            room?.addPendingEvent(localEvent, txnId);
 
-        // addPendingEvent can change the state to NOT_SENT if it believes
-        // that there's other events that have failed. We won't bother to
-        // try sending the event if the state has changed as such.
-        if (localEvent.status === EventStatus.NOT_SENT) {
-            return Promise.reject(new Error("Event blocked by other events not yet sent"));
+            // addPendingEvent can change the state to NOT_SENT if it believes
+            // that there's other events that have failed. We won't bother to
+            // try sending the event if the state has changed as such.
+            if (localEvent.status === EventStatus.NOT_SENT) {
+                return Promise.reject(new Error("Event blocked by other events not yet sent"));
+            }
+
+            return this.encryptAndSendEvent(room, localEvent);
+        } else {
+            return this.encryptAndSendEvent(room, localEvent, delayOpts);
         }
-
-        return this.encryptAndSendEvent(room, localEvent);
     }
 
     /**
      * encrypts the event if necessary; adds the event to the queue, or sends it; marks the event as sent/unsent
      * @returns returns a promise which resolves with the result of the send request
      */
-    protected async encryptAndSendEvent(room: Room | null, event: MatrixEvent): Promise<ISendEventResponse> {
+    protected async encryptAndSendEvent(room: Room | null, event: MatrixEvent): Promise<ISendEventResponse>;
+    /**
+     * Simply sends a delayed event without encrypting it.
+     * TODO: Allow encrypted delayed events, and encrypt them properly
+     * @param delayOpts - Properties of the delay for this event.
+     * @returns returns a promise which resolves with the result of the delayed send request
+     */
+    protected async encryptAndSendEvent(
+        room: Room | null,
+        event: MatrixEvent,
+        delayOpts: SendDelayedEventRequestOpts,
+    ): Promise<SendDelayedEventResponse>;
+    protected async encryptAndSendEvent(
+        room: Room | null,
+        event: MatrixEvent,
+        delayOpts?: SendDelayedEventRequestOpts,
+    ): Promise<ISendEventResponse | SendDelayedEventResponse> {
+        if (delayOpts) {
+            return this.sendEventHttpRequest(event, delayOpts);
+        }
+
         try {
             let cancelled: boolean;
             this.eventsBeingEncrypted.add(event.getId()!);
@@ -4854,7 +4896,15 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         }
     }
 
-    private sendEventHttpRequest(event: MatrixEvent): Promise<ISendEventResponse> {
+    private sendEventHttpRequest(event: MatrixEvent): Promise<ISendEventResponse>;
+    private sendEventHttpRequest(
+        event: MatrixEvent,
+        delayOpts: SendDelayedEventRequestOpts,
+    ): Promise<SendDelayedEventResponse>;
+    private sendEventHttpRequest(
+        event: MatrixEvent,
+        delayOpts?: SendDelayedEventRequestOpts,
+    ): Promise<ISendEventResponse | SendDelayedEventResponse> {
         let txnId = event.getTxnId();
         if (!txnId) {
             txnId = this.makeTxnId();
@@ -4876,22 +4926,30 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
                 pathTemplate = "/rooms/$roomId/state/$eventType/$stateKey";
             }
             path = utils.encodeUri(pathTemplate, pathParams);
-        } else if (event.isRedaction()) {
+        } else if (event.isRedaction() && event.event.redacts) {
             const pathTemplate = `/rooms/$roomId/redact/$redactsEventId/$txnId`;
             path = utils.encodeUri(pathTemplate, {
-                $redactsEventId: event.event.redacts!,
+                $redactsEventId: event.event.redacts,
                 ...pathParams,
             });
         } else {
             path = utils.encodeUri("/rooms/$roomId/send/$eventType/$txnId", pathParams);
         }
 
-        return this.http
-            .authedRequest<ISendEventResponse>(Method.Put, path, undefined, event.getWireContent())
-            .then((res) => {
+        const content = event.getWireContent();
+        if (!delayOpts) {
+            return this.http.authedRequest<ISendEventResponse>(Method.Put, path, undefined, content).then((res) => {
                 this.logger.debug(`Event sent to ${event.getRoomId()} with event id ${res.event_id}`);
                 return res;
             });
+        } else {
+            return this.http.authedRequest<SendDelayedEventResponse>(
+                Method.Put,
+                path,
+                getUnstableDelayQueryOpts(delayOpts),
+                content,
+            );
+        }
     }
 
     /**
@@ -5221,6 +5279,101 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         return this.sendMessage(roomId, threadId, content);
     }
 
+    /**
+     * Send a delayed timeline event.
+     *
+     * Note: This endpoint is unstable, and can throw an `Error`.
+     *   Check progress on [MSC4140](https://github.com/matrix-org/matrix-spec-proposals/pull/4140) for more details.
+     */
+    // eslint-disable-next-line
+    public async _unstable_sendDelayedEvent<K extends keyof TimelineEvents>(
+        roomId: string,
+        delayOpts: SendDelayedEventRequestOpts,
+        threadId: string | null,
+        eventType: K,
+        content: TimelineEvents[K],
+        txnId?: string,
+    ): Promise<SendDelayedEventResponse> {
+        if (!(await this.doesServerSupportUnstableFeature(UNSTABLE_MSC4140_DELAYED_EVENTS))) {
+            throw Error("Server does not support the delayed events API");
+        }
+
+        this.addThreadRelationIfNeeded(content, threadId, roomId);
+        return this.sendCompleteEvent(roomId, threadId, { type: eventType, content }, delayOpts, txnId);
+    }
+
+    /**
+     * Send a delayed state event.
+     *
+     * Note: This endpoint is unstable, and can throw an `Error`.
+     *   Check progress on [MSC4140](https://github.com/matrix-org/matrix-spec-proposals/pull/4140) for more details.
+     */
+    // eslint-disable-next-line
+    public async _unstable_sendDelayedStateEvent<K extends keyof StateEvents>(
+        roomId: string,
+        delayOpts: SendDelayedEventRequestOpts,
+        eventType: K,
+        content: StateEvents[K],
+        stateKey = "",
+        opts: IRequestOpts = {},
+    ): Promise<SendDelayedEventResponse> {
+        if (!(await this.doesServerSupportUnstableFeature(UNSTABLE_MSC4140_DELAYED_EVENTS))) {
+            throw Error("Server does not support the delayed events API");
+        }
+
+        const pathParams = {
+            $roomId: roomId,
+            $eventType: eventType,
+            $stateKey: stateKey,
+        };
+        let path = utils.encodeUri("/rooms/$roomId/state/$eventType", pathParams);
+        if (stateKey !== undefined) {
+            path = utils.encodeUri(path + "/$stateKey", pathParams);
+        }
+        return this.http.authedRequest(Method.Put, path, getUnstableDelayQueryOpts(delayOpts), content as Body, opts);
+    }
+
+    /**
+     * Get all pending delayed events for the calling user.
+     *
+     * Note: This endpoint is unstable, and can throw an `Error`.
+     *   Check progress on [MSC4140](https://github.com/matrix-org/matrix-spec-proposals/pull/4140) for more details.
+     */
+    // eslint-disable-next-line
+    public async _unstable_getDelayedEvents(fromToken?: string): Promise<DelayedEventInfo> {
+        if (!(await this.doesServerSupportUnstableFeature(UNSTABLE_MSC4140_DELAYED_EVENTS))) {
+            throw Error("Server does not support the delayed events API");
+        }
+
+        const queryDict = fromToken ? { from: fromToken } : undefined;
+        return await this.http.authedRequest(Method.Get, "/delayed_events", queryDict, undefined, {
+            prefix: `${ClientPrefix.Unstable}/${UNSTABLE_MSC4140_DELAYED_EVENTS}`,
+        });
+    }
+
+    /**
+     * Manage a delayed event associated with the given delay_id.
+     *
+     * Note: This endpoint is unstable, and can throw an `Error`.
+     *   Check progress on [MSC4140](https://github.com/matrix-org/matrix-spec-proposals/pull/4140) for more details.
+     */
+    // eslint-disable-next-line
+    public async _unstable_updateDelayedEvent(delayId: string, action: UpdateDelayedEventAction): Promise<{}> {
+        if (!(await this.doesServerSupportUnstableFeature(UNSTABLE_MSC4140_DELAYED_EVENTS))) {
+            throw Error("Server does not support the delayed events API");
+        }
+
+        const path = utils.encodeUri("/delayed_events/$delayId", {
+            $delayId: delayId,
+        });
+        const data = {
+            action,
+        };
+        return await this.http.authedRequest(Method.Post, path, undefined, data, {
+            prefix: `${ClientPrefix.Unstable}/${UNSTABLE_MSC4140_DELAYED_EVENTS}`,
+        });
+    }
+
     /**
      * Send a receipt.
      * @param event - The event being acknowledged
@@ -5775,7 +5928,12 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * anyone they share a room with. If false, will return null for such URLs.
      * @param allowRedirects - If true, the caller supports the URL being 307 or
      * 308 redirected to another resource upon request. If false, redirects
-     * are not expected.
+     * are not expected. Implied `true` when `useAuthentication` is `true`.
+     * @param useAuthentication - If true, the caller supports authenticated
+     * media and wants an authentication-required URL. Note that server support
+     * for authenticated media will *not* be checked - it is the caller's responsibility
+     * to do so before calling this function. Note also that `useAuthentication`
+     * implies `allowRedirects`. Defaults to false (unauthenticated endpoints).
      * @returns the avatar URL or null.
      */
     public mxcUrlToHttp(
@@ -5785,8 +5943,18 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         resizeMethod?: string,
         allowDirectLinks?: boolean,
         allowRedirects?: boolean,
+        useAuthentication?: boolean,
     ): string | null {
-        return getHttpUriForMxc(this.baseUrl, mxcUrl, width, height, resizeMethod, allowDirectLinks, allowRedirects);
+        return getHttpUriForMxc(
+            this.baseUrl,
+            mxcUrl,
+            width,
+            height,
+            resizeMethod,
+            allowDirectLinks,
+            allowRedirects,
+            useAuthentication,
+        );
     }
 
     /**
@@ -6621,13 +6789,14 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * Peek into a room and receive updates about the room. This only works if the
      * history visibility for the room is world_readable.
      * @param roomId - The room to attempt to peek into.
+     * @param limit - The number of timeline events to initially retrieve.
      * @returns Promise which resolves: Room object
      * @returns Rejects: with an error response.
      */
-    public peekInRoom(roomId: string): Promise<Room> {
+    public peekInRoom(roomId: string, limit: number = 20): Promise<Room> {
         this.peekSync?.stopPeeking();
         this.peekSync = new SyncApi(this, this.clientOpts, this.buildSyncApiOptions());
-        return this.peekSync.peek(roomId);
+        return this.peekSync.peek(roomId, limit);
     }
 
     /**
@@ -7091,7 +7260,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         // append the new results to our existing results
         const resultsLength = roomEvents.results?.length ?? 0;
         for (let i = 0; i < resultsLength; i++) {
-            const sr = SearchResult.fromJson(roomEvents.results[i], mapper);
+            const sr = SearchResult.fromJson(roomEvents.results![i], mapper);
             const room = this.getRoom(sr.context.getEvent().getRoomId());
             if (room) {
                 // Copy over a known event sender if we can
@@ -7426,7 +7595,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         return this.http.authedRequest(Method.Post, path, undefined, undefined, { prefix: "" });
     }
 
-    private async fetchClientWellKnown(): Promise<void> {
+    protected async fetchClientWellKnown(): Promise<void> {
         // `getRawClientConfig` does not throw or reject on network errors, instead
         // it absorbs errors and returns `{}`.
         this.clientWellKnownPromise = AutoDiscovery.getRawClientConfig(this.getDomain() ?? undefined);
@@ -7876,16 +8045,10 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         password: string,
         sessionId: string | null,
         auth: { session?: string; type: string },
-        bindThreepids?: boolean | null | { email?: boolean; msisdn?: boolean },
+        bindThreepids?: { email?: boolean; msisdn?: boolean },
         guestAccessToken?: string,
         inhibitLogin?: boolean,
     ): Promise<RegisterResponse> {
-        // backwards compat
-        if (bindThreepids === true) {
-            bindThreepids = { email: true };
-        } else if (bindThreepids === null || bindThreepids === undefined || bindThreepids === false) {
-            bindThreepids = {};
-        }
         if (sessionId) {
             auth.session = sessionId;
         }
@@ -7900,27 +8063,12 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         if (password !== undefined && password !== null) {
             params.password = password;
         }
-        if (bindThreepids.email) {
-            params.bind_email = true;
-        }
-        if (bindThreepids.msisdn) {
-            params.bind_msisdn = true;
-        }
         if (guestAccessToken !== undefined && guestAccessToken !== null) {
             params.guest_access_token = guestAccessToken;
         }
         if (inhibitLogin !== undefined && inhibitLogin !== null) {
             params.inhibit_login = inhibitLogin;
         }
-        // Temporary parameter added to make the register endpoint advertise
-        // msisdn flows. This exists because there are clients that break
-        // when given stages they don't recognise. This parameter will cease
-        // to be necessary once these old clients are gone.
-        // Only send it if we send any params at all (the password param is
-        // mandatory, so if we send any params, we'll send the password param)
-        if (password !== undefined && password !== null) {
-            params.x_show_msisdn = true;
-        }
 
         return this.registerRequest(params);
     }
@@ -9337,20 +9485,19 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
 
         // When picking an algorithm, we pick the hashed over no hashes
         if (hashes["algorithms"].includes("sha256")) {
-            // Abuse the olm hashing
-            const olmutil = new global.Olm.Utility();
-            params["addresses"] = addressPairs.map((p) => {
-                const addr = p[0].toLowerCase(); // lowercase to get consistent hashes
-                const med = p[1].toLowerCase();
-                const hashed = olmutil
-                    .sha256(`${addr} ${med} ${params["pepper"]}`)
-                    .replace(/\+/g, "-")
-                    .replace(/\//g, "_"); // URL-safe base64
-                // Map the hash to a known (case-sensitive) address. We use the case
-                // sensitive version because the caller might be expecting that.
-                localMapping[hashed] = p[0];
-                return hashed;
-            });
+            params["addresses"] = await Promise.all(
+                addressPairs.map(async (p) => {
+                    const addr = p[0].toLowerCase(); // lowercase to get consistent hashes
+                    const med = p[1].toLowerCase();
+                    const hashBuffer = await sha256(`${addr} ${med} ${params["pepper"]}`);
+                    const hashed = encodeUnpaddedBase64Url(hashBuffer);
+
+                    // Map the hash to a known (case-sensitive) address. We use the case
+                    // sensitive version because the caller might be expecting that.
+                    localMapping[hashed] = p[0];
+                    return hashed;
+                }),
+            );
             params["algorithm"] = "sha256";
         } else if (hashes["algorithms"].includes("none")) {
             params["addresses"] = addressPairs.map((p) => {
@@ -9927,6 +10074,12 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     }
 }
 
+function getUnstableDelayQueryOpts(delayOpts: SendDelayedEventRequestOpts): QueryDict {
+    return Object.fromEntries(
+        Object.entries(delayOpts).map(([k, v]) => [`${UNSTABLE_MSC4140_DELAYED_EVENTS}.${k}`, v]),
+    );
+}
+
 /**
  * recalculates an accurate notifications count on event decryption.
  * Servers do not have enough knowledge about encrypted events to calculate an

src/common-crypto/CryptoBackend.ts

@@ -113,10 +113,11 @@ export interface CryptoBackend extends SyncCryptoCallbacks, CryptoApi {
      * Import a list of room keys restored from backup
      *
      * @param keys - a list of session export objects
+     * @param backupVersion - the version of the backup these keys came from.
      * @param opts - options object
      * @returns a promise which resolves once the keys have been imported
      */
-    importBackedUpRoomKeys(keys: IMegolmSessionData[], opts?: ImportRoomKeysOpts): Promise<void>;
+    importBackedUpRoomKeys(keys: IMegolmSessionData[], backupVersion: string, opts?: ImportRoomKeysOpts): Promise<void>;
 }
 
 /** The methods which crypto implementations should expose to the Sync api

src/content-repo.ts

@@ -30,7 +30,12 @@ import { encodeParams } from "./utils";
  * for such URLs.
  * @param allowRedirects - If true, the caller supports the URL being 307 or
  * 308 redirected to another resource upon request. If false, redirects
- * are not expected.
+ * are not expected. Implied `true` when `useAuthentication` is `true`.
+ * @param useAuthentication - If true, the caller supports authenticated
+ * media and wants an authentication-required URL. Note that server support
+ * for authenticated media will *not* be checked - it is the caller's responsibility
+ * to do so before calling this function. Note also that `useAuthentication`
+ * implies `allowRedirects`. Defaults to false (unauthenticated endpoints).
  * @returns The complete URL to the content.
  */
 export function getHttpUriForMxc(
@@ -41,6 +46,7 @@ export function getHttpUriForMxc(
     resizeMethod?: string,
     allowDirectLinks = false,
     allowRedirects?: boolean,
+    useAuthentication?: boolean,
 ): string {
     if (typeof mxc !== "string" || !mxc) {
         return "";
@@ -52,8 +58,22 @@ export function getHttpUriForMxc(
             return "";
         }
     }
+
+    if (useAuthentication) {
+        allowRedirects = true; // per docs (MSC3916 always expects redirects)
+
+        // Dev note: MSC3916 removes `allow_redirect` entirely, but
+        // for explicitness we set it here. This makes it slightly more obvious to
+        // callers, hopefully.
+    }
+
     let serverAndMediaId = mxc.slice(6); // strips mxc://
-    let prefix = "/_matrix/media/v3/download/";
+    let prefix: string;
+    if (useAuthentication) {
+        prefix = "/_matrix/client/v1/media/download/";
+    } else {
+        prefix = "/_matrix/media/v3/download/";
+    }
     const params: Record<string, string> = {};
 
     if (width) {
@@ -68,7 +88,11 @@ export function getHttpUriForMxc(
     if (Object.keys(params).length > 0) {
         // these are thumbnailing params so they probably want the
         // thumbnailing API...
-        prefix = "/_matrix/media/v3/thumbnail/";
+        if (useAuthentication) {
+            prefix = "/_matrix/client/v1/media/thumbnail/";
+        } else {
+            prefix = "/_matrix/media/v3/thumbnail/";
+        }
     }
 
     if (typeof allowRedirects === "boolean") {

src/crypto-api/index.ts

@@ -14,15 +14,16 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import type { IMegolmSessionData } from "./@types/crypto";
-import { Room } from "./models/room";
-import { DeviceMap } from "./models/device";
-import { UIAuthCallback } from "./interactive-auth";
-import { PassphraseInfo, SecretStorageCallbacks, SecretStorageKeyDescription } from "./secret-storage";
-import { VerificationRequest } from "./crypto-api/verification";
-import { BackupTrustInfo, KeyBackupCheck, KeyBackupInfo } from "./crypto-api/keybackup";
-import { ISignatures } from "./@types/signed";
-import { MatrixEvent } from "./models/event";
+import type { SecretsBundle } from "@matrix-org/matrix-sdk-crypto-wasm";
+import type { IMegolmSessionData } from "../@types/crypto";
+import { Room } from "../models/room";
+import { DeviceMap } from "../models/device";
+import { UIAuthCallback } from "../interactive-auth";
+import { PassphraseInfo, SecretStorageCallbacks, SecretStorageKeyDescription } from "../secret-storage";
+import { VerificationRequest } from "./verification";
+import { BackupTrustInfo, KeyBackupCheck, KeyBackupInfo } from "./keybackup";
+import { ISignatures } from "../@types/signed";
+import { MatrixEvent } from "../models/event";
 
 /**
  * Public interface to the cryptography parts of the js-sdk
@@ -532,6 +533,23 @@ export interface CryptoApi {
      *   to false.
      */
     startDehydration(createNewKey?: boolean): Promise<void>;
+
+    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+    //
+    // Import/export of secret keys
+    //
+    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+    /**
+     * Export secrets bundle for transmitting to another device as part of OIDC QR login
+     */
+    exportSecretsBundle?(): Promise<Awaited<ReturnType<SecretsBundle["to_json"]>>>;
+
+    /**
+     * Import secrets bundle transmitted from another device.
+     * @param secrets - The secrets bundle received from the other device
+     */
+    importSecretsBundle?(secrets: Awaited<ReturnType<SecretsBundle["to_json"]>>): Promise<void>;
 }
 
 /** A reason code for a failure to decrypt an event. */
@@ -539,6 +557,12 @@ export enum DecryptionFailureCode {
     /** Message was encrypted with a Megolm session whose keys have not been shared with us. */
     MEGOLM_UNKNOWN_INBOUND_SESSION_ID = "MEGOLM_UNKNOWN_INBOUND_SESSION_ID",
 
+    /** A special case of {@link MEGOLM_UNKNOWN_INBOUND_SESSION_ID}: the sender has told us it is withholding the key. */
+    MEGOLM_KEY_WITHHELD = "MEGOLM_KEY_WITHHELD",
+
+    /** A special case of {@link MEGOLM_KEY_WITHHELD}: the sender has told us it is withholding the key, because the current device is unverified. */
+    MEGOLM_KEY_WITHHELD_FOR_UNVERIFIED_DEVICE = "MEGOLM_KEY_WITHHELD_FOR_UNVERIFIED_DEVICE",
+
     /** Message was encrypted with a Megolm session which has been shared with us, but in a later ratchet state. */
     OLM_UNKNOWN_MESSAGE_INDEX = "OLM_UNKNOWN_MESSAGE_INDEX",
 
@@ -830,9 +854,14 @@ export interface CreateSecretStorageOpts {
     setupNewSecretStorage?: boolean;
 
     /**
-     * Function called to get the user's
-     * current key backup passphrase. Should return a promise that resolves with a Uint8Array
+     * Function called to get the user's current key backup passphrase.
+     *
+     * Should return a promise that resolves with a Uint8Array
      * containing the key, or rejects if the key cannot be obtained.
+     *
+     * Only used when the client has existing key backup, but no secret storage.
+     *
+     * @deprecated Not used by the Rust crypto stack.
      */
     getKeyBackupPassphrase?: () => Promise<Uint8Array>;
 }
@@ -931,5 +960,5 @@ export interface OwnDeviceKeys {
     curve25519: string;
 }
 
-export * from "./crypto-api/verification";
-export * from "./crypto-api/keybackup";
+export * from "./verification";
+export * from "./keybackup";

src/crypto-api/keybackup.ts

@@ -63,7 +63,7 @@ export interface BackupTrustInfo {
 }
 
 /**
- * The result of {@link CryptoApi.checkKeyBackupAndEnable}.
+ * The result of {@link Crypto.CryptoApi.checkKeyBackupAndEnable}.
  */
 export interface KeyBackupCheck {
     backupInfo: KeyBackupInfo;

src/crypto/CrossSigning.ts

@@ -24,13 +24,13 @@ import { logger } from "../logger";
 import { IndexedDBCryptoStore } from "../crypto/store/indexeddb-crypto-store";
 import { decryptAES, encryptAES } from "./aes";
 import { DeviceInfo } from "./deviceinfo";
-import { ICrossSigningKey, ISignedKey, MatrixClient } from "../client";
+import { ISignedKey, MatrixClient } from "../client";
 import { OlmDevice } from "./OlmDevice";
 import { ICryptoCallbacks } from ".";
 import { ISignatures } from "../@types/signed";
 import { CryptoStore, SecretStorePrivateKeys } from "./store/base";
 import { ServerSideSecretStorage, SecretStorageKeyDescription } from "../secret-storage";
-import { DeviceVerificationStatus, UserVerificationStatus as UserTrustLevel } from "../crypto-api";
+import { CrossSigningKeyInfo, DeviceVerificationStatus, UserVerificationStatus as UserTrustLevel } from "../crypto-api";
 import { decodeBase64, encodeBase64 } from "../base64";
 
 // backwards-compatibility re-exports
@@ -38,7 +38,7 @@ export { UserTrustLevel };
 
 const KEY_REQUEST_TIMEOUT_MS = 1000 * 60;
 
-function publicKeyFromKeyInfo(keyInfo: ICrossSigningKey): string {
+function publicKeyFromKeyInfo(keyInfo: CrossSigningKeyInfo): string {
     // `keys` is an object with { [`ed25519:${pubKey}`]: pubKey }
     // We assume only a single key, and we want the bare form without type
     // prefix, so we select the values.
@@ -51,13 +51,13 @@ export interface ICacheCallbacks {
 }
 
 export interface ICrossSigningInfo {
-    keys: Record<string, ICrossSigningKey>;
+    keys: Record<string, CrossSigningKeyInfo>;
     firstUse: boolean;
     crossSigningVerifiedBefore: boolean;
 }
 
 export class CrossSigningInfo {
-    public keys: Record<string, ICrossSigningKey> = {};
+    public keys: Record<string, CrossSigningKeyInfo> = {};
     public firstUse = true;
     // This tracks whether we've ever verified this user with any identity.
     // When you verify a user, any devices online at the time that receive
@@ -296,7 +296,7 @@ export class CrossSigningInfo {
         }
 
         const privateKeys: Record<string, Uint8Array> = {};
-        const keys: Record<string, ICrossSigningKey> = {};
+        const keys: Record<string, CrossSigningKeyInfo> = {};
         let masterSigning: PkSigning | undefined;
         let masterPub: string | undefined;
 
@@ -368,8 +368,8 @@ export class CrossSigningInfo {
         this.keys = {};
     }
 
-    public setKeys(keys: Record<string, ICrossSigningKey>): void {
-        const signingKeys: Record<string, ICrossSigningKey> = {};
+    public setKeys(keys: Record<string, CrossSigningKeyInfo>): void {
+        const signingKeys: Record<string, CrossSigningKeyInfo> = {};
         if (keys.master) {
             if (keys.master.user_id !== this.userId) {
                 const error = "Mismatched user ID " + keys.master.user_id + " in master key from " + this.userId;
@@ -457,7 +457,7 @@ export class CrossSigningInfo {
         }
     }
 
-    public async signUser(key: CrossSigningInfo): Promise<ICrossSigningKey | undefined> {
+    public async signUser(key: CrossSigningInfo): Promise<CrossSigningKeyInfo | undefined> {
         if (!this.keys.user_signing) {
             logger.info("No user signing key: not signing user");
             return;

src/crypto/EncryptionSetup.ts

@@ -20,22 +20,15 @@ import { createCryptoStoreCacheCallbacks, ICacheCallbacks } from "./CrossSigning
 import { IndexedDBCryptoStore } from "./store/indexeddb-crypto-store";
 import { Method, ClientPrefix } from "../http-api";
 import { Crypto, ICryptoCallbacks } from "./index";
-import {
-    ClientEvent,
-    ClientEventHandlerMap,
-    CrossSigningKeys,
-    ICrossSigningKey,
-    ISignedKey,
-    KeySignatures,
-} from "../client";
+import { ClientEvent, ClientEventHandlerMap, CrossSigningKeys, ISignedKey, KeySignatures } from "../client";
 import { IKeyBackupInfo } from "./keybackup";
 import { TypedEventEmitter } from "../models/typed-event-emitter";
 import { AccountDataClient, SecretStorageKeyDescription } from "../secret-storage";
-import { BootstrapCrossSigningOpts } from "../crypto-api";
+import { BootstrapCrossSigningOpts, CrossSigningKeyInfo } from "../crypto-api";
 
 interface ICrossSigningKeys {
     authUpload: BootstrapCrossSigningOpts["authUploadDeviceSigningKeys"];
-    keys: Record<"master" | "self_signing" | "user_signing", ICrossSigningKey>;
+    keys: Record<"master" | "self_signing" | "user_signing", CrossSigningKeyInfo>;
 }
 
 /**

src/crypto/OlmDevice.ts

@@ -1221,13 +1221,13 @@ export class OlmDevice {
                 this.getInboundGroupSession(roomId, senderKey, sessionId, txn, (session, sessionData, withheld) => {
                     if (session === null || sessionData === null) {
                         if (withheld) {
-                            error = new DecryptionError(
-                                DecryptionFailureCode.MEGOLM_UNKNOWN_INBOUND_SESSION_ID,
-                                calculateWithheldMessage(withheld),
-                                {
-                                    session: senderKey + "|" + sessionId,
-                                },
-                            );
+                            const failureCode =
+                                withheld.code === "m.unverified"
+                                    ? DecryptionFailureCode.MEGOLM_KEY_WITHHELD_FOR_UNVERIFIED_DEVICE
+                                    : DecryptionFailureCode.MEGOLM_KEY_WITHHELD;
+                            error = new DecryptionError(failureCode, calculateWithheldMessage(withheld), {
+                                session: senderKey + "|" + sessionId,
+                            });
                         }
                         result = null;
                         return;
@@ -1237,13 +1237,13 @@ export class OlmDevice {
                         res = session.decrypt(body);
                     } catch (e) {
                         if ((<Error>e)?.message === "OLM.UNKNOWN_MESSAGE_INDEX" && withheld) {
-                            error = new DecryptionError(
-                                DecryptionFailureCode.MEGOLM_UNKNOWN_INBOUND_SESSION_ID,
-                                calculateWithheldMessage(withheld),
-                                {
-                                    session: senderKey + "|" + sessionId,
-                                },
-                            );
+                            const failureCode =
+                                withheld.code === "m.unverified"
+                                    ? DecryptionFailureCode.MEGOLM_KEY_WITHHELD_FOR_UNVERIFIED_DEVICE
+                                    : DecryptionFailureCode.MEGOLM_KEY_WITHHELD;
+                            error = new DecryptionError(failureCode, calculateWithheldMessage(withheld), {
+                                session: senderKey + "|" + sessionId,
+                            });
                         } else {
                             error = <Error>e;
                         }

src/crypto/aes.ts

@@ -15,7 +15,6 @@ limitations under the License.
 */
 
 import { decodeBase64, encodeBase64 } from "../base64";
-import { subtleCrypto, crypto, TextEncoder } from "./crypto";
 
 // salt for HKDF, with 8 bytes of zeros
 const zeroSalt = new Uint8Array(8);
@@ -49,7 +48,7 @@ export async function encryptAES(
         iv = decodeBase64(ivStr);
     } else {
         iv = new Uint8Array(16);
-        crypto.getRandomValues(iv);
+        globalThis.crypto.getRandomValues(iv);
 
         // clear bit 63 of the IV to stop us hitting the 64-bit counter boundary
         // (which would mean we wouldn't be able to decrypt on Android). The loss
@@ -60,7 +59,7 @@ export async function encryptAES(
     const [aesKey, hmacKey] = await deriveKeys(key, name);
     const encodedData = new TextEncoder().encode(data);
 
-    const ciphertext = await subtleCrypto.encrypt(
+    const ciphertext = await globalThis.crypto.subtle.encrypt(
         {
             name: "AES-CTR",
             counter: iv,
@@ -70,7 +69,7 @@ export async function encryptAES(
         encodedData,
     );
 
-    const hmac = await subtleCrypto.sign({ name: "HMAC" }, hmacKey, ciphertext);
+    const hmac = await globalThis.crypto.subtle.sign({ name: "HMAC" }, hmacKey, ciphertext);
 
     return {
         iv: encodeBase64(iv),
@@ -91,11 +90,11 @@ export async function decryptAES(data: IEncryptedPayload, key: Uint8Array, name:
 
     const ciphertext = decodeBase64(data.ciphertext);
 
-    if (!(await subtleCrypto.verify({ name: "HMAC" }, hmacKey, decodeBase64(data.mac), ciphertext))) {
+    if (!(await globalThis.crypto.subtle.verify({ name: "HMAC" }, hmacKey, decodeBase64(data.mac), ciphertext))) {
         throw new Error(`Error decrypting secret ${name}: bad MAC`);
     }
 
-    const plaintext = await subtleCrypto.decrypt(
+    const plaintext = await globalThis.crypto.subtle.decrypt(
         {
             name: "AES-CTR",
             counter: decodeBase64(data.iv),
@@ -109,8 +108,8 @@ export async function decryptAES(data: IEncryptedPayload, key: Uint8Array, name:
 }
 
 async function deriveKeys(key: Uint8Array, name: string): Promise<[CryptoKey, CryptoKey]> {
-    const hkdfkey = await subtleCrypto.importKey("raw", key, { name: "HKDF" }, false, ["deriveBits"]);
-    const keybits = await subtleCrypto.deriveBits(
+    const hkdfkey = await globalThis.crypto.subtle.importKey("raw", key, { name: "HKDF" }, false, ["deriveBits"]);
+    const keybits = await globalThis.crypto.subtle.deriveBits(
         {
             name: "HKDF",
             salt: zeroSalt,
@@ -126,9 +125,12 @@ async function deriveKeys(key: Uint8Array, name: string): Promise<[CryptoKey, Cr
     const aesKey = keybits.slice(0, 32);
     const hmacKey = keybits.slice(32);
 
-    const aesProm = subtleCrypto.importKey("raw", aesKey, { name: "AES-CTR" }, false, ["encrypt", "decrypt"]);
+    const aesProm = globalThis.crypto.subtle.importKey("raw", aesKey, { name: "AES-CTR" }, false, [
+        "encrypt",
+        "decrypt",
+    ]);
 
-    const hmacProm = subtleCrypto.importKey(
+    const hmacProm = globalThis.crypto.subtle.importKey(
         "raw",
         hmacKey,
         {

src/crypto/algorithms/base.ts

@@ -66,7 +66,6 @@ export abstract class EncryptionAlgorithm {
     protected readonly crypto: Crypto;
     protected readonly olmDevice: OlmDevice;
     protected readonly baseApis: MatrixClient;
-    protected readonly roomId?: string;
 
     /**
      * @param params - parameters
@@ -77,7 +76,6 @@ export abstract class EncryptionAlgorithm {
         this.crypto = params.crypto;
         this.olmDevice = params.olmDevice;
         this.baseApis = params.baseApis;
-        this.roomId = params.roomId;
     }
 
     /**
@@ -127,14 +125,12 @@ export abstract class DecryptionAlgorithm {
     protected readonly crypto: Crypto;
     protected readonly olmDevice: OlmDevice;
     protected readonly baseApis: MatrixClient;
-    protected readonly roomId?: string;
 
     public constructor(params: DecryptionClassParams) {
         this.userId = params.userId;
         this.crypto = params.crypto;
         this.olmDevice = params.olmDevice;
         this.baseApis = params.baseApis;
-        this.roomId = params.roomId;
     }
 
     /**

src/crypto/backup.ts

@@ -38,7 +38,6 @@ import {
 } from "./keybackup";
 import { UnstableValue } from "../NamespacedValue";
 import { CryptoEvent } from "./index";
-import { crypto } from "./crypto";
 import { ClientPrefix, HTTPError, MatrixError, Method } from "../http-api";
 import { BackupTrustInfo } from "../crypto-api/keybackup";
 import { BackupDecryptor } from "../common-crypto/CryptoBackend";
@@ -764,7 +763,7 @@ export class Curve25519 implements BackupAlgorithm {
 
 function randomBytes(size: number): Uint8Array {
     const buf = new Uint8Array(size);
-    crypto.getRandomValues(buf);
+    globalThis.crypto.getRandomValues(buf);
     return buf;
 }
 

src/crypto/crypto.ts

@@ -14,37 +14,5 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import { logger } from "../logger";
-
-export let crypto = globalThis.crypto;
-export let subtleCrypto = crypto?.subtle ?? crypto?.webkitSubtle; // TODO: Stop using webkitSubtle fallback
-export let TextEncoder = globalThis.TextEncoder;
-
-/* eslint-disable @typescript-eslint/no-var-requires */
-if (!crypto) {
-    try {
-        crypto = require("crypto").webcrypto;
-    } catch (e) {
-        logger.error("Failed to load webcrypto", e);
-    }
-}
-if (!subtleCrypto) {
-    subtleCrypto = crypto?.subtle;
-}
-if (!TextEncoder) {
-    try {
-        TextEncoder = require("util").TextEncoder;
-    } catch (e) {
-        logger.error("Failed to load TextEncoder util", e);
-    }
-}
-/* eslint-enable @typescript-eslint/no-var-requires */
-
-export function setCrypto(_crypto: Crypto): void {
-    crypto = _crypto;
-    subtleCrypto = _crypto.subtle ?? _crypto.webkitSubtle;
-}
-
-export function setTextEncoder(_TextEncoder: typeof TextEncoder): void {
-    TextEncoder = _TextEncoder;
-}
+/** @deprecated this is a no-op and should no longer be called. */
+export function setCrypto(_crypto: Crypto): void {}

src/crypto/index.ts

@@ -56,14 +56,7 @@ import { Room, RoomEvent } from "../models/room";
 import { RoomMember, RoomMemberEvent } from "../models/room-member";
 import { EventStatus, IContent, IEvent, MatrixEvent, MatrixEventEvent } from "../models/event";
 import { ToDeviceBatch } from "../models/ToDeviceMessage";
-import {
-    ClientEvent,
-    ICrossSigningKey,
-    IKeysUploadResponse,
-    ISignedKey,
-    IUploadKeySignaturesResponse,
-    MatrixClient,
-} from "../client";
+import { ClientEvent, IKeysUploadResponse, ISignedKey, IUploadKeySignaturesResponse, MatrixClient } from "../client";
 import { IRoomEncryption, RoomList } from "./RoomList";
 import { IKeyBackupInfo } from "./keybackup";
 import { ISyncStateData } from "../sync";
@@ -89,6 +82,7 @@ import { ISecretRequest } from "./SecretSharing";
 import {
     BackupTrustInfo,
     BootstrapCrossSigningOpts,
+    CrossSigningKeyInfo,
     CrossSigningStatus,
     DecryptionFailureCode,
     DeviceVerificationStatus,
@@ -282,7 +276,7 @@ export type CryptoEventHandlerMap = {
      * @param deviceId - the id of the verified device
      * @param deviceInfo - updated device information
      */
-    [CryptoEvent.DeviceVerificationChanged]: (userId: string, deviceId: string, device: DeviceInfo) => void;
+    [CryptoEvent.DeviceVerificationChanged]: (userId: string, deviceId: string, deviceInfo: DeviceInfo) => void;
     /**
      * Fires when the trust status of a user changes
      * If userId is the userId of the logged-in user, this indicated a change
@@ -298,7 +292,7 @@ export type CryptoEventHandlerMap = {
     /**
      * Fires when we receive a room key request
      *
-     * @param req - request details
+     * @param request - request details
      */
     [CryptoEvent.RoomKeyRequest]: (request: IncomingRoomKeyRequest) => void;
     /**
@@ -649,7 +643,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     }
 
     /**
-     * Implementation of {@link CryptoApi#getVersion}.
+     * Implementation of {@link Crypto.CryptoApi#getVersion}.
      */
     public getVersion(): string {
         const olmVersionTuple = Crypto.getOlmVersion();
@@ -809,7 +803,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     }
 
     /**
-     * Implementation of {@link CryptoApi#getCrossSigningStatus}
+     * Implementation of {@link Crypto.CryptoApi#getCrossSigningStatus}
      */
     public async getCrossSigningStatus(): Promise<CrossSigningStatus> {
         const publicKeysOnDevice = Boolean(this.crossSigningInfo.getId());
@@ -1173,7 +1167,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     }
 
     /**
-     * Implementation of {@link CryptoApi#resetKeyBackup}.
+     * Implementation of {@link Crypto.CryptoApi#resetKeyBackup}.
      */
     public async resetKeyBackup(): Promise<void> {
         // Delete existing ones
@@ -1209,7 +1203,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     }
 
     /**
-     * Implementation of {@link CryptoApi#deleteKeyBackupVersion}.
+     * Implementation of {@link Crypto.CryptoApi#deleteKeyBackupVersion}.
      */
     public async deleteKeyBackupVersion(version: string): Promise<void> {
         await this.backupManager.deleteKeyBackupVersion(version);
@@ -1356,7 +1350,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     /**
      * Get the current status of key backup.
      *
-     * Implementation of {@link CryptoApi.getActiveSessionBackupVersion}.
+     * Implementation of {@link Crypto.CryptoApi.getActiveSessionBackupVersion}.
      */
     public async getActiveSessionBackupVersion(): Promise<string | null> {
         if (this.backupManager.getKeyBackupEnabled()) {
@@ -1378,7 +1372,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     /**
      * Force a re-check of the key backup and enable/disable it as appropriate.
      *
-     * Implementation of {@link CryptoApi.checkKeyBackupAndEnable}.
+     * Implementation of {@link Crypto.CryptoApi.checkKeyBackupAndEnable}.
      */
     public async checkKeyBackupAndEnable(): Promise<KeyBackupCheck | null> {
         const checkResult = await this.backupManager.checkKeyBackup();
@@ -1527,7 +1521,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
      */
     private async checkForValidDeviceSignature(
         userId: string,
-        key: ICrossSigningKey,
+        key: CrossSigningKeyInfo,
         devices: Record<string, IDevice>,
     ): Promise<string[]> {
         const deviceIds: string[] = [];
@@ -1595,7 +1589,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     }
 
     /**
-     * Implementation of {@link CryptoApi.getUserVerificationStatus}.
+     * Implementation of {@link Crypto.CryptoApi.getUserVerificationStatus}.
      */
     public async getUserVerificationStatus(userId: string): Promise<UserTrustLevel> {
         return this.checkUserTrust(userId);
@@ -1894,7 +1888,11 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     /**
      * Implementation of {@link CryptoBackend#importBackedUpRoomKeys}.
      */
-    public importBackedUpRoomKeys(keys: IMegolmSessionData[], opts: ImportRoomKeysOpts = {}): Promise<void> {
+    public importBackedUpRoomKeys(
+        keys: IMegolmSessionData[],
+        backupVersion: string,
+        opts: ImportRoomKeysOpts = {},
+    ): Promise<void> {
         opts.source = "backup";
         return this.importRoomKeys(keys, opts);
     }
@@ -1904,7 +1902,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
      *
      * @param keys - The new trusted set of keys
      */
-    private async storeTrustedSelfKeys(keys: Record<string, ICrossSigningKey> | null): Promise<void> {
+    private async storeTrustedSelfKeys(keys: Record<string, CrossSigningKeyInfo> | null): Promise<void> {
         if (keys) {
             this.crossSigningInfo.setKeys(keys);
         } else {
@@ -1992,7 +1990,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
      *
      * @returns base64-encoded ed25519 key.
      *
-     * @deprecated Use {@link CryptoApi#getOwnDeviceKeys}.
+     * @deprecated Use {@link Crypto.CryptoApi#getOwnDeviceKeys}.
      */
     public getDeviceEd25519Key(): string | null {
         return this.olmDevice.deviceEd25519Key;
@@ -2003,14 +2001,14 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
      *
      * @returns base64-encoded curve25519 key.
      *
-     * @deprecated Use {@link CryptoApi#getOwnDeviceKeys}
+     * @deprecated Use {@link Crypto.CryptoApi#getOwnDeviceKeys}
      */
     public getDeviceCurve25519Key(): string | null {
         return this.olmDevice.deviceCurve25519Key;
     }
 
     /**
-     * Implementation of {@link CryptoApi#getOwnDeviceKeys}.
+     * Implementation of {@link Crypto.CryptoApi#getOwnDeviceKeys}.
      */
     public async getOwnDeviceKeys(): Promise<OwnDeviceKeys> {
         if (!this.olmDevice.deviceCurve25519Key) {
@@ -2346,7 +2344,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     /**
      * Mark the given device as locally verified.
      *
-     * Implementation of {@link CryptoApi#setDeviceVerified}.
+     * Implementation of {@link Crypto.CryptoApi#setDeviceVerified}.
      */
     public async setDeviceVerified(userId: string, deviceId: string, verified = true): Promise<void> {
         await this.setDeviceVerification(userId, deviceId, verified);
@@ -2355,7 +2353,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     /**
      * Blindly cross-sign one of our other devices.
      *
-     * Implementation of {@link CryptoApi#crossSignDevice}.
+     * Implementation of {@link Crypto.CryptoApi#crossSignDevice}.
      */
     public async crossSignDevice(deviceId: string): Promise<void> {
         await this.setDeviceVerified(this.userId, deviceId, true);
@@ -2390,7 +2388,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
         blocked: boolean | null = null,
         known: boolean | null = null,
         keys?: Record<string, string>,
-    ): Promise<DeviceInfo | CrossSigningInfo | ICrossSigningKey | undefined> {
+    ): Promise<DeviceInfo | CrossSigningInfo | CrossSigningKeyInfo | undefined> {
         // Check if the 'device' is actually a cross signing key
         // The js-sdk's verification treats cross-signing keys as devices
         // and so uses this method to mark them verified.
@@ -2791,7 +2789,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     }
 
     /**
-     * Implementation of {@link CryptoApi.getEncryptionInfoForEvent}.
+     * Implementation of {@link Crypto.CryptoApi.getEncryptionInfoForEvent}.
      */
     public async getEncryptionInfoForEvent(event: MatrixEvent): Promise<EventEncryptionInfo | null> {
         const encryptionInfo = this.getEventEncryptionInfo(event);
@@ -4274,7 +4272,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     }
 
     /**
-     * Implementation of {@link CryptoApi#isEncryptionEnabledInRoom}.
+     * Implementation of {@link Crypto.CryptoApi#isEncryptionEnabledInRoom}.
      */
     public async isEncryptionEnabledInRoom(roomId: string): Promise<boolean> {
         return this.isRoomEncrypted(roomId);

src/crypto/key_passphrase.ts

@@ -15,7 +15,6 @@ limitations under the License.
 */
 
 import { randomString } from "../randomstring";
-import { subtleCrypto, TextEncoder } from "./crypto";
 
 const DEFAULT_ITERATIONS = 500000;
 
@@ -36,10 +35,6 @@ interface IKey {
 }
 
 export function keyFromAuthData(authData: IAuthData, password: string): Promise<Uint8Array> {
-    if (!global.Olm) {
-        throw new Error("Olm is not available");
-    }
-
     if (!authData.private_key_salt || !authData.private_key_iterations) {
         throw new Error("Salt and/or iterations not found: " + "this backup cannot be restored with a passphrase");
     }
@@ -53,10 +48,6 @@ export function keyFromAuthData(authData: IAuthData, password: string): Promise<
 }
 
 export async function keyFromPassphrase(password: string): Promise<IKey> {
-    if (!global.Olm) {
-        throw new Error("Olm is not available");
-    }
-
     const salt = randomString(32);
 
     const key = await deriveKey(password, salt, DEFAULT_ITERATIONS, DEFAULT_BITSIZE);
@@ -70,15 +61,19 @@ export async function deriveKey(
     iterations: number,
     numBits = DEFAULT_BITSIZE,
 ): Promise<Uint8Array> {
-    if (!subtleCrypto || !TextEncoder) {
+    if (!globalThis.crypto.subtle || !TextEncoder) {
         throw new Error("Password-based backup is not available on this platform");
     }
 
-    const key = await subtleCrypto.importKey("raw", new TextEncoder().encode(password), { name: "PBKDF2" }, false, [
-        "deriveBits",
-    ]);
+    const key = await globalThis.crypto.subtle.importKey(
+        "raw",
+        new TextEncoder().encode(password),
+        { name: "PBKDF2" },
+        false,
+        ["deriveBits"],
+    );
 
-    const keybits = await subtleCrypto.deriveBits(
+    const keybits = await globalThis.crypto.subtle.deriveBits(
         {
             name: "PBKDF2",
             salt: new TextEncoder().encode(salt),

src/crypto/recoverykey.ts

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import * as bs58 from "bs58";
+import bs58 from "bs58";
 
 // picked arbitrarily but to try & avoid clashing with any bitcoin ones
 // (which are also base58 encoded, but bitcoin's involve a lot more hashing)

src/crypto/store/base.ts

@@ -16,7 +16,6 @@ limitations under the License.
 
 import { IRoomKeyRequestBody, IRoomKeyRequestRecipient } from "../index";
 import { RoomKeyRequestState } from "../OutgoingRoomKeyRequestManager";
-import { ICrossSigningKey } from "../../client";
 import { IOlmDevice } from "../algorithms/megolm";
 import { TrackingStatus } from "../DeviceList";
 import { IRoomEncryption } from "../RoomList";
@@ -27,6 +26,7 @@ import { InboundGroupSessionData } from "../OlmDevice";
 import { MatrixEvent } from "../../models/event";
 import { DehydrationManager } from "../dehydration";
 import { IEncryptedPayload } from "../aes";
+import { CrossSigningKeyInfo } from "../../crypto-api";
 
 /**
  * Internal module. Definitions for storage for the crypto module
@@ -100,13 +100,13 @@ export interface CryptoStore {
     // Olm Account
     getAccount(txn: unknown, func: (accountPickle: string | null) => void): void;
     storeAccount(txn: unknown, accountPickle: string): void;
-    getCrossSigningKeys(txn: unknown, func: (keys: Record<string, ICrossSigningKey> | null) => void): void;
+    getCrossSigningKeys(txn: unknown, func: (keys: Record<string, CrossSigningKeyInfo> | null) => void): void;
     getSecretStorePrivateKey<K extends keyof SecretStorePrivateKeys>(
         txn: unknown,
         func: (key: SecretStorePrivateKeys[K] | null) => void,
         type: K,
     ): void;
-    storeCrossSigningKeys(txn: unknown, keys: Record<string, ICrossSigningKey>): void;
+    storeCrossSigningKeys(txn: unknown, keys: Record<string, CrossSigningKeyInfo>): void;
     storeSecretStorePrivateKey<K extends keyof SecretStorePrivateKeys>(
         txn: unknown,
         type: K,

src/crypto/store/indexeddb-crypto-store-backend.ts

@@ -33,11 +33,11 @@ import {
     ACCOUNT_OBJECT_KEY_MIGRATION_STATE,
 } from "./base";
 import { IRoomKeyRequestBody, IRoomKeyRequestRecipient } from "../index";
-import { ICrossSigningKey } from "../../client";
 import { IOlmDevice } from "../algorithms/megolm";
 import { IRoomEncryption } from "../RoomList";
 import { InboundGroupSessionData } from "../OlmDevice";
 import { IndexedDBCryptoStore } from "./indexeddb-crypto-store";
+import { CrossSigningKeyInfo } from "../../crypto-api";
 
 const PROFILE_TRANSACTIONS = false;
 
@@ -418,7 +418,7 @@ export class Backend implements CryptoStore {
 
     public getCrossSigningKeys(
         txn: IDBTransaction,
-        func: (keys: Record<string, ICrossSigningKey> | null) => void,
+        func: (keys: Record<string, CrossSigningKeyInfo> | null) => void,
     ): void {
         const objectStore = txn.objectStore("account");
         const getReq = objectStore.get("crossSigningKeys");
@@ -447,7 +447,7 @@ export class Backend implements CryptoStore {
         };
     }
 
-    public storeCrossSigningKeys(txn: IDBTransaction, keys: Record<string, ICrossSigningKey>): void {
+    public storeCrossSigningKeys(txn: IDBTransaction, keys: Record<string, CrossSigningKeyInfo>): void {
         const objectStore = txn.objectStore("account");
         objectStore.put(keys, "crossSigningKeys");
     }

src/crypto/store/indexeddb-crypto-store.ts

@@ -36,10 +36,10 @@ import {
     ACCOUNT_OBJECT_KEY_MIGRATION_STATE,
 } from "./base";
 import { IRoomKeyRequestBody } from "../index";
-import { ICrossSigningKey } from "../../client";
 import { IOlmDevice } from "../algorithms/megolm";
 import { IRoomEncryption } from "../RoomList";
 import { InboundGroupSessionData } from "../OlmDevice";
+import { CrossSigningKeyInfo } from "../../crypto-api";
 
 /*
  * Internal module. indexeddb storage for e2e.
@@ -420,7 +420,7 @@ export class IndexedDBCryptoStore implements CryptoStore {
      */
     public getCrossSigningKeys(
         txn: IDBTransaction,
-        func: (keys: Record<string, ICrossSigningKey> | null) => void,
+        func: (keys: Record<string, CrossSigningKeyInfo> | null) => void,
     ): void {
         this.backend!.getCrossSigningKeys(txn, func);
     }
@@ -444,7 +444,7 @@ export class IndexedDBCryptoStore implements CryptoStore {
      * @param txn - An active transaction. See doTxn().
      * @param keys - keys object as getCrossSigningKeys()
      */
-    public storeCrossSigningKeys(txn: IDBTransaction, keys: Record<string, ICrossSigningKey>): void {
+    public storeCrossSigningKeys(txn: IDBTransaction, keys: Record<string, CrossSigningKeyInfo>): void {
         this.backend!.storeCrossSigningKeys(txn, keys);
     }