v16.0.0

Prepare changelog for v16.0.0
v16.0.0-rc.1
2022-03-15 14:17:54 +00:00 · 2022-03-15 14:17:54 +00:00 · 2022-03-08 14:43:46 +00:00 · 2022-03-08 13:31:50 +00:00 · 2022-03-04 15:56:14 +00:00 · 2022-03-04 14:03:35 +00:00
190 changed files with 36440 additions and 25257 deletions
@@ -31,6 +31,9 @@ module.exports = {
        "no-async-promise-executor": "off",
        // We use a `logger` intermediary module
        "no-console": "error",
+
+        // restrict EventEmitters to force callers to use TypedEventEmitter
+        "no-restricted-imports": ["error", "events"],
    },
    overrides: [{
        files: [
@@ -0,0 +1 @@
+* @matrix-org/element-web
@@ -0,0 +1,7 @@
+<!-- Please read https://github.com/matrix-org/matrix-js-sdk/blob/develop/CONTRIBUTING.md before submitting your pull request -->
+
+<!-- Include a Sign-Off as described in https://github.com/matrix-org/matrix-js-sdk/blob/develop/CONTRIBUTING.md#sign-off -->
+
+<!-- To specify text for the changelog entry (otherwise the PR title will be used):
+Notes:
+-->
@@ -0,0 +1,6 @@
+comment:
+  layout: "diff, files"
+  behavior: default
+  require_changes: false
+  require_base: no
+  require_head: no
@@ -0,0 +1,12 @@
+name: Preview Changelog
+on:
+  pull_request_target:
+    types: [ opened, edited, labeled ]
+jobs:
+    changelog:
+        runs-on: ubuntu-latest
+        steps:
+            - name: Preview Changelog
+              uses: matrix-org/allchange@main
+              with:
+                  ghToken: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1,19 @@
+name: Test coverage
+on:
+  pull_request: {}
+  push:
+    branches: [develop, main, master]
+jobs:
+  test-coverage:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Run tests with coverage
+        run: "yarn install && yarn build && yarn coverage"
+
+      - name: Upload coverage
+        uses: codecov/codecov-action@v2
+        with:
+          verbose: true
@@ -16,3 +16,6 @@ out
 # version file and tarball created by `npm pack` / `yarn pack`
 /git-revision.txt
 /matrix-js-sdk-*.tgz
+
+.vscode
+.vscode/
@@ -1,3 +1,523 @@
+Changes in [16.0.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v16.0.0) (2022-03-15)
+==================================================================================================
+
+## 🚨 BREAKING CHANGES
+ * Improve typing around event emitter handlers ([\#2180](https://github.com/matrix-org/matrix-js-sdk/pull/2180)).
+
+## ✨ Features
+ * Fix defer not supporting resolving with a Promise<T> ([\#2216](https://github.com/matrix-org/matrix-js-sdk/pull/2216)).
+ * add LocationAssetType enum ([\#2214](https://github.com/matrix-org/matrix-js-sdk/pull/2214)).
+ * Support for mid-call devices changes ([\#2154](https://github.com/matrix-org/matrix-js-sdk/pull/2154)). Contributed by @SimonBrandner.
+ * Add new room state emit RoomStateEvent.Update for lower-frequency hits ([\#2192](https://github.com/matrix-org/matrix-js-sdk/pull/2192)).
+
+## 🐛 Bug Fixes
+ * Fix wrong event_id being sent for m.in_reply_to of threads ([\#2213](https://github.com/matrix-org/matrix-js-sdk/pull/2213)).
+ * Fix wrongly asserting that PushRule::conditions is non-null ([\#2217](https://github.com/matrix-org/matrix-js-sdk/pull/2217)).
+ * Make createThread more resilient when missing rootEvent ([\#2207](https://github.com/matrix-org/matrix-js-sdk/pull/2207)). Fixes vector-im/element-web#21130.
+ * Fix bug with the /hierarchy API sending invalid requests ([\#2201](https://github.com/matrix-org/matrix-js-sdk/pull/2201)). Fixes vector-im/element-web#21170.
+ * fix relation sender filter ([\#2196](https://github.com/matrix-org/matrix-js-sdk/pull/2196)). Fixes vector-im/element-web#20877.
+ * Fix bug with one-way audio after a transfer ([\#2193](https://github.com/matrix-org/matrix-js-sdk/pull/2193)).
+
+Changes in [16.0.0-rc.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v16.0.0-rc.1) (2022-03-08)
+============================================================================================================
+
+## 🚨 BREAKING CHANGES
+ * Improve typing around event emitter handlers ([\#2180](https://github.com/matrix-org/matrix-js-sdk/pull/2180)).
+
+## ✨ Features
+ * Fix defer not supporting resolving with a Promise<T> ([\#2216](https://github.com/matrix-org/matrix-js-sdk/pull/2216)).
+ * add LocationAssetType enum ([\#2214](https://github.com/matrix-org/matrix-js-sdk/pull/2214)).
+ * Support for mid-call devices changes ([\#2154](https://github.com/matrix-org/matrix-js-sdk/pull/2154)). Contributed by @SimonBrandner.
+ * Add new room state emit RoomStateEvent.Update for lower-frequency hits ([\#2192](https://github.com/matrix-org/matrix-js-sdk/pull/2192)).
+
+## 🐛 Bug Fixes
+ * Fix wrong event_id being sent for m.in_reply_to of threads ([\#2213](https://github.com/matrix-org/matrix-js-sdk/pull/2213)).
+ * Fix wrongly asserting that PushRule::conditions is non-null ([\#2217](https://github.com/matrix-org/matrix-js-sdk/pull/2217)).
+ * Make createThread more resilient when missing rootEvent ([\#2207](https://github.com/matrix-org/matrix-js-sdk/pull/2207)). Fixes vector-im/element-web#21130.
+ * Fix bug with the /hierarchy API sending invalid requests ([\#2201](https://github.com/matrix-org/matrix-js-sdk/pull/2201)). Fixes vector-im/element-web#21170.
+ * fix relation sender filter ([\#2196](https://github.com/matrix-org/matrix-js-sdk/pull/2196)). Fixes vector-im/element-web#20877.
+ * Fix bug with one-way audio after a transfer ([\#2193](https://github.com/matrix-org/matrix-js-sdk/pull/2193)).
+
+Changes in [15.6.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.6.0) (2022-02-28)
+==================================================================================================
+
+## ✨ Features
+ * Return send event response from MSC3089Branch.createNewVersion() ([\#2186](https://github.com/matrix-org/matrix-js-sdk/pull/2186)).
+ * Add functions to support refresh tokens ([\#2178](https://github.com/matrix-org/matrix-js-sdk/pull/2178)).
+
+## 🐛 Bug Fixes
+ * [Release] Fix bug with the /hierarchy API sending invalid requests ([\#2202](https://github.com/matrix-org/matrix-js-sdk/pull/2202)).
+ * Fix bug where calls could break if rejected from somewhere else ([\#2189](https://github.com/matrix-org/matrix-js-sdk/pull/2189)).
+ * Fix camera stuck on after call transfer ([\#2188](https://github.com/matrix-org/matrix-js-sdk/pull/2188)).
+ * Fix synthetic read receipt handling ([\#2174](https://github.com/matrix-org/matrix-js-sdk/pull/2174)). Fixes vector-im/element-web#21016.
+ * Revert "Sign backup with cross-signing key when we reset it." ([\#2175](https://github.com/matrix-org/matrix-js-sdk/pull/2175)).
+ * Sign backup with cross-signing key when we reset it. ([\#2170](https://github.com/matrix-org/matrix-js-sdk/pull/2170)).
+ * Fix error in uploadContent() when file is empty under Node.js ([\#2155](https://github.com/matrix-org/matrix-js-sdk/pull/2155)).
+ * Check the backup info against the stored private key when determining trust. ([\#2167](https://github.com/matrix-org/matrix-js-sdk/pull/2167)).
+ * Back up keys before logging out ([\#2158](https://github.com/matrix-org/matrix-js-sdk/pull/2158)). Fixes vector-im/element-web#13151.
+
+Changes in [15.6.0-rc.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.6.0-rc.1) (2022-02-22)
+============================================================================================================
+
+## ✨ Features
+ * Return send event response from MSC3089Branch.createNewVersion() ([\#2186](https://github.com/matrix-org/matrix-js-sdk/pull/2186)).
+ * Add functions to support refresh tokens ([\#2178](https://github.com/matrix-org/matrix-js-sdk/pull/2178)).
+
+## 🐛 Bug Fixes
+ * Fix bug where calls could break if rejected from somewhere else ([\#2189](https://github.com/matrix-org/matrix-js-sdk/pull/2189)).
+ * Fix camera stuck on after call transfer ([\#2188](https://github.com/matrix-org/matrix-js-sdk/pull/2188)).
+ * Fix synthetic read receipt handling ([\#2174](https://github.com/matrix-org/matrix-js-sdk/pull/2174)). Fixes vector-im/element-web#21016.
+ * Revert "Sign backup with cross-signing key when we reset it." ([\#2175](https://github.com/matrix-org/matrix-js-sdk/pull/2175)).
+ * Sign backup with cross-signing key when we reset it. ([\#2170](https://github.com/matrix-org/matrix-js-sdk/pull/2170)).
+ * Fix error in uploadContent() when file is empty under Node.js ([\#2155](https://github.com/matrix-org/matrix-js-sdk/pull/2155)).
+ * Check the backup info against the stored private key when determining trust. ([\#2167](https://github.com/matrix-org/matrix-js-sdk/pull/2167)).
+ * Back up keys before logging out ([\#2158](https://github.com/matrix-org/matrix-js-sdk/pull/2158)). Fixes vector-im/element-web#13151.
+
+Changes in [15.5.2](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.5.2) (2022-02-17)
+==================================================================================================
+
+## 🐛 Bug Fixes
+ * Fix synthetic read receipt handling
+
+Changes in [15.5.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.5.1) (2022-02-14)
+==================================================================================================
+
+## 🐛 Bug Fixes
+ * Fix issue with rooms not getting marked as unread ([\#2163](https://github.com/matrix-org/matrix-js-sdk/pull/2163)). Fixes vector-im/element-web#20971.
+ * Don't store streams that are only used once ([\#2157](https://github.com/matrix-org/matrix-js-sdk/pull/2157)). Fixes vector-im/element-web#20932. Contributed by @SimonBrandner.
+ * Fix edge cases around RR calculations ([\#2160](https://github.com/matrix-org/matrix-js-sdk/pull/2160)). Fixes vector-im/element-web#20922.
+ * Account for encryption in `maySendMessage()` ([\#2159](https://github.com/matrix-org/matrix-js-sdk/pull/2159)). Contributed by @SimonBrandner.
+ * Send references to thread root to threads, even out of order ([\#2156](https://github.com/matrix-org/matrix-js-sdk/pull/2156)).
+ * Fix initial sync fail when event fetching unsuccessful ([\#2150](https://github.com/matrix-org/matrix-js-sdk/pull/2150)). Fixes vector-im/element-web#20862.
+ * Don't decrypt redacted messages ([\#2143](https://github.com/matrix-org/matrix-js-sdk/pull/2143)). Contributed by @SimonBrandner.
+
+Changes in [15.5.1-rc.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.5.1-rc.1) (2022-02-08)
+============================================================================================================
+
+## 🐛 Bug Fixes
+ * Fix issue with rooms not getting marked as unread ([\#2163](https://github.com/matrix-org/matrix-js-sdk/pull/2163)). Fixes vector-im/element-web#20971.
+ * Don't store streams that are only used once ([\#2157](https://github.com/matrix-org/matrix-js-sdk/pull/2157)). Fixes vector-im/element-web#20932. Contributed by @SimonBrandner.
+ * Fix edge cases around RR calculations ([\#2160](https://github.com/matrix-org/matrix-js-sdk/pull/2160)). Fixes vector-im/element-web#20922.
+ * Account for encryption in `maySendMessage()` ([\#2159](https://github.com/matrix-org/matrix-js-sdk/pull/2159)). Contributed by @SimonBrandner.
+ * Send references to thread root to threads, even out of order ([\#2156](https://github.com/matrix-org/matrix-js-sdk/pull/2156)).
+ * Fix initial sync fail when event fetching unsuccessful ([\#2150](https://github.com/matrix-org/matrix-js-sdk/pull/2150)). Fixes vector-im/element-web#20862.
+ * Don't decrypt redacted messages ([\#2143](https://github.com/matrix-org/matrix-js-sdk/pull/2143)). Contributed by @SimonBrandner.
+
+Changes in [15.5.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.5.0) (2022-01-31)
+==================================================================================================
+
+## ✨ Features
+ * Support m.asset in m.location event content ([\#2109](https://github.com/matrix-org/matrix-js-sdk/pull/2109)).
+ * Send extensible events structure and support on-demand parsing ([\#2091](https://github.com/matrix-org/matrix-js-sdk/pull/2091)).
+ * Support cancelling events whilst they are in status = ENCRYPTING ([\#2095](https://github.com/matrix-org/matrix-js-sdk/pull/2095)).
+
+## 🐛 Bug Fixes
+ * Fix http-api butchering idServer requests ([\#2134](https://github.com/matrix-org/matrix-js-sdk/pull/2134)). Fixes vector-im/element-web#20680.
+ * Don't remove streams that still have tracks ([\#2104](https://github.com/matrix-org/matrix-js-sdk/pull/2104)).
+
+Changes in [15.5.0-rc.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.5.0-rc.1) (2022-01-26)
+============================================================================================================
+
+## ✨ Features
+ * Support m.asset in m.location event content ([\#2109](https://github.com/matrix-org/matrix-js-sdk/pull/2109)).
+ * Send extensible events structure and support on-demand parsing ([\#2091](https://github.com/matrix-org/matrix-js-sdk/pull/2091)).
+ * Support cancelling events whilst they are in status = ENCRYPTING ([\#2095](https://github.com/matrix-org/matrix-js-sdk/pull/2095)).
+
+## 🐛 Bug Fixes
+ * Fix http-api butchering idServer requests ([\#2134](https://github.com/matrix-org/matrix-js-sdk/pull/2134)). Fixes vector-im/element-web#20680.
+ * Don't remove streams that still have tracks ([\#2104](https://github.com/matrix-org/matrix-js-sdk/pull/2104)).
+
+Changes in [15.4.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.4.0) (2022-01-17)
+==================================================================================================
+
+## ✨ Features
+ * Don't consider alt_aliases when calculating room name ([\#2094](https://github.com/matrix-org/matrix-js-sdk/pull/2094)). Fixes vector-im/element-web#13887.
+ * Load room history if necessary when searching for MSC3089 getFileEvent() ([\#2066](https://github.com/matrix-org/matrix-js-sdk/pull/2066)).
+ * Add support for MSC3030 `/timestamp_to_event` ([\#2072](https://github.com/matrix-org/matrix-js-sdk/pull/2072)).
+
+## 🐛 Bug Fixes
+ * Stop encrypting redactions as it isn't spec compliant ([\#2098](https://github.com/matrix-org/matrix-js-sdk/pull/2098)). Fixes vector-im/element-web#20460.
+ * Fix more function typings relating to key backup ([\#2086](https://github.com/matrix-org/matrix-js-sdk/pull/2086)).
+ * Fix timeline search in MSC3089 getFileEvent() ([\#2085](https://github.com/matrix-org/matrix-js-sdk/pull/2085)).
+ * Set a `deviceId` for VoIP example and use `const`/`let` ([\#2090](https://github.com/matrix-org/matrix-js-sdk/pull/2090)). Fixes #2083. Contributed by @SimonBrandner.
+ * Fix incorrect TS return type for secret storage and key backup functions ([\#2082](https://github.com/matrix-org/matrix-js-sdk/pull/2082)).
+
+Changes in [15.4.0-rc.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.4.0-rc.1) (2022-01-11)
+============================================================================================================
+
+## ✨ Features
+ * Don't consider alt_aliases when calculating room name ([\#2094](https://github.com/matrix-org/matrix-js-sdk/pull/2094)). Fixes vector-im/element-web#13887.
+ * Load room history if necessary when searching for MSC3089 getFileEvent() ([\#2066](https://github.com/matrix-org/matrix-js-sdk/pull/2066)).
+ * Add support for MSC3030 `/timestamp_to_event` ([\#2072](https://github.com/matrix-org/matrix-js-sdk/pull/2072)).
+
+## 🐛 Bug Fixes
+ * Stop encrypting redactions as it isn't spec compliant ([\#2098](https://github.com/matrix-org/matrix-js-sdk/pull/2098)). Fixes vector-im/element-web#20460.
+ * Fix more function typings relating to key backup ([\#2086](https://github.com/matrix-org/matrix-js-sdk/pull/2086)).
+ * Fix timeline search in MSC3089 getFileEvent() ([\#2085](https://github.com/matrix-org/matrix-js-sdk/pull/2085)).
+ * Set a `deviceId` for VoIP example and use `const`/`let` ([\#2090](https://github.com/matrix-org/matrix-js-sdk/pull/2090)). Fixes #2083. Contributed by @SimonBrandner.
+ * Fix incorrect TS return type for secret storage and key backup functions ([\#2082](https://github.com/matrix-org/matrix-js-sdk/pull/2082)).
+
+Changes in [15.3.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.3.0) (2021-12-20)
+==================================================================================================
+
+## ✨ Features
+ * Improve fallback key behaviour ([\#2037](https://github.com/matrix-org/matrix-js-sdk/pull/2037)).
+ * Add new room event filter fields ([\#2051](https://github.com/matrix-org/matrix-js-sdk/pull/2051)).
+ * Add method to fetch /account/whoami ([\#2046](https://github.com/matrix-org/matrix-js-sdk/pull/2046)).
+
+## 🐛 Bug Fixes
+ * Filter out falsey opts in /relations API hits ([\#2059](https://github.com/matrix-org/matrix-js-sdk/pull/2059)). Fixes vector-im/element-web#20137.
+ * Fix paginateEventTimeline resolve to boolean ([\#2054](https://github.com/matrix-org/matrix-js-sdk/pull/2054)).
+ * Fix incorrect MSC3089 typings and add null checks ([\#2049](https://github.com/matrix-org/matrix-js-sdk/pull/2049)).
+
+Changes in [15.3.0-rc.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.3.0-rc.1) (2021-12-14)
+============================================================================================================
+
+## ✨ Features
+ * Improve fallback key behaviour ([\#2037](https://github.com/matrix-org/matrix-js-sdk/pull/2037)).
+ * Add new room event filter fields ([\#2051](https://github.com/matrix-org/matrix-js-sdk/pull/2051)).
+ * Add method to fetch /account/whoami ([\#2046](https://github.com/matrix-org/matrix-js-sdk/pull/2046)).
+
+## 🐛 Bug Fixes
+ * Filter out falsey opts in /relations API hits ([\#2059](https://github.com/matrix-org/matrix-js-sdk/pull/2059)). Fixes vector-im/element-web#20137.
+ * Fix paginateEventTimeline resolve to boolean ([\#2054](https://github.com/matrix-org/matrix-js-sdk/pull/2054)).
+ * Fix incorrect MSC3089 typings and add null checks ([\#2049](https://github.com/matrix-org/matrix-js-sdk/pull/2049)).
+
+Changes in [15.2.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.2.1) (2021-12-13)
+==================================================================================================
+
+ * Security release with updated version of Olm to fix https://matrix.org/blog/2021/12/03/pre-disclosure-upcoming-security-release-of-libolm-and-matrix-js-sdk
+
+Changes in [15.2.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.2.0) (2021-12-06)
+==================================================================================================
+
+## ✨ Features
+ * Remove support for `ArrayBuffer` in unstable MSC3089 `createFile()` and `createNewVersion()` and instead use same content types as handled by `MatrixClient.uploadContent()`. This enables support for Node.js. ([\#2014](https://github.com/matrix-org/matrix-js-sdk/pull/2014)).
+ * Support for password-based backup on Node.js ([\#2021](https://github.com/matrix-org/matrix-js-sdk/pull/2021)).
+ * Add optional force parameter when ensuring Olm sessions ([\#2027](https://github.com/matrix-org/matrix-js-sdk/pull/2027)).
+
+## 🐛 Bug Fixes
+ * Fix call upgrades ([\#2024](https://github.com/matrix-org/matrix-js-sdk/pull/2024)). Contributed by @SimonBrandner.
+
+Changes in [15.2.0-rc.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.2.0-rc.1) (2021-11-30)
+============================================================================================================
+
+## ✨ Features
+ * Remove support for `ArrayBuffer` in unstable MSC3089 `createFile()` and `createNewVersion()` and instead use same content types as handled by `MatrixClient.uploadContent()`. This enables support for Node.js. ([\#2014](https://github.com/matrix-org/matrix-js-sdk/pull/2014)).
+ * Support for password-based backup on Node.js ([\#2021](https://github.com/matrix-org/matrix-js-sdk/pull/2021)).
+ * Add optional force parameter when ensuring Olm sessions ([\#2027](https://github.com/matrix-org/matrix-js-sdk/pull/2027)).
+
+## 🐛 Bug Fixes
+ * Fix call upgrades ([\#2024](https://github.com/matrix-org/matrix-js-sdk/pull/2024)). Contributed by @SimonBrandner.
+
+Changes in [15.1.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.1.1) (2021-11-22)
+==================================================================================================
+
+## 🐛 Bug Fixes
+ * Fix edit history being broken after editing an unencrypted event with an encrypted event ([\#2013](https://github.com/matrix-org/matrix-js-sdk/pull/2013)). Fixes vector-im/element-web#19651 and vector-im/element-web#19651. Contributed by @aaronraimist.
+ * Make events pagination responses parse threads ([\#2011](https://github.com/matrix-org/matrix-js-sdk/pull/2011)). Fixes vector-im/element-web#19587 and vector-im/element-web#19587.
+
+Changes in [15.1.1-rc.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.1.1-rc.1) (2021-11-17)
+============================================================================================================
+
+## 🐛 Bug Fixes
+ * Fix edit history being broken after editing an unencrypted event with an encrypted event ([\#2013](https://github.com/matrix-org/matrix-js-sdk/pull/2013)). Fixes vector-im/element-web#19651 and vector-im/element-web#19651. Contributed by @aaronraimist.
+ * Make events pagination responses parse threads ([\#2011](https://github.com/matrix-org/matrix-js-sdk/pull/2011)). Fixes vector-im/element-web#19587 and vector-im/element-web#19587.
+
+Changes in [15.1.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.1.0) (2021-11-08)
+==================================================================================================
+
+## 🦖 Deprecations
+ * Mark old verification methods as deprecated ([\#1994](https://github.com/matrix-org/matrix-js-sdk/pull/1994)).
+
+## ✨ Features
+ * Try to set a sender on search result events if possible ([\#2004](https://github.com/matrix-org/matrix-js-sdk/pull/2004)).
+ * Port some changes from group calls branch to develop ([\#2001](https://github.com/matrix-org/matrix-js-sdk/pull/2001)). Contributed by @SimonBrandner.
+ * Fetch room membership from server rather than relying on stored data ([\#1998](https://github.com/matrix-org/matrix-js-sdk/pull/1998)).
+ * Add method to fetch the MSC3266 Room Summary of a Room ([\#1988](https://github.com/matrix-org/matrix-js-sdk/pull/1988)).
+
+## 🐛 Bug Fixes
+ * Don't show `Unable to access microphone` when cancelling screensharing dialog ([\#2005](https://github.com/matrix-org/matrix-js-sdk/pull/2005)). Fixes vector-im/element-web#19533 and vector-im/element-web#19533. Contributed by @SimonBrandner.
+ * Strip direction override characters from display names ([\#1992](https://github.com/matrix-org/matrix-js-sdk/pull/1992)). Fixes vector-im/element-web#1712 and vector-im/element-web#1712.
+
+Changes in [15.1.0-rc.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v15.1.0-rc.1) (2021-11-02)
+============================================================================================================
+
+## 🦖 Deprecations
+ * Mark old verification methods as deprecated ([\#1994](https://github.com/matrix-org/matrix-js-sdk/pull/1994)).
+
+## ✨ Features
+ * Try to set a sender on search result events if possible ([\#2004](https://github.com/matrix-org/matrix-js-sdk/pull/2004)).
+ * Port some changes from group calls branch to develop ([\#2001](https://github.com/matrix-org/matrix-js-sdk/pull/2001)). Contributed by @SimonBrandner.
+ * Fetch room membership from server rather than relying on stored data ([\#1998](https://github.com/matrix-org/matrix-js-sdk/pull/1998)).
+ * Add method to fetch the MSC3266 Room Summary of a Room ([\#1988](https://github.com/matrix-org/matrix-js-sdk/pull/1988)).
+
+## 🐛 Bug Fixes
+ * Don't show `Unable to access microphone` when cancelling screensharing dialog ([\#2005](https://github.com/matrix-org/matrix-js-sdk/pull/2005)). Fixes vector-im/element-web#19533 and vector-im/element-web#19533. Contributed by @SimonBrandner.
+ * Strip direction override characters from display names ([\#1992](https://github.com/matrix-org/matrix-js-sdk/pull/1992)). Fixes vector-im/element-web#1712 and vector-im/element-web#1712.
+
+Changes in [15.0.0](https://github.com/vector-im/element-desktop/releases/tag/v15.0.0) (2021-10-25)
+===================================================================================================
+
+## 🚨 BREAKING CHANGES
+ * Use `ICallFeedOpts` in the `CallFeed` constructor. To construct a new `CallFeed` object you have to pass `ICallFeedOpts` e.g. `const callFeed = new CallFeed({client ([\#1964](https://github.com/matrix-org/matrix-js-sdk/pull/1964)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+
+## ✨ Features
+ * Make threads use 'm.thread' relation ([\#1980](https://github.com/matrix-org/matrix-js-sdk/pull/1980)).
+ * Try to answer a call without video if we can't access the camera  ([\#1972](https://github.com/matrix-org/matrix-js-sdk/pull/1972)). Fixes vector-im/element-web#17975 and vector-im/element-web#17975. Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Make `opts` in `importRoomKeys()` optional ([\#1974](https://github.com/matrix-org/matrix-js-sdk/pull/1974)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Enable TypeScript declaration maps ([\#1966](https://github.com/matrix-org/matrix-js-sdk/pull/1966)). Contributed by [Alexendoo](https://github.com/Alexendoo).
+
+## 🐛 Bug Fixes
+ * Fix `requestVerificationDM` with chronological `pendingEventOrdering` ([\#1943](https://github.com/matrix-org/matrix-js-sdk/pull/1943)). Contributed by [freaktechnik](https://github.com/freaktechnik).
+
+Changes in [15.0.0-rc.1](https://github.com/vector-im/element-desktop/releases/tag/v15.0.0-rc.1) (2021-10-19)
+=============================================================================================================
+
+## 🚨 BREAKING CHANGES
+ * Use `ICallFeedOpts` in the `CallFeed` constructor. To construct a new `CallFeed` object you have to pass `ICallFeedOpts` e.g. `const callFeed = new CallFeed({client ([\#1964](https://github.com/matrix-org/matrix-js-sdk/pull/1964)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+
+## ✨ Features
+ * Make threads use 'm.thread' relation ([\#1980](https://github.com/matrix-org/matrix-js-sdk/pull/1980)).
+ * Try to answer a call without video if we can't access the camera  ([\#1972](https://github.com/matrix-org/matrix-js-sdk/pull/1972)). Fixes vector-im/element-web#17975 and vector-im/element-web#17975. Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Make `opts` in `importRoomKeys()` optional ([\#1974](https://github.com/matrix-org/matrix-js-sdk/pull/1974)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Enable TypeScript declaration maps ([\#1966](https://github.com/matrix-org/matrix-js-sdk/pull/1966)). Contributed by [Alexendoo](https://github.com/Alexendoo).
+
+## 🐛 Bug Fixes
+ * Fix `requestVerificationDM` with chronological `pendingEventOrdering` ([\#1943](https://github.com/matrix-org/matrix-js-sdk/pull/1943)). Contributed by [freaktechnik](https://github.com/freaktechnik).
+
+Changes in [14.0.1](https://github.com/vector-im/element-desktop/releases/tag/v14.0.1) (2021-10-12)
+===================================================================================================
+
+## 🚨 BREAKING CHANGES
+ * Support for call upgrades. `setLocalVideoMuted()` and `setMicrophoneMuted()` are now `async` and return the new mute state ([\#1827](https://github.com/matrix-org/matrix-js-sdk/pull/1827)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+
+## ✨ Features
+ * Implement file versioning for tree spaces ([\#1952](https://github.com/matrix-org/matrix-js-sdk/pull/1952)).
+ * Allow answering calls without audio/video ([\#1950](https://github.com/matrix-org/matrix-js-sdk/pull/1950)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Add `bound` to `IThreepid` ([\#1941](https://github.com/matrix-org/matrix-js-sdk/pull/1941)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Add `trusted_locally` to `TrustInfo` ([\#1942](https://github.com/matrix-org/matrix-js-sdk/pull/1942)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+
+## 🐛 Bug Fixes
+ * Fix incorrect return value type in getJoinedRooms() ([\#1959](https://github.com/matrix-org/matrix-js-sdk/pull/1959)). Contributed by [psrpinto](https://github.com/psrpinto).
+ * Make sure to set `callLengthInterval` only once ([\#1958](https://github.com/matrix-org/matrix-js-sdk/pull/1958)). Fixes vector-im/element-web#19221 and vector-im/element-web#19221. Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Fix event partitioning from non threading ready clients ([\#1948](https://github.com/matrix-org/matrix-js-sdk/pull/1948)).
+ * Ensure unencrypted fields get exposed by getEffectiveEvent() ([\#1938](https://github.com/matrix-org/matrix-js-sdk/pull/1938)). Fixes vector-im/element-web#19062 and vector-im/element-web#19062.
+
+
+Changes in [14.0.0-rc.1](https://github.com/vector-im/element-desktop/releases/tag/v14.0.0-rc.1) (2021-10-04)
+=============================================================================================================
+
+## 🚨 BREAKING CHANGES
+ * Support for call upgrades. `setLocalVideoMuted()` and `setMicrophoneMuted()` are now `async` and return the new mute state ([\#1827](https://github.com/matrix-org/matrix-js-sdk/pull/1827)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+
+## ✨ Features
+ * Implement file versioning for tree spaces ([\#1952](https://github.com/matrix-org/matrix-js-sdk/pull/1952)).
+ * Allow answering calls without audio/video ([\#1950](https://github.com/matrix-org/matrix-js-sdk/pull/1950)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Add `bound` to `IThreepid` ([\#1941](https://github.com/matrix-org/matrix-js-sdk/pull/1941)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Add `trusted_locally` to `TrustInfo` ([\#1942](https://github.com/matrix-org/matrix-js-sdk/pull/1942)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+
+## 🐛 Bug Fixes
+ * Fix incorrect return value type in getJoinedRooms() ([\#1959](https://github.com/matrix-org/matrix-js-sdk/pull/1959)). Contributed by [psrpinto](https://github.com/psrpinto).
+ * Make sure to set `callLengthInterval` only once ([\#1958](https://github.com/matrix-org/matrix-js-sdk/pull/1958)). Fixes vector-im/element-web#19221 and vector-im/element-web#19221. Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Fix event partitioning from non threading ready clients ([\#1948](https://github.com/matrix-org/matrix-js-sdk/pull/1948)).
+ * Ensure unencrypted fields get exposed by getEffectiveEvent() ([\#1938](https://github.com/matrix-org/matrix-js-sdk/pull/1938)). Fixes vector-im/element-web#19062 and vector-im/element-web#19062.
+
+Changes in [13.0.0](https://github.com/vector-im/element-desktop/releases/tag/v13.0.0) (2021-09-27)
+===================================================================================================
+
+## ✨ Features
+ * Add `getHistoryVisibility()` and `getGuestAccess()` ([\#1940](https://github.com/matrix-org/matrix-js-sdk/pull/1940)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Add `getBuffer()` to `QRCodeData` ([\#1927](https://github.com/matrix-org/matrix-js-sdk/pull/1927)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Added `createDataChannel()` and `CallEvent.DataChannel` to `MatrixCall` for creating and listening for WebRTC datachannels. ([\#1929](https://github.com/matrix-org/matrix-js-sdk/pull/1929)). Contributed by [robertlong](https://github.com/robertlong).
+ * Add file locking to MSC3089 branches ([\#1909](https://github.com/matrix-org/matrix-js-sdk/pull/1909)).
+ * Add `hasBeenCancelled` to `VerificationBase` ([\#1915](https://github.com/matrix-org/matrix-js-sdk/pull/1915)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Add `ISasEvent` ([\#1908](https://github.com/matrix-org/matrix-js-sdk/pull/1908)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Count notifications in encrypted rooms client-side ([\#1872](https://github.com/matrix-org/matrix-js-sdk/pull/1872)). Fixes vector-im/element-web#15393 and vector-im/element-web#15393. Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Exclude opt-in Element performance metrics from encryption ([\#1897](https://github.com/matrix-org/matrix-js-sdk/pull/1897)).
+
+## 🐛 Bug Fixes
+ * Fix race on automatic backup restore ([\#1936](https://github.com/matrix-org/matrix-js-sdk/pull/1936)). Fixes vector-im/element-web#17781 and vector-im/element-web#17781.
+
+Changes in [13.0.0-rc.1](https://github.com/vector-im/element-desktop/releases/tag/v13.0.0-rc.1) (2021-09-21)
+=============================================================================================================
+
+## ✨ Features
+ * Add `getHistoryVisibility()` and `getGuestAccess()` ([\#1940](https://github.com/matrix-org/matrix-js-sdk/pull/1940)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Add `getBuffer()` to `QRCodeData` ([\#1927](https://github.com/matrix-org/matrix-js-sdk/pull/1927)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Added `createDataChannel()` and `CallEvent.DataChannel` to `MatrixCall` for creating and listening for WebRTC datachannels. ([\#1929](https://github.com/matrix-org/matrix-js-sdk/pull/1929)). Contributed by [robertlong](https://github.com/robertlong).
+ * Add file locking to MSC3089 branches ([\#1909](https://github.com/matrix-org/matrix-js-sdk/pull/1909)).
+ * Add `hasBeenCancelled` to `VerificationBase` ([\#1915](https://github.com/matrix-org/matrix-js-sdk/pull/1915)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Add `ISasEvent` ([\#1908](https://github.com/matrix-org/matrix-js-sdk/pull/1908)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Count notifications in encrypted rooms client-side ([\#1872](https://github.com/matrix-org/matrix-js-sdk/pull/1872)). Fixes vector-im/element-web#15393 and vector-im/element-web#15393. Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Exclude opt-in Element performance metrics from encryption ([\#1897](https://github.com/matrix-org/matrix-js-sdk/pull/1897)).
+
+## 🐛 Bug Fixes
+ * Fix race on automatic backup restore ([\#1936](https://github.com/matrix-org/matrix-js-sdk/pull/1936)). Fixes vector-im/element-web#17781 and vector-im/element-web#17781.
+
+Changes in [12.5.0](https://github.com/vector-im/element-desktop/releases/tag/v12.5.0) (2021-09-14)
+===================================================================================================
+
+## ✨ Features
+ * [Release] Exclude opt-in Element performance metrics from encryption ([\#1901](https://github.com/matrix-org/matrix-js-sdk/pull/1901)).
+ * Give `MatrixCall` the capability to emit `LengthChanged` events ([\#1873](https://github.com/matrix-org/matrix-js-sdk/pull/1873)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Improve browser example ([\#1875](https://github.com/matrix-org/matrix-js-sdk/pull/1875)). Contributed by [psrpinto](https://github.com/psrpinto).
+ * Give `CallFeed` the capability to emit on volume changes ([\#1865](https://github.com/matrix-org/matrix-js-sdk/pull/1865)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+
+## 🐛 Bug Fixes
+ * Fix verification request cancellation ([\#1871](https://github.com/matrix-org/matrix-js-sdk/pull/1871)).
+
+Changes in [12.4.1](https://github.com/vector-im/element-desktop/releases/tag/v12.4.1) (2021-09-13)
+===================================================================================================
+
+## 🔒 SECURITY FIXES
+ * Fix a security issue with message key sharing. See https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing
+   for details.
+
+Changes in [12.4.0](https://github.com/vector-im/element-desktop/releases/tag/v12.4.0) (2021-08-31)
+===================================================================================================
+
+## 🦖 Deprecations
+ * Deprecate groups APIs. Groups are no longer supported, only Synapse has support. They are being replaced by Spaces which build off of Rooms and are far more flexible. ([\#1792](https://github.com/matrix-org/matrix-js-sdk/pull/1792)).
+
+## ✨ Features
+ * Add method for including extra fields when uploading to a tree space ([\#1850](https://github.com/matrix-org/matrix-js-sdk/pull/1850)).
+
+## 🐛 Bug Fixes
+ * Fix broken voice calls, no ringing and broken call notifications ([\#1858](https://github.com/matrix-org/matrix-js-sdk/pull/1858)). Fixes vector-im/element-web#18578 vector-im/element-web#18538 and vector-im/element-web#18578. Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Revert "Fix glare related regressions" ([\#1857](https://github.com/matrix-org/matrix-js-sdk/pull/1857)).
+ * Fix glare related regressions ([\#1851](https://github.com/matrix-org/matrix-js-sdk/pull/1851)). Fixes vector-im/element-web#18538 and vector-im/element-web#18538. Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Fix temporary call messages being handled without call  ([\#1834](https://github.com/matrix-org/matrix-js-sdk/pull/1834)). Contributed by [Palid](https://github.com/Palid).
+ * Fix conditional on returning file tree spaces ([\#1841](https://github.com/matrix-org/matrix-js-sdk/pull/1841)).
+
+Changes in [12.3.1](https://github.com/vector-im/element-desktop/releases/tag/v12.3.1) (2021-08-17)
+===================================================================================================
+
+## 🐛 Bug Fixes
+ * Fix multiple VoIP regressions ([\#1860](https://github.com/matrix-org/matrix-js-sdk/pull/1860)).
+
+Changes in [12.3.0](https://github.com/vector-im/element-desktop/releases/tag/v12.3.0) (2021-08-16)
+===================================================================================================
+
+## ✨ Features
+ * Support for MSC3291: Muting in VoIP calls ([\#1812](https://github.com/matrix-org/matrix-js-sdk/pull/1812)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Support for screen-sharing using multi-stream VoIP (MSC3077) ([\#1685](https://github.com/matrix-org/matrix-js-sdk/pull/1685)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Handle DTMF support ([\#1813](https://github.com/matrix-org/matrix-js-sdk/pull/1813)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+
+## 🐛 Bug Fixes
+ * [Release] Fix glare related regressions ([\#1854](https://github.com/matrix-org/matrix-js-sdk/pull/1854)). Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Fix the types in shipped package ([\#1842](https://github.com/matrix-org/matrix-js-sdk/pull/1842)). Fixes vector-im/element-web#18503 and vector-im/element-web#18503.
+ * Fix error on turning off screensharing ([\#1833](https://github.com/matrix-org/matrix-js-sdk/pull/1833)). Fixes vector-im/element-web#18449. Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Fix blank profile in join events ([\#1837](https://github.com/matrix-org/matrix-js-sdk/pull/1837)). Fixes vector-im/element-web#18321.
+ * fix TURN by fixing regression preventing multiple ICE candidates from sending. ([\#1838](https://github.com/matrix-org/matrix-js-sdk/pull/1838)).
+ * Send `user_hangup` reason if the opponent supports it ([\#1820](https://github.com/matrix-org/matrix-js-sdk/pull/1820)). Fixes vector-im/element-web#18219. Contributed by [SimonBrandner](https://github.com/SimonBrandner).
+ * Apply hidden char check to rawDisplayName too ([\#1816](https://github.com/matrix-org/matrix-js-sdk/pull/1816)).
+ * Only clear bit 63 when we create the IV ([\#1819](https://github.com/matrix-org/matrix-js-sdk/pull/1819)).
+
+Changes in [12.2.0](https://github.com/vector-im/element-desktop/releases/tag/v12.2.0) (2021-08-02)
+===================================================================================================
+
+## ✨ Features
+ * Improve calculateRoomName performances by using Intl.Collator
+   [\#1801](https://github.com/matrix-org/matrix-js-sdk/pull/1801)
+ * Switch callEventHandler from listening on `event` to `Room.timeline`
+   [\#1789](https://github.com/matrix-org/matrix-js-sdk/pull/1789)
+ * Expose MatrixEvent's internal clearEvent as a function
+   [\#1784](https://github.com/matrix-org/matrix-js-sdk/pull/1784)
+
+## 🐛 Bug Fixes
+ * Clean up Event.clearEvent handling to fix a bug where malformed events with falsey content wouldn't be considered decrypted
+   [\#1807](https://github.com/matrix-org/matrix-js-sdk/pull/1807)
+ * Standardise spelling and casing of homeserver, identity server, and integration manager
+   [\#1782](https://github.com/matrix-org/matrix-js-sdk/pull/1782)
+
+Changes in [12.1.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v12.1.0) (2021-07-19)
+==================================================================================================
+[Full Changelog](https://github.com/matrix-org/matrix-js-sdk/compare/v12.1.0-rc.1...v12.1.0)
+
+ * No changes from rc.1
+
+Changes in [12.1.0-rc.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v12.1.0-rc.1) (2021-07-14)
+============================================================================================================
+[Full Changelog](https://github.com/matrix-org/matrix-js-sdk/compare/v12.0.1...v12.1.0-rc.1)
+
+ * Add VS Code to gitignore
+   [\#1783](https://github.com/matrix-org/matrix-js-sdk/pull/1783)
+ * Make `Crypto::inRoomVerificationRequests` public
+   [\#1781](https://github.com/matrix-org/matrix-js-sdk/pull/1781)
+ * Call `setEventMetadata()` for filtered `timelineSet`s
+   [\#1765](https://github.com/matrix-org/matrix-js-sdk/pull/1765)
+ * Symmetric backup
+   [\#1775](https://github.com/matrix-org/matrix-js-sdk/pull/1775)
+ * Attempt to fix megolm key not being in SSSS
+   [\#1776](https://github.com/matrix-org/matrix-js-sdk/pull/1776)
+ * Convert SecretStorage to TypeScript
+   [\#1774](https://github.com/matrix-org/matrix-js-sdk/pull/1774)
+ * Strip hash from urls being previewed to de-duplicate
+   [\#1721](https://github.com/matrix-org/matrix-js-sdk/pull/1721)
+ * Do not generate a lockfile when running in CI
+   [\#1773](https://github.com/matrix-org/matrix-js-sdk/pull/1773)
+ * Tidy up secret requesting code
+   [\#1766](https://github.com/matrix-org/matrix-js-sdk/pull/1766)
+ * Convert Sync and SyncAccumulator to Typescript
+   [\#1763](https://github.com/matrix-org/matrix-js-sdk/pull/1763)
+ * Convert EventTimeline, EventTimelineSet and TimelineWindow to TS
+   [\#1762](https://github.com/matrix-org/matrix-js-sdk/pull/1762)
+ * Comply with new member-delimiter-style rule
+   [\#1764](https://github.com/matrix-org/matrix-js-sdk/pull/1764)
+ * Do not honor string power levels
+   [\#1754](https://github.com/matrix-org/matrix-js-sdk/pull/1754)
+ * Typescriptify some crypto stuffs
+   [\#1508](https://github.com/matrix-org/matrix-js-sdk/pull/1508)
+ * Make filterId read/write and optional
+   [\#1760](https://github.com/matrix-org/matrix-js-sdk/pull/1760)
+
+Changes in [12.0.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v12.0.1) (2021-07-05)
+==================================================================================================
+[Full Changelog](https://github.com/matrix-org/matrix-js-sdk/compare/v12.0.1-rc.1...v12.0.1)
+
+ * No changes from rc.1
+
+Changes in [12.0.1-rc.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v12.0.1-rc.1) (2021-06-29)
+============================================================================================================
+[Full Changelog](https://github.com/matrix-org/matrix-js-sdk/compare/v12.0.0...v12.0.1-rc.1)
+
+ * Fix broken /messages filtering due to internal field changes in
+   FilterComponent
+   [\#1759](https://github.com/matrix-org/matrix-js-sdk/pull/1759)
+ * Convert crypto index to TS
+   [\#1749](https://github.com/matrix-org/matrix-js-sdk/pull/1749)
+ * Fix typescript return types for membership update events
+   [\#1739](https://github.com/matrix-org/matrix-js-sdk/pull/1739)
+ * Fix types of MatrixEvent sender & target
+   [\#1753](https://github.com/matrix-org/matrix-js-sdk/pull/1753)
+ * Add keysharing on invites to File Tree Spaces
+   [\#1744](https://github.com/matrix-org/matrix-js-sdk/pull/1744)
+ * Convert Room and RoomState to Typescript
+   [\#1746](https://github.com/matrix-org/matrix-js-sdk/pull/1746)
+ * Improve type of IContent msgtype
+   [\#1752](https://github.com/matrix-org/matrix-js-sdk/pull/1752)
+ * Add PR template
+   [\#1747](https://github.com/matrix-org/matrix-js-sdk/pull/1747)
+ * Add functions to assist in immutability of Event objects
+   [\#1738](https://github.com/matrix-org/matrix-js-sdk/pull/1738)
+ * Convert Event Context to TS
+   [\#1742](https://github.com/matrix-org/matrix-js-sdk/pull/1742)
+ * Bump lodash from 4.17.20 to 4.17.21
+   [\#1743](https://github.com/matrix-org/matrix-js-sdk/pull/1743)
+ * Add invite retries to file trees
+   [\#1740](https://github.com/matrix-org/matrix-js-sdk/pull/1740)
+ * Convert IndexedDBStore to TS
+   [\#1741](https://github.com/matrix-org/matrix-js-sdk/pull/1741)
+ * Convert additional files to typescript
+   [\#1736](https://github.com/matrix-org/matrix-js-sdk/pull/1736)
+
+Changes in [12.0.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v12.0.0) (2021-06-21)
+==================================================================================================
+[Full Changelog](https://github.com/matrix-org/matrix-js-sdk/compare/v12.0.0-rc.1...v12.0.0)
+
+ * No changes since rc.1
+
 Changes in [12.0.0-rc.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v12.0.0-rc.1) (2021-06-15)
 ============================================================================================================
 [Full Changelog](https://github.com/matrix-org/matrix-js-sdk/compare/v11.2.0...v12.0.0-rc.1)
@@ -0,0 +1,215 @@
+Contributing code to matrix-js-sdk
+==================================
+
+Everyone is welcome to contribute code to matrix-js-sdk, provided that they are
+willing to license their contributions under the same license as the project
+itself. We follow a simple 'inbound=outbound' model for contributions: the act
+of submitting an 'inbound' contribution means that the contributor agrees to
+license the code under the same terms as the project's overall 'outbound'
+license - in this case, Apache Software License v2 (see
+[LICENSE](LICENSE)).
+
+How to contribute
+-----------------
+
+The preferred and easiest way to contribute changes to the project is to fork
+it on github, and then create a pull request to ask us to pull your changes
+into our repo (https://help.github.com/articles/using-pull-requests/)
+
+We use GitHub's pull request workflow to review the contribution, and either
+ask you to make any refinements needed or merge it and make them ourselves.
+
+Things that should go into your PR description:
+ * A changelog entry in the `Notes` section (see below)
+ * References to any bugs fixed by the change (in GitHub's `Fixes` notation)
+ * Describe the why and what is changing in the PR description so it's easy for
+   onlookers and reviewers to onboard and context switch.
+ * Include both **before** and **after** screenshots to easily compare and discuss
+   what's changing.
+ * Include a step-by-step testing strategy so that a reviewer can check out the
+   code locally and easily get to the point of testing your change.
+ * Add comments to the diff for the reviewer that might help them to understand
+   why the change is necessary or how they might better understand and review it.
+
+Things that should *not* go into your PR description:
+ * Any information on how the code works or why you chose to do it the way
+   you did. If this isn't obvious from your code, you haven't written enough
+   comments.
+
+We rely on information in pull request to populate the information that goes
+into the changelogs our users see, both for the JS SDK itself and also for some
+projects based on it. This is picked up from both labels on the pull request and
+the `Notes:` annotation in the description. By default, the PR title will be
+used for the changelog entry, but you can specify more options, as follows.
+
+To add a longer, more detailed description of the change for the changelog:
+
+
+*Fix llama herding bug*
+
+```
+Notes: Fix a bug (https://github.com/matrix-org/notaproject/issues/123) where the 'Herd' button would not herd more than 8 Llamas if the moon was in the waxing gibbous phase
+```
+
+For some PRs, it's not useful to have an entry in the user-facing changelog (this is
+the default for PRs labelled with `T-Task`):
+
+*Remove outdated comment from `Ungulates.ts`*
+```
+Notes: none
+```
+
+Sometimes, you're fixing a bug in a downstream project, in which case you want
+an entry in that project's changelog. You can do that too:
+
+*Fix another herding bug*
+```
+Notes: Fix a bug where the `herd()` function would only work on Tuesdays
+element-web notes: Fix a bug where the 'Herd' button only worked on Tuesdays
+```
+
+This example is for Element Web. You can specify:
+ * matrix-react-sdk
+ * element-web
+ * element-desktop
+
+If your PR introduces a breaking change, use the `Notes` section in the same
+way, additionally adding the `X-Breaking-Change` label (see below). There's no need
+to specify in the notes that it's a breaking change - this will be added
+automatically based on the label - but remember to tell the developer how to
+migrate:
+
+*Remove legacy class*
+
+```
+Notes: Remove legacy `Camelopard` class. `Giraffe` should be used instead.
+```
+
+Other metadata can be added using labels.
+ * `X-Breaking-Change`: A breaking change - adding this label will mean the change causes a *major* version bump.
+ * `T-Enhancement`: A new feature - adding this label will mean the change causes a *minor* version bump.
+ * `T-Defect`: A bug fix (in either code or docs).
+ * `T-Task`: No user-facing changes, eg. code comments, CI fixes, refactors or tests. Won't have a changelog entry unless you specify one.
+
+If you don't have permission to add labels, your PR reviewer(s) can work with you
+to add them: ask in the PR description or comments.
+
+We use continuous integration, and all pull requests get automatically tested:
+if your change breaks the build, then the PR will show that there are failed
+checks, so please check back after a few minutes.
+
+Tests
+-----
+If your PR is a feature (ie. if it's being labelled with the 'T-Enhancement'
+label) then we require that the PR also includes tests. These need to test that
+your feature works as expected and ideally test edge cases too. For the js-sdk
+itself, your tests should generally be unit tests. matrix-react-sdk also uses
+these guidelines, so for that your tests can be unit tests using
+react-test-utils, snapshot tests or screenshot tests.
+
+We don't require tests for bug fixes (T-Defect) but strongly encourage regression
+tests for the bug itself wherever possible.
+
+In the future we may formalise this more with a minimum test coverage
+percentage for the diff.
+
+Code style
+----------
+The js-sdk aims to target TypeScript/ES6. All new files should be written in
+TypeScript and existing files should use ES6 principles where possible.
+
+Members should not be exported as a default export in general - it causes problems
+with the architecture of the SDK (index file becomes less clear) and could
+introduce naming problems (as default exports get aliased upon import). In
+general, avoid using `export default`.
+
+The remaining code-style for matrix-js-sdk is not formally documented, but
+contributors are encouraged to read the
+[code style document for matrix-react-sdk](https://github.com/matrix-org/matrix-react-sdk/blob/master/code_style.md)
+and follow the principles set out there.
+
+Please ensure your changes match the cosmetic style of the existing project,
+and ***never*** mix cosmetic and functional changes in the same commit, as it
+makes it horribly hard to review otherwise.
+
+Attribution
+-----------
+Everyone who contributes anything to Matrix is welcome to be listed in the
+AUTHORS.rst file for the project in question. Please feel free to include a
+change to AUTHORS.rst in your pull request to list yourself and a short
+description of the area(s) you've worked on. Also, we sometimes have swag to
+give away to contributors - if you feel that Matrix-branded apparel is missing
+from your life, please mail us your shipping address to matrix at matrix.org
+and we'll try to fix it :)
+
+Sign off
+--------
+In order to have a concrete record that your contribution is intentional
+and you agree to license it under the same terms as the project's license, we've
+adopted the same lightweight approach that the Linux Kernel
+(https://www.kernel.org/doc/Documentation/SubmittingPatches), Docker
+(https://github.com/docker/docker/blob/master/CONTRIBUTING.md), and many other
+projects use: the DCO (Developer Certificate of Origin:
+http://developercertificate.org/). This is a simple declaration that you wrote
+the contribution or otherwise have the right to contribute it to Matrix:
+
+```
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+660 York Street, Suite 102,
+San Francisco, CA 94110 USA
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.
+```
+
+If you agree to this for your contribution, then all that's needed is to
+include the line in your commit or pull request comment:
+
+```
+Signed-off-by: Your Name <your@email.example.org>
+```
+
+We accept contributions under a legally identifiable name, such as your name on
+government documentation or common-law names (names claimed by legitimate usage
+or repute). Unfortunately, we cannot accept anonymous contributions at this
+time.
+
+Git allows you to add this signoff automatically when using the `-s` flag to
+`git commit`, which uses the name and email set in your `user.name` and
+`user.email` git configs.
+
+If you forgot to sign off your commits before making your pull request and are
+on Git 2.17+ you can mass signoff using rebase:
+
+```
+git rebase --signoff origin/develop
+```
@@ -1,131 +0,0 @@
-Contributing code to matrix-js-sdk
-==================================
-
-Everyone is welcome to contribute code to matrix-js-sdk, provided that they are
-willing to license their contributions under the same license as the project
-itself. We follow a simple 'inbound=outbound' model for contributions: the act
-of submitting an 'inbound' contribution means that the contributor agrees to
-license the code under the same terms as the project's overall 'outbound'
-license - in this case, Apache Software License v2 (see `<LICENSE>`_).
-
-How to contribute
-~~~~~~~~~~~~~~~~~
-
-The preferred and easiest way to contribute changes to the project is to fork
-it on github, and then create a pull request to ask us to pull your changes
-into our repo (https://help.github.com/articles/using-pull-requests/)
-
-**The single biggest thing you need to know is: please base your changes on
-the develop branch - /not/ master.**
-
-We use the master branch to track the most recent release, so that folks who
-blindly clone the repo and automatically check out master get something that
-works. Develop is the unstable branch where all the development actually
-happens: the workflow is that contributors should fork the develop branch to
-make a 'feature' branch for a particular contribution, and then make a pull
-request to merge this back into the matrix.org 'official' develop branch. We
-use GitHub's pull request workflow to review the contribution, and either ask
-you to make any refinements needed or merge it and make them ourselves. The
-changes will then land on master when we next do a release.
-
-We use continuous integration, and all pull requests get automatically tested:
-if your change breaks the build, then the PR will show that there are failed
-checks, so please check back after a few minutes.
-
-Code style
-~~~~~~~~~~
-
-The js-sdk aims to target TypeScript/ES6. All new files should be written in
-TypeScript and existing files should use ES6 principles where possible.
-
-Members should not be exported as a default export in general - it causes problems
-with the architecture of the SDK (index file becomes less clear) and could
-introduce naming problems (as default exports get aliased upon import). In
-general, avoid using `export default`.
-
-The remaining code-style for matrix-js-sdk is not formally documented, but
-contributors are encouraged to read the code style document for matrix-react-sdk
-(`<https://github.com/matrix-org/matrix-react-sdk/blob/master/code_style.md>`_)
-and follow the principles set out there.
-
-Please ensure your changes match the cosmetic style of the existing project,
-and **never** mix cosmetic and functional changes in the same commit, as it
-makes it horribly hard to review otherwise.
-
-Attribution
-~~~~~~~~~~~
-
-Everyone who contributes anything to Matrix is welcome to be listed in the
-AUTHORS.rst file for the project in question. Please feel free to include a
-change to AUTHORS.rst in your pull request to list yourself and a short
-description of the area(s) you've worked on. Also, we sometimes have swag to
-give away to contributors - if you feel that Matrix-branded apparel is missing
-from your life, please mail us your shipping address to matrix at matrix.org
-and we'll try to fix it :)
-
-Sign off
-~~~~~~~~
-
-In order to have a concrete record that your contribution is intentional
-and you agree to license it under the same terms as the project's license, we've
-adopted the same lightweight approach that the Linux Kernel
-(https://www.kernel.org/doc/Documentation/SubmittingPatches), Docker
-(https://github.com/docker/docker/blob/master/CONTRIBUTING.md), and many other
-projects use: the DCO (Developer Certificate of Origin:
-http://developercertificate.org/). This is a simple declaration that you wrote
-the contribution or otherwise have the right to contribute it to Matrix::
-
-    Developer Certificate of Origin
-    Version 1.1
-
-    Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
-    660 York Street, Suite 102,
-    San Francisco, CA 94110 USA
-
-    Everyone is permitted to copy and distribute verbatim copies of this
-    license document, but changing it is not allowed.
-
-    Developer's Certificate of Origin 1.1
-
-    By making a contribution to this project, I certify that:
-
-    (a) The contribution was created in whole or in part by me and I
-        have the right to submit it under the open source license
-        indicated in the file; or
-
-    (b) The contribution is based upon previous work that, to the best
-        of my knowledge, is covered under an appropriate open source
-        license and I have the right under that license to submit that
-        work with modifications, whether created in whole or in part
-        by me, under the same open source license (unless I am
-        permitted to submit under a different license), as indicated
-        in the file; or
-
-    (c) The contribution was provided directly to me by some other
-        person who certified (a), (b) or (c) and I have not modified
-        it.
-
-    (d) I understand and agree that this project and the contribution
-        are public and that a record of the contribution (including all
-        personal information I submit with it, including my sign-off) is
-        maintained indefinitely and may be redistributed consistent with
-        this project or the open source license(s) involved.
-
-If you agree to this for your contribution, then all that's needed is to
-include the line in your commit or pull request comment::
-
-    Signed-off-by: Your Name <your@email.example.org>
-
-We accept contributions under a legally identifiable name, such as your name on
-government documentation or common-law names (names claimed by legitimate usage
-or repute). Unfortunately, we cannot accept anonymous contributions at this
-time.
-
-Git allows you to add this signoff automatically when using the ``-s`` flag to
-``git commit``, which uses the name and email set in your ``user.name`` and
-``user.email`` git configs.
-
-If you forgot to sign off your commits before making your pull request and are
-on Git 2.17+ you can mass signoff using rebase::
-
-    git rebase --signoff origin/develop
@@ -1,6 +1,6 @@
 console.log("Loading browser sdk");

-var client = matrixcs.createClient("http://matrix.org");
+var client = matrixcs.createClient("https://matrix.org");
 client.publicRooms(function (err, data) {
    if (err) {
 	   console.error("err %s", JSON.stringify(err));
@@ -1,6 +1,8 @@
-<html>
+<html lang="en">
 <head>
 <title>Test</title>
+<meta charset="utf-8"/>
+<link rel="icon" href="data:,">
 <script src="lib/matrix.js"></script>
 <script src="browserTest.js"></script>
 </head>
@@ -1,16 +1,17 @@
 console.log("Loading browser sdk");
-var BASE_URL = "https://matrix.org";
-var TOKEN = "accesstokengoeshere";
-var USER_ID = "@username:localhost";
-var ROOM_ID = "!room:id";
+const BASE_URL = "https://matrix.org";
+const TOKEN = "accesstokengoeshere";
+const USER_ID = "@username:localhost";
+const ROOM_ID = "!room:id";
+const DEVICE_ID = "some_device_id";

-
-var client = matrixcs.createClient({
+const client = matrixcs.createClient({
    baseUrl: BASE_URL,
    accessToken: TOKEN,
-    userId: USER_ID
+    userId: USER_ID,
+    deviceId: DEVICE_ID
 });
-var call;
+let call;

 function disableButtons(place, answer, hangup) {
    document.getElementById("hangup").disabled = hangup;
@@ -19,7 +20,7 @@ function disableButtons(place, answer, hangup) {
 }

 function addListeners(call) {
-    var lastError = "";
+    let lastError = "";
    call.on("hangup", function() {
        disableButtons(false, true, true);
        document.getElementById("result").innerHTML = (
@@ -1,6 +1,6 @@
 {
  "name": "matrix-js-sdk",
-  "version": "12.0.0-rc.1",
+  "version": "16.0.0",
  "description": "Matrix Client-Server SDK for Javascript",
  "scripts": {
    "prepublishOnly": "yarn build",
@@ -9,13 +9,14 @@
    "clean": "rimraf lib dist",
    "build": "yarn build:dev && yarn build:compile-browser && yarn build:minify-browser",
    "build:dev": "yarn clean && git rev-parse HEAD > git-revision.txt && yarn build:compile && yarn build:types",
-    "build:types": "tsc --emitDeclarationOnly",
+    "build:types": "tsc -p tsconfig-build.json --emitDeclarationOnly",
    "build:compile": "babel -d lib --verbose --extensions \".ts,.js\" src",
-    "build:compile-browser": "mkdirp dist && browserify -d src/browser-index.js -p [ tsify -p ./tsconfig.json ] -t [ babelify --sourceMaps=inline --presets [ @babel/preset-env @babel/preset-typescript ] ] | exorcist dist/browser-matrix.js.map > dist/browser-matrix.js",
+    "build:compile-browser": "mkdirp dist && browserify -d src/browser-index.js -p [ tsify -p ./tsconfig-build.json ] -t [ babelify --sourceMaps=inline --presets [ @babel/preset-env @babel/preset-typescript ] ] | exorcist dist/browser-matrix.js.map > dist/browser-matrix.js",
    "build:minify-browser": "terser dist/browser-matrix.js --compress --mangle --source-map --output dist/browser-matrix.min.js",
    "gendoc": "jsdoc -c jsdoc.json -P package.json",
    "lint": "yarn lint:types && yarn lint:js",
-    "lint:js": "eslint --max-warnings 57 src spec",
+    "lint:js": "eslint --max-warnings 0 src spec",
+    "lint:js-fix": "eslint --fix src spec",
    "lint:types": "tsc --noEmit",
    "test": "jest",
    "test:watch": "jest --watch",
@@ -55,6 +56,8 @@
    "bs58": "^4.0.1",
    "content-type": "^1.0.4",
    "loglevel": "^1.7.1",
+    "matrix-events-sdk": "^0.0.1-beta.7",
+    "p-retry": "^4.5.0",
    "qs": "^6.9.6",
    "request": "^2.88.2",
    "unhomoglyph": "^1.0.6"
@@ -72,20 +75,24 @@
    "@babel/preset-env": "^7.12.11",
    "@babel/preset-typescript": "^7.12.7",
    "@babel/register": "^7.12.10",
-    "@matrix-org/olm": "https://gitlab.matrix.org/api/v4/projects/27/packages/npm/@matrix-org/olm/-/@matrix-org/olm-3.2.3.tgz",
+    "@matrix-org/olm": "https://gitlab.matrix.org/api/v4/projects/27/packages/npm/@matrix-org/olm/-/@matrix-org/olm-3.2.8.tgz",
+    "@types/bs58": "^4.0.1",
+    "@types/content-type": "^1.1.5",
    "@types/jest": "^26.0.20",
    "@types/node": "12",
    "@types/request": "^2.48.5",
-    "@typescript-eslint/eslint-plugin": "^4.17.0",
-    "@typescript-eslint/parser": "^4.17.0",
+    "@typescript-eslint/eslint-plugin": "^5.6.0",
+    "@typescript-eslint/parser": "^5.6.0",
+    "allchange": "^1.0.6",
    "babel-jest": "^26.6.3",
    "babelify": "^10.0.0",
-    "better-docs": "^2.3.2",
+    "better-docs": "^2.4.0-beta.9",
    "browserify": "^17.0.0",
    "docdash": "^1.2.0",
-    "eslint": "7.18.0",
+    "eslint": "8.9.0",
    "eslint-config-google": "^0.14.0",
-    "eslint-plugin-matrix-org": "github:matrix-org/eslint-plugin-matrix-org#main",
+    "eslint-plugin-import": "^2.25.4",
+    "eslint-plugin-matrix-org": "^0.4.0",
    "exorcist": "^1.0.1",
    "fake-indexeddb": "^3.1.2",
    "jest": "^26.6.3",
@@ -95,7 +102,7 @@
    "rimraf": "^3.0.2",
    "terser": "^5.5.1",
    "tsify": "^5.0.2",
-    "typescript": "^4.1.3"
+    "typescript": "^4.5.3"
  },
  "jest": {
    "testEnvironment": "node",
@@ -106,7 +113,8 @@
      "<rootDir>/src/**/*.{js,ts}"
    ],
    "coverageReporters": [
-      "text"
+      "text",
+      "json"
    ]
  },
  "typings": "./lib/index.d.ts"
@@ -100,12 +100,7 @@ fi
 # global cache here to ensure we get the right thing.
 yarn cache clean
 # Ensure all dependencies are updated
-yarn install --ignore-scripts
-
-if [ -z "$skip_changelog" ]; then
-    # update_changelog doesn't have a --version flag
-    update_changelog -h > /dev/null || (echo "github-changelog-generator is required: please install it"; exit)
-fi
+yarn install --ignore-scripts --pure-lockfile

 # Login and publish continues to use `npm`, as it seems to have more clearly
 # defined options and semantics than `yarn` for writing to the registry.
@@ -133,14 +128,6 @@ if [ $prerelease -eq 1 ]; then
    echo Making a PRE-RELEASE
 fi

-if [ -z "$skip_changelog" ]; then
-    if ! command -v update_changelog >/dev/null 2>&1; then
-        echo "release.sh requires github-changelog-generator. Try:" >&2
-        echo "    pip install git+https://github.com/matrix-org/github-changelog-generator.git" >&2
-        exit 1
-    fi
-fi
-
 # we might already be on the release branch, in which case, yay
 # If we're on any branch starting with 'release', we don't create
 # a separate release branch (this allows us to use the same
@@ -156,7 +143,7 @@ fi

 if [ -z "$skip_changelog" ]; then
    echo "Generating changelog"
-    update_changelog -f "$changelog_file" "$release"
+    yarn run allchange "$release"
    read -p "Edit $changelog_file manually, or press enter to continue " REPLY

    if [ -n "$(git ls-files --modified $changelog_file)" ]; then
@@ -204,7 +191,10 @@ git commit package.json $pkglock -m "$tag"
 # figure out if we should be signing this release
 signing_id=
 if [ -f release_config.yaml ]; then
-    signing_id=`cat release_config.yaml | python -c "import yaml; import sys; print yaml.load(sys.stdin)['signing_id']"`
+    result=`cat release_config.yaml | python -c "import yaml; import sys; print yaml.load(sys.stdin)['signing_id']" 2> /dev/null || true`
+    if [ "$?" -eq 0 ]; then
+        signing_id=$result
+    fi
 fi


@@ -225,7 +215,7 @@ if [ $dodist -eq 0 ]; then
    pushd "$builddir"
    git clone "$projdir" .
    git checkout "$rel_branch"
-    yarn install
+    yarn install --pure-lockfile
    # We haven't tagged yet, so tell the dist script what version
    # it's building
    DIST_VERSION="$tag" yarn dist
@@ -265,6 +255,12 @@ if [ -n "$signing_id" ]; then
    # the easiest way to check the validity of the tarball from git is to unzip
    # it and compare it with our own idea of what the tar should look like.

+    # This uses git archive which seems to be what github uses. Specifically,
+    # the header fields are set in the same way: same file mode, uid & gid
+    # both zero and mtime set to the timestamp of the commit that the tag
+    # references. Also note that this puts the commit into the tar headers
+    # and can be extracted with gunzip -c foo.tar.gz | git get-tar-commit-id
+
    # the name of the sig file we want to create
    source_sigfile="${tag}-src.tar.gz.asc"

@@ -20,6 +20,7 @@ limitations under the License.
 import './olm-loader';

 import MockHttpBackend from 'matrix-mock-request';
+
 import { LocalStorageCryptoStore } from '../src/crypto/store/localStorage-crypto-store';
 import { logger } from '../src/logger';
 import { WebStorageSessionStore } from "../src/store/session/webstorage";
@@ -85,6 +86,7 @@ TestClient.prototype.toString = function() {
 */
 TestClient.prototype.start = function() {
    logger.log(this + ': starting');
+    this.httpBackend.when("GET", "/capabilities").respond(200, { capabilities: {} });
    this.httpBackend.when("GET", "/pushrules").respond(200, {});
    this.httpBackend.when("POST", "/filter").respond(200, { filter_id: "fid" });
    this.expectDeviceKeyUpload();
@@ -17,54 +17,34 @@ limitations under the License.
 // load XmlHttpRequest mock
 import "./setupTests";
 import "../../dist/browser-matrix"; // uses browser-matrix instead of the src
-import { MockStorageApi } from "../MockStorageApi";
-import { WebStorageSessionStore } from "../../src/store/session/webstorage";
-import MockHttpBackend from "matrix-mock-request";
-import { LocalStorageCryptoStore } from "../../src/crypto/store/localStorage-crypto-store";
 import * as utils from "../test-utils";
+import { TestClient } from "../TestClient";

 const USER_ID = "@user:test.server";
 const DEVICE_ID = "device_id";
 const ACCESS_TOKEN = "access_token";
 const ROOM_ID = "!room_id:server.test";

-/* global matrixcs */
-
 describe("Browserify Test", function() {
    let client;
    let httpBackend;

-    async function createTestClient() {
-        const sessionStoreBackend = new MockStorageApi();
-        const sessionStore = new WebStorageSessionStore(sessionStoreBackend);
-        const httpBackend = new MockHttpBackend();
+    beforeEach(() => {
+        const testClient = new TestClient(USER_ID, DEVICE_ID, ACCESS_TOKEN);

-        const options = {
-            baseUrl: "http://" + USER_ID + ".test.server",
-            userId: USER_ID,
-            accessToken: ACCESS_TOKEN,
-            deviceId: DEVICE_ID,
-            sessionStore: sessionStore,
-            request: httpBackend.requestFn,
-            cryptoStore: new LocalStorageCryptoStore(sessionStoreBackend),
-        };
-
-        const client = matrixcs.createClient(options);
+        client = testClient.client;
+        httpBackend = testClient.httpBackend;

+        httpBackend.when("GET", "/capabilities").respond(200, { capabilities: {} });
        httpBackend.when("GET", "/pushrules").respond(200, {});
        httpBackend.when("POST", "/filter").respond(200, { filter_id: "fid" });

-        return { client, httpBackend };
-    }
-
-    beforeEach(async () => {
-        ({ client, httpBackend } = await createTestClient());
-        await client.startClient();
+        client.startClient();
    });

    afterEach(async () => {
        client.stopClient();
-        await httpBackend.stop();
+        httpBackend.stop();
    });

    it("Sync", async function() {
@@ -91,10 +71,8 @@ describe("Browserify Test", function() {
        };

        httpBackend.when("GET", "/sync").respond(200, syncData);
-        await Promise.race([
-            Promise.all([
-                httpBackend.flushAllExpected(),
-            ]),
+        return await Promise.race([
+            httpBackend.flushAllExpected(),
            new Promise((_, reject) => {
                client.once("sync.unexpectedError", reject);
            }),
@@ -165,7 +165,7 @@ describe("DeviceList management:", function() {
                   aliceTestClient.httpBackend.flush('/keys/query', 1).then(
                       () => aliceTestClient.httpBackend.flush('/send/', 1),
                   ),
-                   aliceTestClient.client.crypto._deviceList.saveIfDirty(),
+                   aliceTestClient.client.crypto.deviceList.saveIfDirty(),
               ]);
           }).then(() => {
               aliceTestClient.cryptoStore.getEndToEndDeviceData(null, (data) => {
@@ -202,7 +202,7 @@ describe("DeviceList management:", function() {
               return aliceTestClient.httpBackend.flush('/keys/query', 1);
           }).then((flushed) => {
               expect(flushed).toEqual(0);
-               return aliceTestClient.client.crypto._deviceList.saveIfDirty();
+               return aliceTestClient.client.crypto.deviceList.saveIfDirty();
           }).then(() => {
               aliceTestClient.cryptoStore.getEndToEndDeviceData(null, (data) => {
                   const bobStat = data.trackingStatus['@bob:xyz'];
@@ -235,7 +235,7 @@ describe("DeviceList management:", function() {
               // wait for the client to stop processing the response
               return aliceTestClient.client.downloadKeys(['@bob:xyz']);
           }).then(() => {
-               return aliceTestClient.client.crypto._deviceList.saveIfDirty();
+               return aliceTestClient.client.crypto.deviceList.saveIfDirty();
           }).then(() => {
               aliceTestClient.cryptoStore.getEndToEndDeviceData(null, (data) => {
                   const bobStat = data.trackingStatus['@bob:xyz'];
@@ -256,7 +256,7 @@ describe("DeviceList management:", function() {
               // wait for the client to stop processing the response
               return aliceTestClient.client.downloadKeys(['@chris:abc']);
           }).then(() => {
-               return aliceTestClient.client.crypto._deviceList.saveIfDirty();
+               return aliceTestClient.client.crypto.deviceList.saveIfDirty();
           }).then(() => {
               aliceTestClient.cryptoStore.getEndToEndDeviceData(null, (data) => {
                   const bobStat = data.trackingStatus['@bob:xyz'];
@@ -286,7 +286,7 @@ describe("DeviceList management:", function() {
                },
            );
            await aliceTestClient.httpBackend.flush('/keys/query', 1);
-            await aliceTestClient.client.crypto._deviceList.saveIfDirty();
+            await aliceTestClient.client.crypto.deviceList.saveIfDirty();

            aliceTestClient.cryptoStore.getEndToEndDeviceData(null, (data) => {
                const bobStat = data.trackingStatus['@bob:xyz'];
@@ -322,7 +322,7 @@ describe("DeviceList management:", function() {
            );

            await aliceTestClient.flushSync();
-            await aliceTestClient.client.crypto._deviceList.saveIfDirty();
+            await aliceTestClient.client.crypto.deviceList.saveIfDirty();

            aliceTestClient.cryptoStore.getEndToEndDeviceData(null, (data) => {
                const bobStat = data.trackingStatus['@bob:xyz'];
@@ -358,7 +358,7 @@ describe("DeviceList management:", function() {
            );

            await aliceTestClient.flushSync();
-            await aliceTestClient.client.crypto._deviceList.saveIfDirty();
+            await aliceTestClient.client.crypto.deviceList.saveIfDirty();

            aliceTestClient.cryptoStore.getEndToEndDeviceData(null, (data) => {
                const bobStat = data.trackingStatus['@bob:xyz'];
@@ -379,7 +379,7 @@ describe("DeviceList management:", function() {
                anotherTestClient.httpBackend.when('GET', '/sync').respond(
                    200, getSyncResponse([]));
                await anotherTestClient.flushSync();
-                await anotherTestClient.client.crypto._deviceList.saveIfDirty();
+                await anotherTestClient.client.crypto.deviceList.saveIfDirty();

                anotherTestClient.cryptoStore.getEndToEndDeviceData(null, (data) => {
                    const bobStat = data.trackingStatus['@bob:xyz'];
@@ -159,7 +159,7 @@ function aliDownloadsKeys() {
    // check that the localStorage is updated as we expect (not sure this is
    // an integration test, but meh)
    return Promise.all([p1, p2]).then(() => {
-        return aliTestClient.client.crypto._deviceList.saveIfDirty();
+        return aliTestClient.client.crypto.deviceList.saveIfDirty();
    }).then(() => {
        aliTestClient.cryptoStore.getEndToEndDeviceData(null, (data) => {
            const devices = data.devices[bobUserId];
@@ -348,7 +348,7 @@ function recvMessage(httpBackend, client, sender, message) {
        return testUtils.awaitDecryption(event);
    }).then((event) => {
        expect(event.getType()).toEqual("m.room.message");
-        expect(event.getContent()).toEqual({
+        expect(event.getContent()).toMatchObject({
            msgtype: "m.text",
            body: "Hello, World",
        });
@@ -722,6 +722,7 @@ describe("MatrixClient crypto", function() {
        return Promise.resolve()
            .then(() => {
                logger.log(aliTestClient + ': starting');
+                httpBackend.when("GET", "/capabilities").respond(200, {});
                httpBackend.when("GET", "/pushrules").respond(200, {});
                httpBackend.when("POST", "/filter").respond(200, { filter_id: "fid" });
                aliTestClient.expectDeviceKeyUpload();
@@ -13,6 +13,7 @@ describe("MatrixClient events", function() {
        httpBackend = testClient.httpBackend;
        httpBackend.when("GET", "/pushrules").respond(200, {});
        httpBackend.when("POST", "/filter").respond(200, { filter_id: "a filter id" });
+        httpBackend.when("GET", "/capabilities").respond(200, { capabilities: {} });
    });

    afterEach(function() {
@@ -71,6 +71,7 @@ const EVENTS = [

 // start the client, and wait for it to initialise
 function startClient(httpBackend, client) {
+    httpBackend.when("GET", "/capabilities").respond(200, { capabilities: {} });
    httpBackend.when("GET", "/pushrules").respond(200, {});
    httpBackend.when("POST", "/filter").respond(200, { filter_id: "fid" });
    httpBackend.when("GET", "/sync").respond(200, INITIAL_SYNC_DATA);
@@ -502,7 +503,7 @@ describe("MatrixClient event timelines", function() {
                    const params = req.queryParams;
                    expect(params.dir).toEqual("b");
                    expect(params.from).toEqual("start_token0");
-                    expect(params.limit).toEqual(30);
+                    expect(params.limit).toEqual("30");
                }).respond(200, function() {
                    return {
                        chunk: [EVENTS[1], EVENTS[2]],
@@ -553,7 +554,7 @@ describe("MatrixClient event timelines", function() {
                    const params = req.queryParams;
                    expect(params.dir).toEqual("f");
                    expect(params.from).toEqual("end_token0");
-                    expect(params.limit).toEqual(20);
+                    expect(params.limit).toEqual("20");
                }).respond(200, function() {
                    return {
                        chunk: [EVENTS[1], EVENTS[2]],
@@ -1,5 +1,6 @@
 import * as utils from "../test-utils";
 import { CRYPTO_ENABLED } from "../../src/client";
+import { MatrixEvent } from "../../src/models/event";
 import { Filter, MemoryStore, Room } from "../../src/matrix";
 import { TestClient } from "../TestClient";

@@ -336,7 +337,7 @@ describe("MatrixClient", function() {
                var b = JSON.parse(JSON.stringify(o));
                delete(b.signatures);
                delete(b.unsigned);
-                return client.crypto._olmDevice.sign(anotherjson.stringify(b));
+                return client.crypto.olmDevice.sign(anotherjson.stringify(b));
            };

            logger.log("Ed25519: " + ed25519key);
@@ -392,6 +393,414 @@ describe("MatrixClient", function() {
            return prom;
        });
    });
+
+    describe("partitionThreadedEvents", function() {
+        it("returns empty arrays when given an empty arrays", function() {
+            const events = [];
+            const [timeline, threaded] = client.partitionThreadedEvents(events);
+            expect(timeline).toEqual([]);
+            expect(threaded).toEqual([]);
+        });
+
+        it("copies pre-thread in-timeline vote events onto both timelines", function() {
+            client.clientOpts = { experimentalThreadSupport: true };
+
+            const eventMessageInThread = buildEventMessageInThread();
+            const eventPollResponseReference = buildEventPollResponseReference();
+            const eventPollStartThreadRoot = buildEventPollStartThreadRoot();
+
+            const events = [
+                eventMessageInThread,
+                eventPollResponseReference,
+                eventPollStartThreadRoot,
+            ];
+            // Vote has no threadId yet
+            expect(eventPollResponseReference.threadId).toBeFalsy();
+
+            const [timeline, threaded] = client.partitionThreadedEvents(events);
+
+            expect(timeline).toEqual([
+                // The message that was sent in a thread is missing
+                eventPollResponseReference,
+                eventPollStartThreadRoot,
+            ]);
+
+            // The vote event has been copied into the thread
+            const eventRefWithThreadId = withThreadId(
+                eventPollResponseReference, eventPollStartThreadRoot.getId());
+            expect(eventRefWithThreadId.threadId).toBeTruthy();
+
+            expect(threaded).toEqual([
+                eventMessageInThread,
+                eventRefWithThreadId,
+                // Thread does not see thread root
+            ]);
+        });
+
+        it("copies pre-thread in-timeline reactions onto both timelines", function() {
+            client.clientOpts = { experimentalThreadSupport: true };
+
+            const eventMessageInThread = buildEventMessageInThread();
+            const eventReaction = buildEventReaction();
+            const eventPollStartThreadRoot = buildEventPollStartThreadRoot();
+
+            const events = [
+                eventMessageInThread,
+                eventReaction,
+                eventPollStartThreadRoot,
+            ];
+
+            const [timeline, threaded] = client.partitionThreadedEvents(events);
+
+            expect(timeline).toEqual([
+                eventReaction,
+                eventPollStartThreadRoot,
+            ]);
+
+            expect(threaded).toEqual([
+                eventMessageInThread,
+                withThreadId(eventReaction, eventPollStartThreadRoot.getId()),
+            ]);
+        });
+
+        it("copies post-thread in-timeline vote events onto both timelines", function() {
+            client.clientOpts = { experimentalThreadSupport: true };
+
+            const eventPollResponseReference = buildEventPollResponseReference();
+            const eventMessageInThread = buildEventMessageInThread();
+            const eventPollStartThreadRoot = buildEventPollStartThreadRoot();
+
+            const events = [
+                eventPollResponseReference,
+                eventMessageInThread,
+                eventPollStartThreadRoot,
+            ];
+
+            const [timeline, threaded] = client.partitionThreadedEvents(events);
+
+            expect(timeline).toEqual([
+                eventPollResponseReference,
+                eventPollStartThreadRoot,
+            ]);
+
+            expect(threaded).toEqual([
+                withThreadId(eventPollResponseReference, eventPollStartThreadRoot.getId()),
+                eventMessageInThread,
+            ]);
+        });
+
+        it("copies post-thread in-timeline reactions onto both timelines", function() {
+            client.clientOpts = { experimentalThreadSupport: true };
+
+            const eventReaction = buildEventReaction();
+            const eventMessageInThread = buildEventMessageInThread();
+            const eventPollStartThreadRoot = buildEventPollStartThreadRoot();
+
+            const events = [
+                eventReaction,
+                eventMessageInThread,
+                eventPollStartThreadRoot,
+            ];
+
+            const [timeline, threaded] = client.partitionThreadedEvents(events);
+
+            expect(timeline).toEqual([
+                eventReaction,
+                eventPollStartThreadRoot,
+            ]);
+
+            expect(threaded).toEqual([
+                withThreadId(eventReaction, eventPollStartThreadRoot.getId()),
+                eventMessageInThread,
+            ]);
+        });
+
+        it("sends room state events to the main timeline only", function() {
+            client.clientOpts = { experimentalThreadSupport: true };
+            // This is based on recording the events in a real room:
+
+            const eventMessageInThread = buildEventMessageInThread();
+            const eventPollResponseReference = buildEventPollResponseReference();
+            const eventPollStartThreadRoot = buildEventPollStartThreadRoot();
+            const eventRoomName = buildEventRoomName();
+            const eventEncryption = buildEventEncryption();
+            const eventGuestAccess = buildEventGuestAccess();
+            const eventHistoryVisibility = buildEventHistoryVisibility();
+            const eventJoinRules = buildEventJoinRules();
+            const eventPowerLevels = buildEventPowerLevels();
+            const eventMember = buildEventMember();
+            const eventCreate = buildEventCreate();
+
+            const events = [
+                eventMessageInThread,
+                eventPollResponseReference,
+                eventPollStartThreadRoot,
+                eventRoomName,
+                eventEncryption,
+                eventGuestAccess,
+                eventHistoryVisibility,
+                eventJoinRules,
+                eventPowerLevels,
+                eventMember,
+                eventCreate,
+            ];
+            const [timeline, threaded] = client.partitionThreadedEvents(events);
+
+            expect(timeline).toEqual([
+                // The message that was sent in a thread is missing
+                eventPollResponseReference,
+                eventPollStartThreadRoot,
+                eventRoomName,
+                eventEncryption,
+                eventGuestAccess,
+                eventHistoryVisibility,
+                eventJoinRules,
+                eventPowerLevels,
+                eventMember,
+                eventCreate,
+            ]);
+
+            // Thread should contain only stuff that happened in the thread -
+            // no thread root, and no room state events
+            expect(threaded).toEqual([
+                eventMessageInThread,
+                withThreadId(eventPollResponseReference, eventPollStartThreadRoot.getId()),
+            ]);
+        });
+    });
+});
+
+function withThreadId(event, newThreadId) {
+    const ret = event.toSnapshot();
+    ret.setThreadId(newThreadId);
+    return ret;
+}
+
+const buildEventMessageInThread = () => new MatrixEvent({
+    "age": 80098509,
+    "content": {
+        "algorithm": "m.megolm.v1.aes-sha2",
+        "ciphertext": "ENCRYPTEDSTUFF",
+        "device_id": "XISFUZSKHH",
+        "m.relates_to": {
+            "event_id": "$VLS2ojbPmxb6x8ECetn45hmND6cRDcjgv-j-to9m7Vo",
+            "m.in_reply_to": {
+                "event_id": "$VLS2ojbPmxb6x8ECetn45hmND6cRDcjgv-j-to9m7Vo",
+            },
+            "rel_type": "io.element.thread",
+        },
+        "sender_key": "i3N3CtG/CD2bGB8rA9fW6adLYSDvlUhf2iuU73L65Vg",
+        "session_id": "Ja11R/KG6ua0wdk8zAzognrxjio1Gm/RK2Gn6lFL804",
+    },
+    "event_id": "$W4chKIGYowtBblVLkRimeIg8TcdjETnxhDPGfi6NpDg",
+    "origin_server_ts": 1643815466378,
+    "room_id": "!STrMRsukXHtqQdSeHa:matrix.org",
+    "sender": "@andybalaam-test1:matrix.org",
+    "type": "m.room.encrypted",
+    "unsigned": { "age": 80098509 },
+    "user_id": "@andybalaam-test1:matrix.org",
+});
+
+const buildEventPollResponseReference = () => new MatrixEvent({
+    "age": 80098509,
+    "content": {
+        "algorithm": "m.megolm.v1.aes-sha2",
+        "ciphertext": "ENCRYPTEDSTUFF",
+        "device_id": "XISFUZSKHH",
+        "m.relates_to": {
+            "event_id": "$VLS2ojbPmxb6x8ECetn45hmND6cRDcjgv-j-to9m7Vo",
+            "rel_type": "m.reference",
+        },
+        "sender_key": "i3N3CtG/CD2bGB8rA9fW6adLYSDvlUhf2iuU73L65Vg",
+        "session_id": "Ja11R/KG6ua0wdk8zAzognrxjio1Gm/RK2Gn6lFL804",
+    },
+    "event_id": "$91JvpezvsF0cKgav3g8W-uEVS4WkDHgxbJZvL3uMR1g",
+    "origin_server_ts": 1643815458650,
+    "room_id": "!STrMRsukXHtqQdSeHa:matrix.org",
+    "sender": "@andybalaam-test1:matrix.org",
+    "type": "m.room.encrypted",
+    "unsigned": { "age": 80106237 },
+    "user_id": "@andybalaam-test1:matrix.org",
+});
+
+const buildEventReaction = () => new MatrixEvent({
+    "content": {
+        "m.relates_to": {
+            "event_id": "$VLS2ojbPmxb6x8ECetn45hmND6cRDcjgv-j-to9m7Vo",
+            "key": "🤗",
+            "rel_type": "m.annotation",
+        },
+    },
+    "origin_server_ts": 1643977249238,
+    "sender": "@andybalaam-test1:matrix.org",
+    "type": "m.reaction",
+    "unsigned": {
+        "age": 22598,
+        "transaction_id": "m1643977249073.16",
+    },
+    "event_id": "$86B2b-x3LgE4DlV4y24b7UHnt72LIA3rzjvMysTtAfA",
+    "room_id": "!STrMRsukXHtqQdSeHa:matrix.org",
+});
+
+const buildEventPollStartThreadRoot = () => new MatrixEvent({
+    "age": 80108647,
+    "content": {
+        "algorithm": "m.megolm.v1.aes-sha2",
+        "ciphertext": "ENCRYPTEDSTUFF",
+        "device_id": "XISFUZSKHH",
+        "sender_key": "i3N3CtG/CD2bGB8rA9fW6adLYSDvlUhf2iuU73L65Vg",
+        "session_id": "Ja11R/KG6ua0wdk8zAzognrxjio1Gm/RK2Gn6lFL804",
+    },
+    "event_id": "$VLS2ojbPmxb6x8ECetn45hmND6cRDcjgv-j-to9m7Vo",
+    "origin_server_ts": 1643815456240,
+    "room_id": "!STrMRsukXHtqQdSeHa:matrix.org",
+    "sender": "@andybalaam-test1:matrix.org",
+    "type": "m.room.encrypted",
+    "unsigned": { "age": 80108647 },
+    "user_id": "@andybalaam-test1:matrix.org",
+});
+
+const buildEventRoomName = () => new MatrixEvent({
+    "age": 80123249,
+    "content": {
+        "name": "1 poll, 1 vote, 1 thread",
+    },
+    "event_id": "$QAdyNJtKnl1j7or2yMycbOCvb6bCgvHs5lg3ZMd5xWk",
+    "origin_server_ts": 1643815441638,
+    "room_id": "!STrMRsukXHtqQdSeHa:matrix.org",
+    "sender": "@andybalaam-test1:matrix.org",
+    "state_key": "",
+    "type": "m.room.name",
+    "unsigned": { "age": 80123249 },
+    "user_id": "@andybalaam-test1:matrix.org",
+});
+
+const buildEventEncryption = () => new MatrixEvent({
+    "age": 80123383,
+    "content": {
+        "algorithm": "m.megolm.v1.aes-sha2",
+    },
+    "event_id": "$1hGykogKQkXbHw8bVuyE3BjHnFBEJBcUWnakd0ck2K0",
+    "origin_server_ts": 1643815441504,
+    "room_id": "!STrMRsukXHtqQdSeHa:matrix.org",
+    "sender": "@andybalaam-test1:matrix.org",
+    "state_key": "",
+    "type": "m.room.encryption",
+    "unsigned": { "age": 80123383 },
+    "user_id": "@andybalaam-test1:matrix.org",
+});
+
+const buildEventGuestAccess = () => new MatrixEvent({
+    "age": 80123473,
+    "content": {
+        "guest_access": "can_join",
+    },
+    "event_id": "$4_2n-H6K9-0nPbnjjtIue2SU44tGJsnuTmi6UuSrh-U",
+    "origin_server_ts": 1643815441414,
+    "room_id": "!STrMRsukXHtqQdSeHa:matrix.org",
+    "sender": "@andybalaam-test1:matrix.org",
+    "state_key": "",
+    "type": "m.room.guest_access",
+    "unsigned": { "age": 80123473 },
+    "user_id": "@andybalaam-test1:matrix.org",
+});
+
+const buildEventHistoryVisibility = () => new MatrixEvent({
+    "age": 80123556,
+    "content": {
+        "history_visibility": "shared",
+    },
+    "event_id": "$W6kp44CTnvciOiHSPyhp8dh4n2v1_9kclUPddeaQj0E",
+    "origin_server_ts": 1643815441331,
+    "room_id": "!STrMRsukXHtqQdSeHa:matrix.org",
+    "sender": "@andybalaam-test1:matrix.org",
+    "state_key": "",
+    "type": "m.room.history_visibility",
+    "unsigned": { "age": 80123556 },
+    "user_id": "@andybalaam-test1:matrix.org",
+});
+
+const buildEventJoinRules = () => new MatrixEvent({
+    "age": 80123696,
+    "content": {
+        "join_rule": "invite",
+    },
+    "event_id": "$6JDDeDp7fEc0F6YnTWMruNcKWFltR3e9wk7wWDDJrAU",
+    "origin_server_ts": 1643815441191,
+    "room_id": "!STrMRsukXHtqQdSeHa:matrix.org",
+    "sender": "@andybalaam-test1:matrix.org",
+    "state_key": "",
+    "type": "m.room.join_rules",
+    "unsigned": { "age": 80123696 },
+    "user_id": "@andybalaam-test1:matrix.org",
+});
+
+const buildEventPowerLevels = () => new MatrixEvent({
+    "age": 80124105,
+    "content": {
+        "ban": 50,
+        "events": {
+            "m.room.avatar": 50,
+            "m.room.canonical_alias": 50,
+            "m.room.encryption": 100,
+            "m.room.history_visibility": 100,
+            "m.room.name": 50,
+            "m.room.power_levels": 100,
+            "m.room.server_acl": 100,
+            "m.room.tombstone": 100,
+        },
+        "events_default": 0,
+        "historical": 100,
+        "invite": 0,
+        "kick": 50,
+        "redact": 50,
+        "state_default": 50,
+        "users": {
+            "@andybalaam-test1:matrix.org": 100,
+        },
+        "users_default": 0,
+    },
+    "event_id": "$XZY2YgQhXskpc7gmJJG3S0VmS9_QjjCUVeeFTfgfC2E",
+    "origin_server_ts": 1643815440782,
+    "room_id": "!STrMRsukXHtqQdSeHa:matrix.org",
+    "sender": "@andybalaam-test1:matrix.org",
+    "state_key": "",
+    "type": "m.room.power_levels",
+    "unsigned": { "age": 80124105 },
+    "user_id": "@andybalaam-test1:matrix.org",
+});
+
+const buildEventMember = () => new MatrixEvent({
+    "age": 80125279,
+    "content": {
+        "avatar_url": "mxc://matrix.org/aNtbVcFfwotudypZcHsIcPOc",
+        "displayname": "andybalaam-test1",
+        "membership": "join",
+    },
+    "event_id": "$Ex5eVmMs_ti784mo8bgddynbwLvy6231lCycJr7Cl9M",
+    "origin_server_ts": 1643815439608,
+    "room_id": "!STrMRsukXHtqQdSeHa:matrix.org",
+    "sender": "@andybalaam-test1:matrix.org",
+    "state_key": "@andybalaam-test1:matrix.org",
+    "type": "m.room.member",
+    "unsigned": { "age": 80125279 },
+    "user_id": "@andybalaam-test1:matrix.org",
+});
+
+const buildEventCreate = () => new MatrixEvent({
+    "age": 80126105,
+    "content": {
+        "creator": "@andybalaam-test1:matrix.org",
+        "room_version": "6",
+    },
+    "event_id": "$e7j2Gt37k5NPwB6lz2N3V9lO5pUdNK8Ai7i2FPEK-oI",
+    "origin_server_ts": 1643815438782,
+    "room_id": "!STrMRsukXHtqQdSeHa:matrix.org",
+    "sender": "@andybalaam-test1:matrix.org",
+    "state_key": "",
+    "type": "m.room.create",
+    "unsigned": { "age": 80126105 },
+    "user_id": "@andybalaam-test1:matrix.org",
 });

 function assertObjectContains(obj, expected) {
@@ -1,5 +1,6 @@
-import * as utils from "../test-utils";
 import HttpBackend from "matrix-mock-request";
+
+import * as utils from "../test-utils";
 import { MatrixClient } from "../../src/matrix";
 import { MatrixScheduler } from "../../src/scheduler";
 import { MemoryStore } from "../../src/store/memory";
@@ -104,10 +105,12 @@ describe("MatrixClient opts", function() {
                    expectedEventTypes.indexOf(event.getType()), 1,
                );
            });
+            httpBackend.when("GET", "/capabilities").respond(200, { capabilities: {} });
            httpBackend.when("GET", "/pushrules").respond(200, {});
            httpBackend.when("POST", "/filter").respond(200, { filter_id: "foo" });
            httpBackend.when("GET", "/sync").respond(200, syncData);
-            await client.startClient();
+            client.startClient();
+            await httpBackend.flush("/capabilities", 1);
            await httpBackend.flush("/pushrules", 1);
            await httpBackend.flush("/filter", 1);
            await Promise.all([
@@ -1,16 +1,16 @@
-import { EventStatus } from "../../src/matrix";
+import { EventStatus, RoomEvent } from "../../src/matrix";
 import { MatrixScheduler } from "../../src/scheduler";
 import { Room } from "../../src/models/room";
 import { TestClient } from "../TestClient";

 describe("MatrixClient retrying", function() {
-    let client = null;
-    let httpBackend = null;
+    let client: TestClient = null;
+    let httpBackend: TestClient["httpBackend"] = null;
    let scheduler;
    const userId = "@alice:localhost";
    const accessToken = "aseukfgwef";
    const roomId = "!room:here";
-    let room;
+    let room: Room;

    beforeEach(function() {
        scheduler = new MatrixScheduler();
@@ -23,7 +23,7 @@ describe("MatrixClient retrying", function() {
        );
        httpBackend = testClient.httpBackend;
        client = testClient.client;
-        room = new Room(roomId);
+        room = new Room(roomId, client, userId);
        client.store.storeRoom(room);
    });

@@ -50,17 +50,23 @@ describe("MatrixClient retrying", function() {

    it("should mark events as EventStatus.CANCELLED when cancelled", function() {
        // send a couple of events; the second will be queued
-        const p1 = client.sendMessage(roomId, "m1").then(function(ev) {
+        const p1 = client.sendMessage(roomId, {
+            "msgtype": "m.text",
+            "body": "m1",
+        }).then(function() {
            // we expect the first message to fail
            throw new Error('Message 1 unexpectedly sent successfully');
-        }, (e) => {
+        }, () => {
            // this is expected
        });

        // XXX: it turns out that the promise returned by this message
        // never gets resolved.
        // https://github.com/matrix-org/matrix-js-sdk/issues/496
-        client.sendMessage(roomId, "m2");
+        client.sendMessage(roomId, {
+            "msgtype": "m.text",
+            "body": "m2",
+        });

        // both events should be in the timeline at this point
        const tl = room.getLiveTimeline().getEvents();
@@ -72,7 +78,7 @@ describe("MatrixClient retrying", function() {
        expect(ev2.status).toEqual(EventStatus.SENDING);

        // the first message should get sent, and the second should get queued
-        httpBackend.when("PUT", "/send/m.room.message/").check(function(rq) {
+        httpBackend.when("PUT", "/send/m.room.message/").check(function() {
            // ev2 should now have been queued
            expect(ev2.status).toEqual(EventStatus.QUEUED);

@@ -88,8 +94,8 @@ describe("MatrixClient retrying", function() {
        }).respond(400); // fail the first message

        // wait for the localecho of ev1 to be updated
-        const p3 = new Promise((resolve, reject) => {
-            room.on("Room.localEchoUpdated", (ev0) => {
+        const p3 = new Promise<void>((resolve, reject) => {
+            room.on(RoomEvent.LocalEchoUpdated, (ev0) => {
                if (ev0 === ev1) {
                    resolve();
                }
@@ -96,7 +96,7 @@ describe("MatrixClient room timelines", function() {
        });
    }

-    beforeEach(function() {
+    beforeEach(async function() {
        // these tests should work with or without timelineSupport
        const testClient = new TestClient(
            userId,
@@ -109,6 +109,7 @@ describe("MatrixClient room timelines", function() {
        client = testClient.client;

        setNextSyncData();
+        httpBackend.when("GET", "/capabilities").respond(200, { capabilities: {} });
        httpBackend.when("GET", "/pushrules").respond(200, {});
        httpBackend.when("POST", "/filter").respond(200, { filter_id: "fid" });
        httpBackend.when("GET", "/sync").respond(200, SYNC_DATA);
@@ -116,9 +117,10 @@ describe("MatrixClient room timelines", function() {
            return NEXT_SYNC_DATA;
        });
        client.startClient();
-        return httpBackend.flush("/pushrules").then(function() {
-            return httpBackend.flush("/filter");
-        });
+
+        await httpBackend.flush("/capabilities");
+        await httpBackend.flush("/pushrules");
+        await httpBackend.flush("/filter");
    });

    afterEach(function() {
@@ -19,6 +19,7 @@ describe("MatrixClient syncing", function() {
        const testClient = new TestClient(selfUserId, "DEVICE", selfAccessToken);
        httpBackend = testClient.httpBackend;
        client = testClient.client;
+        httpBackend.when("GET", "/capabilities").respond(200, { capabilities: {} });
        httpBackend.when("GET", "/pushrules").respond(200, {});
        httpBackend.when("POST", "/filter").respond(200, { filter_id: "a filter id" });
    });
@@ -16,6 +16,7 @@ limitations under the License.
 */

 import anotherjson from "another-json";
+
 import * as testUtils from "../test-utils";
 import { TestClient } from "../TestClient";
 import { logger } from "../../src/logger";
@@ -1012,8 +1013,8 @@ describe("megolm", function() {
                },
                event: true,
            });
-            event._senderCurve25519Key = testSenderKey;
-            return testClient.client.crypto._onRoomKeyEvent(event);
+            event.senderCurve25519Key = testSenderKey;
+            return testClient.client.crypto.onRoomKeyEvent(event);
        }).then(() => {
            const event = testUtils.mkEvent({
                event: true,
@@ -1025,4 +1026,68 @@ describe("megolm", function() {
            });
        });
    });
+
+    it("Alice can decrypt a message with falsey content", function() {
+        return aliceTestClient.start().then(() => {
+            return createOlmSession(testOlmAccount, aliceTestClient);
+        }).then((p2pSession) => {
+            const groupSession = new Olm.OutboundGroupSession();
+            groupSession.create();
+
+            // make the room_key event
+            const roomKeyEncrypted = encryptGroupSessionKey({
+                senderKey: testSenderKey,
+                recipient: aliceTestClient,
+                p2pSession: p2pSession,
+                groupSession: groupSession,
+                room_id: ROOM_ID,
+            });
+
+            const plaintext = {
+                type: "m.room.message",
+                content: undefined,
+                room_id: ROOM_ID,
+            };
+
+            const messageEncrypted = {
+                event_id: 'test_megolm_event',
+                content: {
+                    algorithm: "m.megolm.v1.aes-sha2",
+                    ciphertext: groupSession.encrypt(JSON.stringify(plaintext)),
+                    device_id: "testDevice",
+                    sender_key: testSenderKey,
+                    session_id: groupSession.session_id(),
+                },
+                type: "m.room.encrypted",
+            };
+
+            // Alice gets both the events in a single sync
+            const syncResponse = {
+                next_batch: 1,
+                to_device: {
+                    events: [roomKeyEncrypted],
+                },
+                rooms: {
+                    join: {},
+                },
+            };
+            syncResponse.rooms.join[ROOM_ID] = {
+                timeline: {
+                    events: [messageEncrypted],
+                },
+            };
+
+            aliceTestClient.httpBackend.when("GET", "/sync").respond(200, syncResponse);
+            return aliceTestClient.flushSync();
+        }).then(function() {
+            const room = aliceTestClient.client.getRoom(ROOM_ID);
+            const event = room.getLiveTimeline().getEvents()[0];
+            expect(event.isEncrypted()).toBe(true);
+            return testUtils.awaitDecryption(event);
+        }).then((event) => {
+            expect(event.getRoomId()).toEqual(ROOM_ID);
+            expect(event.getContent()).toEqual({});
+            expect(event.getClearContent()).toBeUndefined();
+        });
+    });
 });
@@ -51,7 +51,7 @@ export function mock(constr, name) {
    result.toString = function() {
        return "mock" + (name ? " of " + name : "");
    };
-    for (const key in constr.prototype) { // eslint-disable-line guard-for-in
+    for (const key of Object.getOwnPropertyNames(constr.prototype)) { // eslint-disable-line guard-for-in
        try {
            if (constr.prototype[key] instanceof Function) {
                result[key] = jest.fn();
@@ -85,13 +85,14 @@ export function mkEvent(opts) {
        room_id: opts.room,
        sender: opts.sender || opts.user, // opts.user for backwards-compat
        content: opts.content,
+        unsigned: opts.unsigned,
        event_id: "$" + Math.random() + "-" + Math.random(),
    };
    if (opts.skey !== undefined) {
        event.state_key = opts.skey;
    } else if (["m.room.name", "m.room.topic", "m.room.create", "m.room.join_rules",
         "m.room.power_levels", "m.room.topic",
-         "com.example.state"].indexOf(opts.type) !== -1) {
+         "com.example.state"].includes(opts.type)) {
        event.state_key = "";
    }
    return opts.event ? new MatrixEvent(event) : event;
@@ -341,8 +342,15 @@ HttpResponse.SYNC_RESPONSE = {
    data: HttpResponse.SYNC_DATA,
 };

+HttpResponse.CAPABILITIES_RESPONSE = {
+    method: "GET",
+    path: "/capabilities",
+    data: { capabilities: {} },
+};
+
 HttpResponse.defaultResponses = function(userId) {
    return [
+        HttpResponse.CAPABILITIES_RESPONSE,
        HttpResponse.PUSH_RULES_RESPONSE,
        HttpResponse.filterResponse(userId),
        HttpResponse.SYNC_RESPONSE,
@@ -350,19 +358,13 @@ HttpResponse.defaultResponses = function(userId) {
 };

 export function setHttpResponses(
-    client, responses, acceptKeepalives, ignoreUnhandledSyncs,
+    httpBackend, responses,
 ) {
-    const httpResponseObj = new HttpResponse(
-        responses, acceptKeepalives, ignoreUnhandledSyncs,
-    );
-
-    const httpReq = httpResponseObj.request.bind(httpResponseObj);
-    client.http = [
-        "authedRequest", "authedRequestWithPrefix", "getContentUri",
-        "request", "requestWithPrefix", "uploadContent",
-    ].reduce((r, k) => {r[k] = jest.fn(); return r;}, {});
-    client.http.authedRequest.mockImplementation(httpReq);
-    client.http.authedRequestWithPrefix.mockImplementation(httpReq);
-    client.http.requestWithPrefix.mockImplementation(httpReq);
-    client.http.request.mockImplementation(httpReq);
+    responses.forEach(response => {
+        httpBackend
+            .when(response.method, response.path)
+            .respond(200, response.data);
+    });
 }
+
+export const emitPromise = (e, k) => new Promise(r => e.once(k, r));
@@ -14,7 +14,9 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

+// eslint-disable-next-line no-restricted-imports
 import { EventEmitter } from "events";
+
 import { ReEmitter } from "../../src/ReEmitter";

 const EVENTNAME = "UnknownEntry";
@@ -16,6 +16,7 @@ limitations under the License.
 */

 import MockHttpBackend from "matrix-mock-request";
+
 import * as sdk from "../../src";
 import { AutoDiscovery } from "../../src/autodiscovery";

@@ -1,4 +1,7 @@
 import '../olm-loader';
+// eslint-disable-next-line no-restricted-imports
+import { EventEmitter } from "events";
+
 import { Crypto } from "../../src/crypto";
 import { WebStorageSessionStore } from "../../src/store/session/webstorage";
 import { MemoryCryptoStore } from "../../src/crypto/store/memory-crypto-store";
@@ -8,7 +11,6 @@ import { MatrixEvent } from "../../src/models/event";
 import { Room } from "../../src/models/room";
 import * as olmlib from "../../src/crypto/olmlib";
 import { sleep } from "../../src/utils";
-import { EventEmitter } from "events";
 import { CRYPTO_ENABLED } from "../../src/client";
 import { DeviceInfo } from "../../src/crypto/deviceinfo";

@@ -65,7 +67,7 @@ describe("Crypto", function() {
                'YmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmI';
            device.keys["ed25519:FLIBBLE"] =
                'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
-            client.crypto._deviceList.getDeviceByIdentityKey = () => device;
+            client.crypto.deviceList.getDeviceByIdentityKey = () => device;

            encryptionInfo = client.getEventEncryptionInfo(event);
            expect(encryptionInfo.encrypted).toBeTruthy();
@@ -213,7 +215,7 @@ describe("Crypto", function() {

                async function keyshareEventForEvent(event, index) {
                    const eventContent = event.getWireContent();
-                    const key = await aliceClient.crypto._olmDevice
+                    const key = await aliceClient.crypto.olmDevice
                        .getInboundGroupSessionKey(
                            roomId, eventContent.sender_key, eventContent.session_id,
                            index,
@@ -234,7 +236,7 @@ describe("Crypto", function() {
                        },
                    });
                    // make onRoomKeyEvent think this was an encrypted event
-                    ksEvent._senderCurve25519Key = "akey";
+                    ksEvent.senderCurve25519Key = "akey";
                    return ksEvent;
                }

@@ -274,9 +276,9 @@ describe("Crypto", function() {
                    // alice encrypts each event, and then bob tries to decrypt
                    // them without any keys, so that they'll be in pending
                    await aliceClient.crypto.encryptEvent(event, aliceRoom);
-                    event._clearEvent = {};
-                    event._senderCurve25519Key = null;
-                    event._claimedEd25519Key = null;
+                    event.clearEvent = undefined;
+                    event.senderCurve25519Key = null;
+                    event.claimedEd25519Key = null;
                    try {
                        await bobClient.crypto.decryptEvent(event);
                    } catch (e) {
@@ -285,7 +287,7 @@ describe("Crypto", function() {
                    }
                }));

-                const bobDecryptor = bobClient.crypto._getRoomDecryptor(
+                const bobDecryptor = bobClient.crypto.getRoomDecryptor(
                    roomId, olmlib.MEGOLM_ALGORITHM,
                );

@@ -377,7 +379,7 @@ describe("Crypto", function() {
            // key requests get queued until the sync has finished, but we don't
            // let the client set up enough for that to happen, so gut-wrench a bit
            // to force it to send now.
-            aliceClient.crypto._outgoingRoomKeyRequestManager.sendQueuedRequests();
+            aliceClient.crypto.outgoingRoomKeyRequestManager.sendQueuedRequests();
            jest.runAllTimers();
            await Promise.resolve();
            expect(aliceClient.sendToDevice).toBeCalledTimes(1);
@@ -256,97 +256,145 @@ describe("MegolmDecryption", function() {
            });
        });

-        it("re-uses sessions for sequential messages", async function() {
-            mockCrypto._backupManager = {
-                backupGroupSession: () => {},
-            };
-            const mockStorage = new MockStorageApi();
-            const cryptoStore = new MemoryCryptoStore(mockStorage);
+        describe("session reuse and key reshares", () => {
+            let megolmEncryption;
+            let aliceDeviceInfo;
+            let mockRoom;
+            let olmDevice;

-            const olmDevice = new OlmDevice(cryptoStore);
-            olmDevice.verifySignature = jest.fn();
-            await olmDevice.init();
+            beforeEach(async () => {
+                mockCrypto.backupManager = {
+                    backupGroupSession: () => {},
+                };
+                const mockStorage = new MockStorageApi();
+                const cryptoStore = new MemoryCryptoStore(mockStorage);

-            mockBaseApis.claimOneTimeKeys = jest.fn().mockReturnValue(Promise.resolve({
-                one_time_keys: {
-                    '@alice:home.server': {
-                        aliceDevice: {
-                            'signed_curve25519:flooble': {
-                                key: 'YmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmI',
-                                signatures: {
-                                    '@alice:home.server': {
-                                        'ed25519:aliceDevice': 'totally valid',
+                olmDevice = new OlmDevice(cryptoStore);
+                olmDevice.verifySignature = jest.fn();
+                await olmDevice.init();
+
+                mockBaseApis.claimOneTimeKeys = jest.fn().mockReturnValue(Promise.resolve({
+                    one_time_keys: {
+                        '@alice:home.server': {
+                            aliceDevice: {
+                                'signed_curve25519:flooble': {
+                                    key: 'YmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmI',
+                                    signatures: {
+                                        '@alice:home.server': {
+                                            'ed25519:aliceDevice': 'totally valid',
+                                        },
                                    },
                                },
                            },
                        },
                    },
-                },
-            }));
-            mockBaseApis.sendToDevice = jest.fn().mockResolvedValue(undefined);
+                }));
+                mockBaseApis.sendToDevice = jest.fn().mockResolvedValue(undefined);

-            mockCrypto.downloadKeys.mockReturnValue(Promise.resolve({
-                '@alice:home.server': {
-                    aliceDevice: {
-                        deviceId: 'aliceDevice',
-                        isBlocked: jest.fn().mockReturnValue(false),
-                        isUnverified: jest.fn().mockReturnValue(false),
-                        getIdentityKey: jest.fn().mockReturnValue(
-                            'YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE',
-                        ),
-                        getFingerprint: jest.fn().mockReturnValue(''),
+                aliceDeviceInfo = {
+                    deviceId: 'aliceDevice',
+                    isBlocked: jest.fn().mockReturnValue(false),
+                    isUnverified: jest.fn().mockReturnValue(false),
+                    getIdentityKey: jest.fn().mockReturnValue(
+                        'YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE',
+                    ),
+                    getFingerprint: jest.fn().mockReturnValue(''),
+                };
+
+                mockCrypto.downloadKeys.mockReturnValue(Promise.resolve({
+                    '@alice:home.server': {
+                        aliceDevice: aliceDeviceInfo,
                    },
-                },
-            }));
+                }));

-            mockCrypto.checkDeviceTrust.mockReturnValue({
-                isVerified: () => false,
+                mockCrypto.checkDeviceTrust.mockReturnValue({
+                    isVerified: () => false,
+                });
+
+                megolmEncryption = new MegolmEncryption({
+                    userId: '@user:id',
+                    crypto: mockCrypto,
+                    olmDevice: olmDevice,
+                    baseApis: mockBaseApis,
+                    roomId: ROOM_ID,
+                    config: {
+                        rotation_period_ms: 9999999999999,
+                    },
+                });
+                mockRoom = {
+                    getEncryptionTargetMembers: jest.fn().mockReturnValue(
+                        [{ userId: "@alice:home.server" }],
+                    ),
+                    getBlacklistUnverifiedDevices: jest.fn().mockReturnValue(false),
+                };
            });

-            const megolmEncryption = new MegolmEncryption({
-                userId: '@user:id',
-                crypto: mockCrypto,
-                olmDevice: olmDevice,
-                baseApis: mockBaseApis,
-                roomId: ROOM_ID,
-                config: {
-                    rotation_period_ms: 9999999999999,
-                },
-            });
-            const mockRoom = {
-                getEncryptionTargetMembers: jest.fn().mockReturnValue(
-                    [{ userId: "@alice:home.server" }],
-                ),
-                getBlacklistUnverifiedDevices: jest.fn().mockReturnValue(false),
-            };
-            const ct1 = await megolmEncryption.encryptMessage(mockRoom, "a.fake.type", {
-                body: "Some text",
-            });
-            expect(mockRoom.getEncryptionTargetMembers).toHaveBeenCalled();
+            it("re-uses sessions for sequential messages", async function() {
+                const ct1 = await megolmEncryption.encryptMessage(mockRoom, "a.fake.type", {
+                    body: "Some text",
+                });
+                expect(mockRoom.getEncryptionTargetMembers).toHaveBeenCalled();

-            // this should have claimed a key for alice as it's starting a new session
-            expect(mockBaseApis.claimOneTimeKeys).toHaveBeenCalledWith(
-                [['@alice:home.server', 'aliceDevice']], 'signed_curve25519', 2000,
-            );
-            expect(mockCrypto.downloadKeys).toHaveBeenCalledWith(
-                ['@alice:home.server'], false,
-            );
-            expect(mockBaseApis.sendToDevice).toHaveBeenCalled();
-            expect(mockBaseApis.claimOneTimeKeys).toHaveBeenCalledWith(
-                [['@alice:home.server', 'aliceDevice']], 'signed_curve25519', 2000,
-            );
+                // this should have claimed a key for alice as it's starting a new session
+                expect(mockBaseApis.claimOneTimeKeys).toHaveBeenCalledWith(
+                    [['@alice:home.server', 'aliceDevice']], 'signed_curve25519', 2000,
+                );
+                expect(mockCrypto.downloadKeys).toHaveBeenCalledWith(
+                    ['@alice:home.server'], false,
+                );
+                expect(mockBaseApis.sendToDevice).toHaveBeenCalled();
+                expect(mockBaseApis.claimOneTimeKeys).toHaveBeenCalledWith(
+                    [['@alice:home.server', 'aliceDevice']], 'signed_curve25519', 2000,
+                );

-            mockBaseApis.claimOneTimeKeys.mockReset();
+                mockBaseApis.claimOneTimeKeys.mockReset();

-            const ct2 = await megolmEncryption.encryptMessage(mockRoom, "a.fake.type", {
-                body: "Some more text",
+                const ct2 = await megolmEncryption.encryptMessage(mockRoom, "a.fake.type", {
+                    body: "Some more text",
+                });
+
+                // this should *not* have claimed a key as it should be using the same session
+                expect(mockBaseApis.claimOneTimeKeys).not.toHaveBeenCalled();
+
+                // likewise they should show the same session ID
+                expect(ct2.session_id).toEqual(ct1.session_id);
            });

-            // this should *not* have claimed a key as it should be using the same session
-            expect(mockBaseApis.claimOneTimeKeys).not.toHaveBeenCalled();
+            it("re-shares keys to devices it's already sent to", async function() {
+                const ct1 = await megolmEncryption.encryptMessage(mockRoom, "a.fake.type", {
+                    body: "Some text",
+                });

-            // likewise they should show the same session ID
-            expect(ct2.session_id).toEqual(ct1.session_id);
+                mockBaseApis.sendToDevice.mockClear();
+                await megolmEncryption.reshareKeyWithDevice(
+                    olmDevice.deviceCurve25519Key,
+                    ct1.session_id,
+                    '@alice:home.server',
+                    aliceDeviceInfo,
+                );
+
+                expect(mockBaseApis.sendToDevice).toHaveBeenCalled();
+            });
+
+            it("does not re-share keys to devices whose keys have changed", async function() {
+                const ct1 = await megolmEncryption.encryptMessage(mockRoom, "a.fake.type", {
+                    body: "Some text",
+                });
+
+                aliceDeviceInfo.getIdentityKey = jest.fn().mockReturnValue(
+                    'YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWI',
+                );
+
+                mockBaseApis.sendToDevice.mockClear();
+                await megolmEncryption.reshareKeyWithDevice(
+                    olmDevice.deviceCurve25519Key,
+                    ct1.session_id,
+                    '@alice:home.server',
+                    aliceDeviceInfo,
+                );
+
+                expect(mockBaseApis.sendToDevice).not.toHaveBeenCalled();
+            });
        });
    });

@@ -365,9 +413,9 @@ describe("MegolmDecryption", function() {
            bobClient1.initCrypto(),
            bobClient2.initCrypto(),
        ]);
-        const aliceDevice = aliceClient.crypto._olmDevice;
-        const bobDevice1 = bobClient1.crypto._olmDevice;
-        const bobDevice2 = bobClient2.crypto._olmDevice;
+        const aliceDevice = aliceClient.crypto.olmDevice;
+        const bobDevice1 = bobClient1.crypto.olmDevice;
+        const bobDevice2 = bobClient2.crypto.olmDevice;

        const encryptionCfg = {
            "algorithm": "m.megolm.v1.aes-sha2",
@@ -404,11 +452,11 @@ describe("MegolmDecryption", function() {
            },
        };

-        aliceClient.crypto._deviceList.storeDevicesForUser(
+        aliceClient.crypto.deviceList.storeDevicesForUser(
            "@bob:example.com", BOB_DEVICES,
        );
-        aliceClient.crypto._deviceList.downloadKeys = async function(userIds) {
-            return this._getDevicesFromStore(userIds);
+        aliceClient.crypto.deviceList.downloadKeys = async function(userIds) {
+            return this.getDevicesFromStore(userIds);
        };

        let run = false;
@@ -468,8 +516,8 @@ describe("MegolmDecryption", function() {
            aliceClient.initCrypto(),
            bobClient.initCrypto(),
        ]);
-        const aliceDevice = aliceClient.crypto._olmDevice;
-        const bobDevice = bobClient.crypto._olmDevice;
+        const aliceDevice = aliceClient.crypto.olmDevice;
+        const bobDevice = bobClient.crypto.olmDevice;

        const encryptionCfg = {
            "algorithm": "m.megolm.v1.aes-sha2",
@@ -508,11 +556,11 @@ describe("MegolmDecryption", function() {
            },
        };

-        aliceClient.crypto._deviceList.storeDevicesForUser(
+        aliceClient.crypto.deviceList.storeDevicesForUser(
            "@bob:example.com", BOB_DEVICES,
        );
-        aliceClient.crypto._deviceList.downloadKeys = async function(userIds) {
-            return this._getDevicesFromStore(userIds);
+        aliceClient.crypto.deviceList.downloadKeys = async function(userIds) {
+            return this.getDevicesFromStore(userIds);
        };

        aliceClient.claimOneTimeKeys = async () => {
@@ -561,11 +609,11 @@ describe("MegolmDecryption", function() {
            aliceClient.initCrypto(),
            bobClient.initCrypto(),
        ]);
-        const bobDevice = bobClient.crypto._olmDevice;
+        const bobDevice = bobClient.crypto.olmDevice;

        const roomId = "!someroom";

-        aliceClient.crypto._onToDeviceEvent(new MatrixEvent({
+        aliceClient.crypto.onToDeviceEvent(new MatrixEvent({
            type: "org.matrix.room_key.withheld",
            sender: "@bob:example.com",
            content: {
@@ -605,13 +653,13 @@ describe("MegolmDecryption", function() {
            bobClient.initCrypto(),
        ]);
        aliceClient.crypto.downloadKeys = async () => {};
-        const bobDevice = bobClient.crypto._olmDevice;
+        const bobDevice = bobClient.crypto.olmDevice;

        const roomId = "!someroom";

        const now = Date.now();

-        aliceClient.crypto._onToDeviceEvent(new MatrixEvent({
+        aliceClient.crypto.onToDeviceEvent(new MatrixEvent({
            type: "org.matrix.room_key.withheld",
            sender: "@bob:example.com",
            content: {
@@ -655,7 +703,7 @@ describe("MegolmDecryption", function() {
            aliceClient.initCrypto(),
            bobClient.initCrypto(),
        ]);
-        const bobDevice = bobClient.crypto._olmDevice;
+        const bobDevice = bobClient.crypto.olmDevice;
        aliceClient.crypto.downloadKeys = async () => {};

        const roomId = "!someroom";
@@ -663,7 +711,7 @@ describe("MegolmDecryption", function() {
        const now = Date.now();

        // pretend we got an event that we can't decrypt
-        aliceClient.crypto._onToDeviceEvent(new MatrixEvent({
+        aliceClient.crypto.onToDeviceEvent(new MatrixEvent({
            type: "m.room.encrypted",
            sender: "@bob:example.com",
            content: {
@@ -246,7 +246,7 @@ describe("OlmDevice", function() {

            // After a single tick through the first task, it should have
            // claimed ownership of all devices to avoid deadlocking others.
-            expect(Object.keys(aliceOlmDevice._sessionsInProgress).length).toBe(2);
+            expect(Object.keys(aliceOlmDevice.sessionsInProgress).length).toBe(2);

            const task2 = alwaysSucceed(olmlib.ensureOlmSessionsForDevices(
                aliceOlmDevice, baseApis, devicesByUserBA,
@@ -254,7 +254,7 @@ describe("OlmDevice", function() {

            // The second task should not have changed the ownership count, as
            // it's waiting on the first task.
-            expect(Object.keys(aliceOlmDevice._sessionsInProgress).length).toBe(2);
+            expect(Object.keys(aliceOlmDevice.sessionsInProgress).length).toBe(2);

            // Track the tasks, but don't await them yet.
            const promises = Promise.all([
@@ -52,7 +52,7 @@ const ENCRYPTED_EVENT = new MatrixEvent({
    origin_server_ts: 1507753886000,
 });

-const KEY_BACKUP_DATA = {
+const CURVE25519_KEY_BACKUP_DATA = {
    first_message_index: 0,
    forwarded_count: 0,
    is_verified: false,
@@ -73,7 +73,26 @@ const KEY_BACKUP_DATA = {
    },
 };

-const BACKUP_INFO = {
+const AES256_KEY_BACKUP_DATA = {
+    first_message_index: 0,
+    forwarded_count: 0,
+    is_verified: false,
+    session_data: {
+        iv: 'b3Jqqvm5S9QdmXrzssspLQ',
+        ciphertext: 'GOOASO3E9ThogkG0zMjEduGLM3u9jHZTkS7AvNNbNj3q1znwk4OlaVKXce'
+            + '7ynofiiYIiS865VlOqrKEEXv96XzRyUpgn68e3WsicwYl96EtjIEh/iY003PG2Qd'
+            + 'EluT899Ax7PydpUHxEktbWckMppYomUR5q8x1KI1SsOQIiJaIGThmIMPANRCFiK0'
+            + 'WQj+q+dnhzx4lt9AFqU5bKov8qKnw2qGYP7/+6RmJ0Kpvs8tG6lrcNDEHtFc2r0r'
+            + 'KKubDypo0Vc8EWSwsAHdKa36ewRavpreOuE8Z9RLfY0QIR1ecXrMqW0CdGFr7H3P'
+            + 'vcjF8sjwvQAavzxEKT1WMGizSMLeKWo2mgZ5cKnwV5HGUAw596JQvKs9laG2U89K'
+            + 'YrT0sH30vi62HKzcBLcDkWkUSNYPz7UiZ1MM0L380UA+1ZOXSOmtBA9xxzzbc8Xd'
+            + 'fRimVgklGdxrxjzuNLYhL2BvVH4oPWonD9j0bvRwE6XkimdbGQA8HB7UmXXjE8WA'
+            + 'RgaDHkfzoA3g3aeQ',
+        mac: 'uR988UYgGL99jrvLLPX3V1ows+UYbktTmMxPAo2kxnU',
+    },
+};
+
+const CURVE25519_BACKUP_INFO = {
    algorithm: "m.megolm_backup.v1.curve25519-aes-sha2",
    version: 1,
    auth_data: {
@@ -81,6 +100,14 @@ const BACKUP_INFO = {
    },
 };

+const AES256_BACKUP_INFO = {
+    algorithm: "org.matrix.msc3270.v1.aes-hmac-sha2",
+    version: 1,
+    auth_data: {
+        // FIXME: add iv and mac
+    },
+};
+
 const keys = {};

 function getCrossSigningKey(type) {
@@ -139,12 +166,12 @@ describe("MegolmBackup", function() {
    let megolmDecryption;
    beforeEach(async function() {
        mockCrypto = testUtils.mock(Crypto, 'Crypto');
-        mockCrypto._backupManager = testUtils.mock(BackupManager, "BackupManager");
+        mockCrypto.backupManager = testUtils.mock(BackupManager, "BackupManager");
        mockCrypto.backupKey = new Olm.PkEncryption();
        mockCrypto.backupKey.set_recipient_key(
            "hSDwCYkwp1R0i33ctD73Wg2/Og0mOBr066SpjqqbTmo",
        );
-        mockCrypto.backupInfo = BACKUP_INFO;
+        mockCrypto.backupInfo = CURVE25519_BACKUP_INFO;

        mockStorage = new MockStorageApi();
        sessionStore = new WebStorageSessionStore(mockStorage);
@@ -217,18 +244,18 @@ describe("MegolmBackup", function() {
            };
            mockCrypto.cancelRoomKeyRequest = function() {};

-            mockCrypto._backupManager = {
+            mockCrypto.backupManager = {
                backupGroupSession: jest.fn(),
            };

            return event.attemptDecryption(mockCrypto).then(() => {
                return megolmDecryption.onRoomKeyEvent(event);
            }).then(() => {
-                expect(mockCrypto._backupManager.backupGroupSession).toHaveBeenCalled();
+                expect(mockCrypto.backupManager.backupGroupSession).toHaveBeenCalled();
            });
        });

-        it('sends backups to the server', function() {
+        it('sends backups to the server (Curve25519 version)', function() {
            const groupSession = new Olm.OutboundGroupSession();
            groupSession.create();
            const ibGroupSession = new Olm.InboundGroupSession();
@@ -261,7 +288,7 @@ describe("MegolmBackup", function() {
                                        ed25519: "SENDER_ED25519",
                                    },
                                    room_id: ROOM_ID,
-                                    session: ibGroupSession.pickle(olmDevice._pickleKey),
+                                    session: ibGroupSession.pickle(olmDevice.pickleKey),
                                },
                                txn);
                        });
@@ -296,7 +323,89 @@ describe("MegolmBackup", function() {
                            resolve();
                            return Promise.resolve({});
                        };
-                        client.crypto._backupManager.backupGroupSession(
+                        client.crypto.backupManager.backupGroupSession(
+                            "F0Q2NmyJNgUVj9DGsb4ZQt3aVxhVcUQhg7+gvW0oyKI",
+                            groupSession.session_id(),
+                        );
+                    }).then(() => {
+                        expect(numCalls).toBe(1);
+                    });
+                });
+        });
+
+        it('sends backups to the server (AES-256 version)', function() {
+            const groupSession = new Olm.OutboundGroupSession();
+            groupSession.create();
+            const ibGroupSession = new Olm.InboundGroupSession();
+            ibGroupSession.create(groupSession.session_key());
+
+            const client = makeTestClient(sessionStore, cryptoStore);
+
+            megolmDecryption = new MegolmDecryption({
+                userId: '@user:id',
+                crypto: mockCrypto,
+                olmDevice: olmDevice,
+                baseApis: client,
+                roomId: ROOM_ID,
+            });
+
+            megolmDecryption.olmlib = mockOlmLib;
+
+            return client.initCrypto()
+                .then(() => {
+                    return client.crypto.storeSessionBackupPrivateKey(new Uint8Array(32));
+                })
+                .then(() => {
+                    return cryptoStore.doTxn(
+                        "readwrite",
+                        [cryptoStore.STORE_SESSION],
+                        (txn) => {
+                            cryptoStore.addEndToEndInboundGroupSession(
+                                "F0Q2NmyJNgUVj9DGsb4ZQt3aVxhVcUQhg7+gvW0oyKI",
+                                groupSession.session_id(),
+                                {
+                                    forwardingCurve25519KeyChain: undefined,
+                                    keysClaimed: {
+                                        ed25519: "SENDER_ED25519",
+                                    },
+                                    room_id: ROOM_ID,
+                                    session: ibGroupSession.pickle(olmDevice.pickleKey),
+                                },
+                                txn);
+                        });
+                })
+                .then(() => {
+                    client.enableKeyBackup({
+                        algorithm: "org.matrix.msc3270.v1.aes-hmac-sha2",
+                        version: 1,
+                        auth_data: {
+                            iv: "PsCAtR7gMc4xBd9YS3A9Ow",
+                            mac: "ZSDsTFEZK7QzlauCLMleUcX96GQZZM7UNtk4sripSqQ",
+                        },
+                    });
+                    let numCalls = 0;
+                    return new Promise((resolve, reject) => {
+                        client.http.authedRequest = function(
+                            callback, method, path, queryParams, data, opts,
+                        ) {
+                            ++numCalls;
+                            expect(numCalls).toBeLessThanOrEqual(1);
+                            if (numCalls >= 2) {
+                                // exit out of retry loop if there's something wrong
+                                reject(new Error("authedRequest called too many timmes"));
+                                return Promise.resolve({});
+                            }
+                            expect(method).toBe("PUT");
+                            expect(path).toBe("/room_keys/keys");
+                            expect(queryParams.version).toBe(1);
+                            expect(data.rooms[ROOM_ID].sessions).toBeDefined();
+                            expect(data.rooms[ROOM_ID].sessions).toHaveProperty(
+                                groupSession.session_id(),
+                            );
+                            resolve();
+                            return Promise.resolve({});
+                        };
+                        client.crypto.backupManager.backupGroupSession(
                            "F0Q2NmyJNgUVj9DGsb4ZQt3aVxhVcUQhg7+gvW0oyKI",
                            groupSession.session_id(),
                        );
@@ -437,7 +546,7 @@ describe("MegolmBackup", function() {
                                        ed25519: "SENDER_ED25519",
                                    },
                                    room_id: ROOM_ID,
-                                    session: ibGroupSession.pickle(olmDevice._pickleKey),
+                                    session: ibGroupSession.pickle(olmDevice.pickleKey),
                                },
                                txn);
                        });
@@ -478,7 +587,7 @@ describe("MegolmBackup", function() {
                                );
                            }
                        };
-                        client.crypto._backupManager.backupGroupSession(
+                        client.crypto.backupManager.backupGroupSession(
                            "F0Q2NmyJNgUVj9DGsb4ZQt3aVxhVcUQhg7+gvW0oyKI",
                            groupSession.session_id(),
                        );
@@ -512,30 +621,47 @@ describe("MegolmBackup", function() {
            client.stopClient();
        });

-        it('can restore from backup', function() {
+        it('can restore from backup (Curve25519 version)', function() {
            client.http.authedRequest = function() {
-                return Promise.resolve(KEY_BACKUP_DATA);
+                return Promise.resolve(CURVE25519_KEY_BACKUP_DATA);
            };
            return client.restoreKeyBackupWithRecoveryKey(
                "EsTc LW2K PGiF wKEA 3As5 g5c4 BXwk qeeJ ZJV8 Q9fu gUMN UE4d",
                ROOM_ID,
                SESSION_ID,
-                BACKUP_INFO,
+                CURVE25519_BACKUP_INFO,
            ).then(() => {
                return megolmDecryption.decryptEvent(ENCRYPTED_EVENT);
            }).then((res) => {
                expect(res.clearEvent.content).toEqual('testytest');
-                expect(res.untrusted).toBeTruthy(); // keys from backup are untrusted
+                expect(res.untrusted).toBeTruthy(); // keys from Curve25519 backup are untrusted
            });
        });

-        it('can restore backup by room', function() {
+        it('can restore from backup (AES-256 version)', function() {
+            client.http.authedRequest = function() {
+                return Promise.resolve(AES256_KEY_BACKUP_DATA);
+            };
+            return client.restoreKeyBackupWithRecoveryKey(
+                "EsTc LW2K PGiF wKEA 3As5 g5c4 BXwk qeeJ ZJV8 Q9fu gUMN UE4d",
+                ROOM_ID,
+                SESSION_ID,
+                AES256_BACKUP_INFO,
+            ).then(() => {
+                return megolmDecryption.decryptEvent(ENCRYPTED_EVENT);
+            }).then((res) => {
+                expect(res.clearEvent.content).toEqual('testytest');
+                expect(res.untrusted).toBeFalsy(); // keys from AES backup are trusted
+            });
+        });
+
+        it('can restore backup by room (Curve25519 version)', function() {
            client.http.authedRequest = function() {
                return Promise.resolve({
                    rooms: {
                        [ROOM_ID]: {
                            sessions: {
-                                [SESSION_ID]: KEY_BACKUP_DATA,
+                                [SESSION_ID]: CURVE25519_KEY_BACKUP_DATA,
                            },
                        },
                    },
@@ -543,7 +669,7 @@ describe("MegolmBackup", function() {
            };
            return client.restoreKeyBackupWithRecoveryKey(
                "EsTc LW2K PGiF wKEA 3As5 g5c4 BXwk qeeJ ZJV8 Q9fu gUMN UE4d",
-                null, null, BACKUP_INFO,
+                null, null, CURVE25519_BACKUP_INFO,
            ).then(() => {
                return megolmDecryption.decryptEvent(ENCRYPTED_EVENT);
            }).then((res) => {
@@ -562,14 +688,14 @@ describe("MegolmBackup", function() {
            const cachedNull = await client.crypto.getSessionBackupPrivateKey();
            expect(cachedNull).toBeNull();
            client.http.authedRequest = function() {
-                return Promise.resolve(KEY_BACKUP_DATA);
+                return Promise.resolve(CURVE25519_KEY_BACKUP_DATA);
            };
            await new Promise((resolve) => {
                client.restoreKeyBackupWithRecoveryKey(
                    "EsTc LW2K PGiF wKEA 3As5 g5c4 BXwk qeeJ ZJV8 Q9fu gUMN UE4d",
                    ROOM_ID,
                    SESSION_ID,
-                    BACKUP_INFO,
+                    CURVE25519_BACKUP_INFO,
                    { cacheCompleteCallback: resolve },
                );
            });
@@ -578,11 +704,11 @@ describe("MegolmBackup", function() {
        });

        it("fails if an known algorithm is used", async function() {
-            const BAD_BACKUP_INFO = Object.assign({}, BACKUP_INFO, {
+            const BAD_BACKUP_INFO = Object.assign({}, CURVE25519_BACKUP_INFO, {
                algorithm: "this.algorithm.does.not.exist",
            });
            client.http.authedRequest = function() {
-                return Promise.resolve(KEY_BACKUP_DATA);
+                return Promise.resolve(CURVE25519_KEY_BACKUP_DATA);
            };

            await expect(client.restoreKeyBackupWithRecoveryKey(
@@ -17,6 +17,7 @@ limitations under the License.

 import '../../olm-loader';
 import anotherjson from 'another-json';
+
 import * as olmlib from "../../../src/crypto/olmlib";
 import { TestClient } from '../../TestClient';
 import { HttpResponse, setHttpResponses } from '../../test-utils';
@@ -39,13 +40,14 @@ async function makeTestClient(userInfo, options, keys) {
    options.cryptoCallbacks = Object.assign(
        {}, { getCrossSigningKey, saveCrossSigningKeys }, options.cryptoCallbacks || {},
    );
-    const client = (new TestClient(
+    const testClient = new TestClient(
        userInfo.userId, userInfo.deviceId, undefined, undefined, options,
-    )).client;
+    );
+    const client = testClient.client;

    await client.initCrypto();

-    return client;
+    return { client, httpBackend: testClient.httpBackend };
 }

 describe("Cross Signing", function() {
@@ -59,13 +61,13 @@ describe("Cross Signing", function() {
    });

    it("should sign the master key with the device key", async function() {
-        const alice = await makeTestClient(
+        const { client: alice } = await makeTestClient(
            { userId: "@alice:example.com", deviceId: "Osborne2" },
        );
        alice.uploadDeviceSigningKeys = jest.fn(async (auth, keys) => {
            await olmlib.verifySignature(
-                alice.crypto._olmDevice, keys.master_key, "@alice:example.com",
-                "Osborne2", alice.crypto._olmDevice.deviceEd25519Key,
+                alice.crypto.olmDevice, keys.master_key, "@alice:example.com",
+                "Osborne2", alice.crypto.olmDevice.deviceEd25519Key,
            );
        });
        alice.uploadKeySignatures = async () => {};
@@ -79,7 +81,7 @@ describe("Cross Signing", function() {
    });

    it("should abort bootstrap if device signing auth fails", async function() {
-        const alice = await makeTestClient(
+        const { client: alice } = await makeTestClient(
            { userId: "@alice:example.com", deviceId: "Osborne2" },
        );
        alice.uploadDeviceSigningKeys = async (auth, keys) => {
@@ -130,7 +132,7 @@ describe("Cross Signing", function() {
    });

    it("should upload a signature when a user is verified", async function() {
-        const alice = await makeTestClient(
+        const { client: alice } = await makeTestClient(
            { userId: "@alice:example.com", deviceId: "Osborne2" },
        );
        alice.uploadDeviceSigningKeys = async () => {};
@@ -138,7 +140,7 @@ describe("Cross Signing", function() {
        // set Alice's cross-signing key
        await resetCrossSigningKeys(alice);
        // Alice downloads Bob's device key
-        alice.crypto._deviceList.storeCrossSigningForUser("@bob:example.com", {
+        alice.crypto.deviceList.storeCrossSigningForUser("@bob:example.com", {
            keys: {
                master: {
                    user_id: "@bob:example.com",
@@ -160,7 +162,7 @@ describe("Cross Signing", function() {
        await promise;
    });

-    it("should get cross-signing keys from sync", async function() {
+    it.skip("should get cross-signing keys from sync", async function() {
        const masterKey = new Uint8Array([
            0xda, 0x5a, 0x27, 0x60, 0xe3, 0x3a, 0xc5, 0x82,
            0x9d, 0x12, 0xc3, 0xbe, 0xe8, 0xaa, 0xc2, 0xef,
@@ -174,7 +176,7 @@ describe("Cross Signing", function() {
            0x34, 0xf2, 0x4b, 0x64, 0x9b, 0x52, 0xf8, 0x5f,
        ]);

-        const alice = await makeTestClient(
+        const { client: alice, httpBackend } = await makeTestClient(
            { userId: "@alice:example.com", deviceId: "Osborne2" },
            {
                cryptoCallbacks: {
@@ -203,12 +205,12 @@ describe("Cross Signing", function() {
            alice.uploadKeySignatures = jest.fn(async (content) => {
                try {
                    await olmlib.verifySignature(
-                        alice.crypto._olmDevice,
+                        alice.crypto.olmDevice,
                        content["@alice:example.com"][
                            "nqOvzeuGWT/sRx3h7+MHoInYj3Uk2LD/unI9kDYcHwk"
                            ],
                        "@alice:example.com",
-                        "Osborne2", alice.crypto._olmDevice.deviceEd25519Key,
+                        "Osborne2", alice.crypto.olmDevice.deviceEd25519Key,
                    );
                    olmlib.pkVerify(
                        content["@alice:example.com"]["Osborne2"],
@@ -222,7 +224,7 @@ describe("Cross Signing", function() {
            });
        });

-        const deviceInfo = alice.crypto._deviceList._devices["@alice:example.com"]
+        const deviceInfo = alice.crypto.deviceList.devices["@alice:example.com"]
            .Osborne2;
        const aliceDevice = {
            user_id: "@alice:example.com",
@@ -230,11 +232,12 @@ describe("Cross Signing", function() {
        };
        aliceDevice.keys = deviceInfo.keys;
        aliceDevice.algorithms = deviceInfo.algorithms;
-        await alice.crypto._signObject(aliceDevice);
+        await alice.crypto.signObject(aliceDevice);
        olmlib.pkSign(aliceDevice, selfSigningKey, "@alice:example.com");

        // feed sync result that includes master key, ssk, device key
        const responses = [
+            HttpResponse.CAPABILITIES_RESPONSE,
            HttpResponse.PUSH_RULES_RESPONSE,
            {
                method: "POST",
@@ -310,9 +313,10 @@ describe("Cross Signing", function() {
                },
            },
        ];
-        setHttpResponses(alice, responses, true, true);
+        setHttpResponses(httpBackend, responses);

-        await alice.startClient();
+        alice.startClient();
+        httpBackend.flushAllExpected();

        // once ssk is confirmed, device key should be trusted
        await keyChangePromise;
@@ -331,7 +335,7 @@ describe("Cross Signing", function() {
    });

    it("should use trust chain to determine device verification", async function() {
-        const alice = await makeTestClient(
+        const { client: alice } = await makeTestClient(
            { userId: "@alice:example.com", deviceId: "Osborne2" },
        );
        alice.uploadDeviceSigningKeys = async () => {};
@@ -358,7 +362,7 @@ describe("Cross Signing", function() {
                ["ed25519:" + bobMasterPubkey]: sskSig,
            },
        };
-        alice.crypto._deviceList.storeCrossSigningForUser("@bob:example.com", {
+        alice.crypto.deviceList.storeCrossSigningForUser("@bob:example.com", {
            keys: {
                master: {
                    user_id: "@bob:example.com",
@@ -387,7 +391,7 @@ describe("Cross Signing", function() {
                ["ed25519:" + bobPubkey]: sig,
            },
        };
-        alice.crypto._deviceList.storeDevicesForUser("@bob:example.com", {
+        alice.crypto.deviceList.storeDevicesForUser("@bob:example.com", {
            Dynabook: bobDevice,
        });
        // Bob's device key should be TOFU
@@ -414,15 +418,15 @@ describe("Cross Signing", function() {
        expect(bobDeviceTrust2.isTofu()).toBeTruthy();
    });

-    it("should trust signatures received from other devices", async function() {
+    it.skip("should trust signatures received from other devices", async function() {
        const aliceKeys = {};
-        const alice = await makeTestClient(
+        const { client: alice, httpBackend } = await makeTestClient(
            { userId: "@alice:example.com", deviceId: "Osborne2" },
            null,
            aliceKeys,
        );
-        alice.crypto._deviceList.startTrackingDeviceList("@bob:example.com");
-        alice.crypto._deviceList.stopTrackingAllDeviceLists = () => {};
+        alice.crypto.deviceList.startTrackingDeviceList("@bob:example.com");
+        alice.crypto.deviceList.stopTrackingAllDeviceLists = () => {};
        alice.uploadDeviceSigningKeys = async () => {};
        alice.uploadKeySignatures = async () => {};

@@ -437,14 +441,14 @@ describe("Cross Signing", function() {
        ]);

        const keyChangePromise = new Promise((resolve, reject) => {
-            alice.crypto._deviceList.once("userCrossSigningUpdated", (userId) => {
+            alice.crypto.deviceList.once("userCrossSigningUpdated", (userId) => {
                if (userId === "@bob:example.com") {
                    resolve();
                }
            });
        });

-        const deviceInfo = alice.crypto._deviceList._devices["@alice:example.com"]
+        const deviceInfo = alice.crypto.deviceList.devices["@alice:example.com"]
            .Osborne2;
        const aliceDevice = {
            user_id: "@alice:example.com",
@@ -452,7 +456,7 @@ describe("Cross Signing", function() {
        };
        aliceDevice.keys = deviceInfo.keys;
        aliceDevice.algorithms = deviceInfo.algorithms;
-        await alice.crypto._signObject(aliceDevice);
+        await alice.crypto.signObject(aliceDevice);

        const bobOlmAccount = new global.Olm.Account();
        bobOlmAccount.create();
@@ -490,6 +494,7 @@ describe("Cross Signing", function() {
        // - master key signed by her usk (pretend that it was signed by another
        //   of Alice's devices)
        const responses = [
+            HttpResponse.CAPABILITIES_RESPONSE,
            HttpResponse.PUSH_RULES_RESPONSE,
            {
                method: "POST",
@@ -560,10 +565,10 @@ describe("Cross Signing", function() {
                },
            },
        ];
-        setHttpResponses(alice, responses);
-
-        await alice.startClient();
+        setHttpResponses(httpBackend, responses);

+        alice.startClient();
+        httpBackend.flushAllExpected();
        await keyChangePromise;

        // Bob's device key should be trusted
@@ -578,7 +583,7 @@ describe("Cross Signing", function() {
    });

    it("should dis-trust an unsigned device", async function() {
-        const alice = await makeTestClient(
+        const { client: alice } = await makeTestClient(
            { userId: "@alice:example.com", deviceId: "Osborne2" },
        );
        alice.uploadDeviceSigningKeys = async () => {};
@@ -606,7 +611,7 @@ describe("Cross Signing", function() {
                ["ed25519:" + bobMasterPubkey]: sskSig,
            },
        };
-        alice.crypto._deviceList.storeCrossSigningForUser("@bob:example.com", {
+        alice.crypto.deviceList.storeCrossSigningForUser("@bob:example.com", {
            keys: {
                master: {
                    user_id: "@bob:example.com",
@@ -629,7 +634,7 @@ describe("Cross Signing", function() {
                "ed25519:Dynabook": "someOtherPubkey",
            },
        };
-        alice.crypto._deviceList.storeDevicesForUser("@bob:example.com", {
+        alice.crypto.deviceList.storeDevicesForUser("@bob:example.com", {
            Dynabook: bobDevice,
        });
        // Bob's device key should be untrusted
@@ -647,7 +652,7 @@ describe("Cross Signing", function() {
    });

    it("should dis-trust a user when their ssk changes", async function() {
-        const alice = await makeTestClient(
+        const { client: alice } = await makeTestClient(
            { userId: "@alice:example.com", deviceId: "Osborne2" },
        );
        alice.uploadDeviceSigningKeys = async () => {};
@@ -673,7 +678,7 @@ describe("Cross Signing", function() {
                ["ed25519:" + bobMasterPubkey]: sskSig,
            },
        };
-        alice.crypto._deviceList.storeCrossSigningForUser("@bob:example.com", {
+        alice.crypto.deviceList.storeCrossSigningForUser("@bob:example.com", {
            keys: {
                master: {
                    user_id: "@bob:example.com",
@@ -701,7 +706,7 @@ describe("Cross Signing", function() {
        bobDevice.signatures = {};
        bobDevice.signatures["@bob:example.com"] = {};
        bobDevice.signatures["@bob:example.com"]["ed25519:" + bobPubkey] = sig;
-        alice.crypto._deviceList.storeDevicesForUser("@bob:example.com", {
+        alice.crypto.deviceList.storeDevicesForUser("@bob:example.com", {
            Dynabook: bobDevice,
        });
        // Alice verifies Bob's SSK
@@ -733,7 +738,7 @@ describe("Cross Signing", function() {
                ["ed25519:" + bobMasterPubkey2]: sskSig2,
            },
        };
-        alice.crypto._deviceList.storeCrossSigningForUser("@bob:example.com", {
+        alice.crypto.deviceList.storeCrossSigningForUser("@bob:example.com", {
            keys: {
                master: {
                    user_id: "@bob:example.com",
@@ -770,7 +775,7 @@ describe("Cross Signing", function() {
        // Alice gets new signature for device
        const sig2 = bobSigning2.sign(bobDeviceString);
        bobDevice.signatures["@bob:example.com"]["ed25519:" + bobPubkey2] = sig2;
-        alice.crypto._deviceList.storeDevicesForUser("@bob:example.com", {
+        alice.crypto.deviceList.storeDevicesForUser("@bob:example.com", {
            Dynabook: bobDevice,
        });

@@ -785,7 +790,7 @@ describe("Cross Signing", function() {
    it("should offer to upgrade device verifications to cross-signing", async function() {
        let upgradeResolveFunc;

-        const alice = await makeTestClient(
+        const { client: alice } = await makeTestClient(
            { userId: "@alice:example.com", deviceId: "Osborne2" },
            {
                cryptoCallbacks: {
@@ -797,7 +802,7 @@ describe("Cross Signing", function() {
                },
            },
        );
-        const bob = await makeTestClient(
+        const { client: bob } = await makeTestClient(
            { userId: "@bob:example.com", deviceId: "Dynabook" },
        );

@@ -805,20 +810,20 @@ describe("Cross Signing", function() {
        bob.uploadKeySignatures = async () => {};
        // set Bob's cross-signing key
        await resetCrossSigningKeys(bob);
-        alice.crypto._deviceList.storeDevicesForUser("@bob:example.com", {
+        alice.crypto.deviceList.storeDevicesForUser("@bob:example.com", {
            Dynabook: {
                algorithms: ["m.olm.curve25519-aes-sha256", "m.megolm.v1.aes-sha"],
                keys: {
-                    "curve25519:Dynabook": bob.crypto._olmDevice.deviceCurve25519Key,
-                    "ed25519:Dynabook": bob.crypto._olmDevice.deviceEd25519Key,
+                    "curve25519:Dynabook": bob.crypto.olmDevice.deviceCurve25519Key,
+                    "ed25519:Dynabook": bob.crypto.olmDevice.deviceEd25519Key,
                },
                verified: 1,
                known: true,
            },
        });
-        alice.crypto._deviceList.storeCrossSigningForUser(
+        alice.crypto.deviceList.storeCrossSigningForUser(
            "@bob:example.com",
-            bob.crypto._crossSigningInfo.toStorage(),
+            bob.crypto.crossSigningInfo.toStorage(),
        );

        alice.uploadDeviceSigningKeys = async () => {};
@@ -838,7 +843,7 @@ describe("Cross Signing", function() {
        expect(bobTrust.isTofu()).toBeTruthy();

        // "forget" that Bob is trusted
-        delete alice.crypto._deviceList._crossSigningInfo["@bob:example.com"]
+        delete alice.crypto.deviceList.crossSigningInfo["@bob:example.com"]
            .keys.master.signatures["@alice:example.com"];

        const bobTrust2 = alice.checkUserTrust("@bob:example.com");
@@ -848,7 +853,7 @@ describe("Cross Signing", function() {
        upgradePromise = new Promise((resolve) => {
            upgradeResolveFunc = resolve;
        });
-        alice.crypto._deviceList.emit("userCrossSigningUpdated", "@bob:example.com");
+        alice.crypto.deviceList.emit("userCrossSigningUpdated", "@bob:example.com");
        await new Promise((resolve) => {
            alice.crypto.on("userTrustStatusChanged", resolve);
        });
@@ -8,26 +8,26 @@ export async function resetCrossSigningKeys(client, {
 } = {}) {
    const crypto = client.crypto;

-    const oldKeys = Object.assign({}, crypto._crossSigningInfo.keys);
+    const oldKeys = Object.assign({}, crypto.crossSigningInfo.keys);
    try {
-        await crypto._crossSigningInfo.resetKeys(level);
-        await crypto._signObject(crypto._crossSigningInfo.keys.master);
+        await crypto.crossSigningInfo.resetKeys(level);
+        await crypto.signObject(crypto.crossSigningInfo.keys.master);
        // write a copy locally so we know these are trusted keys
-        await crypto._cryptoStore.doTxn(
+        await crypto.cryptoStore.doTxn(
            'readwrite', [IndexedDBCryptoStore.STORE_ACCOUNT],
            (txn) => {
-                crypto._cryptoStore.storeCrossSigningKeys(
-                    txn, crypto._crossSigningInfo.keys);
+                crypto.cryptoStore.storeCrossSigningKeys(
+                    txn, crypto.crossSigningInfo.keys);
            },
        );
    } catch (e) {
        // If anything failed here, revert the keys so we know to try again from the start
        // next time.
-        crypto._crossSigningInfo.keys = oldKeys;
+        crypto.crossSigningInfo.keys = oldKeys;
        throw e;
    }
-    crypto._baseApis.emit("crossSigning.keysChanged", {});
-    await crypto._afterCrossSigningLocalKeyChange();
+    crypto.emit("crossSigning.keysChanged", {});
+    await crypto.afterCrossSigningLocalKeyChange();
 }

 export async function createSecretStorageKey() {
@@ -18,28 +18,26 @@ import {
    IndexedDBCryptoStore,
 } from '../../../src/crypto/store/indexeddb-crypto-store';
 import { MemoryCryptoStore } from '../../../src/crypto/store/memory-crypto-store';
+import { RoomKeyRequestState } from '../../../src/crypto/OutgoingRoomKeyRequestManager';
+
 import 'fake-indexeddb/auto';
 import 'jest-localstorage-mock';

-import {
-    ROOM_KEY_REQUEST_STATES,
-} from '../../../src/crypto/OutgoingRoomKeyRequestManager';
-
 const requests = [
    {
        requestId: "A",
        requestBody: { session_id: "A", room_id: "A" },
-        state: ROOM_KEY_REQUEST_STATES.SENT,
+        state: RoomKeyRequestState.Sent,
    },
    {
        requestId: "B",
        requestBody: { session_id: "B", room_id: "B" },
-        state: ROOM_KEY_REQUEST_STATES.SENT,
+        state: RoomKeyRequestState.Sent,
    },
    {
        requestId: "C",
        requestBody: { session_id: "C", room_id: "C" },
-        state: ROOM_KEY_REQUEST_STATES.UNSENT,
+        state: RoomKeyRequestState.Unsent,
    },
 ];

@@ -68,9 +66,9 @@ describe.each([
    it("getAllOutgoingRoomKeyRequestsByState retrieves all entries in a given state",
    async () => {
        const r = await
-            store.getAllOutgoingRoomKeyRequestsByState(ROOM_KEY_REQUEST_STATES.SENT);
+            store.getAllOutgoingRoomKeyRequestsByState(RoomKeyRequestState.Sent);
        expect(r).toHaveLength(2);
-        requests.filter((e) => e.state == ROOM_KEY_REQUEST_STATES.SENT).forEach((e) => {
+        requests.filter((e) => e.state === RoomKeyRequestState.Sent).forEach((e) => {
            expect(r).toContainEqual(e);
        });
    });
@@ -78,10 +76,10 @@ describe.each([
    test("getOutgoingRoomKeyRequestByState retrieves any entry in a given state",
    async () => {
        const r =
-            await store.getOutgoingRoomKeyRequestByState([ROOM_KEY_REQUEST_STATES.SENT]);
+            await store.getOutgoingRoomKeyRequestByState([RoomKeyRequestState.Sent]);
        expect(r).not.toBeNull();
        expect(r).not.toBeUndefined();
-        expect(r.state).toEqual(ROOM_KEY_REQUEST_STATES.SENT);
+        expect(r.state).toEqual(RoomKeyRequestState.Sent);
        expect(requests).toContainEqual(r);
    });
 });
@@ -23,7 +23,6 @@ import { makeTestClients } from './verification/util';
 import { encryptAES } from "../../../src/crypto/aes";
 import { resetCrossSigningKeys, createSecretStorageKey } from "./crypto-utils";
 import { logger } from '../../../src/logger';
-
 import * as utils from "../../../src/utils";

 try {
@@ -99,11 +98,11 @@ describe("Secrets", function() {
                },
            },
        );
-        alice.crypto._crossSigningInfo.setKeys({
+        alice.crypto.crossSigningInfo.setKeys({
            master: signingkeyInfo,
        });

-        const secretStorage = alice.crypto._secretStorage;
+        const secretStorage = alice.crypto.secretStorage;

        alice.setAccountData = async function(eventType, contents, callback) {
            alice.store.storeAccountDataEvents([
@@ -120,7 +119,7 @@ describe("Secrets", function() {
        const keyAccountData = {
            algorithm: SECRET_STORAGE_ALGORITHM_V1_AES,
        };
-        await alice.crypto._crossSigningInfo.signObject(keyAccountData, 'master');
+        await alice.crypto.crossSigningInfo.signObject(keyAccountData, 'master');

        alice.store.storeAccountDataEvents([
            new MatrixEvent({
@@ -234,11 +233,11 @@ describe("Secrets", function() {
            },
        );

-        const vaxDevice = vax.client.crypto._olmDevice;
-        const osborne2Device = osborne2.client.crypto._olmDevice;
-        const secretStorage = osborne2.client.crypto._secretStorage;
+        const vaxDevice = vax.client.crypto.olmDevice;
+        const osborne2Device = osborne2.client.crypto.olmDevice;
+        const secretStorage = osborne2.client.crypto.secretStorage;

-        osborne2.client.crypto._deviceList.storeDevicesForUser("@alice:example.com", {
+        osborne2.client.crypto.deviceList.storeDevicesForUser("@alice:example.com", {
            "VAX": {
                user_id: "@alice:example.com",
                device_id: "VAX",
@@ -249,7 +248,7 @@ describe("Secrets", function() {
                },
            },
        });
-        vax.client.crypto._deviceList.storeDevicesForUser("@alice:example.com", {
+        vax.client.crypto.deviceList.storeDevicesForUser("@alice:example.com", {
            "Osborne2": {
                user_id: "@alice:example.com",
                device_id: "Osborne2",
@@ -265,7 +264,7 @@ describe("Secrets", function() {
        const otks = (await osborne2Device.getOneTimeKeys()).curve25519;
        await osborne2Device.markKeysAsPublished();

-        await vax.client.crypto._olmDevice.createOutboundSession(
+        await vax.client.crypto.olmDevice.createOutboundSession(
            osborne2Device.deviceCurve25519Key,
            Object.values(otks)[0],
        );
@@ -334,8 +333,8 @@ describe("Secrets", function() {
                createSecretStorageKey,
            });

-            const crossSigning = bob.crypto._crossSigningInfo;
-            const secretStorage = bob.crypto._secretStorage;
+            const crossSigning = bob.crypto.crossSigningInfo;
+            const secretStorage = bob.crypto.secretStorage;

            expect(crossSigning.getId()).toBeTruthy();
            expect(await crossSigning.isStoredInSecretStorage(secretStorage))
@@ -376,10 +375,10 @@ describe("Secrets", function() {
                ]);
                this.emit("accountData", event);
            };
-            bob.crypto._backupManager.checkKeyBackup = async () => {};
+            bob.crypto.backupManager.checkKeyBackup = async () => {};

-            const crossSigning = bob.crypto._crossSigningInfo;
-            const secretStorage = bob.crypto._secretStorage;
+            const crossSigning = bob.crypto.crossSigningInfo;
+            const secretStorage = bob.crypto.secretStorage;

            // Set up cross-signing keys from scratch with specific storage key
            await bob.bootstrapCrossSigning({
@@ -394,7 +393,7 @@ describe("Secrets", function() {
            });

            // Clear local cross-signing keys and read from secret storage
-            bob.crypto._deviceList.storeCrossSigningForUser(
+            bob.crypto.deviceList.storeCrossSigningForUser(
                "@bob:example.com",
                crossSigning.toStorage(),
            );
@@ -479,7 +478,7 @@ describe("Secrets", function() {
                    },
                }),
            ]);
-            alice.crypto._deviceList.storeCrossSigningForUser("@alice:example.com", {
+            alice.crypto.deviceList.storeCrossSigningForUser("@alice:example.com", {
                keys: {
                    master: {
                        user_id: "@alice:example.com",
@@ -619,7 +618,7 @@ describe("Secrets", function() {
                    },
                }),
            ]);
-            alice.crypto._deviceList.storeCrossSigningForUser("@alice:example.com", {
+            alice.crypto.deviceList.storeCrossSigningForUser("@alice:example.com", {
                keys: {
                    master: {
                        user_id: "@alice:example.com",
@@ -14,8 +14,8 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 import { InRoomChannel } from "../../../../src/crypto/verification/request/InRoomChannel";
-    "../../../../src/crypto/verification/request/ToDeviceChannel";
 import { MatrixEvent } from "../../../../src/models/event";
+    "../../../../src/crypto/verification/request/ToDeviceChannel";

 describe("InRoomChannel tests", function() {
    const ALICE = "@alice:hs.tld";
@@ -49,7 +49,7 @@ describe("verification request integration tests with crypto layer", function()
                verificationMethods: [verificationMethods.SAS],
            },
        );
-        alice.client.crypto._deviceList.getRawStoredDevicesForUser = function() {
+        alice.client.crypto.deviceList.getRawStoredDevicesForUser = function() {
            return {
                Dynabook: {
                    keys: {
@@ -69,7 +69,7 @@ describe("verification request integration tests with crypto layer", function()
            bobVerifier.verify();

            // XXX: Private function access (but it's a test, so we're okay)
-            bobVerifier._endTimer();
+            bobVerifier.endTimer();
        });
        const aliceRequest = await alice.client.requestVerification("@bob:example.com");
        await aliceRequest.waitFor(r => r.started);
@@ -77,6 +77,6 @@ describe("verification request integration tests with crypto layer", function()
        expect(aliceVerifier).toBeInstanceOf(SAS);

        // XXX: Private function access (but it's a test, so we're okay)
-        aliceVerifier._endTimer();
+        aliceVerifier.endTimer();
    });
 });
@@ -87,8 +87,8 @@ describe("SAS verification", function() {
                },
            );

-            const aliceDevice = alice.client.crypto._olmDevice;
-            const bobDevice = bob.client.crypto._olmDevice;
+            const aliceDevice = alice.client.crypto.olmDevice;
+            const bobDevice = bob.client.crypto.olmDevice;

            ALICE_DEVICES = {
                Osborne2: {
@@ -114,14 +114,14 @@ describe("SAS verification", function() {
                },
            };

-            alice.client.crypto._deviceList.storeDevicesForUser(
+            alice.client.crypto.deviceList.storeDevicesForUser(
                "@bob:example.com", BOB_DEVICES,
            );
            alice.client.downloadKeys = () => {
                return Promise.resolve();
            };

-            bob.client.crypto._deviceList.storeDevicesForUser(
+            bob.client.crypto.deviceList.storeDevicesForUser(
                "@alice:example.com", ALICE_DEVICES,
            );
            bob.client.downloadKeys = () => {
@@ -296,9 +296,9 @@ describe("SAS verification", function() {

            await resetCrossSigningKeys(bob.client);

-            bob.client.crypto._deviceList.storeCrossSigningForUser(
+            bob.client.crypto.deviceList.storeCrossSigningForUser(
                "@alice:example.com", {
-                    keys: alice.client.crypto._crossSigningInfo.keys,
+                    keys: alice.client.crypto.crossSigningInfo.keys,
                },
            );

@@ -14,10 +14,10 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import { VerificationBase } from '../../../../src/crypto/verification/Base';
 import { CrossSigningInfo } from '../../../../src/crypto/CrossSigning';
 import { encodeBase64 } from "../../../../src/crypto/olmlib";
 import { setupWebcrypto, teardownWebcrypto } from './util';
+import { VerificationBase } from '../../../../src/crypto/verification/Base';

 jest.useFakeTimers();

@@ -48,18 +48,18 @@ describe("self-verifications", () => {
            storeCrossSigningKeyCache: jest.fn(),
        };

-        const _crossSigningInfo = new CrossSigningInfo(
+        const crossSigningInfo = new CrossSigningInfo(
            userId,
            {},
            cacheCallbacks,
        );
-        _crossSigningInfo.keys = {
+        crossSigningInfo.keys = {
            master: { keys: { X: testKeyPub } },
            self_signing: { keys: { X: testKeyPub } },
            user_signing: { keys: { X: testKeyPub } },
        };

-        const _secretStorage = {
+        const secretStorage = {
            request: jest.fn().mockReturnValue({
                promise: Promise.resolve(encodeBase64(testKey)),
            }),
@@ -70,12 +70,12 @@ describe("self-verifications", () => {

        const client = {
            crypto: {
-                _crossSigningInfo,
-                _secretStorage,
+                crossSigningInfo,
+                secretStorage,
                storeSessionBackupPrivateKey,
                getSessionBackupPrivateKey: () => null,
            },
-            requestSecret: _secretStorage.request.bind(_secretStorage),
+            requestSecret: secretStorage.request.bind(secretStorage),
            getUserId: () => userId,
            getKeyBackupVersion: () => Promise.resolve({}),
            restoreKeyBackupWithCache,
@@ -93,13 +93,13 @@ describe("self-verifications", () => {
            undefined, // startEvent
            request,
        );
-        verification._resolve = () => undefined;
+        verification.resolve = () => undefined;

        const result = await verification.done();

        /* We should request, and store, 3 cross signing keys and the key backup key */
        expect(cacheCallbacks.storeCrossSigningKeyCache.mock.calls.length).toBe(3);
-        expect(_secretStorage.request.mock.calls.length).toBe(4);
+        expect(secretStorage.request.mock.calls.length).toBe(4);

        expect(cacheCallbacks.storeCrossSigningKeyCache.mock.calls[0][1])
          .toEqual(testKey);
@@ -15,9 +15,10 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

+import nodeCrypto from "crypto";
+
 import { TestClient } from '../../../TestClient';
 import { MatrixEvent } from "../../../../src/models/event";
-import nodeCrypto from "crypto";
 import { logger } from '../../../../src/logger';

 export async function makeTestClients(userInfos, options) {
@@ -3,8 +3,8 @@ import { EventTimeline } from "../../src/models/event-timeline";
 import { RoomState } from "../../src/models/room-state";

 function mockRoomStates(timeline) {
-    timeline._startState = utils.mock(RoomState, "startState");
-    timeline._endState = utils.mock(RoomState, "endState");
+    timeline.startState = utils.mock(RoomState, "startState");
+    timeline.endState = utils.mock(RoomState, "endState");
 }

 describe("EventTimeline", function() {
@@ -48,10 +48,10 @@ describe("EventTimeline", function() {
                }),
            ];
            timeline.initialiseState(events);
-            expect(timeline._startState.setStateEvents).toHaveBeenCalledWith(
+            expect(timeline.startState.setStateEvents).toHaveBeenCalledWith(
                events,
            );
-            expect(timeline._endState.setStateEvents).toHaveBeenCalledWith(
+            expect(timeline.endState.setStateEvents).toHaveBeenCalledWith(
                events,
            );
        });
@@ -1,34 +0,0 @@
-import { FilterComponent } from "../../src/filter-component";
-import { mkEvent } from '../test-utils';
-
-describe("Filter Component", function() {
-    describe("types", function() {
-        it("should filter out events with other types", function() {
-            const filter = new FilterComponent({ types: ['m.room.message'] });
-            const event = mkEvent({
-                type: 'm.room.member',
-                content: { },
-                room: 'roomId',
-                event: true,
-            });
-
-            const checkResult = filter.check(event);
-
-            expect(checkResult).toBe(false);
-        });
-
-        it("should validate events with the same type", function() {
-            const filter = new FilterComponent({ types: ['m.room.message'] });
-            const event = mkEvent({
-                type: 'm.room.message',
-                content: { },
-                room: 'roomId',
-                event: true,
-            });
-
-            const checkResult = filter.check(event);
-
-            expect(checkResult).toBe(true);
-        });
-    });
-});
@@ -0,0 +1,132 @@
+import {
+    RelationType,
+    UNSTABLE_FILTER_RELATED_BY_REL_TYPES,
+    UNSTABLE_FILTER_RELATED_BY_SENDERS,
+} from "../../src";
+import { FilterComponent } from "../../src/filter-component";
+import { mkEvent } from '../test-utils';
+
+describe("Filter Component", function() {
+    describe("types", function() {
+        it("should filter out events with other types", function() {
+            const filter = new FilterComponent({ types: ['m.room.message'] });
+            const event = mkEvent({
+                type: 'm.room.member',
+                content: { },
+                room: 'roomId',
+                event: true,
+            });
+
+            const checkResult = filter.check(event);
+
+            expect(checkResult).toBe(false);
+        });
+
+        it("should validate events with the same type", function() {
+            const filter = new FilterComponent({ types: ['m.room.message'] });
+            const event = mkEvent({
+                type: 'm.room.message',
+                content: { },
+                room: 'roomId',
+                event: true,
+            });
+
+            const checkResult = filter.check(event);
+
+            expect(checkResult).toBe(true);
+        });
+
+        it("should filter out events by relation participation", function() {
+            const currentUserId = '@me:server.org';
+            const filter = new FilterComponent({
+                [UNSTABLE_FILTER_RELATED_BY_SENDERS.name]: [currentUserId],
+            }, currentUserId);
+
+            const threadRootNotParticipated = mkEvent({
+                type: 'm.room.message',
+                content: {},
+                room: 'roomId',
+                user: '@someone-else:server.org',
+                event: true,
+                unsigned: {
+                    "m.relations": {
+                        [RelationType.Thread]: {
+                            count: 2,
+                            current_user_participated: false,
+                        },
+                    },
+                },
+            });
+
+            expect(filter.check(threadRootNotParticipated)).toBe(false);
+        });
+
+        it("should keep events by relation participation", function() {
+            const currentUserId = '@me:server.org';
+            const filter = new FilterComponent({
+                [UNSTABLE_FILTER_RELATED_BY_SENDERS.name]: [currentUserId],
+            }, currentUserId);
+
+            const threadRootParticipated = mkEvent({
+                type: 'm.room.message',
+                content: {},
+                unsigned: {
+                    "m.relations": {
+                        [RelationType.Thread]: {
+                            count: 2,
+                            current_user_participated: true,
+                        },
+                    },
+                },
+                user: '@someone-else:server.org',
+                room: 'roomId',
+                event: true,
+            });
+
+            expect(filter.check(threadRootParticipated)).toBe(true);
+        });
+
+        it("should filter out events by relation type", function() {
+            const filter = new FilterComponent({
+                [UNSTABLE_FILTER_RELATED_BY_REL_TYPES.name]: [RelationType.Thread],
+            });
+
+            const referenceRelationEvent = mkEvent({
+                type: 'm.room.message',
+                content: {},
+                room: 'roomId',
+                event: true,
+                unsigned: {
+                    "m.relations": {
+                        [RelationType.Reference]: {},
+                    },
+                },
+            });
+
+            expect(filter.check(referenceRelationEvent)).toBe(false);
+        });
+
+        it("should keep events by relation type", function() {
+            const filter = new FilterComponent({
+                [UNSTABLE_FILTER_RELATED_BY_REL_TYPES.name]: [RelationType.Thread],
+            });
+
+            const threadRootEvent = mkEvent({
+                type: 'm.room.message',
+                content: {},
+                unsigned: {
+                    "m.relations": {
+                        [RelationType.Thread]: {
+                            count: 2,
+                            current_user_participated: true,
+                        },
+                    },
+                },
+                room: 'roomId',
+                event: true,
+            });
+
+            expect(filter.check(threadRootEvent)).toBe(true);
+        });
+    });
+});
@@ -0,0 +1,56 @@
+/*
+Copyright 2022 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { makeLocationContent } from "../../src/content-helpers";
+import {
+    ASSET_NODE_TYPE,
+    LocationAssetType,
+    LOCATION_EVENT_TYPE,
+    TIMESTAMP_NODE_TYPE,
+} from "../../src/@types/location";
+import { TEXT_NODE_TYPE } from "../../src/@types/extensible_events";
+
+describe("Location", function() {
+    it("should create a valid location with defaults", function() {
+        const loc = makeLocationContent("txt", "geo:foo", 134235435);
+        expect(loc.body).toEqual("txt");
+        expect(loc.msgtype).toEqual("m.location");
+        expect(loc.geo_uri).toEqual("geo:foo");
+        expect(LOCATION_EVENT_TYPE.findIn(loc)).toEqual({
+            uri: "geo:foo",
+            description: undefined,
+        });
+        expect(ASSET_NODE_TYPE.findIn(loc)).toEqual({ type: LocationAssetType.Self });
+        expect(TEXT_NODE_TYPE.findIn(loc)).toEqual("txt");
+        expect(TIMESTAMP_NODE_TYPE.findIn(loc)).toEqual(134235435);
+    });
+
+    it("should create a valid location with explicit properties", function() {
+        const loc = makeLocationContent(
+            "txxt", "geo:bar", 134235436, "desc", LocationAssetType.Pin);
+
+        expect(loc.body).toEqual("txxt");
+        expect(loc.msgtype).toEqual("m.location");
+        expect(loc.geo_uri).toEqual("geo:bar");
+        expect(LOCATION_EVENT_TYPE.findIn(loc)).toEqual({
+            uri: "geo:bar",
+            description: "desc",
+        });
+        expect(ASSET_NODE_TYPE.findIn(loc)).toEqual({ type: LocationAssetType.Pin });
+        expect(TEXT_NODE_TYPE.findIn(loc)).toEqual("txxt");
+        expect(TIMESTAMP_NODE_TYPE.findIn(loc)).toEqual(134235436);
+    });
+});
@@ -11,8 +11,9 @@ import {
    UNSTABLE_MSC3089_TREE_SUBTYPE,
 } from "../../src/@types/event";
 import { MEGOLM_ALGORITHM } from "../../src/crypto/olmlib";
-import { MatrixEvent } from "../../src/models/event";
+import { EventStatus, MatrixEvent } from "../../src/models/event";
 import { Preset } from "../../src/@types/partials";
+import * as testUtils from "../test-utils";

 jest.useFakeTimers();

@@ -52,6 +53,12 @@ describe("MatrixClient", function() {
        data: SYNC_DATA,
    };

+    const CAPABILITIES_RESPONSE = {
+        method: "GET",
+        path: "/capabilities",
+        data: { capabilities: {} },
+    };
+
    let httpLookups = [
        // items are objects which look like:
        // {
@@ -84,11 +91,7 @@ describe("MatrixClient", function() {
                    return pendingLookup.promise;
                }
                // >1 pending thing, and they are different, whine.
-                expect(false).toBe(
-                    true, ">1 pending request. You should probably handle them. " +
-                    "PENDING: " + JSON.stringify(pendingLookup) + " JUST GOT: " +
-                    method + " " + path,
-                );
+                expect(false).toBe(true);
            }
            pendingLookup = {
                promise: new Promise(() => {}),
@@ -116,6 +119,7 @@ describe("MatrixClient", function() {
            }

            if (next.error) {
+                // eslint-disable-next-line
                return Promise.reject({
                    errcode: next.error.errcode,
                    httpStatus: next.error.httpStatus,
@@ -126,7 +130,7 @@ describe("MatrixClient", function() {
            }
            return Promise.resolve(next.data);
        }
-        expect(true).toBe(false, "Expected different request. " + logLine);
+        expect(true).toBe(false);
        return new Promise(() => {});
    }

@@ -151,7 +155,7 @@ describe("MatrixClient", function() {
            baseUrl: "https://my.home.server",
            idBaseUrl: identityServerUrl,
            accessToken: "my.access.token",
-            request: function() {}, // NOP
+            request: function() {} as any, // NOP
            store: store,
            scheduler: scheduler,
            userId: userId,
@@ -167,6 +171,7 @@ describe("MatrixClient", function() {
        acceptKeepalives = true;
        pendingLookup = null;
        httpLookups = [];
+        httpLookups.push(CAPABILITIES_RESPONSE);
        httpLookups.push(PUSH_RULES_RESPONSE);
        httpLookups.push(FILTER_RESPONSE);
        httpLookups.push(SYNC_RESPONSE);
@@ -237,6 +242,7 @@ describe("MatrixClient", function() {
    it("should get (unstable) file trees with valid state", async () => {
        const roomId = "!room:example.org";
        const mockRoom = {
+            getMyMembership: () => "join",
            currentState: {
                getStateEvents: (eventType, stateKey) => {
                    if (eventType === EventType.RoomCreate) {
@@ -270,9 +276,33 @@ describe("MatrixClient", function() {
        expect(tree.room).toBe(mockRoom);
    });

+    it("should not get (unstable) file trees if not joined", async () => {
+        const roomId = "!room:example.org";
+        const mockRoom = {
+            getMyMembership: () => "leave", // "not join"
+        };
+        client.getRoom = (getRoomId) => {
+            expect(getRoomId).toEqual(roomId);
+            return mockRoom;
+        };
+        const tree = client.unstableGetFileTreeSpace(roomId);
+        expect(tree).toBeFalsy();
+    });
+
+    it("should not get (unstable) file trees for unknown rooms", async () => {
+        const roomId = "!room:example.org";
+        client.getRoom = (getRoomId) => {
+            expect(getRoomId).toEqual(roomId);
+            return null; // imply unknown
+        };
+        const tree = client.unstableGetFileTreeSpace(roomId);
+        expect(tree).toBeFalsy();
+    });
+
    it("should not get (unstable) file trees with invalid create contents", async () => {
        const roomId = "!room:example.org";
        const mockRoom = {
+            getMyMembership: () => "join",
            currentState: {
                getStateEvents: (eventType, stateKey) => {
                    if (eventType === EventType.RoomCreate) {
@@ -307,6 +337,7 @@ describe("MatrixClient", function() {
    it("should not get (unstable) file trees with invalid purpose/subtype contents", async () => {
        const roomId = "!room:example.org";
        const mockRoom = {
+            getMyMembership: () => "join",
            currentState: {
                getStateEvents: (eventType, stateKey) => {
                    if (eventType === EventType.RoomCreate) {
@@ -338,15 +369,17 @@ describe("MatrixClient", function() {
    });

    it("should not POST /filter if a matching filter already exists", async function() {
-        httpLookups = [];
-        httpLookups.push(PUSH_RULES_RESPONSE);
-        httpLookups.push(SYNC_RESPONSE);
+        httpLookups = [
+            CAPABILITIES_RESPONSE,
+            PUSH_RULES_RESPONSE,
+            SYNC_RESPONSE,
+        ];
        const filterId = "ehfewf";
        store.getFilterIdByName.mockReturnValue(filterId);
-        const filter = new Filter(0, filterId);
+        const filter = new Filter("0", filterId);
        filter.setDefinition({ "room": { "timeline": { "limit": 8 } } });
        store.getFilter.mockReturnValue(filter);
-        const syncPromise = new Promise((resolve, reject) => {
+        const syncPromise = new Promise<void>((resolve, reject) => {
            client.on("sync", function syncListener(state) {
                if (state === "SYNCING") {
                    expect(httpLookups.length).toEqual(0);
@@ -367,7 +400,7 @@ describe("MatrixClient", function() {
        });

        it("should return the same sync state as emitted sync events", async function() {
-            const syncingPromise = new Promise((resolve) => {
+            const syncingPromise = new Promise<void>((resolve) => {
                client.on("sync", function syncListener(state) {
                    expect(state).toEqual(client.getSyncState());
                    if (state === "SYNCING") {
@@ -387,7 +420,7 @@ describe("MatrixClient", function() {
        it("should use an existing filter if id is present in localStorage", function() {
        });
        it("should handle localStorage filterId missing from the server", function(done) {
-            function getFilterName(userId, suffix) {
+            function getFilterName(userId, suffix?: string) {
                // scope this on the user ID because people may login on many accounts
                // and they all need to be stored!
                return "FILTER_SYNC_" + userId + (suffix ? "_" + suffix : "");
@@ -421,12 +454,15 @@ describe("MatrixClient", function() {

    describe("retryImmediately", function() {
        it("should return false if there is no request waiting", async function() {
+            httpLookups = [];
+            httpLookups.push(CAPABILITIES_RESPONSE);
            await client.startClient();
            expect(client.retryImmediately()).toBe(false);
        });

        it("should work on /filter", function(done) {
            httpLookups = [];
+            httpLookups.push(CAPABILITIES_RESPONSE);
            httpLookups.push(PUSH_RULES_RESPONSE);
            httpLookups.push({
                method: "POST", path: FILTER_PATH, error: { errcode: "NOPE_NOPE_NOPE" },
@@ -462,7 +498,7 @@ describe("MatrixClient", function() {
                if (state === "ERROR" && httpLookups.length > 0) {
                    expect(httpLookups.length).toEqual(1);
                    expect(client.retryImmediately()).toBe(
-                        true, "retryImmediately returned false",
+                        true,
                    );
                    jest.advanceTimersByTime(1);
                } else if (state === "RECONNECTING" && httpLookups.length > 0) {
@@ -477,6 +513,7 @@ describe("MatrixClient", function() {

        it("should work on /pushrules", function(done) {
            httpLookups = [];
+            httpLookups.push(CAPABILITIES_RESPONSE);
            httpLookups.push({
                method: "GET", path: "/pushrules/", error: { errcode: "NOPE_NOPE_NOPE" },
            });
@@ -533,6 +570,7 @@ describe("MatrixClient", function() {
        it("should transition null -> ERROR after a failed /filter", function(done) {
            const expectedStates = [];
            httpLookups = [];
+            httpLookups.push(CAPABILITIES_RESPONSE);
            httpLookups.push(PUSH_RULES_RESPONSE);
            httpLookups.push({
                method: "POST", path: FILTER_PATH, error: { errcode: "NOPE_NOPE_NOPE" },
@@ -543,32 +581,33 @@ describe("MatrixClient", function() {
        });

        it("should transition ERROR -> CATCHUP after /sync if prev failed",
-        function(done) {
-            const expectedStates = [];
-            acceptKeepalives = false;
-            httpLookups = [];
-            httpLookups.push(PUSH_RULES_RESPONSE);
-            httpLookups.push(FILTER_RESPONSE);
-            httpLookups.push({
-                method: "GET", path: "/sync", error: { errcode: "NOPE_NOPE_NOPE" },
-            });
-            httpLookups.push({
-                method: "GET", path: KEEP_ALIVE_PATH,
-                error: { errcode: "KEEPALIVE_FAIL" },
-            });
-            httpLookups.push({
-                method: "GET", path: KEEP_ALIVE_PATH, data: {},
-            });
-            httpLookups.push({
-                method: "GET", path: "/sync", data: SYNC_DATA,
-            });
+            function(done) {
+                const expectedStates = [];
+                acceptKeepalives = false;
+                httpLookups = [];
+                httpLookups.push(CAPABILITIES_RESPONSE);
+                httpLookups.push(PUSH_RULES_RESPONSE);
+                httpLookups.push(FILTER_RESPONSE);
+                httpLookups.push({
+                    method: "GET", path: "/sync", error: { errcode: "NOPE_NOPE_NOPE" },
+                });
+                httpLookups.push({
+                    method: "GET", path: KEEP_ALIVE_PATH,
+                    error: { errcode: "KEEPALIVE_FAIL" },
+                });
+                httpLookups.push({
+                    method: "GET", path: KEEP_ALIVE_PATH, data: {},
+                });
+                httpLookups.push({
+                    method: "GET", path: "/sync", data: SYNC_DATA,
+                });

-            expectedStates.push(["RECONNECTING", null]);
-            expectedStates.push(["ERROR", "RECONNECTING"]);
-            expectedStates.push(["CATCHUP", "ERROR"]);
-            client.on("sync", syncChecker(expectedStates, done));
-            client.startClient();
-        });
+                expectedStates.push(["RECONNECTING", null]);
+                expectedStates.push(["ERROR", "RECONNECTING"]);
+                expectedStates.push(["CATCHUP", "ERROR"]);
+                client.on("sync", syncChecker(expectedStates, done));
+                client.startClient();
+            });

        it("should transition PREPARED -> SYNCING after /sync", function(done) {
            const expectedStates = [];
@@ -598,32 +637,32 @@ describe("MatrixClient", function() {
        });

        xit("should transition ERROR -> SYNCING after /sync if prev failed",
-        function(done) {
-            const expectedStates = [];
-            httpLookups.push({
-                method: "GET", path: "/sync", error: { errcode: "NONONONONO" },
-            });
-            httpLookups.push(SYNC_RESPONSE);
+            function(done) {
+                const expectedStates = [];
+                httpLookups.push({
+                    method: "GET", path: "/sync", error: { errcode: "NONONONONO" },
+                });
+                httpLookups.push(SYNC_RESPONSE);

-            expectedStates.push(["PREPARED", null]);
-            expectedStates.push(["SYNCING", "PREPARED"]);
-            expectedStates.push(["ERROR", "SYNCING"]);
-            client.on("sync", syncChecker(expectedStates, done));
-            client.startClient();
-        });
+                expectedStates.push(["PREPARED", null]);
+                expectedStates.push(["SYNCING", "PREPARED"]);
+                expectedStates.push(["ERROR", "SYNCING"]);
+                client.on("sync", syncChecker(expectedStates, done));
+                client.startClient();
+            });

        it("should transition SYNCING -> SYNCING on subsequent /sync successes",
-        function(done) {
-            const expectedStates = [];
-            httpLookups.push(SYNC_RESPONSE);
-            httpLookups.push(SYNC_RESPONSE);
+            function(done) {
+                const expectedStates = [];
+                httpLookups.push(SYNC_RESPONSE);
+                httpLookups.push(SYNC_RESPONSE);

-            expectedStates.push(["PREPARED", null]);
-            expectedStates.push(["SYNCING", "PREPARED"]);
-            expectedStates.push(["SYNCING", "SYNCING"]);
-            client.on("sync", syncChecker(expectedStates, done));
-            client.startClient();
-        });
+                expectedStates.push(["PREPARED", null]);
+                expectedStates.push(["SYNCING", "PREPARED"]);
+                expectedStates.push(["SYNCING", "SYNCING"]);
+                client.on("sync", syncChecker(expectedStates, done));
+                client.startClient();
+            });

        it("should transition ERROR -> ERROR if keepalive keeps failing", function(done) {
            acceptKeepalives = false;
@@ -671,7 +710,8 @@ describe("MatrixClient", function() {

    describe("guest rooms", function() {
        it("should only do /sync calls (without filter/pushrules)", function(done) {
-            httpLookups = []; // no /pushrules or /filter
+            httpLookups = []; // no /pushrules or /filterw
+            httpLookups.push(CAPABILITIES_RESPONSE);
            httpLookups.push({
                method: "GET",
                path: "/sync",
@@ -702,4 +742,242 @@ describe("MatrixClient", function() {
            expect(httpLookups.length).toEqual(0);
        });
    });
+
+    describe("sendEvent", () => {
+        const roomId = "!room:example.org";
+        const body = "This is the body";
+        const content = { body };
+
+        it("overload without threadId works", async () => {
+            const eventId = "$eventId:example.org";
+            const txnId = client.makeTxnId();
+            httpLookups = [{
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/send/m.room.message/${txnId}`,
+                data: { event_id: eventId },
+                expectBody: content,
+            }];
+
+            await client.sendEvent(roomId, EventType.RoomMessage, content, txnId);
+        });
+
+        it("overload with null threadId works", async () => {
+            const eventId = "$eventId:example.org";
+            const txnId = client.makeTxnId();
+            httpLookups = [{
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/send/m.room.message/${txnId}`,
+                data: { event_id: eventId },
+                expectBody: content,
+            }];
+
+            await client.sendEvent(roomId, null, EventType.RoomMessage, content, txnId);
+        });
+
+        it("overload with threadId works", async () => {
+            const eventId = "$eventId:example.org";
+            const txnId = client.makeTxnId();
+            httpLookups = [{
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/send/m.room.message/${txnId}`,
+                data: { event_id: eventId },
+                expectBody: content,
+            }];
+
+            await client.sendEvent(roomId, "$threadId:server", EventType.RoomMessage, content, txnId);
+        });
+    });
+
+    describe("redactEvent", () => {
+        const roomId = "!room:example.org";
+        const mockRoom = {
+            getMyMembership: () => "join",
+            currentState: {
+                getStateEvents: (eventType, stateKey) => {
+                    if (eventType === EventType.RoomEncryption) {
+                        expect(stateKey).toEqual("");
+                        return new MatrixEvent({ content: {} });
+                    } else {
+                        throw new Error("Unexpected event type or state key");
+                    }
+                },
+            },
+            threads: {
+                get: jest.fn(),
+            },
+            addPendingEvent: jest.fn(),
+            updatePendingEvent: jest.fn(),
+        };
+
+        beforeEach(() => {
+            client.getRoom = (getRoomId) => {
+                expect(getRoomId).toEqual(roomId);
+                return mockRoom;
+            };
+        });
+
+        it("overload without threadId works", async () => {
+            const eventId = "$eventId:example.org";
+            const txnId = client.makeTxnId();
+            httpLookups = [{
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/redact/${encodeURIComponent(eventId)}/${txnId}`,
+                data: { event_id: eventId },
+            }];
+
+            await client.redactEvent(roomId, eventId, txnId);
+        });
+
+        it("overload with null threadId works", async () => {
+            const eventId = "$eventId:example.org";
+            const txnId = client.makeTxnId();
+            httpLookups = [{
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/redact/${encodeURIComponent(eventId)}/${txnId}`,
+                data: { event_id: eventId },
+            }];
+
+            await client.redactEvent(roomId, null, eventId, txnId);
+        });
+
+        it("overload with threadId works", async () => {
+            const eventId = "$eventId:example.org";
+            const txnId = client.makeTxnId();
+            httpLookups = [{
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/redact/${encodeURIComponent(eventId)}/${txnId}`,
+                data: { event_id: eventId },
+            }];
+
+            await client.redactEvent(roomId, "$threadId:server", eventId, txnId);
+        });
+
+        it("does not get wrongly encrypted", async () => {
+            const eventId = "$eventId:example.org";
+            const txnId = client.makeTxnId();
+            const reason = "This is the redaction reason";
+            httpLookups = [{
+                method: "PUT",
+                path: `/rooms/${encodeURIComponent(roomId)}/redact/${encodeURIComponent(eventId)}/${txnId}`,
+                expectBody: { reason }, // NOT ENCRYPTED
+                data: { event_id: eventId },
+            }];
+
+            await client.redactEvent(roomId, eventId, txnId, { reason });
+        });
+    });
+
+    describe("cancelPendingEvent", () => {
+        const roomId = "!room:server";
+        const txnId = "m12345";
+
+        const mockRoom = {
+            getMyMembership: () => "join",
+            updatePendingEvent: (event, status) => event.setStatus(status),
+            currentState: {
+                getStateEvents: (eventType, stateKey) => {
+                    if (eventType === EventType.RoomCreate) {
+                        expect(stateKey).toEqual("");
+                        return new MatrixEvent({
+                            content: {
+                                [RoomCreateTypeField]: RoomType.Space,
+                            },
+                        });
+                    } else if (eventType === EventType.RoomEncryption) {
+                        expect(stateKey).toEqual("");
+                        return new MatrixEvent({ content: {} });
+                    } else {
+                        throw new Error("Unexpected event type or state key");
+                    }
+                },
+            },
+        };
+
+        let event;
+        beforeEach(async () => {
+            event = new MatrixEvent({
+                event_id: "~" + roomId + ":" + txnId,
+                user_id: client.credentials.userId,
+                sender: client.credentials.userId,
+                room_id: roomId,
+                origin_server_ts: new Date().getTime(),
+            });
+            event.setTxnId(txnId);
+
+            client.getRoom = (getRoomId) => {
+                expect(getRoomId).toEqual(roomId);
+                return mockRoom;
+            };
+            client.crypto = { // mock crypto
+                encryptEvent: (event, room) => new Promise(() => {}),
+            };
+        });
+
+        function assertCancelled() {
+            expect(event.status).toBe(EventStatus.CANCELLED);
+            expect(client.scheduler.removeEventFromQueue(event)).toBeFalsy();
+            expect(httpLookups.filter(h => h.path.includes("/send/")).length).toBe(0);
+        }
+
+        it("should cancel an event which is queued", () => {
+            event.setStatus(EventStatus.QUEUED);
+            client.scheduler.queueEvent(event);
+            client.cancelPendingEvent(event);
+            assertCancelled();
+        });
+
+        it("should cancel an event which is encrypting", async () => {
+            client.encryptAndSendEvent(null, event);
+            await testUtils.emitPromise(event, "Event.status");
+            client.cancelPendingEvent(event);
+            assertCancelled();
+        });
+
+        it("should cancel an event which is not sent", () => {
+            event.setStatus(EventStatus.NOT_SENT);
+            client.cancelPendingEvent(event);
+            assertCancelled();
+        });
+
+        it("should error when given any other event status", () => {
+            event.setStatus(EventStatus.SENDING);
+            expect(() => client.cancelPendingEvent(event)).toThrow("cannot cancel an event with status sending");
+            expect(event.status).toBe(EventStatus.SENDING);
+        });
+    });
+
+    describe("threads", () => {
+        it("partitions root events to room timeline and thread timeline", () => {
+            const supportsExperimentalThreads = client.supportsExperimentalThreads;
+            client.supportsExperimentalThreads = () => true;
+
+            const rootEvent = new MatrixEvent({
+                "content": {},
+                "origin_server_ts": 1,
+                "room_id": "!room1:matrix.org",
+                "sender": "@alice:matrix.org",
+                "type": "m.room.message",
+                "unsigned": {
+                    "m.relations": {
+                        "io.element.thread": {
+                            "latest_event": {},
+                            "count": 33,
+                            "current_user_participated": false,
+                        },
+                    },
+                },
+                "event_id": "$ev1",
+                "user_id": "@alice:matrix.org",
+            });
+
+            expect(rootEvent.isThreadRoot).toBe(true);
+
+            const [room, threads] = client.partitionThreadedEvents([rootEvent]);
+            expect(room).toHaveLength(1);
+            expect(threads).toHaveLength(1);
+
+            // Restore method
+            client.supportsExperimentalThreads = supportsExperimentalThreads;
+        });
+    });
 });
@@ -14,22 +14,25 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import { MatrixClient } from "../../../src";
+import { IContent, MatrixClient, MatrixEvent } from "../../../src";
 import { Room } from "../../../src/models/room";
-import { MatrixEvent } from "../../../src/models/event";
-import { UNSTABLE_MSC3089_BRANCH } from "../../../src/@types/event";
+import { IEncryptedFile, RelationType, UNSTABLE_MSC3089_BRANCH } from "../../../src/@types/event";
 import { EventTimelineSet } from "../../../src/models/event-timeline-set";
 import { EventTimeline } from "../../../src/models/event-timeline";
 import { MSC3089Branch } from "../../../src/models/MSC3089Branch";
+import { MSC3089TreeSpace } from "../../../src/models/MSC3089TreeSpace";

 describe("MSC3089Branch", () => {
    let client: MatrixClient;
    // @ts-ignore - TS doesn't know that this is a type
-    let indexEvent: MatrixEvent;
+    let indexEvent: any;
+    let directory: MSC3089TreeSpace;
    let branch: MSC3089Branch;
+    let branch2: MSC3089Branch;

    const branchRoomId = "!room:example.org";
    const fileEventId = "$file";
+    const fileEventId2 = "$second_file";

    const staticTimelineSets = {} as EventTimelineSet;
    const staticRoom = {
@@ -47,11 +50,16 @@ describe("MSC3089Branch", () => {
                }
            },
        };
-        indexEvent = {
+        indexEvent = ({
            getRoomId: () => branchRoomId,
            getStateKey: () => fileEventId,
-        };
-        branch = new MSC3089Branch(client, indexEvent);
+        });
+        directory = new MSC3089TreeSpace(client, branchRoomId);
+        branch = new MSC3089Branch(client, indexEvent, directory);
+        branch2 = new MSC3089Branch(client, {
+            getRoomId: () => branchRoomId,
+            getStateKey: () => fileEventId2,
+        } as MatrixEvent, directory);
    });

    it('should know the file event ID', () => {
@@ -70,13 +78,15 @@ describe("MSC3089Branch", () => {
    });

    it('should be able to delete the file', async () => {
+        const eventIdOrder = [fileEventId, fileEventId2];
+
        const stateFn = jest.fn()
            .mockImplementation((roomId: string, eventType: string, content: any, stateKey: string) => {
                expect(roomId).toEqual(branchRoomId);
                expect(eventType).toEqual(UNSTABLE_MSC3089_BRANCH.unstable); // test that we're definitely using the unstable value
                expect(content).toMatchObject({});
                expect(content['active']).toBeUndefined();
-                expect(stateKey).toEqual(fileEventId);
+                expect(stateKey).toEqual(eventIdOrder[stateFn.mock.calls.length - 1]);

                return Promise.resolve(); // return value not used
            });
@@ -84,16 +94,19 @@ describe("MSC3089Branch", () => {

        const redactFn = jest.fn().mockImplementation((roomId: string, eventId: string) => {
            expect(roomId).toEqual(branchRoomId);
-            expect(eventId).toEqual(fileEventId);
+            expect(eventId).toEqual(eventIdOrder[stateFn.mock.calls.length - 1]);

            return Promise.resolve(); // return value not used
        });
        client.redactEvent = redactFn;

+        branch.getVersionHistory = () => Promise.resolve([branch, branch2]);
+        branch2.getVersionHistory = () => Promise.resolve([branch2]);
+
        await branch.delete();

-        expect(stateFn).toHaveBeenCalledTimes(1);
-        expect(redactFn).toHaveBeenCalledTimes(1);
+        expect(stateFn).toHaveBeenCalledTimes(2);
+        expect(redactFn).toHaveBeenCalledTimes(2);
    });

    it('should know its name', async () => {
@@ -128,16 +141,71 @@ describe("MSC3089Branch", () => {
        expect(stateFn).toHaveBeenCalledTimes(1);
    });

+    it('should be v1 by default', () => {
+        indexEvent.getContent = () => ({ active: true });
+
+        const res = branch.version;
+
+        expect(res).toEqual(1);
+    });
+
+    it('should be vN when set', () => {
+        indexEvent.getContent = () => ({ active: true, version: 3 });
+
+        const res = branch.version;
+
+        expect(res).toEqual(3);
+    });
+
+    it('should be unlocked by default', async () => {
+        indexEvent.getContent = () => ({ active: true });
+
+        const res = branch.isLocked();
+
+        expect(res).toEqual(false);
+    });
+
+    it('should use lock status from index event', async () => {
+        indexEvent.getContent = () => ({ active: true, locked: true });
+
+        const res = branch.isLocked();
+
+        expect(res).toEqual(true);
+    });
+
+    it('should be able to change its locked status', async () => {
+        const locked = true;
+        indexEvent.getContent = () => ({ active: true, retained: true });
+        const stateFn = jest.fn()
+            .mockImplementation((roomId: string, eventType: string, content: any, stateKey: string) => {
+                expect(roomId).toEqual(branchRoomId);
+                expect(eventType).toEqual(UNSTABLE_MSC3089_BRANCH.unstable); // test that we're definitely using the unstable value
+                expect(content).toMatchObject({
+                    retained: true, // canary for copying state
+                    active: true,
+                    locked: locked,
+                });
+                expect(stateKey).toEqual(fileEventId);
+
+                return Promise.resolve(); // return value not used
+            });
+        client.sendStateEvent = stateFn;
+
+        await branch.setLocked(locked);
+
+        expect(stateFn).toHaveBeenCalledTimes(1);
+    });
+
    it('should be able to return event information', async () => {
        const mxcLatter = "example.org/file";
        const fileContent = { isFile: "not quite", url: "mxc://" + mxcLatter };
-        const eventsArr = [
-            { getId: () => "$not-file", getContent: () => ({}) },
-            { getId: () => fileEventId, getContent: () => ({ file: fileContent }) },
-        ];
-        client.getEventTimeline = () => Promise.resolve({
-            getEvents: () => eventsArr,
-        }) as any as Promise<EventTimeline>; // partial
+        const fileEvent = { getId: () => fileEventId, getOriginalContent: () => ({ file: fileContent }) };
+        staticRoom.getUnfilteredTimelineSet = () => ({
+            findEventById: (eventId) => {
+                expect(eventId).toEqual(fileEventId);
+                return fileEvent;
+            },
+        }) as EventTimelineSet;
        client.mxcUrlToHttp = (mxc: string) => {
            expect(mxc).toEqual("mxc://" + mxcLatter);
            return `https://example.org/_matrix/media/v1/download/${mxcLatter}`;
@@ -152,4 +220,112 @@ describe("MSC3089Branch", () => {
            httpUrl: expect.stringMatching(`.+${mxcLatter.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`),
        });
    });
+
+    it('should be able to return the event object', async () => {
+        const mxcLatter = "example.org/file";
+        const fileContent = { isFile: "not quite", url: "mxc://" + mxcLatter };
+        const fileEvent = { getId: () => fileEventId, getOriginalContent: () => ({ file: fileContent }) };
+        staticRoom.getUnfilteredTimelineSet = () => ({
+            findEventById: (eventId) => {
+                expect(eventId).toEqual(fileEventId);
+                return fileEvent;
+            },
+        }) as EventTimelineSet;
+        client.mxcUrlToHttp = (mxc: string) => {
+            expect(mxc).toEqual("mxc://" + mxcLatter);
+            return `https://example.org/_matrix/media/v1/download/${mxcLatter}`;
+        };
+        client.decryptEventIfNeeded = () => Promise.resolve();
+
+        const res = await branch.getFileEvent();
+        expect(res).toBeDefined();
+        expect(res).toBe(fileEvent);
+    });
+
+    it('should create new versions of itself', async () => {
+        const canaryName = "canary";
+        const canaryContents = "contents go here";
+        const canaryFile = {} as IEncryptedFile;
+        const canaryAddl = { canary: true };
+        indexEvent.getContent = () => ({ active: true, retained: true });
+        const stateKeyOrder = [fileEventId2, fileEventId];
+        const stateFn = jest.fn()
+            .mockImplementation((roomId: string, eventType: string, content: any, stateKey: string) => {
+                expect(roomId).toEqual(branchRoomId);
+                expect(eventType).toEqual(UNSTABLE_MSC3089_BRANCH.unstable); // test that we're definitely using the unstable value
+                expect(stateKey).toEqual(stateKeyOrder[stateFn.mock.calls.length - 1]);
+                if (stateKey === fileEventId) {
+                    expect(content).toMatchObject({
+                        retained: true, // canary for copying state
+                        active: false,
+                    });
+                } else if (stateKey === fileEventId2) {
+                    expect(content).toMatchObject({
+                        active: true,
+                        version: 2,
+                        name: canaryName,
+                    });
+                } else {
+                    throw new Error("Unexpected state key: " + stateKey);
+                }
+
+                return Promise.resolve(); // return value not used
+            });
+        client.sendStateEvent = stateFn;
+
+        const createFn = jest.fn().mockImplementation((
+            name: string,
+            contents: ArrayBuffer,
+            info: Partial<IEncryptedFile>,
+            addl: IContent,
+        ) => {
+            expect(name).toEqual(canaryName);
+            expect(contents).toBe(canaryContents);
+            expect(info).toBe(canaryFile);
+            expect(addl).toMatchObject({
+                ...canaryAddl,
+                "m.new_content": true,
+                "m.relates_to": {
+                    "rel_type": RelationType.Replace,
+                    "event_id": fileEventId,
+                },
+            });
+
+            return Promise.resolve({ event_id: fileEventId2 });
+        });
+        directory.createFile = createFn;
+
+        await branch.createNewVersion(canaryName, canaryContents, canaryFile, canaryAddl);
+
+        expect(stateFn).toHaveBeenCalledTimes(2);
+        expect(createFn).toHaveBeenCalledTimes(1);
+    });
+
+    it('should fetch file history', async () => {
+        branch2.getFileEvent = () => Promise.resolve({
+            replacingEventId: () => undefined,
+            getId: () => fileEventId2,
+        } as MatrixEvent);
+        branch.getFileEvent = () => Promise.resolve({
+            replacingEventId: () => fileEventId2,
+            getId: () => fileEventId,
+        } as MatrixEvent);
+
+        const events = [await branch.getFileEvent(), await branch2.getFileEvent(), {
+            replacingEventId: (): string => null,
+            getId: () => "$unknown",
+        }];
+        staticRoom.getLiveTimeline = () => ({ getEvents: () => events }) as EventTimeline;
+
+        directory.getFile = (evId: string) => {
+            expect(evId).toEqual(fileEventId);
+            return branch;
+        };
+
+        const results = await branch2.getVersionHistory();
+        expect(results).toMatchObject([
+            branch2,
+            branch,
+        ]);
+    });
 });
@@ -24,11 +24,11 @@ import {
    TreePermissions,
 } from "../../../src/models/MSC3089TreeSpace";
 import { DEFAULT_ALPHABET } from "../../../src/utils";
-import { MockBlob } from "../../MockBlob";
+import { MatrixError } from "../../../src/http-api";

 describe("MSC3089TreeSpace", () => {
    let client: MatrixClient;
-    let room: Room;
+    let room: any;
    let tree: MSC3089TreeSpace;
    const roomId = "!tree:localhost";
    const targetUser = "@target:example.org";
@@ -93,7 +93,7 @@ describe("MSC3089TreeSpace", () => {
            });
        client.sendStateEvent = fn;
        await tree.setName(newName);
-        expect(fn.mock.calls.length).toBe(1);
+        expect(fn).toHaveBeenCalledTimes(1);
    });

    it('should support inviting users to the space', async () => {
@@ -104,8 +104,113 @@ describe("MSC3089TreeSpace", () => {
            return Promise.resolve();
        });
        client.invite = fn;
-        await tree.invite(target);
-        expect(fn.mock.calls.length).toBe(1);
+        await tree.invite(target, false, false);
+        expect(fn).toHaveBeenCalledTimes(1);
+    });
+
+    it('should retry invites to the space', async () => {
+        const target = targetUser;
+        const fn = jest.fn().mockImplementation((inviteRoomId: string, userId: string) => {
+            expect(inviteRoomId).toEqual(roomId);
+            expect(userId).toEqual(target);
+            if (fn.mock.calls.length === 1) return Promise.reject(new Error("Sample Failure"));
+            return Promise.resolve();
+        });
+        client.invite = fn;
+        await tree.invite(target, false, false);
+        expect(fn).toHaveBeenCalledTimes(2);
+    });
+
+    it('should not retry invite permission errors', async () => {
+        const target = targetUser;
+        const fn = jest.fn().mockImplementation((inviteRoomId: string, userId: string) => {
+            expect(inviteRoomId).toEqual(roomId);
+            expect(userId).toEqual(target);
+            return Promise.reject(new MatrixError({ errcode: "M_FORBIDDEN", error: "Sample Failure" }));
+        });
+        client.invite = fn;
+        try {
+            await tree.invite(target, false, false);
+
+            // noinspection ExceptionCaughtLocallyJS
+            throw new Error("Failed to fail");
+        } catch (e) {
+            expect(e.errcode).toEqual("M_FORBIDDEN");
+        }
+
+        expect(fn).toHaveBeenCalledTimes(1);
+    });
+
+    it('should invite to subspaces', async () => {
+        const target = targetUser;
+        const fn = jest.fn().mockImplementation((inviteRoomId: string, userId: string) => {
+            expect(inviteRoomId).toEqual(roomId);
+            expect(userId).toEqual(target);
+            return Promise.resolve();
+        });
+        client.invite = fn;
+        tree.getDirectories = () => [
+            // Bare minimum overrides. We proxy to our mock function manually so we can
+            // count the calls, not to ensure accuracy. The invite function behaving correctly
+            // is covered by another test.
+            { invite: (userId) => fn(tree.roomId, userId) } as MSC3089TreeSpace,
+            { invite: (userId) => fn(tree.roomId, userId) } as MSC3089TreeSpace,
+            { invite: (userId) => fn(tree.roomId, userId) } as MSC3089TreeSpace,
+        ];
+
+        await tree.invite(target, true, false);
+        expect(fn).toHaveBeenCalledTimes(4);
+    });
+
+    it('should share keys with invitees', async () => {
+        const target = targetUser;
+        const sendKeysFn = jest.fn().mockImplementation((inviteRoomId: string, userIds: string[]) => {
+            expect(inviteRoomId).toEqual(roomId);
+            expect(userIds).toMatchObject([target]);
+            return Promise.resolve();
+        });
+        client.invite = () => Promise.resolve({}); // we're not testing this here - see other tests
+        client.sendSharedHistoryKeys = sendKeysFn;
+
+        // Mock the history check as best as possible
+        const historyVis = "shared";
+        const historyFn = jest.fn().mockImplementation((eventType: string, stateKey?: string) => {
+            // We're not expecting a super rigid test: the function that calls this internally isn't
+            // really being tested here.
+            expect(eventType).toEqual(EventType.RoomHistoryVisibility);
+            expect(stateKey).toEqual("");
+            return { getContent: () => ({ history_visibility: historyVis }) }; // eslint-disable-line camelcase
+        });
+        room.currentState.getStateEvents = historyFn;
+
+        // Note: inverse test is implicit from other tests, which disable the call stack of this
+        // test in order to pass.
+        await tree.invite(target, false, true);
+        expect(sendKeysFn).toHaveBeenCalledTimes(1);
+        expect(historyFn).toHaveBeenCalledTimes(1);
+    });
+
+    it('should not share keys with invitees if inappropriate history visibility', async () => {
+        const target = targetUser;
+        const sendKeysFn = jest.fn().mockImplementation((inviteRoomId: string, userIds: string[]) => {
+            expect(inviteRoomId).toEqual(roomId);
+            expect(userIds).toMatchObject([target]);
+            return Promise.resolve();
+        });
+        client.invite = () => Promise.resolve({}); // we're not testing this here - see other tests
+        client.sendSharedHistoryKeys = sendKeysFn;
+
+        const historyVis = "joined"; // NOTE: Changed.
+        const historyFn = jest.fn().mockImplementation((eventType: string, stateKey?: string) => {
+            expect(eventType).toEqual(EventType.RoomHistoryVisibility);
+            expect(stateKey).toEqual("");
+            return { getContent: () => ({ history_visibility: historyVis }) }; // eslint-disable-line camelcase
+        });
+        room.currentState.getStateEvents = historyFn;
+
+        await tree.invite(target, false, true);
+        expect(sendKeysFn).toHaveBeenCalledTimes(0);
+        expect(historyFn).toHaveBeenCalledTimes(1);
    });

    async function evaluatePowerLevels(pls: any, role: TreePermissions, expectedPl: number) {
@@ -121,40 +226,61 @@ describe("MSC3089TreeSpace", () => {
                        [targetUser]: expectedPl,
                    },
                });
+
+                // Store new power levels so the `getPermissions()` test passes
+                makePowerLevels(content);
+
                return Promise.resolve();
            });
        client.sendStateEvent = fn;
        await tree.setPermissions(targetUser, role);
        expect(fn.mock.calls.length).toBe(1);
+
+        const finalPermissions = tree.getPermissions(targetUser);
+        expect(finalPermissions).toEqual(role);
    }

    it('should support setting Viewer permissions', () => {
        return evaluatePowerLevels({
            ...DEFAULT_TREE_POWER_LEVELS_TEMPLATE,
            users_default: 1024,
+            events_default: 1025,
+            events: {
+                [EventType.RoomPowerLevels]: 1026,
+            },
        }, TreePermissions.Viewer, 1024);
    });

    it('should support setting Editor permissions', () => {
        return evaluatePowerLevels({
            ...DEFAULT_TREE_POWER_LEVELS_TEMPLATE,
-            events_default: 1024,
-        }, TreePermissions.Editor, 1024);
+            users_default: 1024,
+            events_default: 1025,
+            events: {
+                [EventType.RoomPowerLevels]: 1026,
+            },
+        }, TreePermissions.Editor, 1025);
    });

    it('should support setting Owner permissions', () => {
        return evaluatePowerLevels({
            ...DEFAULT_TREE_POWER_LEVELS_TEMPLATE,
+            users_default: 1024,
+            events_default: 1025,
            events: {
-                [EventType.RoomPowerLevels]: 1024,
+                [EventType.RoomPowerLevels]: 1026,
            },
-        }, TreePermissions.Owner, 1024);
+        }, TreePermissions.Owner, 1026);
    });

    it('should support demoting permissions', () => {
        return evaluatePowerLevels({
            ...DEFAULT_TREE_POWER_LEVELS_TEMPLATE,
            users_default: 1024,
+            events_default: 1025,
+            events: {
+                [EventType.RoomPowerLevels]: 1026,
+            },
            users: {
                [targetUser]: 2222,
            },
@@ -164,11 +290,15 @@ describe("MSC3089TreeSpace", () => {
    it('should support promoting permissions', () => {
        return evaluatePowerLevels({
            ...DEFAULT_TREE_POWER_LEVELS_TEMPLATE,
-            events_default: 1024,
+            users_default: 1024,
+            events_default: 1025,
+            events: {
+                [EventType.RoomPowerLevels]: 1026,
+            },
            users: {
                [targetUser]: 5,
            },
-        }, TreePermissions.Editor, 1024);
+        }, TreePermissions.Editor, 1025);
    });

    it('should support defaults: Viewer', () => {
@@ -340,9 +470,9 @@ describe("MSC3089TreeSpace", () => {
        // Danger: these are partial implementations for testing purposes only

        // @ts-ignore - "MatrixEvent is a value but used as a type", which is true but not important
-        let childState: { [roomId: string]: MatrixEvent[] } = {};
+        let childState: { [roomId: string]: any[] } = {};
        // @ts-ignore - "MatrixEvent is a value but used as a type", which is true but not important
-        let parentState: MatrixEvent[] = [];
+        let parentState: any[] = [];
        let parentRoom: Room;
        let childTrees: MSC3089TreeSpace[];
        let rooms: { [roomId: string]: Room };
@@ -756,12 +886,8 @@ describe("MSC3089TreeSpace", () => {
        const fileName = "My File.txt";
        const fileContents = "This is a test file";

-        // Mock out Blob for the test environment
-        (<any>global).Blob = MockBlob;
-
-        const uploadFn = jest.fn().mockImplementation((contents: Blob, opts: any) => {
-            expect(contents).toBeInstanceOf(Blob);
-            expect(contents.size).toEqual(fileContents.length);
+        const uploadFn = jest.fn().mockImplementation((contents: Buffer, opts: any) => {
+            expect(contents.length).toEqual(fileContents.length);
            expect(opts).toMatchObject({
                includeFilename: false,
                onlyContentUri: true, // because the tests rely on this - we shouldn't really be testing  for this.
@@ -777,6 +903,7 @@ describe("MSC3089TreeSpace", () => {
                body: fileName,
                url: mxc,
                file: fileInfo,
+                metadata: true, // additional content from test
                [UNSTABLE_MSC3089_LEAF.unstable]: {}, // test to ensure we're definitely using unstable
            });

@@ -794,14 +921,78 @@ describe("MSC3089TreeSpace", () => {
                    name: fileName,
                });

-                return Promise.resolve(); // return value not used.
+                return Promise.resolve({ event_id: "wrong" }); // return value shouldn't be used
            });
        client.sendStateEvent = sendStateFn;

-        const buf = Uint8Array.from(Array.from(fileContents).map((_, i) => fileContents.charCodeAt(i)));
+        const buf = Buffer.from(fileContents);

        // We clone the file info just to make sure it doesn't get mutated for the test.
-        await tree.createFile(fileName, buf, Object.assign({}, fileInfo));
+        const result = await tree.createFile(fileName, buf, Object.assign({}, fileInfo), { metadata: true });
+        expect(result).toMatchObject({ event_id: fileEventId });
+
+        expect(uploadFn).toHaveBeenCalledTimes(1);
+        expect(sendMsgFn).toHaveBeenCalledTimes(1);
+        expect(sendStateFn).toHaveBeenCalledTimes(1);
+    });
+
+    it('should upload file versions', async () => {
+        const mxc = "mxc://example.org/file";
+        const fileInfo = {
+            mimetype: "text/plain",
+            // other fields as required by encryption, but ignored here
+        };
+        const fileEventId = "$file";
+        const fileName = "My File.txt";
+        const fileContents = "This is a test file";
+
+        const uploadFn = jest.fn().mockImplementation((contents: Buffer, opts: any) => {
+            expect(contents.length).toEqual(fileContents.length);
+            expect(opts).toMatchObject({
+                includeFilename: false,
+                onlyContentUri: true, // because the tests rely on this - we shouldn't really be testing  for this.
+            });
+            return Promise.resolve(mxc);
+        });
+        client.uploadContent = uploadFn;
+
+        const sendMsgFn = jest.fn().mockImplementation((roomId: string, contents: any) => {
+            expect(roomId).toEqual(tree.roomId);
+            const content = {
+                msgtype: MsgType.File,
+                body: fileName,
+                url: mxc,
+                file: fileInfo,
+            };
+            expect(contents).toMatchObject({
+                ...content,
+                "m.new_content": content,
+                [UNSTABLE_MSC3089_LEAF.unstable]: {}, // test to ensure we're definitely using unstable
+            });
+
+            return Promise.resolve({ event_id: fileEventId }); // eslint-disable-line camelcase
+        });
+        client.sendMessage = sendMsgFn;
+
+        const sendStateFn = jest.fn()
+            .mockImplementation((roomId: string, eventType: string, content: any, stateKey: string) => {
+                expect(roomId).toEqual(tree.roomId);
+                expect(eventType).toEqual(UNSTABLE_MSC3089_BRANCH.unstable); // test to ensure we're definitely using unstable
+                expect(stateKey).toEqual(fileEventId);
+                expect(content).toMatchObject({
+                    active: true,
+                    name: fileName,
+                });
+
+                return Promise.resolve({ event_id: "wrong" }); // return value shouldn't be used
+            });
+        client.sendStateEvent = sendStateFn;
+
+        const buf = Buffer.from(fileContents);
+
+        // We clone the file info just to make sure it doesn't get mutated for the test.
+        const result = await tree.createFile(fileName, buf, Object.assign({}, fileInfo), { "m.new_content": true });
+        expect(result).toMatchObject({ event_id: fileEventId });

        expect(uploadFn).toHaveBeenCalledTimes(1);
        expect(sendMsgFn).toHaveBeenCalledTimes(1);
@@ -827,7 +1018,7 @@ describe("MSC3089TreeSpace", () => {
    it('should return falsy for unknown files', () => {
        const fileEventId = "$file";
        room.currentState = {
-            getStateEvents: (eventType: string, stateKey?: string) => {
+            getStateEvents: (eventType: string, stateKey?: string): MatrixEvent[] | MatrixEvent | null => {
                expect(eventType).toEqual(UNSTABLE_MSC3089_BRANCH.unstable); // test to ensure we're definitely using unstable
                expect(stateKey).toEqual(fileEventId);
                return null;
@@ -854,4 +1045,22 @@ describe("MSC3089TreeSpace", () => {
        expect(files.length).toEqual(1);
        expect(files[0].indexEvent).toBe(firstFile);
    });
+
+    it('should list all files', () => {
+        const firstFile = { getContent: () => ({ active: true }) };
+        const secondFile = { getContent: () => ({ active: false }) }; // deliberately inactive
+        room.currentState = {
+            getStateEvents: (eventType: string, stateKey?: string) => {
+                expect(eventType).toEqual(UNSTABLE_MSC3089_BRANCH.unstable); // test to ensure we're definitely using unstable
+                expect(stateKey).toBeUndefined();
+                return [firstFile, secondFile];
+            },
+        };
+
+        const files = tree.listAllFiles();
+        expect(files).toBeDefined();
+        expect(files.length).toEqual(2);
+        expect(files[0].indexEvent).toBe(firstFile);
+        expect(files[1].indexEvent).toBe(secondFile);
+    });
 });
@@ -0,0 +1,60 @@
+/*
+Copyright 2021 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { MatrixEvent } from "../../../src/models/event";
+
+describe('MatrixEvent', () => {
+    it('should create copies of itself', () => {
+        const a = new MatrixEvent({
+            type: "com.example.test",
+            content: {
+                isTest: true,
+                num: 42,
+            },
+        });
+
+        const clone = a.toSnapshot();
+        expect(clone).toBeDefined();
+        expect(clone).not.toBe(a);
+        expect(clone.event).not.toBe(a.event);
+        expect(clone.event).toMatchObject(a.event);
+
+        // The other properties we're not super interested in, honestly.
+    });
+
+    it('should compare itself to other events using json', () => {
+        const a = new MatrixEvent({
+            type: "com.example.test",
+            content: {
+                isTest: true,
+                num: 42,
+            },
+        });
+        const b = new MatrixEvent({
+            type: "com.example.test______B",
+            content: {
+                isTest: true,
+                num: 42,
+            },
+        });
+        expect(a.isEquivalentTo(b)).toBe(false);
+        expect(a.isEquivalentTo(a)).toBe(true);
+        expect(b.isEquivalentTo(a)).toBe(false);
+        expect(b.isEquivalentTo(b)).toBe(true);
+        expect(a.toSnapshot().isEquivalentTo(a)).toBe(true);
+        expect(a.toSnapshot().isEquivalentTo(b)).toBe(false);
+    });
+});
@@ -302,4 +302,20 @@ describe('NotificationService', function() {
        const actions = pushProcessor.actionsForEvent(testEvent);
        expect(actions.tweaks.highlight).toEqual(false);
    });
+
+    it("a rule with no conditions matches every event.", function() {
+        expect(pushProcessor.ruleMatchesEvent({
+            rule_id: "rule1",
+            actions: [],
+            conditions: [],
+            default: false,
+            enabled: true,
+        }, testEvent)).toBe(true);
+        expect(pushProcessor.ruleMatchesEvent({
+            rule_id: "rule1",
+            actions: [],
+            default: false,
+            enabled: true,
+        }, testEvent)).toBe(true);
+    });
 });
@@ -15,12 +15,14 @@ limitations under the License.
 */

 import { EventTimelineSet } from "../../src/models/event-timeline-set";
-import { MatrixEvent } from "../../src/models/event";
+import { MatrixEvent, MatrixEventEvent } from "../../src/models/event";
+import { Room } from "../../src/models/room";
 import { Relations } from "../../src/models/relations";

 describe("Relations", function() {
    it("should deduplicate annotations", function() {
-        const relations = new Relations("m.annotation", "m.reaction");
+        const room = new Room("room123", null, null);
+        const relations = new Relations("m.annotation", "m.reaction", room);

        // Create an instance of an annotation
        const eventData = {
@@ -95,15 +97,13 @@ describe("Relations", function() {
        });

        // Stub the room
-        const room = {
-            getPendingEvent() { return null; },
-            getUnfilteredTimelineSet() { return null; },
-        };
+
+        const room = new Room("room123", null, null);

        // Add the target event first, then the relation event
        {
            const relationsCreated = new Promise(resolve => {
-                targetEvent.once("Event.relationsCreated", resolve);
+                targetEvent.once(MatrixEventEvent.RelationsCreated, resolve);
            });

            const timelineSet = new EventTimelineSet(room, {
@@ -118,7 +118,7 @@ describe("Relations", function() {
        // Add the relation event first, then the target event
        {
            const relationsCreated = new Promise(resolve => {
-                targetEvent.once("Event.relationsCreated", resolve);
+                targetEvent.once(MatrixEventEvent.RelationsCreated, resolve);
            });

            const timelineSet = new EventTimelineSet(room, {
@@ -124,6 +124,34 @@ describe("RoomMember", function() {
            expect(member.powerLevel).toEqual(0);
            expect(emitCount).toEqual(1);
        });
+
+        it("should not honor string power levels.",
+        function() {
+            const event = utils.mkEvent({
+                type: "m.room.power_levels",
+                room: roomId,
+                user: userA,
+                content: {
+                    users_default: 20,
+                    users: {
+                        "@alice:bar": "5",
+                    },
+                },
+                event: true,
+            });
+            let emitCount = 0;
+
+            member.on("RoomMember.powerLevel", function(emitEvent, emitMember) {
+                emitCount += 1;
+                expect(emitMember.userId).toEqual('@alice:bar');
+                expect(emitMember.powerLevel).toEqual(20);
+                expect(emitEvent).toEqual(event);
+            });
+
+            member.setPowerLevelEvent(event);
+            expect(member.powerLevel).toEqual(20);
+            expect(emitCount).toEqual(1);
+        });
    });

    describe("setTypingEvent", function() {
@@ -1,6 +1,5 @@
 import * as utils from "../test-utils";
 import { RoomState } from "../../src/models/room-state";
-import { RoomMember } from "../../src/models/room-member";

 describe("RoomState", function() {
    const roomId = "!foo:bar";
@@ -121,7 +120,7 @@ describe("RoomState", function() {
        it("should return a single MatrixEvent if a state_key was specified",
        function() {
            const event = state.getStateEvents("m.room.member", userA);
-            expect(event.getContent()).toEqual({
+            expect(event.getContent()).toMatchObject({
                membership: "join",
            });
        });
@@ -193,12 +192,7 @@ describe("RoomState", function() {
            expect(emitCount).toEqual(2);
        });

-        it("should call setPowerLevelEvent on each RoomMember for m.room.power_levels",
-        function() {
-            // mock up the room members
-            state.members[userA] = utils.mock(RoomMember);
-            state.members[userB] = utils.mock(RoomMember);
-
+        it("should call setPowerLevelEvent on each RoomMember for m.room.power_levels", function() {
            const powerLevelEvent = utils.mkEvent({
                type: "m.room.power_levels", room: roomId, user: userA, event: true,
                content: {
@@ -208,18 +202,16 @@ describe("RoomState", function() {
                },
            });

+            // spy on the room members
+            jest.spyOn(state.members[userA], "setPowerLevelEvent");
+            jest.spyOn(state.members[userB], "setPowerLevelEvent");
            state.setStateEvents([powerLevelEvent]);

-            expect(state.members[userA].setPowerLevelEvent).toHaveBeenCalledWith(
-                powerLevelEvent,
-            );
-            expect(state.members[userB].setPowerLevelEvent).toHaveBeenCalledWith(
-                powerLevelEvent,
-            );
+            expect(state.members[userA].setPowerLevelEvent).toHaveBeenCalledWith(powerLevelEvent);
+            expect(state.members[userB].setPowerLevelEvent).toHaveBeenCalledWith(powerLevelEvent);
        });

-        it("should call setPowerLevelEvent on a new RoomMember if power levels exist",
-        function() {
+        it("should call setPowerLevelEvent on a new RoomMember if power levels exist", function() {
            const memberEvent = utils.mkMembership({
                mship: "join", user: userC, room: roomId, event: true,
            });
@@ -243,13 +235,12 @@ describe("RoomState", function() {
        });

        it("should call setMembershipEvent on the right RoomMember", function() {
-            // mock up the room members
-            state.members[userA] = utils.mock(RoomMember);
-            state.members[userB] = utils.mock(RoomMember);
-
            const memberEvent = utils.mkMembership({
                user: userB, mship: "leave", room: roomId, event: true,
            });
+            // spy on the room members
+            jest.spyOn(state.members[userA], "setMembershipEvent");
+            jest.spyOn(state.members[userB], "setMembershipEvent");
            state.setStateEvents([memberEvent]);

            expect(state.members[userA].setMembershipEvent).not.toHaveBeenCalled();
@@ -374,17 +365,13 @@ describe("RoomState", function() {
                    user_ids: [userA],
                },
            });
-            // mock up the room members
-            state.members[userA] = utils.mock(RoomMember);
-            state.members[userB] = utils.mock(RoomMember);
+            // spy on the room members
+            jest.spyOn(state.members[userA], "setTypingEvent");
+            jest.spyOn(state.members[userB], "setTypingEvent");
            state.setTypingEvent(typingEvent);

-            expect(state.members[userA].setTypingEvent).toHaveBeenCalledWith(
-                typingEvent,
-            );
-            expect(state.members[userB].setTypingEvent).toHaveBeenCalledWith(
-                typingEvent,
-            );
+            expect(state.members[userA].setTypingEvent).toHaveBeenCalledWith(typingEvent);
+            expect(state.members[userB].setTypingEvent).toHaveBeenCalledWith(typingEvent);
        });
    });

@@ -3,10 +3,12 @@ import {
    alphabetPad,
    averageBetweenStrings,
    baseToString,
+    deepSortedObjectEntries,
    DEFAULT_ALPHABET,
    lexicographicCompare,
    nextString,
    prevString,
+    simpleRetryOperation,
    stringToBase,
 } from "../../src/utils";
 import { logger } from "../../src/logger";
@@ -24,6 +26,15 @@ describe("utils", function() {
                "foo=bar&baz=beer%40",
            );
        });
+
+        it("should handle boolean and numeric values", function() {
+            const params = {
+                string: "foobar",
+                number: 12345,
+                boolean: false,
+            };
+            expect(utils.encodeParams(params)).toEqual("string=foobar&number=12345&boolean=false");
+        });
    });

    describe("encodeUri", function() {
@@ -109,10 +120,10 @@ describe("utils", function() {

    describe("deepCompare", function() {
        const assert = {
-            isTrue: function(x) {
+            isTrue: function(x: any) {
                expect(x).toBe(true);
            },
-            isFalse: function(x) {
+            isFalse: function(x: any) {
                expect(x).toBe(false);
            },
        };
@@ -174,10 +185,10 @@ describe("utils", function() {
            // no two different function is equal really, they capture their
            // context variables so even if they have same toString(), they
            // won't have same functionality
-            const func = function(x) {
+            const func = function() {
                return true;
            };
-            const func2 = function(x) {
+            const func2 = function() {
                return true;
            };
            assert.isTrue(utils.deepCompare(func, func));
@@ -187,66 +198,6 @@ describe("utils", function() {
        });
    });

-    describe("extend", function() {
-        const SOURCE = { "prop2": 1, "string2": "x", "newprop": "new" };
-
-        it("should extend", function() {
-            const target = {
-                "prop1": 5, "prop2": 7, "string1": "baz", "string2": "foo",
-            };
-            const merged = {
-                "prop1": 5, "prop2": 1, "string1": "baz", "string2": "x",
-                "newprop": "new",
-            };
-            const sourceOrig = JSON.stringify(SOURCE);
-
-            utils.extend(target, SOURCE);
-            expect(JSON.stringify(target)).toEqual(JSON.stringify(merged));
-
-            // check the originial wasn't modified
-            expect(JSON.stringify(SOURCE)).toEqual(sourceOrig);
-        });
-
-        it("should ignore null", function() {
-            const target = {
-                "prop1": 5, "prop2": 7, "string1": "baz", "string2": "foo",
-            };
-            const merged = {
-                "prop1": 5, "prop2": 1, "string1": "baz", "string2": "x",
-                "newprop": "new",
-            };
-            const sourceOrig = JSON.stringify(SOURCE);
-
-            utils.extend(target, null, SOURCE);
-            expect(JSON.stringify(target)).toEqual(JSON.stringify(merged));
-
-            // check the originial wasn't modified
-            expect(JSON.stringify(SOURCE)).toEqual(sourceOrig);
-        });
-
-        it("should handle properties created with defineProperties", function() {
-            const source = Object.defineProperties({}, {
-                "enumerableProp": {
-                    get: function() {
-                        return true;
-                    },
-                    enumerable: true,
-                },
-                "nonenumerableProp": {
-                    get: function() {
-                        return true;
-                    },
-                },
-            });
-
-            // TODO: Fix type
-            const target: any = {};
-            utils.extend(target, source);
-            expect(target.enumerableProp).toBe(true);
-            expect(target.nonenumerableProp).toBe(undefined);
-        });
-    });
-
    describe("chunkPromises", function() {
        it("should execute promises in chunks", async function() {
            let promiseCount = 0;
@@ -267,6 +218,34 @@ describe("utils", function() {
        });
    });

+    describe('simpleRetryOperation', () => {
+        it('should retry', async () => {
+            let count = 0;
+            const val = {};
+            const fn = (attempt: any) => {
+                count++;
+
+                // If this expectation fails then it can appear as a Jest Timeout due to
+                // the retry running beyond the test limit.
+                expect(attempt).toEqual(count);
+
+                if (count > 1) {
+                    return Promise.resolve(val);
+                } else {
+                    return Promise.reject(new Error("Iterative failure"));
+                }
+            };
+
+            const ret = await simpleRetryOperation(fn);
+            expect(ret).toBe(val);
+            expect(count).toEqual(2);
+        });
+
+        // We don't test much else of the function because then we're just testing that the
+        // underlying library behaves, which should be tested on its own. Our API surface is
+        // all that concerns us.
+    });
+
    describe('DEFAULT_ALPHABET', () => {
        it('should be usefully printable ASCII in order', () => {
            expect(DEFAULT_ALPHABET).toEqual(
@@ -429,4 +408,102 @@ describe("utils", function() {
            expect(lexicographicCompare('a', 'A') > 0).toBe(true);
        });
    });
+
+    describe('deepSortedObjectEntries', () => {
+        it('should auto-return non-objects', () => {
+            expect(deepSortedObjectEntries(42)).toEqual(42);
+            expect(deepSortedObjectEntries("not object")).toEqual("not object");
+            expect(deepSortedObjectEntries(true)).toEqual(true);
+            expect(deepSortedObjectEntries([42])).toEqual([42]);
+            expect(deepSortedObjectEntries(null)).toEqual(null);
+            expect(deepSortedObjectEntries(undefined)).toEqual(undefined);
+        });
+
+        it('should sort objects appropriately', () => {
+            const input = {
+                a: 42,
+                b: {
+                    d: {},
+                    a: "test",
+                    b: "alpha",
+                },
+                [72]: "test",
+            };
+            const output: any = [
+                ["72", "test"],
+                ["a", 42],
+                ["b", [
+                    ["a", "test"],
+                    ["b", "alpha"],
+                    ["d", []],
+                ]],
+            ];
+
+            expect(deepSortedObjectEntries(input)).toMatchObject(output);
+        });
+    });
+
+    describe("recursivelyAssign", () => {
+        it("doesn't override with null/undefined", () => {
+            const result = utils.recursivelyAssign(
+                {
+                    string: "Hello world",
+                    object: {},
+                    float: 0.1,
+                }, {
+                    string: null,
+                    object: undefined,
+                },
+                true,
+            );
+
+            expect(result).toStrictEqual({
+                string: "Hello world",
+                object: {},
+                float: 0.1,
+            });
+        });
+
+        it("assigns recursively", () => {
+            const result = utils.recursivelyAssign(
+                {
+                    number: 42,
+                    object: {
+                        message: "Hello world",
+                        day: "Monday",
+                        langs: {
+                            compiled: ["c++"],
+                        },
+                    },
+                    thing: "string",
+                }, {
+                    number: 2,
+                    object: {
+                        message: "How are you",
+                        day: "Friday",
+                        langs: {
+                            compiled: ["c++", "c"],
+                        },
+                    },
+                    thing: {
+                        aSubThing: "something",
+                    },
+                },
+            );
+
+            expect(result).toStrictEqual({
+                number: 2,
+                object: {
+                    message: "How are you",
+                    day: "Friday",
+                    langs: {
+                        compiled: ["c++", "c"],
+                    },
+                },
+                thing: {
+                    aSubThing: "something",
+                },
+            });
+        });
+    });
 });
@@ -16,6 +16,8 @@ limitations under the License.

 import { TestClient } from '../../TestClient';
 import { MatrixCall, CallErrorCode, CallEvent } from '../../../src/webrtc/call';
+import { SDPStreamMetadataKey, SDPStreamMetadataPurpose } from '../../../src/webrtc/callEventTypes';
+import { RoomMember } from "../../../src";

 const DUMMY_SDP = (
    "v=0\r\n" +
@@ -80,6 +82,51 @@ class MockRTCPeerConnection {
    }
    close() {}
    getStats() { return []; }
+    addTrack(track: MockMediaStreamTrack) {return new MockRTCRtpSender(track);}
+}
+
+class MockRTCRtpSender {
+    constructor(public track: MockMediaStreamTrack) {}
+
+    replaceTrack(track: MockMediaStreamTrack) {this.track = track;}
+}
+
+class MockMediaStreamTrack {
+    constructor(public readonly id: string, public readonly kind: "audio" | "video", public enabled = true) {}
+
+    stop() {}
+}
+
+class MockMediaStream {
+    constructor(
+        public id: string,
+        private tracks: MockMediaStreamTrack[] = [],
+    ) {}
+
+    getTracks() { return this.tracks; }
+    getAudioTracks() { return this.tracks.filter((track) => track.kind === "audio"); }
+    getVideoTracks() { return this.tracks.filter((track) => track.kind === "video"); }
+    addEventListener() {}
+    removeEventListener() { }
+    addTrack(track: MockMediaStreamTrack) {this.tracks.push(track);}
+    removeTrack(track: MockMediaStreamTrack) {this.tracks.splice(this.tracks.indexOf(track), 1);}
+}
+
+class MockMediaDeviceInfo {
+    constructor(
+        public kind: "audio" | "video",
+    ) {}
+}
+
+class MockMediaHandler {
+    getUserMediaStream(audio: boolean, video: boolean) {
+        const tracks = [];
+        if (audio) tracks.push(new MockMediaStreamTrack("audio_track", "audio"));
+        if (video) tracks.push(new MockMediaStreamTrack("video_track", "video"));
+
+        return new MockMediaStream("mock_stream_from_media_handler", tracks);
+    }
+    stopUserMediaStream() {}
 }

 describe('Call', function() {
@@ -97,13 +144,9 @@ describe('Call', function() {
        global.navigator = {
            mediaDevices: {
                // @ts-ignore Mock
-                getUserMedia: () => {
-                    return {
-                        getTracks: () => [],
-                        getAudioTracks: () => [],
-                        getVideoTracks: () => [],
-                    };
-                },
+                getUserMedia: () => new MockMediaStream("local_stream"),
+                // @ts-ignore Mock
+                enumerateDevices: async () => [new MockMediaDeviceInfo("audio"), new MockMediaDeviceInfo("video")],
            },
        };

@@ -114,7 +157,7 @@ describe('Call', function() {
            RTCSessionDescription: {},
            // @ts-ignore Mock
            RTCIceCandidate: {},
-            getUserMedia: {},
+            getUserMedia: () => new MockMediaStream("local_stream"),
        };
        // @ts-ignore Mock
        global.document = {};
@@ -123,6 +166,8 @@ describe('Call', function() {
        // We just stub out sendEvent: we're not interested in testing the client's
        // event sending code here
        client.client.sendEvent = () => {};
+        client.client.mediaHandler = new MockMediaHandler;
+        client.client.getMediaHandler = () => client.client.mediaHandler;
        client.httpBackend.when("GET", "/voip/turnServer").respond(200, {});
        call = new MatrixCall({
            client: client.client,
@@ -298,4 +343,166 @@ describe('Call', function() {
        // Hangup to stop timers
        call.hangup(CallErrorCode.UserHangup, true);
    });
+
+    it("should map SDPStreamMetadata to feeds", async () => {
+        const callPromise = call.placeVoiceCall();
+        await client.httpBackend.flush();
+        await callPromise;
+
+        call.getOpponentMember = () => {
+            return { userId: "@bob:bar.uk" };
+        };
+
+        await call.onAnswerReceived({
+            getContent: () => {
+                return {
+                    version: 1,
+                    call_id: call.callId,
+                    party_id: 'party_id',
+                    answer: {
+                        sdp: DUMMY_SDP,
+                    },
+                    [SDPStreamMetadataKey]: {
+                        "remote_stream": {
+                            purpose: SDPStreamMetadataPurpose.Usermedia,
+                            audio_muted: true,
+                            video_muted: false,
+                        },
+                    },
+                };
+            },
+        });
+
+        call.pushRemoteFeed(
+            new MockMediaStream(
+                "remote_stream",
+                [
+                    new MockMediaStreamTrack("remote_audio_track", "audio"),
+                    new MockMediaStreamTrack("remote_video_track", "video"),
+                ],
+            ),
+        );
+        const feed = call.getFeeds().find((feed) => feed.stream.id === "remote_stream");
+        expect(feed?.purpose).toBe(SDPStreamMetadataPurpose.Usermedia);
+        expect(feed?.isAudioMuted()).toBeTruthy();
+        expect(feed?.isVideoMuted()).not.toBeTruthy();
+    });
+
+    it("should fallback to replaceTrack() if the other side doesn't support SPDStreamMetadata", async () => {
+        const callPromise = call.placeVoiceCall();
+        await client.httpBackend.flush();
+        await callPromise;
+
+        call.getOpponentMember = () => {
+            return { userId: "@bob:bar.uk" } as RoomMember;
+        };
+
+        await call.onAnswerReceived({
+            getContent: () => {
+                return {
+                    version: 1,
+                    call_id: call.callId,
+                    party_id: 'party_id',
+                    answer: {
+                        sdp: DUMMY_SDP,
+                    },
+                };
+            },
+        });
+
+        call.setScreensharingEnabledWithoutMetadataSupport = jest.fn();
+
+        call.setScreensharingEnabled(true);
+        expect(call.setScreensharingEnabledWithoutMetadataSupport).toHaveBeenCalled();
+    });
+
+    it("should fallback to answering with no video", async () => {
+        await client.httpBackend.flush();
+
+        call.shouldAnswerWithMediaType = (wantedValue: boolean) => wantedValue;
+        client.client.mediaHandler.getUserMediaStream = jest.fn().mockRejectedValue("reject");
+
+        await call.answer(true, true);
+
+        expect(client.client.mediaHandler.getUserMediaStream).toHaveBeenNthCalledWith(1, true, true);
+        expect(client.client.mediaHandler.getUserMediaStream).toHaveBeenNthCalledWith(2, true, false);
+    });
+
+    it("should handle mid-call device changes", async () => {
+        client.client.mediaHandler.getUserMediaStream = jest.fn().mockReturnValue(
+            new MockMediaStream(
+                "stream", [
+                    new MockMediaStreamTrack("audio_track", "audio"),
+                    new MockMediaStreamTrack("video_track", "video"),
+                ],
+            ),
+        );
+
+        const callPromise = call.placeVideoCall();
+        await client.httpBackend.flush();
+        await callPromise;
+
+        await call.onAnswerReceived({
+            getContent: () => {
+                return {
+                    version: 1,
+                    call_id: call.callId,
+                    party_id: 'party_id',
+                    answer: {
+                        sdp: DUMMY_SDP,
+                    },
+                };
+            },
+        });
+
+        await call.updateLocalUsermediaStream(
+            new MockMediaStream(
+                "replacement_stream",
+                [
+                    new MockMediaStreamTrack("new_audio_track", "audio"),
+                    new MockMediaStreamTrack("video_track", "video"),
+                ],
+            ),
+        );
+        expect(call.localUsermediaStream.id).toBe("stream");
+        expect(call.localUsermediaStream.getAudioTracks()[0].id).toBe("new_audio_track");
+        expect(call.localUsermediaStream.getVideoTracks()[0].id).toBe("video_track");
+        expect(call.usermediaSenders.find((sender) => {
+            return sender?.track?.kind === "audio";
+        }).track.id).toBe("new_audio_track");
+        expect(call.usermediaSenders.find((sender) => {
+            return sender?.track?.kind === "video";
+        }).track.id).toBe("video_track");
+    });
+
+    it("should handle upgrade to video call", async () => {
+        const callPromise = call.placeVoiceCall();
+        await client.httpBackend.flush();
+        await callPromise;
+
+        await call.onAnswerReceived({
+            getContent: () => {
+                return {
+                    version: 1,
+                    call_id: call.callId,
+                    party_id: 'party_id',
+                    answer: {
+                        sdp: DUMMY_SDP,
+                    },
+                    [SDPStreamMetadataKey]: {},
+                };
+            },
+        });
+
+        await call.upgradeCall(false, true);
+
+        expect(call.localUsermediaStream.getAudioTracks()[0].id).toBe("audio_track");
+        expect(call.localUsermediaStream.getVideoTracks()[0].id).toBe("video_track");
+        expect(call.usermediaSenders.find((sender) => {
+            return sender?.track?.kind === "audio";
+        }).track.id).toBe("audio_track");
+        expect(call.usermediaSenders.find((sender) => {
+            return sender?.track?.kind === "video";
+        }).track.id).toBe("video_track");
+    });
 });
@@ -0,0 +1,165 @@
+/*
+Copyright 2021 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// allow camelcase as these are things that go onto the wire
+/* eslint-disable camelcase */
+
+export enum PushRuleActionName {
+    DontNotify = "dont_notify",
+    Notify = "notify",
+    Coalesce = "coalesce",
+}
+
+export enum TweakName {
+    Highlight = "highlight",
+    Sound = "sound",
+}
+
+export type Tweak<N extends TweakName, V> = {
+    set_tweak: N;
+    value: V;
+};
+
+export type TweakHighlight = Tweak<TweakName.Highlight, boolean>;
+export type TweakSound = Tweak<TweakName.Sound, string>;
+
+export type Tweaks = TweakHighlight | TweakSound;
+
+export enum ConditionOperator {
+    ExactEquals = "==",
+    LessThan = "<",
+    GreaterThan = ">",
+    GreaterThanOrEqual = ">=",
+    LessThanOrEqual = "<=",
+}
+
+export type PushRuleAction = Tweaks | PushRuleActionName;
+
+export type MemberCountCondition
+    <N extends number, Op extends ConditionOperator = ConditionOperator.ExactEquals>
+    = `${Op}${N}` | (Op extends ConditionOperator.ExactEquals ? `${N}` : never);
+
+export type AnyMemberCountCondition = MemberCountCondition<number, ConditionOperator>;
+
+export const DMMemberCountCondition: MemberCountCondition<2> = "2";
+
+export function isDmMemberCountCondition(condition: AnyMemberCountCondition): boolean {
+    return condition === "==2" || condition === "2";
+}
+
+export enum ConditionKind {
+    EventMatch = "event_match",
+    ContainsDisplayName = "contains_display_name",
+    RoomMemberCount = "room_member_count",
+    SenderNotificationPermission = "sender_notification_permission",
+}
+
+export interface IPushRuleCondition<N extends ConditionKind | string> {
+    [k: string]: any; // for custom conditions, there can be other fields here
+    kind: N;
+}
+
+export interface IEventMatchCondition extends IPushRuleCondition<ConditionKind.EventMatch> {
+    key: string;
+    pattern: string;
+}
+
+export interface IContainsDisplayNameCondition extends IPushRuleCondition<ConditionKind.ContainsDisplayName> {
+    // no additional fields
+}
+
+export interface IRoomMemberCountCondition extends IPushRuleCondition<ConditionKind.RoomMemberCount> {
+    is: AnyMemberCountCondition;
+}
+
+export interface ISenderNotificationPermissionCondition
+    extends IPushRuleCondition<ConditionKind.SenderNotificationPermission> {
+    key: string;
+}
+
+// XXX: custom conditions are possible but always fail, and break the typescript discriminated union so ignore them here
+// IPushRuleCondition<Exclude<string, ConditionKind>> unfortunately does not resolve this at the time of writing.
+export type PushRuleCondition = IEventMatchCondition
+    | IContainsDisplayNameCondition
+    | IRoomMemberCountCondition
+    | ISenderNotificationPermissionCondition;
+
+export enum PushRuleKind {
+    Override = "override",
+    ContentSpecific = "content",
+    RoomSpecific = "room",
+    SenderSpecific = "sender",
+    Underride = "underride",
+}
+
+export enum RuleId {
+    Master = ".m.rule.master",
+    ContainsDisplayName = ".m.rule.contains_display_name",
+    ContainsUserName = ".m.rule.contains_user_name",
+    AtRoomNotification = ".m.rule.roomnotif",
+    DM = ".m.rule.room_one_to_one",
+    EncryptedDM = ".m.rule.encrypted_room_one_to_one",
+    Message = ".m.rule.message",
+    EncryptedMessage = ".m.rule.encrypted",
+    InviteToSelf = ".m.rule.invite_for_me",
+    MemberEvent = ".m.rule.member_event",
+    IncomingCall = ".m.rule.call",
+    SuppressNotices = ".m.rule.suppress_notices",
+    Tombstone = ".m.rule.tombstone",
+}
+
+export type PushRuleSet = {
+    [k in PushRuleKind]?: IPushRule[];
+};
+
+export interface IPushRule {
+    actions: PushRuleAction[];
+    conditions?: PushRuleCondition[];
+    default: boolean;
+    enabled: boolean;
+    pattern?: string;
+    rule_id: RuleId | string;
+}
+
+export interface IAnnotatedPushRule extends IPushRule {
+    kind: PushRuleKind;
+}
+
+export interface IPushRules {
+    global: PushRuleSet;
+    device?: PushRuleSet;
+}
+
+export interface IPusher {
+    app_display_name: string;
+    app_id: string;
+    data: {
+        format?: string;
+        url?: string; // TODO: Required if kind==http
+        brand?: string; // TODO: For email notifications only? Unspecced field
+    };
+    device_display_name: string;
+    kind: "http" | string;
+    lang: string;
+    profile_tag?: string;
+    pushkey: string;
+}
+
+export interface IPusherRequest extends IPusher {
+    append?: boolean;
+}
+
+/* eslint-enable camelcase */
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 The Matrix.org Foundation C.I.C.
+Copyright 2021 The Matrix.org Foundation C.I.C.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,7 +14,6 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-export const SERVICE_TYPES = Object.freeze({
-    IS: 'SERVICE_TYPE_IS', // An Identity Service
-    IM: 'SERVICE_TYPE_IM', // An Integration Manager
-});
+declare module "another-json" {
+    export function stringify(o: object): string;
+}
@@ -0,0 +1,29 @@
+/*
+Copyright 2022 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// disable lint because these are wire responses
+/* eslint-disable camelcase */
+
+/**
+ * Represents a response to the CSAPI `/refresh` endpoint.
+ */
+export interface IRefreshTokenResponse {
+    access_token: string;
+    expires_in_ms: number;
+    refresh_token: string;
+}
+
+/* eslint-enable camelcase */
@@ -53,6 +53,8 @@ export enum EventType {
    CallReject = "m.call.reject",
    CallSelectAnswer = "m.call.select_answer",
    CallNegotiate = "m.call.negotiate",
+    CallSDPStreamMetadataChanged = "m.call.sdp_stream_metadata_changed",
+    CallSDPStreamMetadataChangedPrefix = "org.matrix.call.sdp_stream_metadata_changed",
    CallReplaces = "m.call.replaces",
    CallAssertedIdentity = "m.call.asserted_identity",
    CallAssertedIdentityPrefix = "org.matrix.call.asserted_identity",
@@ -87,6 +89,20 @@ export enum EventType {
    Dummy = "m.dummy",
 }

+export enum RelationType {
+    Annotation = "m.annotation",
+    Replace = "m.replace",
+    Reference = "m.reference",
+    /**
+     * Note, "io.element.thread" is hardcoded
+     * Should be replaced with "m.thread" once MSC3440 lands
+     * Can not use `UnstableValue` as TypeScript does not
+     * allow computed values in enums
+     * https://github.com/microsoft/TypeScript/issues/27976
+     */
+    Thread = "io.element.thread",
+}
+
 export enum MsgType {
    Text = "m.text",
    Emote = "m.emote",
@@ -96,6 +112,7 @@ export enum MsgType {
    Audio = "m.audio",
    Location = "m.location",
    Video = "m.video",
+    KeyVerificationRequest = "m.key.verification.request",
 }

 export const RoomCreateTypeField = "type";
@@ -139,6 +156,38 @@ export const UNSTABLE_MSC3089_LEAF = new UnstableValue("m.leaf", "org.matrix.msc
 */
 export const UNSTABLE_MSC3089_BRANCH = new UnstableValue("m.branch", "org.matrix.msc3089.branch");

+/**
+ * Functional members type for declaring a purpose of room members (e.g. helpful bots).
+ * Note that this reference is UNSTABLE and subject to breaking changes, including its
+ * eventual removal.
+ *
+ * Schema (TypeScript):
+ * {
+ *   service_members?: string[]
+ * }
+ *
+ * Example:
+ * {
+ *   "service_members": [
+ *     "@helperbot:localhost",
+ *     "@reminderbot:alice.tdl"
+ *   ]
+ * }
+ */
+export const UNSTABLE_ELEMENT_FUNCTIONAL_USERS = new UnstableValue(
+    "io.element.functional_members",
+    "io.element.functional_members");
+
+/**
+ * A type of message that affects visibility of a message,
+ * as per https://github.com/matrix-org/matrix-doc/pull/3531
+ *
+ * @experimental
+ */
+export const EVENT_VISIBILITY_CHANGE_TYPE = new UnstableValue(
+    "m.visibility",
+    "org.matrix.msc3531.visibility");
+
 export interface IEncryptedFile {
    url: string;
    mimetype?: string;
@@ -14,13 +14,8 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-// TODO: Merge this with sync.js once converted
+// Types for MSC1767: Extensible events in Matrix

-export enum SyncState {
-    Error = "ERROR",
-    Prepared = "PREPARED",
-    Stopped = "STOPPED",
-    Syncing = "SYNCING",
-    Catchup = "CATCHUP",
-    Reconnecting = "RECONNECTING",
-}
+import { UnstableValue } from "../NamespacedValue";
+
+export const TEXT_NODE_TYPE = new UnstableValue("m.text", "org.matrix.msc1767.text");
@@ -15,11 +15,17 @@ limitations under the License.
 */

 // this is needed to tell TS about global.Olm
-import * as Olm from "@matrix-org/olm"; // eslint-disable-line @typescript-eslint/no-unused-vars
+import "@matrix-org/olm";

 export {};

 declare global {
+    // use `number` as the return type in all cases for global.set{Interval,Timeout},
+    // so we don't accidentally use the methods on NodeJS.Timeout - they only exist in a subset of environments.
+    // The overload for clear{Interval,Timeout} is resolved as expected.
+    function setInterval(handler: TimerHandler, timeout: number, ...arguments: any[]): number;
+    function setTimeout(handler: TimerHandler, timeout: number, ...arguments: any[]): number;
+
    namespace NodeJS {
        interface Global {
            localStorage: Storage;
@@ -27,11 +33,11 @@ declare global {
    }

    interface Window {
-        electron?: Electron;
+        webkitAudioContext: typeof AudioContext;
    }

-    interface Electron {
-        getDesktopCapturerSources(options: GetSourcesOptions): Promise<Array<DesktopCapturerSource>>;
+    interface Crypto {
+        webkitSubtle?: Window["crypto"]["subtle"];
    }

    interface MediaDevices {
@@ -56,27 +62,6 @@ declare global {
        };
    }

-    interface DesktopCapturerSource {
-        id: string;
-        name: string;
-        thumbnailURL: string;
-    }
-
-    interface GetSourcesOptions {
-        types: Array<string>;
-        thumbnailSize?: {
-            height: number;
-            width: number;
-        };
-        fetchWindowIcons?: boolean;
-    }
-
-    interface HTMLAudioElement {
-        // sinkId & setSinkId are experimental and typescript doesn't know about them
-        sinkId: string;
-        setSinkId(outputId: string);
-    }
-
    interface DummyInterfaceWeShouldntBeUsingThis {}

    interface Navigator {
@@ -84,4 +69,24 @@ declare global {
        // on webkit: we should check if we still need to do this
        webkitGetUserMedia: DummyInterfaceWeShouldntBeUsingThis;
    }
+
+    export interface ISettledFulfilled<T> {
+        status: "fulfilled";
+        value: T;
+    }
+    export interface ISettledRejected {
+        status: "rejected";
+        reason: any;
+    }
+
+    interface PromiseConstructor {
+        allSettled<T>(promises: Promise<T>[]): Promise<Array<ISettledFulfilled<T> | ISettledRejected>>;
+    }
+
+    interface RTCRtpTransceiver {
+        // This has been removed from TS
+        // (https://github.com/microsoft/TypeScript-DOM-lib-generator/issues/1029),
+        // but we still need this for MatrixCall::getRidOfRTXCodecs()
+        setCodecPreferences(codecs: RTCRtpCodecCapability[]): void;
+    }
 }
@@ -0,0 +1,71 @@
+/*
+Copyright 2021 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Types for MSC3488 - m.location: Extending events with location data
+
+import { UnstableValue } from "../NamespacedValue";
+import { IContent } from "../models/event";
+import { TEXT_NODE_TYPE } from "./extensible_events";
+
+export const LOCATION_EVENT_TYPE = new UnstableValue(
+    "m.location", "org.matrix.msc3488.location");
+
+export const ASSET_NODE_TYPE = new UnstableValue("m.asset", "org.matrix.msc3488.asset");
+
+export const TIMESTAMP_NODE_TYPE = new UnstableValue("m.ts", "org.matrix.msc3488.ts");
+
+export enum LocationAssetType {
+    Self = "m.self",
+    Pin = "m.pin",
+}
+
+/* From the spec at:
+ * https://github.com/matrix-org/matrix-doc/blob/matthew/location/proposals/3488-location.md
+{
+    "type": "m.room.message",
+    "content": {
+        "body": "Matthew was at geo:51.5008,0.1247;u=35 as of Sat Nov 13 18:50:58 2021",
+        "msgtype": "m.location",
+        "geo_uri": "geo:51.5008,0.1247;u=35",
+        "m.location": {
+            "uri": "geo:51.5008,0.1247;u=35",
+            "description": "Matthew's whereabouts",
+        },
+        "m.asset": {
+            "type": "m.self"
+        },
+        "m.text": "Matthew was at geo:51.5008,0.1247;u=35 as of Sat Nov 13 18:50:58 2021",
+        "m.ts": 1636829458432,
+    }
+}
+*/
+
+/* eslint-disable camelcase */
+export interface ILocationContent extends IContent {
+    body: string;
+    msgtype: string;
+    geo_uri: string;
+    [LOCATION_EVENT_TYPE.name]: {
+        uri: string;
+        description?: string;
+    };
+    [ASSET_NODE_TYPE.name]: {
+        type: LocationAssetType;
+    };
+    [TEXT_NODE_TYPE.name]: string;
+    [TIMESTAMP_NODE_TYPE.name]: number;
+}
+/* eslint-enable camelcase */
@@ -37,3 +37,57 @@ export enum Preset {
    TrustedPrivateChat = "trusted_private_chat",
    PublicChat = "public_chat",
 }
+
+export type ResizeMethod = "crop" | "scale";
+
+// TODO move to http-api after TSification
+export interface IAbortablePromise<T> extends Promise<T> {
+    abort(): void;
+}
+
+export type IdServerUnbindResult = "no-support" | "success";
+
+// Knock and private are reserved keywords which are not yet implemented.
+export enum JoinRule {
+    Public = "public",
+    Invite = "invite",
+    /**
+     * @deprecated Reserved keyword. Should not be used. Not yet implemented.
+     */
+    Private = "private",
+    Knock = "knock",
+    Restricted = "restricted",
+}
+
+export enum RestrictedAllowType {
+    RoomMembership = "m.room_membership",
+}
+
+export interface IJoinRuleEventContent {
+    join_rule: JoinRule; // eslint-disable-line camelcase
+    allow?: {
+        type: RestrictedAllowType;
+        room_id: string; // eslint-disable-line camelcase
+    }[];
+}
+
+export enum GuestAccess {
+    CanJoin = "can_join",
+    Forbidden = "forbidden",
+}
+
+export enum HistoryVisibility {
+    Invited = "invited",
+    Joined = "joined",
+    Shared = "shared",
+    WorldReadable = "world_readable",
+}
+
+export interface IUsageLimit {
+    // "hs_disabled" is NOT a specced string, but is used in Synapse
+    // This is tracked over at https://github.com/matrix-org/synapse/issues/9237
+    // eslint-disable-next-line camelcase
+    limit_type: "monthly_active_user" | "hs_disabled" | string;
+    // eslint-disable-next-line camelcase
+    admin_contact?: string;
+}
@@ -15,9 +15,13 @@ limitations under the License.
 */

 import { Callback } from "../client";
+import { IContent, IEvent } from "../models/event";
 import { Preset, Visibility } from "./partials";
+import { SearchKey } from "./search";
+import { IRoomEventFilter } from "../filter";
+import { Direction } from "../models/event-timeline";

-// allow camelcase as these are things go onto the wire
+// allow camelcase as these are things that go onto the wire
 /* eslint-disable camelcase */

 export interface IJoinRoomOpts {
@@ -63,12 +67,12 @@ export interface IGuestAccessOpts {
 }

 export interface ISearchOpts {
-    keys?: string[];
+    keys?: SearchKey[];
    query: string;
 }

 export interface IEventSearchOpts {
-    filter: any; // TODO: Types
+    filter?: IRoomEventFilter;
    term: string;
 }

@@ -82,7 +86,7 @@ export interface IInvite3PID {
 export interface ICreateRoomStateEvent {
    type: string;
    state_key?: string; // defaults to an empty string
-    content: object;
+    content: IContent;
 }

 export interface ICreateRoomOpts {
@@ -104,9 +108,11 @@ export interface IRoomDirectoryOptions {
    server?: string;
    limit?: number;
    since?: string;
-
-    // TODO: Proper types
-    filter?: any & {generic_search_term: string};
+    filter?: {
+        generic_search_term: string;
+    };
+    include_all_networks?: boolean;
+    third_party_instance_id?: string;
 }

 export interface IUploadOpts {
@@ -119,4 +125,34 @@ export interface IUploadOpts {
    progressHandler?: (state: {loaded: number, total: number}) => void;
 }

+export interface IAddThreePidOnlyBody {
+    auth?: {
+        type: string;
+        session?: string;
+    };
+    client_secret: string;
+    sid: string;
+}
+
+export interface IBindThreePidBody {
+    client_secret: string;
+    id_server: string;
+    id_access_token: string;
+    sid: string;
+}
+
+export interface IRelationsRequestOpts {
+    from?: string;
+    to?: string;
+    limit?: number;
+    direction?: Direction;
+}
+
+export interface IRelationsResponse {
+    original_event: IEvent;
+    chunk: IEvent[];
+    next_batch?: string;
+    prev_batch?: string;
+}
+
 /* eslint-enable camelcase */
@@ -0,0 +1,118 @@
+/*
+Copyright 2021 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Types relating to the /search API
+
+import { IRoomEvent, IStateEvent } from "../sync-accumulator";
+import { IRoomEventFilter } from "../filter";
+import { SearchResult } from "../models/search-result";
+
+/* eslint-disable camelcase */
+export interface IEventWithRoomId extends IRoomEvent {
+    room_id: string;
+}
+
+export interface IStateEventWithRoomId extends IStateEvent {
+    room_id: string;
+}
+
+export interface IMatrixProfile {
+    avatar_url?: string;
+    displayname?: string;
+}
+
+export interface IResultContext {
+    events_before: IEventWithRoomId[];
+    events_after: IEventWithRoomId[];
+    profile_info: Record<string, IMatrixProfile>;
+    start?: string;
+    end?: string;
+}
+
+export interface ISearchResult {
+    rank: number;
+    result: IEventWithRoomId;
+    context: IResultContext;
+}
+
+enum GroupKey {
+    RoomId = "room_id",
+    Sender = "sender",
+}
+
+export interface IResultRoomEvents {
+    count: number;
+    highlights: string[];
+    results: ISearchResult[];
+    state?: { [roomId: string]: IStateEventWithRoomId[] };
+    groups?: {
+        [groupKey in GroupKey]: {
+            [value: string]: {
+                next_batch?: string;
+                order: number;
+                results: string[];
+            };
+        };
+    };
+    next_batch?: string;
+}
+
+interface IResultCategories {
+    room_events: IResultRoomEvents;
+}
+
+export type SearchKey = "content.body" | "content.name" | "content.topic";
+
+export enum SearchOrderBy {
+    Recent = "recent",
+    Rank = "rank",
+}
+
+export interface ISearchRequestBody {
+    search_categories: {
+        room_events: {
+            search_term: string;
+            keys?: SearchKey[];
+            filter?: IRoomEventFilter;
+            order_by?: SearchOrderBy;
+            event_context?: {
+                before_limit?: number;
+                after_limit?: number;
+                include_profile?: boolean;
+            };
+            include_state?: boolean;
+            groupings?: {
+                group_by: {
+                    key: GroupKey;
+                }[];
+            };
+        };
+    };
+}
+
+export interface ISearchResponse {
+    search_categories: IResultCategories;
+}
+
+export interface ISearchResults {
+    _query?: ISearchRequestBody;
+    results: SearchResult[];
+    highlights: string[];
+    count?: number;
+    next_batch?: string;
+    pendingRequest?: Promise<ISearchResults>;
+}
+/* eslint-enable camelcase */
@@ -19,3 +19,7 @@ export interface ISignatures {
        [keyId: string]: string;
    };
 }
+
+export interface ISigned {
+    signatures?: ISignatures;
+}
@@ -0,0 +1,37 @@
+/*
+Copyright 2021 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { IPublicRoomsChunkRoom } from "../client";
+import { RoomType } from "./event";
+import { IStrippedState } from "../sync-accumulator";
+
+// Types relating to Rooms of type `m.space` and related APIs
+
+/* eslint-disable camelcase */
+export interface IHierarchyRelation extends IStrippedState {
+    origin_server_ts: number;
+    content: {
+        order?: string;
+        suggested?: boolean;
+        via?: string[];
+    };
+}
+
+export interface IHierarchyRoom extends IPublicRoomsChunkRoom {
+    room_type?: RoomType | string;
+    children_state: IHierarchyRelation[];
+}
+/* eslint-enable camelcase */
@@ -0,0 +1,40 @@
+/*
+Copyright 2021 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { IdServerUnbindResult } from "./partials";
+
+// Types relating to Synapse Admin APIs
+
+/* eslint-disable camelcase */
+export interface ISynapseAdminWhoisResponse {
+    user_id: string;
+    devices: {
+        [deviceId: string]: {
+            sessions: {
+                connections: {
+                    ip: string;
+                    last_seen: number; // millis since epoch
+                    user_agent: string;
+                }[];
+            }[];
+        };
+    };
+}
+
+export interface ISynapseAdminDeactivateResponse {
+    id_server_unbind_result: IdServerUnbindResult;
+}
+/* eslint-enable camelcase */
@@ -14,14 +14,16 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-export class MockBlob {
-    private contents: number[] = [];
-
-    public constructor(private parts: ArrayLike<number>[]) {
-        parts.forEach(p => Array.from(p).forEach(e => this.contents.push(e)));
-    }
-
-    public get size(): number {
-        return this.contents.length;
-    }
+export enum ThreepidMedium {
+    Email = "email",
+    Phone = "msisdn",
+}
+
+// TODO: Are these types universal, or specific to just /account/3pid?
+export interface IThreepid {
+    medium: ThreepidMedium;
+    address: string;
+    validated_at: number; // eslint-disable-line camelcase
+    added_at: number; // eslint-disable-line camelcase
+    bound?: boolean;
 }
@@ -16,21 +16,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

+// eslint-disable-next-line no-restricted-imports
 import { EventEmitter } from "events";

+import { ListenerMap, TypedEventEmitter } from "./models/typed-event-emitter";
+
 export class ReEmitter {
-    private target: EventEmitter;
+    constructor(private readonly target: EventEmitter) {}

-    constructor(target: EventEmitter) {
-        this.target = target;
-    }
-
-    reEmit(source: EventEmitter, eventNames: string[]) {
+    public reEmit(source: EventEmitter, eventNames: string[]): void {
        for (const eventName of eventNames) {
            // We include the source as the last argument for event handlers which may need it,
            // such as read receipt listeners on the client class which won't have the context
            // of the room.
-            const forSource = (...args) => {
+            const forSource = (...args: any[]) => {
                // EventEmitter special cases 'error' to make the emit function throw if no
                // handler is attached, which sort of makes sense for making sure that something
                // handles an error, but for re-emitting, there could be a listener on the original
@@ -48,3 +47,19 @@ export class ReEmitter {
        }
    }
 }
+
+export class TypedReEmitter<
+    Events extends string,
+    Arguments extends ListenerMap<Events>,
+> extends ReEmitter {
+    constructor(target: TypedEventEmitter<Events, Arguments>) {
+        super(target);
+    }
+
+    public reEmit<ReEmittedEvents extends string, T extends Events & ReEmittedEvents>(
+        source: TypedEventEmitter<ReEmittedEvents, any>,
+        eventNames: T[],
+    ): void {
+        super.reEmit(source, eventNames);
+    }
+}
@@ -17,79 +17,20 @@ limitations under the License.

 /** @module auto-discovery */

-import { logger } from './logger';
 import { URL as NodeURL } from "url";

+import { IClientWellKnown, IWellKnownConfig } from "./client";
+import { logger } from './logger';
+
 // Dev note: Auto discovery is part of the spec.
 // See: https://matrix.org/docs/spec/client_server/r0.4.0.html#server-discovery

-/**
- * Description for what an automatically discovered client configuration
- * would look like. Although this is a class, it is recommended that it
- * be treated as an interface definition rather than as a class.
- *
- * Additional properties than those defined here may be present, and
- * should follow the Java package naming convention.
- */
-class DiscoveredClientConfig { // eslint-disable-line no-unused-vars
-    // Dev note: this is basically a copy/paste of the .well-known response
-    // object as defined in the spec. It does have additional information,
-    // however. Overall, this exists to serve as a place for documentation
-    // and not functionality.
-    // See https://matrix.org/docs/spec/client_server/r0.4.0.html#get-well-known-matrix-client
-
-    constructor() {
-        /**
-         * The homeserver configuration the client should use. This will
-         * always be present on the object.
-         * @type {{state: string, base_url: string}} The configuration.
-         */
-        this["m.homeserver"] = {
-            /**
-             * The lookup result state. If this is anything other than
-             * AutoDiscovery.SUCCESS then base_url may be falsey. Additionally,
-             * if this is not AutoDiscovery.SUCCESS then the client should
-             * assume the other properties in the client config (such as
-             * the identity server configuration) are not valid.
-             */
-            state: AutoDiscovery.PROMPT,
-
-            /**
-             * If the state is AutoDiscovery.FAIL_ERROR or .FAIL_PROMPT
-             * then this will contain a human-readable (English) message
-             * for what went wrong. If the state is none of those previously
-             * mentioned, this will be falsey.
-             */
-            error: "Something went wrong",
-
-            /**
-             * The base URL clients should use to talk to the homeserver,
-             * particularly for the login process. May be falsey if the
-             * state is not AutoDiscovery.SUCCESS.
-             */
-            base_url: "https://matrix.org",
-        };
-
-        /**
-         * The identity server configuration the client should use. This
-         * will always be present on teh object.
-         * @type {{state: string, base_url: string}} The configuration.
-         */
-        this["m.identity_server"] = {
-            /**
-             * The lookup result state. If this is anything other than
-             * AutoDiscovery.SUCCESS then base_url may be falsey.
-             */
-            state: AutoDiscovery.PROMPT,
-
-            /**
-             * The base URL clients should use for interacting with the
-             * identity server. May be falsey if the state is not
-             * AutoDiscovery.SUCCESS.
-             */
-            base_url: "https://vector.im",
-        };
-    }
+export enum AutoDiscoveryAction {
+    SUCCESS = "SUCCESS",
+    IGNORE = "IGNORE",
+    PROMPT = "PROMPT",
+    FAIL_PROMPT = "FAIL_PROMPT",
+    FAIL_ERROR = "FAIL_ERROR",
 }

 /**
@@ -102,55 +43,36 @@ export class AutoDiscovery {
    // translate the meaning of the states in the spec, but also
    // support our own if needed.

-    static get ERROR_INVALID() {
-        return "Invalid homeserver discovery response";
-    }
+    public static readonly ERROR_INVALID = "Invalid homeserver discovery response";

-    static get ERROR_GENERIC_FAILURE() {
-        return "Failed to get autodiscovery configuration from server";
-    }
+    public static readonly ERROR_GENERIC_FAILURE = "Failed to get autodiscovery configuration from server";

-    static get ERROR_INVALID_HS_BASE_URL() {
-        return "Invalid base_url for m.homeserver";
-    }
+    public static readonly ERROR_INVALID_HS_BASE_URL = "Invalid base_url for m.homeserver";

-    static get ERROR_INVALID_HOMESERVER() {
-        return "Homeserver URL does not appear to be a valid Matrix homeserver";
-    }
+    public static readonly ERROR_INVALID_HOMESERVER = "Homeserver URL does not appear to be a valid Matrix homeserver";

-    static get ERROR_INVALID_IS_BASE_URL() {
-        return "Invalid base_url for m.identity_server";
-    }
+    public static readonly ERROR_INVALID_IS_BASE_URL = "Invalid base_url for m.identity_server";

-    static get ERROR_INVALID_IDENTITY_SERVER() {
-        return "Identity server URL does not appear to be a valid identity server";
-    }
+    // eslint-disable-next-line
+    public static readonly ERROR_INVALID_IDENTITY_SERVER = "Identity server URL does not appear to be a valid identity server";

-    static get ERROR_INVALID_IS() {
-        return "Invalid identity server discovery response";
-    }
+    public static readonly ERROR_INVALID_IS = "Invalid identity server discovery response";

-    static get ERROR_MISSING_WELLKNOWN() {
-        return "No .well-known JSON file found";
-    }
+    public static readonly ERROR_MISSING_WELLKNOWN = "No .well-known JSON file found";

-    static get ERROR_INVALID_JSON() {
-        return "Invalid JSON";
-    }
+    public static readonly ERROR_INVALID_JSON = "Invalid JSON";

-    static get ALL_ERRORS() {
-        return [
-            AutoDiscovery.ERROR_INVALID,
-            AutoDiscovery.ERROR_GENERIC_FAILURE,
-            AutoDiscovery.ERROR_INVALID_HS_BASE_URL,
-            AutoDiscovery.ERROR_INVALID_HOMESERVER,
-            AutoDiscovery.ERROR_INVALID_IS_BASE_URL,
-            AutoDiscovery.ERROR_INVALID_IDENTITY_SERVER,
-            AutoDiscovery.ERROR_INVALID_IS,
-            AutoDiscovery.ERROR_MISSING_WELLKNOWN,
-            AutoDiscovery.ERROR_INVALID_JSON,
-        ];
-    }
+    public static readonly ALL_ERRORS = [
+        AutoDiscovery.ERROR_INVALID,
+        AutoDiscovery.ERROR_GENERIC_FAILURE,
+        AutoDiscovery.ERROR_INVALID_HS_BASE_URL,
+        AutoDiscovery.ERROR_INVALID_HOMESERVER,
+        AutoDiscovery.ERROR_INVALID_IS_BASE_URL,
+        AutoDiscovery.ERROR_INVALID_IDENTITY_SERVER,
+        AutoDiscovery.ERROR_INVALID_IS,
+        AutoDiscovery.ERROR_MISSING_WELLKNOWN,
+        AutoDiscovery.ERROR_INVALID_JSON,
+    ];

    /**
     * The auto discovery failed. The client is expected to communicate
@@ -158,7 +80,7 @@ export class AutoDiscovery {
     * @return {string}
     * @constructor
     */
-    static get FAIL_ERROR() { return "FAIL_ERROR"; }
+    public static readonly FAIL_ERROR = AutoDiscoveryAction.FAIL_ERROR;

    /**
     * The auto discovery failed, however the client may still recover
@@ -169,7 +91,7 @@ export class AutoDiscovery {
     * @return {string}
     * @constructor
     */
-    static get FAIL_PROMPT() { return "FAIL_PROMPT"; }
+    public static readonly FAIL_PROMPT = AutoDiscoveryAction.FAIL_PROMPT;

    /**
     * The auto discovery didn't fail but did not find anything of
@@ -178,14 +100,14 @@ export class AutoDiscovery {
     * @return {string}
     * @constructor
     */
-    static get PROMPT() { return "PROMPT"; }
+    public static readonly PROMPT = AutoDiscoveryAction.PROMPT;

    /**
     * The auto discovery was successful.
     * @return {string}
     * @constructor
     */
-    static get SUCCESS() { return "SUCCESS"; }
+    public static readonly SUCCESS = AutoDiscoveryAction.SUCCESS;

    /**
     * Validates and verifies client configuration information for purposes
@@ -193,13 +115,13 @@ export class AutoDiscovery {
     * and identity server URL the client would want. Additional details
     * may also be included, and will be transparently brought into the
     * response object unaltered.
-     * @param {string} wellknown The configuration object itself, as returned
+     * @param {object} wellknown The configuration object itself, as returned
     * by the .well-known auto-discovery endpoint.
     * @return {Promise<DiscoveredClientConfig>} Resolves to the verified
     * configuration, which may include error states. Rejects on unexpected
     * failure, not when verification fails.
     */
-    static async fromDiscoveryConfig(wellknown) {
+    public static async fromDiscoveryConfig(wellknown: any): Promise<IClientWellKnown> {
        // Step 1 is to get the config, which is provided to us here.

        // We default to an error state to make the first few checks easier to
@@ -240,7 +162,7 @@ export class AutoDiscovery {

        // Step 2: Make sure the homeserver URL is valid *looking*. We'll make
        // sure it points to a homeserver in Step 3.
-        const hsUrl = this._sanitizeWellKnownUrl(
+        const hsUrl = this.sanitizeWellKnownUrl(
            wellknown["m.homeserver"]["base_url"],
        );
        if (!hsUrl) {
@@ -250,7 +172,7 @@ export class AutoDiscovery {
        }

        // Step 3: Make sure the homeserver URL points to a homeserver.
-        const hsVersions = await this._fetchWellKnownObject(
+        const hsVersions = await this.fetchWellKnownObject(
            `${hsUrl}/_matrix/client/versions`,
        );
        if (!hsVersions || !hsVersions.raw["versions"]) {
@@ -272,7 +194,7 @@ export class AutoDiscovery {
        };

        // Step 5: Try to pull out the identity server configuration
-        let isUrl = "";
+        let isUrl: string | boolean = "";
        if (wellknown["m.identity_server"]) {
            // We prepare a failing identity server response to save lines later
            // in this branch.
@@ -287,7 +209,7 @@ export class AutoDiscovery {

            // Step 5a: Make sure the URL is valid *looking*. We'll make sure it
            // points to an identity server in Step 5b.
-            isUrl = this._sanitizeWellKnownUrl(
+            isUrl = this.sanitizeWellKnownUrl(
                wellknown["m.identity_server"]["base_url"],
            );
            if (!isUrl) {
@@ -299,10 +221,10 @@ export class AutoDiscovery {

            // Step 5b: Verify there is an identity server listening on the provided
            // URL.
-            const isResponse = await this._fetchWellKnownObject(
+            const isResponse = await this.fetchWellKnownObject(
                `${isUrl}/_matrix/identity/api/v1`,
            );
-            if (!isResponse || !isResponse.raw || isResponse.action !== "SUCCESS") {
+            if (!isResponse || !isResponse.raw || isResponse.action !== AutoDiscoveryAction.SUCCESS) {
                logger.error("Invalid /api/v1 response");
                failingClientConfig["m.identity_server"].error =
                    AutoDiscovery.ERROR_INVALID_IDENTITY_SERVER;
@@ -317,7 +239,7 @@ export class AutoDiscovery {

        // Step 6: Now that the identity server is valid, or never existed,
        // populate the IS section.
-        if (isUrl && isUrl.length > 0) {
+        if (isUrl && isUrl.toString().length > 0) {
            clientConfig["m.identity_server"] = {
                state: AutoDiscovery.SUCCESS,
                error: null,
@@ -359,7 +281,7 @@ export class AutoDiscovery {
     * configuration, which may include error states. Rejects on unexpected
     * failure, not when discovery fails.
     */
-    static async findClientConfig(domain) {
+    public static async findClientConfig(domain: string): Promise<IClientWellKnown> {
        if (!domain || typeof(domain) !== "string" || domain.length === 0) {
            throw new Error("'domain' must be a string of non-zero length");
        }
@@ -395,13 +317,13 @@ export class AutoDiscovery {

        // Step 1: Actually request the .well-known JSON file and make sure it
        // at least has a homeserver definition.
-        const wellknown = await this._fetchWellKnownObject(
+        const wellknown = await this.fetchWellKnownObject(
            `https://${domain}/.well-known/matrix/client`,
        );
-        if (!wellknown || wellknown.action !== "SUCCESS") {
+        if (!wellknown || wellknown.action !== AutoDiscoveryAction.SUCCESS) {
            logger.error("No response or error when parsing .well-known");
            if (wellknown.reason) logger.error(wellknown.reason);
-            if (wellknown.action === "IGNORE") {
+            if (wellknown.action === AutoDiscoveryAction.IGNORE) {
                clientConfig["m.homeserver"] = {
                    state: AutoDiscovery.PROMPT,
                    error: null,
@@ -427,12 +349,12 @@ export class AutoDiscovery {
     * @returns {Promise<object>} Resolves to the domain's client config. Can
     * be an empty object.
     */
-    static async getRawClientConfig(domain) {
+    public static async getRawClientConfig(domain: string): Promise<IClientWellKnown> {
        if (!domain || typeof(domain) !== "string" || domain.length === 0) {
            throw new Error("'domain' must be a string of non-zero length");
        }

-        const response = await this._fetchWellKnownObject(
+        const response = await this.fetchWellKnownObject(
            `https://${domain}/.well-known/matrix/client`,
        );
        if (!response) return {};
@@ -447,7 +369,7 @@ export class AutoDiscovery {
     * @return {string|boolean} The sanitized URL or a falsey value if the URL is invalid.
     * @private
     */
-    static _sanitizeWellKnownUrl(url) {
+    private static sanitizeWellKnownUrl(url: string): string | boolean {
        if (!url) return false;

        try {
@@ -495,8 +417,9 @@ export class AutoDiscovery {
     * @return {Promise<object>} Resolves to the returned state.
     * @private
     */
-    static async _fetchWellKnownObject(url) {
+    private static async fetchWellKnownObject(url: string): Promise<IWellKnownConfig> {
        return new Promise(function(resolve, reject) {
+            // eslint-disable-next-line
            const request = require("./matrix").getRequest();
            if (!request) throw new Error("No request library available");
            request(
@@ -505,10 +428,10 @@ export class AutoDiscovery {
                    if (err || response &&
                        (response.statusCode < 200 || response.statusCode >= 300)
                    ) {
-                        let action = "FAIL_PROMPT";
+                        let action = AutoDiscoveryAction.FAIL_PROMPT;
                        let reason = (err ? err.message : null) || "General failure";
                        if (response && response.statusCode === 404) {
-                            action = "IGNORE";
+                            action = AutoDiscoveryAction.IGNORE;
                            reason = AutoDiscovery.ERROR_MISSING_WELLKNOWN;
                        }
                        resolve({ raw: {}, action: action, reason: reason, error: err });
@@ -516,7 +439,7 @@ export class AutoDiscovery {
                    }

                    try {
-                        resolve({ raw: JSON.parse(body), action: "SUCCESS" });
+                        resolve({ raw: JSON.parse(body), action: AutoDiscoveryAction.SUCCESS });
                    } catch (e) {
                        let reason = AutoDiscovery.ERROR_INVALID;
                        if (e.name === "SyntaxError") {
@@ -524,7 +447,7 @@ export class AutoDiscovery {
                        }
                        resolve({
                            raw: {},
-                            action: "FAIL_PROMPT",
+                            action: AutoDiscoveryAction.FAIL_PROMPT,
                            reason: reason,
                            error: e,
                        });
@@ -14,10 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import * as matrixcs from "./matrix";
 import request from "browser-request";
 import queryString from "qs";

+import * as matrixcs from "./matrix";
+
+if (matrixcs.getRequest()) {
+    throw new Error("Multiple matrix-js-sdk entrypoints detected!");
+}
+
 matrixcs.request(function(opts, fn) {
    // We manually fix the query string for browser-request because
    // it doesn't correctly handle cases like ?via=one&via=two. Instead
@@ -1,6 +1,5 @@
 /*
-Copyright 2018 New Vector Ltd
-Copyright 2019 The Matrix.org Foundation C.I.C.
+Copyright 2018 - 2022 The Matrix.org Foundation C.I.C.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,15 +16,25 @@ limitations under the License.

 /** @module ContentHelpers */

+import { MsgType } from "./@types/event";
+import { TEXT_NODE_TYPE } from "./@types/extensible_events";
+import {
+    ASSET_NODE_TYPE,
+    ILocationContent,
+    LocationAssetType,
+    LOCATION_EVENT_TYPE,
+    TIMESTAMP_NODE_TYPE,
+} from "./@types/location";
+
 /**
 * Generates the content for a HTML Message event
 * @param {string} body the plaintext body of the message
 * @param {string} htmlBody the HTML representation of the message
 * @returns {{msgtype: string, format: string, body: string, formatted_body: string}}
 */
-export function makeHtmlMessage(body, htmlBody) {
+export function makeHtmlMessage(body: string, htmlBody: string) {
    return {
-        msgtype: "m.text",
+        msgtype: MsgType.Text,
        format: "org.matrix.custom.html",
        body: body,
        formatted_body: htmlBody,
@@ -38,9 +47,9 @@ export function makeHtmlMessage(body, htmlBody) {
 * @param {string} htmlBody the HTML representation of the notice
 * @returns {{msgtype: string, format: string, body: string, formatted_body: string}}
 */
-export function makeHtmlNotice(body, htmlBody) {
+export function makeHtmlNotice(body: string, htmlBody: string) {
    return {
-        msgtype: "m.notice",
+        msgtype: MsgType.Notice,
        format: "org.matrix.custom.html",
        body: body,
        formatted_body: htmlBody,
@@ -53,9 +62,9 @@ export function makeHtmlNotice(body, htmlBody) {
 * @param {string} htmlBody the HTML representation of the emote
 * @returns {{msgtype: string, format: string, body: string, formatted_body: string}}
 */
-export function makeHtmlEmote(body, htmlBody) {
+export function makeHtmlEmote(body: string, htmlBody: string) {
    return {
-        msgtype: "m.emote",
+        msgtype: MsgType.Emote,
        format: "org.matrix.custom.html",
        body: body,
        formatted_body: htmlBody,
@@ -67,9 +76,9 @@ export function makeHtmlEmote(body, htmlBody) {
 * @param {string} body the plaintext body of the emote
 * @returns {{msgtype: string, body: string}}
 */
-export function makeTextMessage(body) {
+export function makeTextMessage(body: string) {
    return {
-        msgtype: "m.text",
+        msgtype: MsgType.Text,
        body: body,
    };
 }
@@ -79,9 +88,9 @@ export function makeTextMessage(body) {
 * @param {string} body the plaintext body of the notice
 * @returns {{msgtype: string, body: string}}
 */
-export function makeNotice(body) {
+export function makeNotice(body: string) {
    return {
-        msgtype: "m.notice",
+        msgtype: MsgType.Notice,
        body: body,
    };
 }
@@ -91,9 +100,42 @@ export function makeNotice(body) {
 * @param {string} body the plaintext body of the emote
 * @returns {{msgtype: string, body: string}}
 */
-export function makeEmoteMessage(body) {
+export function makeEmoteMessage(body: string) {
    return {
-        msgtype: "m.emote",
+        msgtype: MsgType.Emote,
        body: body,
    };
 }
+
+/**
+ * Generates the content for a Location event
+ * @param text a text for of our location
+ * @param uri a geo:// uri for the location
+ * @param ts the timestamp when the location was correct (milliseconds since
+ *           the UNIX epoch)
+ * @param description the (optional) label for this location on the map
+ * @param asset_type the (optional) asset type of this location e.g. "m.self"
+ */
+export function makeLocationContent(
+    text: string,
+    uri: string,
+    ts: number,
+    description?: string,
+    assetType?: LocationAssetType,
+): ILocationContent {
+    return {
+        "body": text,
+        "msgtype": MsgType.Location,
+        "geo_uri": uri,
+        [LOCATION_EVENT_TYPE.name]: {
+            uri,
+            description,
+        },
+        [ASSET_NODE_TYPE.name]: {
+            type: assetType ?? LocationAssetType.Self,
+        },
+        [TEXT_NODE_TYPE.name]: text,
+        [TIMESTAMP_NODE_TYPE.name]: ts,
+        // TODO: MSC1767 fallbacks m.image thumbnail
+    };
+}
@@ -1,6 +1,5 @@
 /*
-Copyright 2015, 2016 OpenMarket Ltd
-Copyright 2019 The Matrix.org Foundation C.I.C.
+Copyright 2015 - 2021 The Matrix.org Foundation C.I.C.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -34,8 +33,14 @@ import * as utils from "./utils";
 * for such URLs.
 * @return {string} The complete URL to the content.
 */
-export function getHttpUriForMxc(baseUrl, mxc, width, height,
-                           resizeMethod, allowDirectLinks) {
+export function getHttpUriForMxc(
+    baseUrl: string,
+    mxc: string,
+    width: number,
+    height: number,
+    resizeMethod: string,
+    allowDirectLinks = false,
+): string {
    if (typeof mxc !== "string" || !mxc) {
        return '';
    }
@@ -48,16 +53,16 @@ export function getHttpUriForMxc(baseUrl, mxc, width, height,
    }
    let serverAndMediaId = mxc.slice(6); // strips mxc://
    let prefix = "/_matrix/media/r0/download/";
-    const params = {};
+    const params: Record<string, string> = {};

    if (width) {
-        params.width = Math.round(width);
+        params["width"] = Math.round(width).toString();
    }
    if (height) {
-        params.height = Math.round(height);
+        params["height"] = Math.round(height).toString();
    }
    if (resizeMethod) {
-        params.method = resizeMethod;
+        params["method"] = resizeMethod;
    }
    if (Object.keys(params).length > 0) {
        // these are thumbnailing params so they probably want the
@@ -71,7 +76,7 @@ export function getHttpUriForMxc(baseUrl, mxc, width, height,
        fragment = serverAndMediaId.substr(fragmentOffset);
        serverAndMediaId = serverAndMediaId.substr(0, fragmentOffset);
    }
-    return baseUrl + prefix + serverAndMediaId +
-        (Object.keys(params).length === 0 ? "" :
-        ("?" + utils.encodeParams(params))) + fragment;
+
+    const urlParams = (Object.keys(params).length === 0 ? "" : ("?" + utils.encodeParams(params)));
+    return baseUrl + prefix + serverAndMediaId + urlParams + fragment;
 }
@@ -1,6 +1,5 @@
 /*
-Copyright 2019 New Vector Ltd
-Copyright 2019 The Matrix.org Foundation C.I.C.
+Copyright 2019 - 2021 The Matrix.org Foundation C.I.C.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -20,22 +19,51 @@ limitations under the License.
 * @module crypto/CrossSigning
 */

+import { PkSigning } from "@matrix-org/olm";
+
 import { decodeBase64, encodeBase64, pkSign, pkVerify } from './olmlib';
-import { EventEmitter } from 'events';
 import { logger } from '../logger';
 import { IndexedDBCryptoStore } from '../crypto/store/indexeddb-crypto-store';
 import { decryptAES, encryptAES } from './aes';
+import { DeviceInfo } from "./deviceinfo";
+import { SecretStorage } from "./SecretStorage";
+import { ICrossSigningKey, ISignedKey, MatrixClient } from "../client";
+import { OlmDevice } from "./OlmDevice";
+import { ICryptoCallbacks } from "../matrix";
+import { ISignatures } from "../@types/signed";
+import { CryptoStore } from "./store/base";
+import { ISecretStorageKeyInfo } from "./api";

 const KEY_REQUEST_TIMEOUT_MS = 1000 * 60;

-function publicKeyFromKeyInfo(keyInfo) {
+function publicKeyFromKeyInfo(keyInfo: ICrossSigningKey): string {
    // `keys` is an object with { [`ed25519:${pubKey}`]: pubKey }
    // We assume only a single key, and we want the bare form without type
    // prefix, so we select the values.
    return Object.values(keyInfo.keys)[0];
 }

-export class CrossSigningInfo extends EventEmitter {
+export interface ICacheCallbacks {
+    getCrossSigningKeyCache?(type: string, expectedPublicKey?: string): Promise<Uint8Array>;
+    storeCrossSigningKeyCache?(type: string, key: Uint8Array): Promise<void>;
+}
+
+export interface ICrossSigningInfo {
+    keys: Record<string, ICrossSigningKey>;
+    firstUse: boolean;
+    crossSigningVerifiedBefore: boolean;
+}
+
+export class CrossSigningInfo {
+    public keys: Record<string, ICrossSigningKey> = {};
+    public firstUse = true;
+    // This tracks whether we've ever verified this user with any identity.
+    // When you verify a user, any devices online at the time that receive
+    // the verifying signature via the homeserver will latch this to true
+    // and can use it in the future to detect cases where the user has
+    // become unverified later for any reason.
+    private crossSigningVerifiedBefore = false;
+
    /**
     * Information about a user's cross-signing keys
     *
@@ -46,27 +74,13 @@ export class CrossSigningInfo extends EventEmitter {
     *     Requires getCrossSigningKey and saveCrossSigningKeys
     * @param {object} cacheCallbacks Callbacks used to interact with the cache
     */
-    constructor(userId, callbacks, cacheCallbacks) {
-        super();
+    constructor(
+        public readonly userId: string,
+        private callbacks: ICryptoCallbacks = {},
+        private cacheCallbacks: ICacheCallbacks = {},
+    ) {}

-        // you can't change the userId
-        Object.defineProperty(this, 'userId', {
-            enumerable: true,
-            value: userId,
-        });
-        this._callbacks = callbacks || {};
-        this._cacheCallbacks = cacheCallbacks || {};
-        this.keys = {};
-        this.firstUse = true;
-        // This tracks whether we've ever verified this user with any identity.
-        // When you verify a user, any devices online at the time that receive
-        // the verifying signature via the homeserver will latch this to true
-        // and can use it in the future to detect cases where the user has
-        // become unverifed later for any reason.
-        this.crossSigningVerifiedBefore = false;
-    }
-
-    static fromStorage(obj, userId) {
+    public static fromStorage(obj: ICrossSigningInfo, userId: string): CrossSigningInfo {
        const res = new CrossSigningInfo(userId);
        for (const prop in obj) {
            if (obj.hasOwnProperty(prop)) {
@@ -76,7 +90,7 @@ export class CrossSigningInfo extends EventEmitter {
        return res;
    }

-    toStorage() {
+    public toStorage(): ICrossSigningInfo {
        return {
            keys: this.keys,
            firstUse: this.firstUse,
@@ -92,10 +106,10 @@ export class CrossSigningInfo extends EventEmitter {
     *     the stored public key for the given key type.
     * @returns {Array} An array with [ public key, Olm.PkSigning ]
     */
-    async getCrossSigningKey(type, expectedPubkey) {
+    public async getCrossSigningKey(type: string, expectedPubkey?: string): Promise<[string, PkSigning]> {
        const shouldCache = ["master", "self_signing", "user_signing"].indexOf(type) >= 0;

-        if (!this._callbacks.getCrossSigningKey) {
+        if (!this.callbacks.getCrossSigningKey) {
            throw new Error("No getCrossSigningKey callback supplied");
        }

@@ -103,7 +117,7 @@ export class CrossSigningInfo extends EventEmitter {
            expectedPubkey = this.getId(type);
        }

-        function validateKey(key) {
+        function validateKey(key: Uint8Array): [string, PkSigning] {
            if (!key) return;
            const signing = new global.Olm.PkSigning();
            const gotPubkey = signing.init_with_seed(key);
@@ -114,9 +128,8 @@ export class CrossSigningInfo extends EventEmitter {
        }

        let privkey;
-        if (this._cacheCallbacks.getCrossSigningKeyCache && shouldCache) {
-            privkey = await this._cacheCallbacks
-              .getCrossSigningKeyCache(type, expectedPubkey);
+        if (this.cacheCallbacks.getCrossSigningKeyCache && shouldCache) {
+            privkey = await this.cacheCallbacks.getCrossSigningKeyCache(type, expectedPubkey);
        }

        const cacheresult = validateKey(privkey);
@@ -124,11 +137,11 @@ export class CrossSigningInfo extends EventEmitter {
            return cacheresult;
        }

-        privkey = await this._callbacks.getCrossSigningKey(type, expectedPubkey);
+        privkey = await this.callbacks.getCrossSigningKey(type, expectedPubkey);
        const result = validateKey(privkey);
        if (result) {
-            if (this._cacheCallbacks.storeCrossSigningKeyCache && shouldCache) {
-                await this._cacheCallbacks.storeCrossSigningKeyCache(type, privkey);
+            if (this.cacheCallbacks.storeCrossSigningKeyCache && shouldCache) {
+                await this.cacheCallbacks.storeCrossSigningKeyCache(type, privkey);
            }
            return result;
        }
@@ -156,12 +169,11 @@ export class CrossSigningInfo extends EventEmitter {
     *     with, or null if it is not present or not encrypted with a trusted
     *     key
     */
-    async isStoredInSecretStorage(secretStorage) {
+    public async isStoredInSecretStorage(secretStorage: SecretStorage): Promise<Record<string, object>> {
        // check what SSSS keys have encrypted the master key (if any)
-        const stored =
-              await secretStorage.isStored("m.cross_signing.master", false) || {};
+        const stored = await secretStorage.isStored("m.cross_signing.master", false) || {};
        // then check which of those SSSS keys have also encrypted the SSK and USK
-        function intersect(s) {
+        function intersect(s: Record<string, ISecretStorageKeyInfo>) {
            for (const k of Object.keys(stored)) {
                if (!s[k]) {
                    delete stored[k];
@@ -169,9 +181,7 @@ export class CrossSigningInfo extends EventEmitter {
            }
        }
        for (const type of ["self_signing", "user_signing"]) {
-            intersect(
-                await secretStorage.isStored(`m.cross_signing.${type}`, false) || {},
-            );
+            intersect(await secretStorage.isStored(`m.cross_signing.${type}`, false) || {});
        }
        return Object.keys(stored).length ? stored : null;
    }
@@ -184,7 +194,10 @@ export class CrossSigningInfo extends EventEmitter {
     * @param {Map} keys The keys to store
     * @param {SecretStorage} secretStorage The secret store using account data
     */
-    static async storeInSecretStorage(keys, secretStorage) {
+    public static async storeInSecretStorage(
+        keys: Map<string, Uint8Array>,
+        secretStorage: SecretStorage,
+    ): Promise<void> {
        for (const [type, privateKey] of keys) {
            const encodedKey = encodeBase64(privateKey);
            await secretStorage.store(`m.cross_signing.${type}`, encodedKey);
@@ -200,7 +213,7 @@ export class CrossSigningInfo extends EventEmitter {
     * @param {SecretStorage} secretStorage The secret store using account data
     * @return {Uint8Array} The private key
     */
-    static async getFromSecretStorage(type, secretStorage) {
+    public static async getFromSecretStorage(type: string, secretStorage: SecretStorage): Promise<Uint8Array> {
        const encodedKey = await secretStorage.get(`m.cross_signing.${type}`);
        if (!encodedKey) {
            return null;
@@ -215,8 +228,8 @@ export class CrossSigningInfo extends EventEmitter {
     * "self_signing", or "user_signing". Optional, will check all by default.
     * @returns {boolean} True if all keys are stored in the local cache.
     */
-    async isStoredInKeyCache(type) {
-        const cacheCallbacks = this._cacheCallbacks;
+    public async isStoredInKeyCache(type?: string): Promise<boolean> {
+        const cacheCallbacks = this.cacheCallbacks;
        if (!cacheCallbacks) return false;
        const types = type ? [type] : ["master", "self_signing", "user_signing"];
        for (const t of types) {
@@ -232,9 +245,9 @@ export class CrossSigningInfo extends EventEmitter {
     *
     * @returns {Map} A map from key type (string) to private key (Uint8Array)
     */
-    async getCrossSigningKeysFromCache() {
+    public async getCrossSigningKeysFromCache(): Promise<Map<string, Uint8Array>> {
        const keys = new Map();
-        const cacheCallbacks = this._cacheCallbacks;
+        const cacheCallbacks = this.cacheCallbacks;
        if (!cacheCallbacks) return keys;
        for (const type of ["master", "self_signing", "user_signing"]) {
            const privKey = await cacheCallbacks.getCrossSigningKeyCache(type);
@@ -255,8 +268,7 @@ export class CrossSigningInfo extends EventEmitter {
     *
     * @return {string} the ID
     */
-    getId(type) {
-        type = type || "master";
+    public getId(type = "master"): string {
        if (!this.keys[type]) return null;
        const keyInfo = this.keys[type];
        return publicKeyFromKeyInfo(keyInfo);
@@ -269,8 +281,8 @@ export class CrossSigningInfo extends EventEmitter {
     *
     * @param {CrossSigningLevel} level The key types to reset
     */
-    async resetKeys(level) {
-        if (!this._callbacks.saveCrossSigningKeys) {
+    public async resetKeys(level?: CrossSigningLevel): Promise<void> {
+        if (!this.callbacks.saveCrossSigningKeys) {
            throw new Error("No saveCrossSigningKeys callback supplied");
        }

@@ -285,12 +297,12 @@ export class CrossSigningInfo extends EventEmitter {
                CrossSigningLevel.USER_SIGNING |
                CrossSigningLevel.SELF_SIGNING
            );
-        } else if (level === 0) {
+        } else if (level === 0 as CrossSigningLevel) {
            return;
        }

-        const privateKeys = {};
-        const keys = {};
+        const privateKeys: Record<string, Uint8Array> = {};
+        const keys: Record<string, ICrossSigningKey> = {};
        let masterSigning;
        let masterPub;

@@ -347,7 +359,7 @@ export class CrossSigningInfo extends EventEmitter {
            }

            Object.assign(this.keys, keys);
-            this._callbacks.saveCrossSigningKeys(privateKeys);
+            this.callbacks.saveCrossSigningKeys(privateKeys);
        } finally {
            if (masterSigning) {
                masterSigning.free();
@@ -358,12 +370,12 @@ export class CrossSigningInfo extends EventEmitter {
    /**
     * unsets the keys, used when another session has reset the keys, to disable cross-signing
     */
-    clearKeys() {
+    public clearKeys(): void {
        this.keys = {};
    }

-    setKeys(keys) {
-        const signingKeys = {};
+    public setKeys(keys: Record<string, ICrossSigningKey>): void {
+        const signingKeys: Record<string, ICrossSigningKey> = {};
        if (keys.master) {
            if (keys.master.user_id !== this.userId) {
                const error = "Mismatched user ID " + keys.master.user_id +
@@ -434,7 +446,7 @@ export class CrossSigningInfo extends EventEmitter {
        }
    }

-    updateCrossSigningVerifiedBefore(isCrossSigningVerified) {
+    public updateCrossSigningVerifiedBefore(isCrossSigningVerified: boolean): void {
        // It is critical that this value latches forward from false to true but
        // never back to false to avoid a downgrade attack.
        if (!this.crossSigningVerifiedBefore && isCrossSigningVerified) {
@@ -442,7 +454,7 @@ export class CrossSigningInfo extends EventEmitter {
        }
    }

-    async signObject(data, type) {
+    public async signObject<T extends object>(data: T, type: string): Promise<T & { signatures: ISignatures }> {
        if (!this.keys[type]) {
            throw new Error(
                "Attempted to sign with " + type + " key but no such key present",
@@ -451,13 +463,13 @@ export class CrossSigningInfo extends EventEmitter {
        const [pubkey, signing] = await this.getCrossSigningKey(type);
        try {
            pkSign(data, signing, this.userId, pubkey);
-            return data;
+            return data as T & { signatures: ISignatures };
        } finally {
            signing.free();
        }
    }

-    async signUser(key) {
+    public async signUser(key: CrossSigningInfo): Promise<ICrossSigningKey> {
        if (!this.keys.user_signing) {
            logger.info("No user signing key: not signing user");
            return;
@@ -465,7 +477,7 @@ export class CrossSigningInfo extends EventEmitter {
        return this.signObject(key.keys.master, "user_signing");
    }

-    async signDevice(userId, device) {
+    public async signDevice(userId: string, device: DeviceInfo): Promise<ISignedKey> {
        if (userId !== this.userId) {
            throw new Error(
                `Trying to sign ${userId}'s device; can only sign our own device`,
@@ -475,7 +487,7 @@ export class CrossSigningInfo extends EventEmitter {
            logger.info("No self signing key: not signing device");
            return;
        }
-        return this.signObject(
+        return this.signObject<Omit<ISignedKey, "signatures">>(
            {
                algorithms: device.algorithms,
                keys: device.keys,
@@ -492,7 +504,7 @@ export class CrossSigningInfo extends EventEmitter {
     *
     * @returns {UserTrustLevel}
     */
-    checkUserTrust(userCrossSigning) {
+    public checkUserTrust(userCrossSigning: CrossSigningInfo): UserTrustLevel {
        // if we're checking our own key, then it's trusted if the master key
        // and self-signing key match
        if (this.userId === userCrossSigning.userId
@@ -530,12 +542,17 @@ export class CrossSigningInfo extends EventEmitter {
     *
     * @param {CrossSigningInfo} userCrossSigning Cross signing info for user
     * @param {module:crypto/deviceinfo} device The device to check
-     * @param {bool} localTrust Whether the device is trusted locally
-     * @param {bool} trustCrossSignedDevices Whether we trust cross signed devices
+     * @param {boolean} localTrust Whether the device is trusted locally
+     * @param {boolean} trustCrossSignedDevices Whether we trust cross signed devices
     *
     * @returns {DeviceTrustLevel}
     */
-    checkDeviceTrust(userCrossSigning, device, localTrust, trustCrossSignedDevices) {
+    public checkDeviceTrust(
+        userCrossSigning: CrossSigningInfo,
+        device: DeviceInfo,
+        localTrust: boolean,
+        trustCrossSignedDevices: boolean,
+    ): DeviceTrustLevel {
        const userTrust = this.checkUserTrust(userCrossSigning);

        const userSSK = userCrossSigning.keys.self_signing;
@@ -552,29 +569,23 @@ export class CrossSigningInfo extends EventEmitter {
            // if we can verify the user's SSK from their master key...
            pkVerify(userSSK, userCrossSigning.getId(), userCrossSigning.userId);
            // ...and this device's key from their SSK...
-            pkVerify(
-                deviceObj, publicKeyFromKeyInfo(userSSK), userCrossSigning.userId,
-            );
+            pkVerify(deviceObj, publicKeyFromKeyInfo(userSSK), userCrossSigning.userId);
            // ...then we trust this device as much as far as we trust the user
-            return DeviceTrustLevel.fromUserTrustLevel(
-                userTrust, localTrust, trustCrossSignedDevices,
-            );
+            return DeviceTrustLevel.fromUserTrustLevel(userTrust, localTrust, trustCrossSignedDevices);
        } catch (e) {
-            return new DeviceTrustLevel(
-                false, false, localTrust, trustCrossSignedDevices,
-            );
+            return new DeviceTrustLevel(false, false, localTrust, trustCrossSignedDevices);
        }
    }

    /**
     * @returns {object} Cache callbacks
     */
-    getCacheCallbacks() {
-        return this._cacheCallbacks;
+    public getCacheCallbacks(): ICacheCallbacks {
+        return this.cacheCallbacks;
    }
 }

-function deviceToObject(device, userId) {
+function deviceToObject(device: DeviceInfo, userId: string) {
    return {
        algorithms: device.algorithms,
        keys: device.keys,
@@ -584,49 +595,49 @@ function deviceToObject(device, userId) {
    };
 }

-export const CrossSigningLevel = {
-    MASTER: 4,
-    USER_SIGNING: 2,
-    SELF_SIGNING: 1,
-};
+export enum CrossSigningLevel {
+    MASTER = 4,
+    USER_SIGNING = 2,
+    SELF_SIGNING = 1,
+}

 /**
 * Represents the ways in which we trust a user
 */
 export class UserTrustLevel {
-    constructor(crossSigningVerified, crossSigningVerifiedBefore, tofu) {
-        this._crossSigningVerified = crossSigningVerified;
-        this._crossSigningVerifiedBefore = crossSigningVerifiedBefore;
-        this._tofu = tofu;
-    }
+    constructor(
+        private readonly crossSigningVerified: boolean,
+        private readonly crossSigningVerifiedBefore: boolean,
+        private readonly tofu: boolean,
+    ) {}

    /**
-     * @returns {bool} true if this user is verified via any means
+     * @returns {boolean} true if this user is verified via any means
     */
-    isVerified() {
+    public isVerified(): boolean {
        return this.isCrossSigningVerified();
    }

    /**
-     * @returns {bool} true if this user is verified via cross signing
+     * @returns {boolean} true if this user is verified via cross signing
     */
-    isCrossSigningVerified() {
-        return this._crossSigningVerified;
+    public isCrossSigningVerified(): boolean {
+        return this.crossSigningVerified;
    }

    /**
-     * @returns {bool} true if we ever verified this user before (at least for
+     * @returns {boolean} true if we ever verified this user before (at least for
     * the history of verifications observed by this device).
     */
-    wasCrossSigningVerified() {
-        return this._crossSigningVerifiedBefore;
+    public wasCrossSigningVerified(): boolean {
+        return this.crossSigningVerifiedBefore;
    }

    /**
-     * @returns {bool} true if this user's key is trusted on first use
+     * @returns {boolean} true if this user's key is trusted on first use
     */
-    isTofu() {
-        return this._tofu;
+    public isTofu(): boolean {
+        return this.tofu;
    }
 }

@@ -634,58 +645,62 @@ export class UserTrustLevel {
 * Represents the ways in which we trust a device
 */
 export class DeviceTrustLevel {
-    constructor(crossSigningVerified, tofu, localVerified, trustCrossSignedDevices) {
-        this._crossSigningVerified = crossSigningVerified;
-        this._tofu = tofu;
-        this._localVerified = localVerified;
-        this._trustCrossSignedDevices = trustCrossSignedDevices;
-    }
+    constructor(
+        public readonly crossSigningVerified: boolean,
+        public readonly tofu: boolean,
+        private readonly localVerified: boolean,
+        private readonly trustCrossSignedDevices: boolean,
+    ) {}

-    static fromUserTrustLevel(userTrustLevel, localVerified, trustCrossSignedDevices) {
+    public static fromUserTrustLevel(
+        userTrustLevel: UserTrustLevel,
+        localVerified: boolean,
+        trustCrossSignedDevices: boolean,
+    ): DeviceTrustLevel {
        return new DeviceTrustLevel(
-            userTrustLevel._crossSigningVerified,
-            userTrustLevel._tofu,
+            userTrustLevel.isCrossSigningVerified(),
+            userTrustLevel.isTofu(),
            localVerified,
            trustCrossSignedDevices,
        );
    }

    /**
-     * @returns {bool} true if this device is verified via any means
+     * @returns {boolean} true if this device is verified via any means
     */
-    isVerified() {
+    public isVerified(): boolean {
        return Boolean(this.isLocallyVerified() || (
-            this._trustCrossSignedDevices && this.isCrossSigningVerified()
+            this.trustCrossSignedDevices && this.isCrossSigningVerified()
        ));
    }

    /**
-     * @returns {bool} true if this device is verified via cross signing
+     * @returns {boolean} true if this device is verified via cross signing
     */
-    isCrossSigningVerified() {
-        return this._crossSigningVerified;
+    public isCrossSigningVerified(): boolean {
+        return this.crossSigningVerified;
    }

    /**
-     * @returns {bool} true if this device is verified locally
+     * @returns {boolean} true if this device is verified locally
     */
-    isLocallyVerified() {
-        return this._localVerified;
+    public isLocallyVerified(): boolean {
+        return this.localVerified;
    }

    /**
-     * @returns {bool} true if this device is trusted from a user's key
+     * @returns {boolean} true if this device is trusted from a user's key
     * that is trusted on first use
     */
-    isTofu() {
-        return this._tofu;
+    public isTofu(): boolean {
+        return this.tofu;
    }
 }

-export function createCryptoStoreCacheCallbacks(store, olmdevice) {
+export function createCryptoStoreCacheCallbacks(store: CryptoStore, olmDevice: OlmDevice): ICacheCallbacks {
    return {
-        getCrossSigningKeyCache: async function(type, _expectedPublicKey) {
-            const key = await new Promise((resolve) => {
+        getCrossSigningKeyCache: async function(type: string, _expectedPublicKey: string): Promise<Uint8Array> {
+            const key = await new Promise<any>((resolve) => {
                return store.doTxn(
                    'readonly',
                    [IndexedDBCryptoStore.STORE_ACCOUNT],
@@ -696,32 +711,34 @@ export function createCryptoStoreCacheCallbacks(store, olmdevice) {
            });

            if (key && key.ciphertext) {
-                const pickleKey = Buffer.from(olmdevice._pickleKey);
+                const pickleKey = Buffer.from(olmDevice.pickleKey);
                const decrypted = await decryptAES(key, pickleKey, type);
                return decodeBase64(decrypted);
            } else {
                return key;
            }
        },
-        storeCrossSigningKeyCache: async function(type, key) {
+        storeCrossSigningKeyCache: async function(type: string, key: Uint8Array): Promise<void> {
            if (!(key instanceof Uint8Array)) {
                throw new Error(
                    `storeCrossSigningKeyCache expects Uint8Array, got ${key}`,
                );
            }
-            const pickleKey = Buffer.from(olmdevice._pickleKey);
-            key = await encryptAES(encodeBase64(key), pickleKey, type);
+            const pickleKey = Buffer.from(olmDevice.pickleKey);
+            const encryptedKey = await encryptAES(encodeBase64(key), pickleKey, type);
            return store.doTxn(
                'readwrite',
                [IndexedDBCryptoStore.STORE_ACCOUNT],
                (txn) => {
-                    store.storeSecretStorePrivateKey(txn, type, key);
+                    store.storeSecretStorePrivateKey(txn, type, encryptedKey);
                },
            );
        },
    };
 }

+export type KeysDuringVerification = [[string, PkSigning], [string, PkSigning], [string, PkSigning], void];
+
 /**
 * Request cross-signing keys from another device during verification.
 *
@@ -729,17 +746,21 @@ export function createCryptoStoreCacheCallbacks(store, olmdevice) {
 * @param {string} userId The user ID being verified
 * @param {string} deviceId The device ID being verified
 */
-export async function requestKeysDuringVerification(baseApis, userId, deviceId) {
+export function requestKeysDuringVerification(
+    baseApis: MatrixClient,
+    userId: string,
+    deviceId: string,
+): Promise<KeysDuringVerification | void> {
    // If this is a self-verification, ask the other party for keys
    if (baseApis.getUserId() !== userId) {
        return;
    }
    logger.log("Cross-signing: Self-verification done; requesting keys");
    // This happens asynchronously, and we're not concerned about waiting for
-    // it.  We return here in order to test.
-    return new Promise((resolve, reject) => {
+    // it. We return here in order to test.
+    return new Promise<KeysDuringVerification | void>((resolve, reject) => {
        const client = baseApis;
-        const original = client.crypto._crossSigningInfo;
+        const original = client.crypto.crossSigningInfo;

        // We already have all of the infrastructure we need to validate and
        // cache cross-signing keys, so instead of replicating that, here we set
@@ -748,8 +769,7 @@ export async function requestKeysDuringVerification(baseApis, userId, deviceId)
        const crossSigning = new CrossSigningInfo(
            original.userId,
            { getCrossSigningKey: async (type) => {
-                logger.debug("Cross-signing: requesting secret",
-                                type, deviceId);
+                logger.debug("Cross-signing: requesting secret", type, deviceId);
                const { promise } = client.requestSecret(
                    `m.cross_signing.${type}`, [deviceId],
                );
@@ -757,7 +777,7 @@ export async function requestKeysDuringVerification(baseApis, userId, deviceId)
                const decoded = decodeBase64(result);
                return Uint8Array.from(decoded);
            } },
-            original._cacheCallbacks,
+            original.getCacheCallbacks(),
        );
        crossSigning.keys = original.keys;

@@ -765,7 +785,7 @@ export async function requestKeysDuringVerification(baseApis, userId, deviceId)
        // https://github.com/vector-im/element-web/issues/12604
        // then change here to reject on the timeout
        // Requests can be ignored, so don't wait around forever
-        const timeout = new Promise((resolve, reject) => {
+        const timeout = new Promise<void>((resolve) => {
            setTimeout(
                resolve,
                KEY_REQUEST_TIMEOUT_MS,
@@ -774,7 +794,7 @@ export async function requestKeysDuringVerification(baseApis, userId, deviceId)
        });

        // also request and cache the key backup key
-        const backupKeyPromise = new Promise(async resolve => {
+        const backupKeyPromise = (async () => {
            const cachedKey = await client.crypto.getSessionBackupPrivateKey();
            if (!cachedKey) {
                logger.info("No cached backup key found. Requesting...");
@@ -785,29 +805,26 @@ export async function requestKeysDuringVerification(baseApis, userId, deviceId)
                logger.info("Got key backup key, decoding...");
                const decodedKey = decodeBase64(base64Key);
                logger.info("Decoded backup key, storing...");
-                client.crypto.storeSessionBackupPrivateKey(
+                await client.crypto.storeSessionBackupPrivateKey(
                    Uint8Array.from(decodedKey),
                );
                logger.info("Backup key stored. Starting backup restore...");
                const backupInfo = await client.getKeyBackupVersion();
                // no need to await for this - just let it go in the bg
-                client.restoreKeyBackupWithCache(
-                    undefined, undefined, backupInfo,
-                ).then(() => {
+                client.restoreKeyBackupWithCache(undefined, undefined, backupInfo).then(() => {
                    logger.info("Backup restored.");
                });
            }
-            resolve();
-        });
+        })();

        // We call getCrossSigningKey() for its side-effects
-        return Promise.race([
+        return Promise.race<KeysDuringVerification | void>([
            Promise.all([
                crossSigning.getCrossSigningKey("master"),
                crossSigning.getCrossSigningKey("self_signing"),
                crossSigning.getCrossSigningKey("user_signing"),
                backupKeyPromise,
-            ]),
+            ]) as Promise<KeysDuringVerification>,
            timeout,
        ]).then(resolve, reject);
    }).catch((e) => {
@@ -1,11 +1,43 @@
+/*
+Copyright 2021 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
 import { logger } from "../logger";
 import { MatrixEvent } from "../models/event";
-import { EventEmitter } from "events";
-import { createCryptoStoreCacheCallbacks } from "./CrossSigning";
+import { createCryptoStoreCacheCallbacks, ICacheCallbacks } from "./CrossSigning";
 import { IndexedDBCryptoStore } from './store/indexeddb-crypto-store';
+import { Method, PREFIX_UNSTABLE } from "../http-api";
+import { Crypto, IBootstrapCrossSigningOpts } from "./index";
 import {
-    PREFIX_UNSTABLE,
-} from "../http-api";
+    ClientEvent,
+    CrossSigningKeys,
+    ClientEventHandlerMap,
+    ICrossSigningKey,
+    ICryptoCallbacks,
+    ISignedKey,
+    KeySignatures,
+} from "../matrix";
+import { ISecretStorageKeyInfo } from "./api";
+import { IKeyBackupInfo } from "./keybackup";
+import { TypedEventEmitter } from "../models/typed-event-emitter";
+import { IAccountDataClient } from "./SecretStorage";
+
+interface ICrossSigningKeys {
+    authUpload: IBootstrapCrossSigningOpts["authUploadDeviceSigningKeys"];
+    keys: Record<string, ICrossSigningKey>;
+}

 /**
 * Builds an EncryptionSetupOperation by calling any of the add.. methods.
@@ -17,18 +49,23 @@ import {
 * more than once.
 */
 export class EncryptionSetupBuilder {
+    public readonly accountDataClientAdapter: AccountDataClientAdapter;
+    public readonly crossSigningCallbacks: CrossSigningCallbacks;
+    public readonly ssssCryptoCallbacks: SSSSCryptoCallbacks;
+
+    private crossSigningKeys: ICrossSigningKeys = null;
+    private keySignatures: KeySignatures = null;
+    private keyBackupInfo: IKeyBackupInfo = null;
+    private sessionBackupPrivateKey: Uint8Array;
+
    /**
     * @param {Object.<String, MatrixEvent>} accountData pre-existing account data, will only be read, not written.
     * @param {CryptoCallbacks} delegateCryptoCallbacks crypto callbacks to delegate to if the key isn't in cache yet
     */
-    constructor(accountData, delegateCryptoCallbacks) {
+    constructor(accountData: Record<string, MatrixEvent>, delegateCryptoCallbacks?: ICryptoCallbacks) {
        this.accountDataClientAdapter = new AccountDataClientAdapter(accountData);
        this.crossSigningCallbacks = new CrossSigningCallbacks();
        this.ssssCryptoCallbacks = new SSSSCryptoCallbacks(delegateCryptoCallbacks);
-
-        this._crossSigningKeys = null;
-        this._keySignatures = null;
-        this._keyBackupInfo = null;
    }

    /**
@@ -42,8 +79,8 @@ export class EncryptionSetupBuilder {
     *     an empty authDict, to obtain the flows.
     * @param {Object} keys the new keys
     */
-    addCrossSigningKeys(authUpload, keys) {
-        this._crossSigningKeys = { authUpload, keys };
+    public addCrossSigningKeys(authUpload: ICrossSigningKeys["authUpload"], keys: ICrossSigningKeys["keys"]): void {
+        this.crossSigningKeys = { authUpload, keys };
    }

    /**
@@ -54,8 +91,8 @@ export class EncryptionSetupBuilder {
     *
     * @param {Object} keyBackupInfo as received from/sent to the server
     */
-    addSessionBackup(keyBackupInfo) {
-        this._keyBackupInfo = keyBackupInfo;
+    public addSessionBackup(keyBackupInfo: IKeyBackupInfo): void {
+        this.keyBackupInfo = keyBackupInfo;
    }

    /**
@@ -65,8 +102,8 @@ export class EncryptionSetupBuilder {
     *
     * @param {Uint8Array} privateKey
     */
-    addSessionBackupPrivateKeyToCache(privateKey) {
-        this._sessionBackupPrivateKey = privateKey;
+    public addSessionBackupPrivateKeyToCache(privateKey: Uint8Array): void {
+        this.sessionBackupPrivateKey = privateKey;
    }

    /**
@@ -75,14 +112,14 @@ export class EncryptionSetupBuilder {
     *
     * @param {String} userId
     * @param {String} deviceId
-     * @param {String} signature
+     * @param {Object} signature
     */
-    addKeySignature(userId, deviceId, signature) {
-        if (!this._keySignatures) {
-            this._keySignatures = {};
+    public addKeySignature(userId: string, deviceId: string, signature: ISignedKey): void {
+        if (!this.keySignatures) {
+            this.keySignatures = {};
        }
-        const userSignatures = this._keySignatures[userId] || {};
-        this._keySignatures[userId] = userSignatures;
+        const userSignatures = this.keySignatures[userId] || {};
+        this.keySignatures[userId] = userSignatures;
        userSignatures[deviceId] = signature;
    }

@@ -91,21 +128,21 @@ export class EncryptionSetupBuilder {
     * @param {Object} content
     * @return {Promise}
     */
-    setAccountData(type, content) {
-        return this.accountDataClientAdapter.setAccountData(type, content);
+    public async setAccountData(type: string, content: object): Promise<void> {
+        await this.accountDataClientAdapter.setAccountData(type, content);
    }

    /**
     * builds the operation containing all the parts that have been added to the builder
     * @return {EncryptionSetupOperation}
     */
-    buildOperation() {
-        const accountData = this.accountDataClientAdapter._values;
+    public buildOperation(): EncryptionSetupOperation {
+        const accountData = this.accountDataClientAdapter.values;
        return new EncryptionSetupOperation(
            accountData,
-            this._crossSigningKeys,
-            this._keyBackupInfo,
-            this._keySignatures,
+            this.crossSigningKeys,
+            this.keyBackupInfo,
+            this.keySignatures,
        );
    }

@@ -118,28 +155,27 @@ export class EncryptionSetupBuilder {
     * @param  {Crypto} crypto
     * @return {Promise}
     */
-    async persist(crypto) {
+    public async persist(crypto: Crypto): Promise<void> {
        // store private keys in cache
-        if (this._crossSigningKeys) {
-            const cacheCallbacks = createCryptoStoreCacheCallbacks(
-                crypto._cryptoStore, crypto._olmDevice);
+        if (this.crossSigningKeys) {
+            const cacheCallbacks = createCryptoStoreCacheCallbacks(crypto.cryptoStore, crypto.olmDevice);
            for (const type of ["master", "self_signing", "user_signing"]) {
                logger.log(`Cache ${type} cross-signing private key locally`);
                const privateKey = this.crossSigningCallbacks.privateKeys.get(type);
                await cacheCallbacks.storeCrossSigningKeyCache(type, privateKey);
            }
            // store own cross-sign pubkeys as trusted
-            await crypto._cryptoStore.doTxn(
+            await crypto.cryptoStore.doTxn(
                'readwrite', [IndexedDBCryptoStore.STORE_ACCOUNT],
                (txn) => {
-                    crypto._cryptoStore.storeCrossSigningKeys(
-                        txn, this._crossSigningKeys.keys);
+                    crypto.cryptoStore.storeCrossSigningKeys(
+                        txn, this.crossSigningKeys.keys);
                },
            );
        }
        // store session backup key in cache
-        if (this._sessionBackupPrivateKey) {
-            await crypto.storeSessionBackupPrivateKey(this._sessionBackupPrivateKey);
+        if (this.sessionBackupPrivateKey) {
+            await crypto.storeSessionBackupPrivateKey(this.sessionBackupPrivateKey);
        }
    }
 }
@@ -157,66 +193,66 @@ export class EncryptionSetupOperation {
     * @param  {Object} keyBackupInfo
     * @param  {Object} keySignatures
     */
-    constructor(accountData, crossSigningKeys, keyBackupInfo, keySignatures) {
-        this._accountData = accountData;
-        this._crossSigningKeys = crossSigningKeys;
-        this._keyBackupInfo = keyBackupInfo;
-        this._keySignatures = keySignatures;
-    }
+    constructor(
+        private readonly accountData: Map<string, object>,
+        private readonly crossSigningKeys: ICrossSigningKeys,
+        private readonly keyBackupInfo: IKeyBackupInfo,
+        private readonly keySignatures: KeySignatures,
+    ) {}

    /**
     * Runs the (remaining part of, in the future) operation by sending requests to the server.
-     * @param  {Crypto} crypto
+     * @param {Crypto} crypto
     */
-    async apply(crypto) {
-        const baseApis = crypto._baseApis;
+    public async apply(crypto: Crypto): Promise<void> {
+        const baseApis = crypto.baseApis;
        // upload cross-signing keys
-        if (this._crossSigningKeys) {
-            const keys = {};
-            for (const [name, key] of Object.entries(this._crossSigningKeys.keys)) {
+        if (this.crossSigningKeys) {
+            const keys: Partial<CrossSigningKeys> = {};
+            for (const [name, key] of Object.entries(this.crossSigningKeys.keys)) {
                keys[name + "_key"] = key;
            }

            // We must only call `uploadDeviceSigningKeys` from inside this auth
            // helper to ensure we properly handle auth errors.
-            await this._crossSigningKeys.authUpload(authDict => {
-                return baseApis.uploadDeviceSigningKeys(authDict, keys);
+            await this.crossSigningKeys.authUpload(authDict => {
+                return baseApis.uploadDeviceSigningKeys(authDict, keys as CrossSigningKeys);
            });

            // pass the new keys to the main instance of our own CrossSigningInfo.
-            crypto._crossSigningInfo.setKeys(this._crossSigningKeys.keys);
+            crypto.crossSigningInfo.setKeys(this.crossSigningKeys.keys);
        }
        // set account data
-        if (this._accountData) {
-            for (const [type, content] of this._accountData) {
+        if (this.accountData) {
+            for (const [type, content] of this.accountData) {
                await baseApis.setAccountData(type, content);
            }
        }
        // upload first cross-signing signatures with the new key
        // (e.g. signing our own device)
-        if (this._keySignatures) {
-            await baseApis.uploadKeySignatures(this._keySignatures);
+        if (this.keySignatures) {
+            await baseApis.uploadKeySignatures(this.keySignatures);
        }
        // need to create/update key backup info
-        if (this._keyBackupInfo) {
-            if (this._keyBackupInfo.version) {
+        if (this.keyBackupInfo) {
+            if (this.keyBackupInfo.version) {
                // session backup signature
                // The backup is trusted because the user provided the private key.
                // Sign the backup with the cross signing key so the key backup can
                // be trusted via cross-signing.
                await baseApis.http.authedRequest(
-                    undefined, "PUT", "/room_keys/version/" + this._keyBackupInfo.version,
+                    undefined, Method.Put, "/room_keys/version/" + this.keyBackupInfo.version,
                    undefined, {
-                        algorithm: this._keyBackupInfo.algorithm,
-                        auth_data: this._keyBackupInfo.auth_data,
+                        algorithm: this.keyBackupInfo.algorithm,
+                        auth_data: this.keyBackupInfo.auth_data,
                    },
                    { prefix: PREFIX_UNSTABLE },
                );
            } else {
                // add new key backup
                await baseApis.http.authedRequest(
-                    undefined, "POST", "/room_keys/version",
-                    undefined, this._keyBackupInfo,
+                    undefined, Method.Post, "/room_keys/version",
+                    undefined, this.keyBackupInfo,
                    { prefix: PREFIX_UNSTABLE },
                );
            }
@@ -228,21 +264,24 @@ export class EncryptionSetupOperation {
 * Catches account data set by SecretStorage during bootstrapping by
 * implementing the methods related to account data in MatrixClient
 */
-class AccountDataClientAdapter extends EventEmitter {
+class AccountDataClientAdapter
+    extends TypedEventEmitter<ClientEvent.AccountData, ClientEventHandlerMap>
+    implements IAccountDataClient {
+    //
+    public readonly values = new Map<string, MatrixEvent>();
+
    /**
-     * @param  {Object.<String, MatrixEvent>} accountData existing account data
+     * @param  {Object.<String, MatrixEvent>} existingValues existing account data
     */
-    constructor(accountData) {
+    constructor(private readonly existingValues: Record<string, MatrixEvent>) {
        super();
-        this._existingValues = accountData;
-        this._values = new Map();
    }

    /**
     * @param  {String} type
     * @return {Promise<Object>} the content of the account data
     */
-    getAccountDataFromServer(type) {
+    public getAccountDataFromServer(type: string): Promise<any> {
        return Promise.resolve(this.getAccountData(type));
    }

@@ -250,12 +289,12 @@ class AccountDataClientAdapter extends EventEmitter {
     * @param  {String} type
     * @return {Object} the content of the account data
     */
-    getAccountData(type) {
-        const modifiedValue = this._values.get(type);
+    public getAccountData(type: string): MatrixEvent {
+        const modifiedValue = this.values.get(type);
        if (modifiedValue) {
            return modifiedValue;
        }
-        const existingValue = this._existingValues[type];
+        const existingValue = this.existingValues[type];
        if (existingValue) {
            return existingValue.getContent();
        }
@@ -267,15 +306,16 @@ class AccountDataClientAdapter extends EventEmitter {
     * @param {Object} content
     * @return {Promise}
     */
-    setAccountData(type, content) {
-        const lastEvent = this._values.get(type);
-        this._values.set(type, content);
+    public setAccountData(type: string, content: any): Promise<{}> {
+        const lastEvent = this.values.get(type);
+        this.values.set(type, content);
        // ensure accountData is emitted on the next tick,
        // as SecretStorage listens for it while calling this method
        // and it seems to rely on this.
        return Promise.resolve().then(() => {
            const event = new MatrixEvent({ type, content });
-            this.emit("accountData", event, lastEvent);
+            this.emit(ClientEvent.AccountData, event, lastEvent);
+            return {};
        });
    }
 }
@@ -285,27 +325,25 @@ class AccountDataClientAdapter extends EventEmitter {
 * by both cache callbacks (see createCryptoStoreCacheCallbacks) as non-cache callbacks.
 * See CrossSigningInfo constructor
 */
-class CrossSigningCallbacks {
-    constructor() {
-        this.privateKeys = new Map();
-    }
+class CrossSigningCallbacks implements ICryptoCallbacks, ICacheCallbacks {
+    public readonly privateKeys = new Map<string, Uint8Array>();

    // cache callbacks
-    getCrossSigningKeyCache(type, expectedPublicKey) {
+    public getCrossSigningKeyCache(type: string, expectedPublicKey: string): Promise<Uint8Array> {
        return this.getCrossSigningKey(type, expectedPublicKey);
    }

-    storeCrossSigningKeyCache(type, key) {
+    public storeCrossSigningKeyCache(type: string, key: Uint8Array): Promise<void> {
        this.privateKeys.set(type, key);
        return Promise.resolve();
    }

    // non-cache callbacks
-    getCrossSigningKey(type, _expectedPubkey) {
+    public getCrossSigningKey(type: string, expectedPubkey: string): Promise<Uint8Array> {
        return Promise.resolve(this.privateKeys.get(type));
    }

-    saveCrossSigningKeys(privateKeys) {
+    public saveCrossSigningKeys(privateKeys: Record<string, Uint8Array>) {
        for (const [type, privateKey] of Object.entries(privateKeys)) {
            this.privateKeys.set(type, privateKey);
        }
@@ -317,39 +355,37 @@ class CrossSigningCallbacks {
 * the SecretStorage crypto callbacks
 */
 class SSSSCryptoCallbacks {
-    constructor(delegateCryptoCallbacks) {
-        this._privateKeys = new Map();
-        this._delegateCryptoCallbacks = delegateCryptoCallbacks;
-    }
+    private readonly privateKeys = new Map<string, Uint8Array>();

-    async getSecretStorageKey({ keys }, name) {
+    constructor(private readonly delegateCryptoCallbacks?: ICryptoCallbacks) {}
+
+    public async getSecretStorageKey(
+        { keys }: { keys: Record<string, ISecretStorageKeyInfo> },
+        name: string,
+    ): Promise<[string, Uint8Array]|null> {
        for (const keyId of Object.keys(keys)) {
-            const privateKey = this._privateKeys.get(keyId);
+            const privateKey = this.privateKeys.get(keyId);
            if (privateKey) {
                return [keyId, privateKey];
            }
        }
        // if we don't have the key cached yet, ask
        // for it to the general crypto callbacks and cache it
-        if (this._delegateCryptoCallbacks) {
-            const result = await this._delegateCryptoCallbacks.
+        if (this?.delegateCryptoCallbacks?.getSecretStorageKey) {
+            const result = await this.delegateCryptoCallbacks.
                getSecretStorageKey({ keys }, name);
            if (result) {
                const [keyId, privateKey] = result;
-                this._privateKeys.set(keyId, privateKey);
+                this.privateKeys.set(keyId, privateKey);
            }
            return result;
        }
+        return null;
    }

-    addPrivateKey(keyId, keyInfo, privKey) {
-        this._privateKeys.set(keyId, privKey);
+    public addPrivateKey(keyId: string, keyInfo: ISecretStorageKeyInfo, privKey: Uint8Array): void {
+        this.privateKeys.set(keyId, privKey);
        // Also pass along to application to cache if it wishes
-        if (
-            this._delegateCryptoCallbacks &&
-            this._delegateCryptoCallbacks.cacheSecretStorageKey
-        ) {
-            this._delegateCryptoCallbacks.cacheSecretStorageKey(keyId, keyInfo, privKey);
-        }
+        this.delegateCryptoCallbacks?.cacheSecretStorageKey?.(keyId, keyInfo, privKey);
    }
 }
@@ -1,5 +1,5 @@
 /*
-Copyright 2017 Vector Creations Ltd
+Copyright 2017 - 2021 The Matrix.org Foundation C.I.C.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -15,6 +15,10 @@ limitations under the License.
 */

 import { logger } from '../logger';
+import { MatrixClient } from "../client";
+import { IRoomKeyRequestBody, IRoomKeyRequestRecipient } from "./index";
+import { CryptoStore, OutgoingRoomKeyRequest } from './store/base';
+import { EventType } from "../@types/event";

 /**
 * Internal module. Management of outgoing room key requests.
@@ -57,61 +61,58 @@ const SEND_KEY_REQUESTS_DELAY_MS = 500;
 *
 * @enum {number}
 */
-export const ROOM_KEY_REQUEST_STATES = {
+export enum RoomKeyRequestState {
    /** request not yet sent */
-    UNSENT: 0,
-
+    Unsent,
    /** request sent, awaiting reply */
-    SENT: 1,
-
+    Sent,
    /** reply received, cancellation not yet sent */
-    CANCELLATION_PENDING: 2,
-
+    CancellationPending,
    /**
     * Cancellation not yet sent and will transition to UNSENT instead of
     * being deleted once the cancellation has been sent.
     */
-    CANCELLATION_PENDING_AND_WILL_RESEND: 3,
-};
+    CancellationPendingAndWillResend,
+}

 export class OutgoingRoomKeyRequestManager {
-    constructor(baseApis, deviceId, cryptoStore) {
-        this._baseApis = baseApis;
-        this._deviceId = deviceId;
-        this._cryptoStore = cryptoStore;
+    // handle for the delayed call to sendOutgoingRoomKeyRequests. Non-null
+    // if the callback has been set, or if it is still running.
+    private sendOutgoingRoomKeyRequestsTimer: number = null;

-        // handle for the delayed call to _sendOutgoingRoomKeyRequests. Non-null
-        // if the callback has been set, or if it is still running.
-        this._sendOutgoingRoomKeyRequestsTimer = null;
+    // sanity check to ensure that we don't end up with two concurrent runs
+    // of sendOutgoingRoomKeyRequests
+    private sendOutgoingRoomKeyRequestsRunning = false;

-        // sanity check to ensure that we don't end up with two concurrent runs
-        // of _sendOutgoingRoomKeyRequests
-        this._sendOutgoingRoomKeyRequestsRunning = false;
+    private clientRunning = false;

-        this._clientRunning = false;
-    }
+    constructor(
+        private readonly baseApis: MatrixClient,
+        private readonly deviceId: string,
+        private readonly cryptoStore: CryptoStore,
+    ) {}

    /**
     * Called when the client is started. Sets background processes running.
     */
-    start() {
-        this._clientRunning = true;
+    public start(): void {
+        this.clientRunning = true;
    }

    /**
     * Called when the client is stopped. Stops any running background processes.
     */
-    stop() {
+    public stop(): void {
        logger.log('stopping OutgoingRoomKeyRequestManager');
        // stop the timer on the next run
-        this._clientRunning = false;
+        this.clientRunning = false;
    }

    /**
     * Send any requests that have been queued
     */
-    sendQueuedRequests() {
-        this._startTimer();
+    public sendQueuedRequests(): void {
+        this.startTimer();
    }

    /**
@@ -131,95 +132,97 @@ export class OutgoingRoomKeyRequestManager {
     *    pending list (or we have established that a similar request already
     *    exists)
     */
-    async queueRoomKeyRequest(requestBody, recipients, resend=false) {
-        const req = await this._cryptoStore.getOutgoingRoomKeyRequest(
-            requestBody,
-        );
+    public async queueRoomKeyRequest(
+        requestBody: IRoomKeyRequestBody,
+        recipients: IRoomKeyRequestRecipient[],
+        resend = false,
+    ): Promise<void> {
+        const req = await this.cryptoStore.getOutgoingRoomKeyRequest(requestBody);
        if (!req) {
-            await this._cryptoStore.getOrAddOutgoingRoomKeyRequest({
+            await this.cryptoStore.getOrAddOutgoingRoomKeyRequest({
                requestBody: requestBody,
                recipients: recipients,
-                requestId: this._baseApis.makeTxnId(),
-                state: ROOM_KEY_REQUEST_STATES.UNSENT,
+                requestId: this.baseApis.makeTxnId(),
+                state: RoomKeyRequestState.Unsent,
            });
        } else {
            switch (req.state) {
-            case ROOM_KEY_REQUEST_STATES.CANCELLATION_PENDING_AND_WILL_RESEND:
-            case ROOM_KEY_REQUEST_STATES.UNSENT:
-                // nothing to do here, since we're going to send a request anyways
-                return;
+                case RoomKeyRequestState.CancellationPendingAndWillResend:
+                case RoomKeyRequestState.Unsent:
+                    // nothing to do here, since we're going to send a request anyways
+                    return;

-            case ROOM_KEY_REQUEST_STATES.CANCELLATION_PENDING: {
-                // existing request is about to be cancelled.  If we want to
-                // resend, then change the state so that it resends after
-                // cancelling.  Otherwise, just cancel the cancellation.
-                const state = resend ?
-                    ROOM_KEY_REQUEST_STATES.CANCELLATION_PENDING_AND_WILL_RESEND :
-                    ROOM_KEY_REQUEST_STATES.SENT;
-                await this._cryptoStore.updateOutgoingRoomKeyRequest(
-                    req.requestId, ROOM_KEY_REQUEST_STATES.CANCELLATION_PENDING, {
-                        state,
-                        cancellationTxnId: this._baseApis.makeTxnId(),
-                    },
-                );
-                break;
-            }
-            case ROOM_KEY_REQUEST_STATES.SENT: {
-                // a request has already been sent.  If we don't want to
-                // resend, then do nothing.  If we do want to, then cancel the
-                // existing request and send a new one.
-                if (resend) {
-                    const state =
-                          ROOM_KEY_REQUEST_STATES.CANCELLATION_PENDING_AND_WILL_RESEND;
-                    const updatedReq =
-                          await this._cryptoStore.updateOutgoingRoomKeyRequest(
-                              req.requestId, ROOM_KEY_REQUEST_STATES.SENT, {
-                                  state,
-                                  cancellationTxnId: this._baseApis.makeTxnId(),
-                                  // need to use a new transaction ID so that
-                                  // the request gets sent
-                                  requestTxnId: this._baseApis.makeTxnId(),
-                              },
-                          );
-                    if (!updatedReq) {
-                        // updateOutgoingRoomKeyRequest couldn't find the request
-                        // in state ROOM_KEY_REQUEST_STATES.SENT, so we must have
-                        // raced with another tab to mark the request cancelled.
-                        // Try again, to make sure the request is resent.
-                        return await this.queueRoomKeyRequest(
-                            requestBody, recipients, resend,
-                        );
-                    }
-
-                    // We don't want to wait for the timer, so we send it
-                    // immediately. (We might actually end up racing with the timer,
-                    // but that's ok: even if we make the request twice, we'll do it
-                    // with the same transaction_id, so only one message will get
-                    // sent).
-                    //
-                    // (We also don't want to wait for the response from the server
-                    // here, as it will slow down processing of received keys if we
-                    // do.)
-                    try {
-                        await this._sendOutgoingRoomKeyRequestCancellation(
-                            updatedReq,
-                            true,
-                        );
-                    } catch (e) {
-                        logger.error(
-                            "Error sending room key request cancellation;"
-                                + " will retry later.", e,
-                        );
-                    }
-                    // The request has transitioned from
-                    // CANCELLATION_PENDING_AND_WILL_RESEND to UNSENT. We
-                    // still need to resend the request which is now UNSENT, so
-                    // start the timer if it isn't already started.
+                case RoomKeyRequestState.CancellationPending: {
+                    // existing request is about to be cancelled.  If we want to
+                    // resend, then change the state so that it resends after
+                    // cancelling.  Otherwise, just cancel the cancellation.
+                    const state = resend ?
+                        RoomKeyRequestState.CancellationPendingAndWillResend :
+                        RoomKeyRequestState.Sent;
+                    await this.cryptoStore.updateOutgoingRoomKeyRequest(
+                        req.requestId, RoomKeyRequestState.CancellationPending, {
+                            state,
+                            cancellationTxnId: this.baseApis.makeTxnId(),
+                        },
+                    );
+                    break;
                }
-                break;
-            }
-            default:
-                throw new Error('unhandled state: ' + req.state);
+                case RoomKeyRequestState.Sent: {
+                    // a request has already been sent.  If we don't want to
+                    // resend, then do nothing.  If we do want to, then cancel the
+                    // existing request and send a new one.
+                    if (resend) {
+                        const state =
+                              RoomKeyRequestState.CancellationPendingAndWillResend;
+                        const updatedReq =
+                              await this.cryptoStore.updateOutgoingRoomKeyRequest(
+                                  req.requestId, RoomKeyRequestState.Sent, {
+                                      state,
+                                      cancellationTxnId: this.baseApis.makeTxnId(),
+                                      // need to use a new transaction ID so that
+                                      // the request gets sent
+                                      requestTxnId: this.baseApis.makeTxnId(),
+                                  },
+                              );
+                        if (!updatedReq) {
+                            // updateOutgoingRoomKeyRequest couldn't find the request
+                            // in state ROOM_KEY_REQUEST_STATES.SENT, so we must have
+                            // raced with another tab to mark the request cancelled.
+                            // Try again, to make sure the request is resent.
+                            return await this.queueRoomKeyRequest(
+                                requestBody, recipients, resend,
+                            );
+                        }
+
+                        // We don't want to wait for the timer, so we send it
+                        // immediately. (We might actually end up racing with the timer,
+                        // but that's ok: even if we make the request twice, we'll do it
+                        // with the same transaction_id, so only one message will get
+                        // sent).
+                        //
+                        // (We also don't want to wait for the response from the server
+                        // here, as it will slow down processing of received keys if we
+                        // do.)
+                        try {
+                            await this.sendOutgoingRoomKeyRequestCancellation(
+                                updatedReq,
+                                true,
+                            );
+                        } catch (e) {
+                            logger.error(
+                                "Error sending room key request cancellation;"
+                                    + " will retry later.", e,
+                            );
+                        }
+                        // The request has transitioned from
+                        // CANCELLATION_PENDING_AND_WILL_RESEND to UNSENT. We
+                        // still need to resend the request which is now UNSENT, so
+                        // start the timer if it isn't already started.
+                    }
+                    break;
+                }
+                default:
+                    throw new Error('unhandled state: ' + req.state);
            }
        }
    }
@@ -232,21 +235,21 @@ export class OutgoingRoomKeyRequestManager {
     * @returns {Promise} resolves when the request has been updated in our
     *    pending list.
     */
-    cancelRoomKeyRequest(requestBody) {
-        return this._cryptoStore.getOutgoingRoomKeyRequest(
+    public cancelRoomKeyRequest(requestBody: IRoomKeyRequestBody): Promise<unknown> {
+        return this.cryptoStore.getOutgoingRoomKeyRequest(
            requestBody,
-        ).then((req) => {
+        ).then((req): unknown => {
            if (!req) {
                // no request was made for this key
                return;
            }
            switch (req.state) {
-                case ROOM_KEY_REQUEST_STATES.CANCELLATION_PENDING:
-                case ROOM_KEY_REQUEST_STATES.CANCELLATION_PENDING_AND_WILL_RESEND:
+                case RoomKeyRequestState.CancellationPending:
+                case RoomKeyRequestState.CancellationPendingAndWillResend:
                    // nothing to do here
                    return;

-                case ROOM_KEY_REQUEST_STATES.UNSENT:
+                case RoomKeyRequestState.Unsent:
                    // just delete it

                    // FIXME: ghahah we may have attempted to send it, and
@@ -258,16 +261,14 @@ export class OutgoingRoomKeyRequestManager {
                        'deleting unnecessary room key request for ' +
                        stringifyRequestBody(requestBody),
                    );
-                    return this._cryptoStore.deleteOutgoingRoomKeyRequest(
-                        req.requestId, ROOM_KEY_REQUEST_STATES.UNSENT,
-                    );
+                    return this.cryptoStore.deleteOutgoingRoomKeyRequest(req.requestId, RoomKeyRequestState.Unsent);

-                case ROOM_KEY_REQUEST_STATES.SENT: {
+                case RoomKeyRequestState.Sent: {
                    // send a cancellation.
-                    return this._cryptoStore.updateOutgoingRoomKeyRequest(
-                        req.requestId, ROOM_KEY_REQUEST_STATES.SENT, {
-                            state: ROOM_KEY_REQUEST_STATES.CANCELLATION_PENDING,
-                            cancellationTxnId: this._baseApis.makeTxnId(),
+                    return this.cryptoStore.updateOutgoingRoomKeyRequest(
+                        req.requestId, RoomKeyRequestState.Sent, {
+                            state: RoomKeyRequestState.CancellationPending,
+                            cancellationTxnId: this.baseApis.makeTxnId(),
                        },
                    ).then((updatedReq) => {
                        if (!updatedReq) {
@@ -294,14 +295,14 @@ export class OutgoingRoomKeyRequestManager {
                        // (We also don't want to wait for the response from the server
                        // here, as it will slow down processing of received keys if we
                        // do.)
-                        this._sendOutgoingRoomKeyRequestCancellation(
+                        this.sendOutgoingRoomKeyRequestCancellation(
                            updatedReq,
                        ).catch((e) => {
                            logger.error(
                                "Error sending room key request cancellation;"
                                + " will retry later.", e,
                            );
-                            this._startTimer();
+                            this.startTimer();
                        });
                    });
                }
@@ -320,10 +321,8 @@ export class OutgoingRoomKeyRequestManager {
     * @return {Promise} resolves to a list of all the
     *    {@link module:crypto/store/base~OutgoingRoomKeyRequest}
     */
-    getOutgoingSentRoomKeyRequest(userId, deviceId) {
-        return this._cryptoStore.getOutgoingRoomKeyRequestsByTarget(
-            userId, deviceId, [ROOM_KEY_REQUEST_STATES.SENT],
-        );
+    public getOutgoingSentRoomKeyRequest(userId: string, deviceId: string): Promise<OutgoingRoomKeyRequest[]> {
+        return this.cryptoStore.getOutgoingRoomKeyRequestsByTarget(userId, deviceId, [RoomKeyRequestState.Sent]);
    }

    /**
@@ -333,29 +332,27 @@ export class OutgoingRoomKeyRequestManager {
     * For example, after initialization or self-verification.
     * @return {Promise} An array of `queueRoomKeyRequest` outputs.
     */
-    async cancelAndResendAllOutgoingRequests() {
-        const outgoings = await this._cryptoStore.getAllOutgoingRoomKeyRequestsByState(
-            ROOM_KEY_REQUEST_STATES.SENT,
-        );
+    public async cancelAndResendAllOutgoingRequests(): Promise<void[]> {
+        const outgoings = await this.cryptoStore.getAllOutgoingRoomKeyRequestsByState(RoomKeyRequestState.Sent);
        return Promise.all(outgoings.map(({ requestBody, recipients }) =>
            this.queueRoomKeyRequest(requestBody, recipients, true)));
    }

    // start the background timer to send queued requests, if the timer isn't
    // already running
-    _startTimer() {
-        if (this._sendOutgoingRoomKeyRequestsTimer) {
+    private startTimer(): void {
+        if (this.sendOutgoingRoomKeyRequestsTimer) {
            return;
        }

        const startSendingOutgoingRoomKeyRequests = () => {
-            if (this._sendOutgoingRoomKeyRequestsRunning) {
+            if (this.sendOutgoingRoomKeyRequestsRunning) {
                throw new Error("RoomKeyRequestSend already in progress!");
            }
-            this._sendOutgoingRoomKeyRequestsRunning = true;
+            this.sendOutgoingRoomKeyRequestsRunning = true;

-            this._sendOutgoingRoomKeyRequests().finally(() => {
-                this._sendOutgoingRoomKeyRequestsRunning = false;
+            this.sendOutgoingRoomKeyRequests().finally(() => {
+                this.sendOutgoingRoomKeyRequestsRunning = false;
            }).catch((e) => {
                // this should only happen if there is an indexeddb error,
                // in which case we're a bit stuffed anyway.
@@ -365,7 +362,7 @@ export class OutgoingRoomKeyRequestManager {
            });
        };

-        this._sendOutgoingRoomKeyRequestsTimer = global.setTimeout(
+        this.sendOutgoingRoomKeyRequestsTimer = setTimeout(
            startSendingOutgoingRoomKeyRequests,
            SEND_KEY_REQUESTS_DELAY_MS,
        );
@@ -374,47 +371,47 @@ export class OutgoingRoomKeyRequestManager {
    // look for and send any queued requests. Runs itself recursively until
    // there are no more requests, or there is an error (in which case, the
    // timer will be restarted before the promise resolves).
-    _sendOutgoingRoomKeyRequests() {
-        if (!this._clientRunning) {
-            this._sendOutgoingRoomKeyRequestsTimer = null;
+    private sendOutgoingRoomKeyRequests(): Promise<void> {
+        if (!this.clientRunning) {
+            this.sendOutgoingRoomKeyRequestsTimer = null;
            return Promise.resolve();
        }

-        return this._cryptoStore.getOutgoingRoomKeyRequestByState([
-            ROOM_KEY_REQUEST_STATES.CANCELLATION_PENDING,
-            ROOM_KEY_REQUEST_STATES.CANCELLATION_PENDING_AND_WILL_RESEND,
-            ROOM_KEY_REQUEST_STATES.UNSENT,
-        ]).then((req) => {
+        return this.cryptoStore.getOutgoingRoomKeyRequestByState([
+            RoomKeyRequestState.CancellationPending,
+            RoomKeyRequestState.CancellationPendingAndWillResend,
+            RoomKeyRequestState.Unsent,
+        ]).then((req: OutgoingRoomKeyRequest) => {
            if (!req) {
-                this._sendOutgoingRoomKeyRequestsTimer = null;
+                this.sendOutgoingRoomKeyRequestsTimer = null;
                return;
            }

            let prom;
            switch (req.state) {
-                case ROOM_KEY_REQUEST_STATES.UNSENT:
-                    prom = this._sendOutgoingRoomKeyRequest(req);
+                case RoomKeyRequestState.Unsent:
+                    prom = this.sendOutgoingRoomKeyRequest(req);
                    break;
-                case ROOM_KEY_REQUEST_STATES.CANCELLATION_PENDING:
-                    prom = this._sendOutgoingRoomKeyRequestCancellation(req);
+                case RoomKeyRequestState.CancellationPending:
+                    prom = this.sendOutgoingRoomKeyRequestCancellation(req);
                    break;
-                case ROOM_KEY_REQUEST_STATES.CANCELLATION_PENDING_AND_WILL_RESEND:
-                    prom = this._sendOutgoingRoomKeyRequestCancellation(req, true);
+                case RoomKeyRequestState.CancellationPendingAndWillResend:
+                    prom = this.sendOutgoingRoomKeyRequestCancellation(req, true);
                    break;
            }

            return prom.then(() => {
                // go around the loop again
-                return this._sendOutgoingRoomKeyRequests();
+                return this.sendOutgoingRoomKeyRequests();
            }).catch((e) => {
                logger.error("Error sending room key request; will retry later.", e);
-                this._sendOutgoingRoomKeyRequestsTimer = null;
+                this.sendOutgoingRoomKeyRequestsTimer = null;
            });
        });
    }

    // given a RoomKeyRequest, send it and update the request record
-    _sendOutgoingRoomKeyRequest(req) {
+    private sendOutgoingRoomKeyRequest(req: OutgoingRoomKeyRequest): Promise<unknown> {
        logger.log(
            `Requesting keys for ${stringifyRequestBody(req.requestBody)}` +
            ` from ${stringifyRecipientList(req.recipients)}` +
@@ -423,24 +420,24 @@ export class OutgoingRoomKeyRequestManager {

        const requestMessage = {
            action: "request",
-            requesting_device_id: this._deviceId,
+            requesting_device_id: this.deviceId,
            request_id: req.requestId,
            body: req.requestBody,
        };

-        return this._sendMessageToDevices(
+        return this.sendMessageToDevices(
            requestMessage, req.recipients, req.requestTxnId || req.requestId,
        ).then(() => {
-            return this._cryptoStore.updateOutgoingRoomKeyRequest(
-                req.requestId, ROOM_KEY_REQUEST_STATES.UNSENT,
-                { state: ROOM_KEY_REQUEST_STATES.SENT },
+            return this.cryptoStore.updateOutgoingRoomKeyRequest(
+                req.requestId, RoomKeyRequestState.Unsent,
+                { state: RoomKeyRequestState.Sent },
            );
        });
    }

    // Given a RoomKeyRequest, cancel it and delete the request record unless
    // andResend is set, in which case transition to UNSENT.
-    _sendOutgoingRoomKeyRequestCancellation(req, andResend) {
+    private sendOutgoingRoomKeyRequestCancellation(req: OutgoingRoomKeyRequest, andResend = false): Promise<unknown> {
        logger.log(
            `Sending cancellation for key request for ` +
            `${stringifyRequestBody(req.requestBody)} to ` +
@@ -450,30 +447,30 @@ export class OutgoingRoomKeyRequestManager {

        const requestMessage = {
            action: "request_cancellation",
-            requesting_device_id: this._deviceId,
+            requesting_device_id: this.deviceId,
            request_id: req.requestId,
        };

-        return this._sendMessageToDevices(
+        return this.sendMessageToDevices(
            requestMessage, req.recipients, req.cancellationTxnId,
        ).then(() => {
            if (andResend) {
                // We want to resend, so transition to UNSENT
-                return this._cryptoStore.updateOutgoingRoomKeyRequest(
+                return this.cryptoStore.updateOutgoingRoomKeyRequest(
                    req.requestId,
-                    ROOM_KEY_REQUEST_STATES.CANCELLATION_PENDING_AND_WILL_RESEND,
-                    { state: ROOM_KEY_REQUEST_STATES.UNSENT },
+                    RoomKeyRequestState.CancellationPendingAndWillResend,
+                    { state: RoomKeyRequestState.Unsent },
                );
            }
-            return this._cryptoStore.deleteOutgoingRoomKeyRequest(
-                req.requestId, ROOM_KEY_REQUEST_STATES.CANCELLATION_PENDING,
+            return this.cryptoStore.deleteOutgoingRoomKeyRequest(
+                req.requestId, RoomKeyRequestState.CancellationPending,
            );
        });
    }

    // send a RoomKeyRequest to a list of recipients
-    _sendMessageToDevices(message, recipients, txnId) {
-        const contentMap = {};
+    private sendMessageToDevices(message, recipients, txnId: string): Promise<{}> {
+        const contentMap: Record<string, Record<string, Record<string, any>>> = {};
        for (const recip of recipients) {
            if (!contentMap[recip.userId]) {
                contentMap[recip.userId] = {};
@@ -481,9 +478,7 @@ export class OutgoingRoomKeyRequestManager {
            contentMap[recip.userId][recip.deviceId] = message;
        }

-        return this._baseApis.sendToDevice(
-            'm.room_key_request', contentMap, txnId,
-        );
+        return this.baseApis.sendToDevice(EventType.RoomKeyRequest, contentMap, txnId);
    }
 }

@@ -1,5 +1,5 @@
 /*
-Copyright 2018, 2019 New Vector Ltd
+Copyright 2018 - 2021 The Matrix.org Foundation C.I.C.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -20,45 +20,52 @@ limitations under the License.
 * Manages the list of encrypted rooms
 */

+import { CryptoStore } from './store/base';
 import { IndexedDBCryptoStore } from './store/indexeddb-crypto-store';

+/* eslint-disable camelcase */
+export interface IRoomEncryption {
+    algorithm: string;
+    rotation_period_ms?: number;
+    rotation_period_msgs?: number;
+}
+/* eslint-enable camelcase */
+
 /**
 * @alias module:crypto/RoomList
 */
 export class RoomList {
-    constructor(cryptoStore) {
-        this._cryptoStore = cryptoStore;
+    // Object of roomId -> room e2e info object (body of the m.room.encryption event)
+    private roomEncryption: Record<string, IRoomEncryption> = {};

-        // Object of roomId -> room e2e info object (body of the m.room.encryption event)
-        this._roomEncryption = {};
-    }
+    constructor(private readonly cryptoStore: CryptoStore) {}

-    async init() {
-        await this._cryptoStore.doTxn(
+    public async init(): Promise<void> {
+        await this.cryptoStore.doTxn(
            'readwrite', [IndexedDBCryptoStore.STORE_ROOMS], (txn) => {
-                this._cryptoStore.getEndToEndRooms(txn, (result) => {
-                    this._roomEncryption = result;
+                this.cryptoStore.getEndToEndRooms(txn, (result) => {
+                    this.roomEncryption = result;
                });
            },
        );
    }

-    getRoomEncryption(roomId) {
-        return this._roomEncryption[roomId] || null;
+    public getRoomEncryption(roomId: string): IRoomEncryption {
+        return this.roomEncryption[roomId] || null;
    }

-    isRoomEncrypted(roomId) {
+    public isRoomEncrypted(roomId: string): boolean {
        return Boolean(this.getRoomEncryption(roomId));
    }

-    async setRoomEncryption(roomId, roomInfo) {
+    public async setRoomEncryption(roomId: string, roomInfo: IRoomEncryption): Promise<void> {
        // important that this happens before calling into the store
        // as it prevents the Crypto::setRoomEncryption from calling
        // this twice for consecutive m.room.encryption events
-        this._roomEncryption[roomId] = roomInfo;
-        await this._cryptoStore.doTxn(
+        this.roomEncryption[roomId] = roomInfo;
+        await this.cryptoStore.doTxn(
            'readwrite', [IndexedDBCryptoStore.STORE_ROOMS], (txn) => {
-                this._cryptoStore.storeEndToEndRoom(roomId, roomInfo, txn);
+                this.cryptoStore.storeEndToEndRoom(roomId, roomInfo, txn);
            },
        );
    }
@@ -1,5 +1,5 @@
 /*
-Copyright 2019, 2020 The Matrix.org Foundation C.I.C.
+Copyright 2019 - 2021 The Matrix.org Foundation C.I.C.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,61 +14,103 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import { EventEmitter } from 'events';
 import { logger } from '../logger';
 import * as olmlib from './olmlib';
+import { encodeBase64 } from './olmlib';
 import { randomString } from '../randomstring';
-import { encryptAES, decryptAES } from './aes';
-import { encodeBase64 } from "./olmlib";
+import { calculateKeyCheck, decryptAES, encryptAES, IEncryptedPayload } from './aes';
+import { ClientEvent, ICryptoCallbacks, MatrixEvent } from '../matrix';
+import { ClientEventHandlerMap, MatrixClient } from "../client";
+import { IAddSecretStorageKeyOpts, ISecretStorageKeyInfo } from './api';
+import { TypedEventEmitter } from '../models/typed-event-emitter';

-export const SECRET_STORAGE_ALGORITHM_V1_AES
-    = "m.secret_storage.v1.aes-hmac-sha2";
+export const SECRET_STORAGE_ALGORITHM_V1_AES = "m.secret_storage.v1.aes-hmac-sha2";

-const ZERO_STR = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
+// Some of the key functions use a tuple and some use an object...
+export type SecretStorageKeyTuple = [keyId: string, keyInfo: ISecretStorageKeyInfo];
+export type SecretStorageKeyObject = {keyId: string, keyInfo: ISecretStorageKeyInfo};
+
+export interface ISecretRequest {
+    requestId: string;
+    promise: Promise<string>;
+    cancel: (reason: string) => void;
+}
+
+export interface IAccountDataClient extends TypedEventEmitter<ClientEvent.AccountData, ClientEventHandlerMap> {
+    // Subset of MatrixClient (which also uses any for the event content)
+    getAccountDataFromServer: <T extends {[k: string]: any}>(eventType: string) => Promise<T>;
+    getAccountData: (eventType: string) => MatrixEvent;
+    setAccountData: (eventType: string, content: any) => Promise<{}>;
+}
+
+interface ISecretRequestInternal {
+    name: string;
+    devices: string[];
+    resolve: (reason: string) => void;
+    reject: (error: Error) => void;
+}
+
+interface IDecryptors {
+    encrypt: (plaintext: string) => Promise<IEncryptedPayload>;
+    decrypt: (ciphertext: IEncryptedPayload) => Promise<string>;
+}
+
+interface ISecretInfo {
+    encrypted: {
+        // eslint-disable-next-line camelcase
+        key_id: IEncryptedPayload;
+    };
+}

 /**
 * Implements Secure Secret Storage and Sharing (MSC1946)
 * @module crypto/SecretStorage
 */
-export class SecretStorage extends EventEmitter {
-    constructor(baseApis, cryptoCallbacks) {
-        super();
-        this._baseApis = baseApis;
-        this._cryptoCallbacks = cryptoCallbacks;
-        this._requests = {};
-        this._incomingRequests = {};
-    }
+export class SecretStorage {
+    private requests = new Map<string, ISecretRequestInternal>();

-    async getDefaultKeyId() {
-        const defaultKey = await this._baseApis.getAccountDataFromServer(
+    // In it's pure javascript days, this was relying on some proper Javascript-style
+    // type-abuse where sometimes we'd pass in a fake client object with just the account
+    // data methods implemented, which is all this class needs unless you use the secret
+    // sharing code, so it was fine. As a low-touch TypeScript migration, this now has
+    // an extra, optional param for a real matrix client, so you can not pass it as long
+    // as you don't request any secrets.
+    // A better solution would probably be to split this class up into secret storage and
+    // secret sharing which are really two separate things, even though they share an MSC.
+    constructor(
+        private readonly accountDataAdapter: IAccountDataClient,
+        private readonly cryptoCallbacks: ICryptoCallbacks,
+        private readonly baseApis?: MatrixClient,
+    ) {}
+
+    public async getDefaultKeyId(): Promise<string | null> {
+        const defaultKey = await this.accountDataAdapter.getAccountDataFromServer<{ key: string }>(
            'm.secret_storage.default_key',
        );
        if (!defaultKey) return null;
        return defaultKey.key;
    }

-    setDefaultKeyId(keyId) {
-        return new Promise(async (resolve, reject) => {
-            const listener = (ev) => {
+    public setDefaultKeyId(keyId: string): Promise<void> {
+        return new Promise<void>((resolve, reject) => {
+            const listener = (ev: MatrixEvent): void => {
                if (
                    ev.getType() === 'm.secret_storage.default_key' &&
                    ev.getContent().key === keyId
                ) {
-                    this._baseApis.removeListener('accountData', listener);
+                    this.accountDataAdapter.removeListener(ClientEvent.AccountData, listener);
                    resolve();
                }
            };
-            this._baseApis.on('accountData', listener);
+            this.accountDataAdapter.on(ClientEvent.AccountData, listener);

-            try {
-                await this._baseApis.setAccountData(
-                    'm.secret_storage.default_key',
-                    { key: keyId },
-                );
-            } catch (e) {
-                this._baseApis.removeListener('accountData', listener);
+            this.accountDataAdapter.setAccountData(
+                'm.secret_storage.default_key',
+                { key: keyId },
+            ).catch(e => {
+                this.accountDataAdapter.removeListener(ClientEvent.AccountData, listener);
                reject(e);
-            }
+            });
        });
    }

@@ -85,10 +127,14 @@ export class SecretStorage extends EventEmitter {
     *     keyId: {string} the ID of the key
     *     keyInfo: {object} details about the key (iv, mac, passphrase)
     */
-    async addKey(algorithm, opts, keyId) {
-        const keyInfo = { algorithm };
+    public async addKey(
+        algorithm: string,
+        opts: IAddSecretStorageKeyOpts,
+        keyId?: string,
+    ): Promise<SecretStorageKeyObject> {
+        const keyInfo = { algorithm } as ISecretStorageKeyInfo;

-        if (!opts) opts = {};
+        if (!opts) opts = {} as IAddSecretStorageKeyOpts;

        if (opts.name) {
            keyInfo.name = opts.name;
@@ -99,25 +145,25 @@ export class SecretStorage extends EventEmitter {
                keyInfo.passphrase = opts.passphrase;
            }
            if (opts.key) {
-                const { iv, mac } = await SecretStorage._calculateKeyCheck(opts.key);
+                const { iv, mac } = await calculateKeyCheck(opts.key);
                keyInfo.iv = iv;
                keyInfo.mac = mac;
            }
        } else {
-            throw new Error(`Unknown key algorithm ${opts.algorithm}`);
+            throw new Error(`Unknown key algorithm ${algorithm}`);
        }

        if (!keyId) {
            do {
                keyId = randomString(32);
            } while (
-                await this._baseApis.getAccountDataFromServer(
+                await this.accountDataAdapter.getAccountDataFromServer<ISecretStorageKeyInfo>(
                    `m.secret_storage.key.${keyId}`,
                )
            );
        }

-        await this._baseApis.setAccountData(
+        await this.accountDataAdapter.setAccountData(
            `m.secret_storage.key.${keyId}`, keyInfo,
        );

@@ -134,8 +180,9 @@ export class SecretStorage extends EventEmitter {
     *     for. Defaults to the default key ID if not provided.
     * @returns {Array?} If the key was found, the return value is an array of
     *     the form [keyId, keyInfo].  Otherwise, null is returned.
+     *     XXX: why is this an array when addKey returns an object?
     */
-    async getKey(keyId) {
+    public async getKey(keyId: string): Promise<SecretStorageKeyTuple | null> {
        if (!keyId) {
            keyId = await this.getDefaultKeyId();
        }
@@ -143,7 +190,7 @@ export class SecretStorage extends EventEmitter {
            return null;
        }

-        const keyInfo = await this._baseApis.getAccountDataFromServer(
+        const keyInfo = await this.accountDataAdapter.getAccountDataFromServer<ISecretStorageKeyInfo>(
            "m.secret_storage.key." + keyId,
        );
        return keyInfo ? [keyId, keyInfo] : null;
@@ -156,8 +203,8 @@ export class SecretStorage extends EventEmitter {
     *     for. Defaults to the default key ID if not provided.
     * @return {boolean} Whether we have the key.
     */
-    async hasKey(keyId) {
-        return !!(await this.getKey(keyId));
+    public async hasKey(keyId?: string): Promise<boolean> {
+        return Boolean(await this.getKey(keyId));
    }

    /**
@@ -168,10 +215,10 @@ export class SecretStorage extends EventEmitter {
     *
     * @return {boolean} whether or not the key matches
     */
-    async checkKey(key, info) {
+    public async checkKey(key: Uint8Array, info: ISecretStorageKeyInfo): Promise<boolean> {
        if (info.algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) {
            if (info.mac) {
-                const { mac } = await SecretStorage._calculateKeyCheck(key, info.iv);
+                const { mac } = await calculateKeyCheck(key, info.iv);
                return info.mac.replace(/=+$/g, '') === mac.replace(/=+$/g, '');
            } else {
                // if we have no information, we have to assume the key is right
@@ -182,10 +229,6 @@ export class SecretStorage extends EventEmitter {
        }
    }

-    static async _calculateKeyCheck(key, iv) {
-        return await encryptAES(ZERO_STR, key, "", iv);
-    }
-
    /**
     * Store an encrypted secret on the server
     *
@@ -194,8 +237,8 @@ export class SecretStorage extends EventEmitter {
     * @param {Array} keys The IDs of the keys to use to encrypt the secret
     *     or null/undefined to use the default key.
     */
-    async store(name, secret, keys) {
-        const encrypted = {};
+    public async store(name: string, secret: string, keys?: string[]): Promise<void> {
+        const encrypted: Record<string, IEncryptedPayload> = {};

        if (!keys) {
            const defaultKeyId = await this.getDefaultKeyId();
@@ -211,7 +254,7 @@ export class SecretStorage extends EventEmitter {

        for (const keyId of keys) {
            // get key information from key storage
-            const keyInfo = await this._baseApis.getAccountDataFromServer(
+            const keyInfo = await this.accountDataAdapter.getAccountDataFromServer<ISecretStorageKeyInfo>(
                "m.secret_storage.key." + keyId,
            );
            if (!keyInfo) {
@@ -221,7 +264,7 @@ export class SecretStorage extends EventEmitter {
            // encrypt secret, based on the algorithm
            if (keyInfo.algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) {
                const keys = { [keyId]: keyInfo };
-                const [, encryption] = await this._getSecretStorageKey(keys, name);
+                const [, encryption] = await this.getSecretStorageKey(keys, name);
                encrypted[keyId] = await encryption.encrypt(secret);
            } else {
                logger.warn("unknown algorithm for secret storage key " + keyId
@@ -231,34 +274,7 @@ export class SecretStorage extends EventEmitter {
        }

        // save encrypted secret
-        await this._baseApis.setAccountData(name, { encrypted });
-    }
-
-    /**
-     * Temporary method to fix up existing accounts where secrets
-     * are incorrectly stored without the 'encrypted' level
-     *
-     * @param {string} name The name of the secret
-     * @param {object} secretInfo The account data object
-     * @returns {object} The fixed object or null if no fix was performed
-     */
-    async _fixupStoredSecret(name, secretInfo) {
-        // We assume the secret was only stored passthrough for 1
-        // key - this was all the broken code supported.
-        const keys = Object.keys(secretInfo);
-        if (
-            keys.length === 1 && keys[0] !== 'encrypted' &&
-            secretInfo[keys[0]].passthrough
-        ) {
-            const hasKey = await this.hasKey(keys[0]);
-            if (hasKey) {
-                logger.log("Fixing up passthrough secret: " + name);
-                await this.storePassthrough(name, keys[0]);
-                const newData = await this._baseApis.getAccountDataFromServer(name);
-                return newData;
-            }
-        }
-        return null;
+        await this.accountDataAdapter.setAccountData(name, { encrypted });
    }

    /**
@@ -268,25 +284,23 @@ export class SecretStorage extends EventEmitter {
     *
     * @return {string} the contents of the secret
     */
-    async get(name) {
-        let secretInfo = await this._baseApis.getAccountDataFromServer(name);
+    public async get(name: string): Promise<string> {
+        const secretInfo = await this.accountDataAdapter.getAccountDataFromServer<ISecretInfo>(name);
        if (!secretInfo) {
            return;
        }
        if (!secretInfo.encrypted) {
-            // try to fix it up
-            secretInfo = await this._fixupStoredSecret(name, secretInfo);
-            if (!secretInfo || !secretInfo.encrypted) {
-                throw new Error("Content is not encrypted!");
-            }
+            throw new Error("Content is not encrypted!");
        }

        // get possible keys to decrypt
-        const keys = {};
+        const keys: Record<string, ISecretStorageKeyInfo> = {};
        for (const keyId of Object.keys(secretInfo.encrypted)) {
            // get key information from key storage
-            const keyInfo = await this._baseApis.getAccountDataFromServer(
-                "m.secret_storage.key." + keyId,
+            const keyInfo = (
+                await this.accountDataAdapter.getAccountDataFromServer<ISecretStorageKeyInfo>(
+                    "m.secret_storage.key." + keyId,
+                )
            );
            const encInfo = secretInfo.encrypted[keyId];
            // only use keys we understand the encryption algorithm of
@@ -302,11 +316,11 @@ export class SecretStorage extends EventEmitter {
                `the keys it is encrypted with are for a supported algorithm`);
        }

-        let keyId;
+        let keyId: string;
        let decryption;
        try {
            // fetch private key from app
-            [keyId, decryption] = await this._getSecretStorageKey(keys, name);
+            [keyId, decryption] = await this.getSecretStorageKey(keys, name);

            const encInfo = secretInfo.encrypted[keyId];

@@ -331,16 +345,12 @@ export class SecretStorage extends EventEmitter {
     *     with, or null if it is not present or not encrypted with a trusted
     *     key
     */
-    async isStored(name, checkKey) {
+    public async isStored(name: string, checkKey: boolean): Promise<Record<string, ISecretStorageKeyInfo> | null> {
        // check if secret exists
-        let secretInfo = await this._baseApis.getAccountDataFromServer(name);
+        const secretInfo = await this.accountDataAdapter.getAccountDataFromServer<ISecretInfo>(name);
        if (!secretInfo) return null;
        if (!secretInfo.encrypted) {
-            // try to fix it up
-            secretInfo = await this._fixupStoredSecret(name, secretInfo);
-            if (!secretInfo || !secretInfo.encrypted) {
-                return null;
-            }
+            return null;
        }

        if (checkKey === undefined) checkKey = true;
@@ -350,7 +360,7 @@ export class SecretStorage extends EventEmitter {
        // filter secret encryption keys with supported algorithm
        for (const keyId of Object.keys(secretInfo.encrypted)) {
            // get key information from key storage
-            const keyInfo = await this._baseApis.getAccountDataFromServer(
+            const keyInfo = await this.accountDataAdapter.getAccountDataFromServer<ISecretStorageKeyInfo>(
                "m.secret_storage.key." + keyId,
            );
            if (!keyInfo) continue;
@@ -371,45 +381,48 @@ export class SecretStorage extends EventEmitter {
     *
     * @param {string} name the name of the secret to request
     * @param {string[]} devices the devices to request the secret from
-     *
-     * @return {string} the contents of the secret
     */
-    request(name, devices) {
-        const requestId = this._baseApis.makeTxnId();
+    public request(name: string, devices: string[]): ISecretRequest {
+        const requestId = this.baseApis.makeTxnId();

-        const requestControl = this._requests[requestId] = {
+        let resolve: (s: string) => void;
+        let reject: (e: Error) => void;
+        const promise = new Promise<string>((res, rej) => {
+            resolve = res;
+            reject = rej;
+        });
+        this.requests.set(requestId, {
            name,
            devices,
-        };
-        const promise = new Promise((resolve, reject) => {
-            requestControl.resolve = resolve;
-            requestControl.reject = reject;
+            resolve,
+            reject,
        });
-        const cancel = (reason) => {
+
+        const cancel = (reason: string) => {
            // send cancellation event
            const cancelData = {
                action: "request_cancellation",
-                requesting_device_id: this._baseApis.deviceId,
+                requesting_device_id: this.baseApis.deviceId,
                request_id: requestId,
            };
            const toDevice = {};
            for (const device of devices) {
                toDevice[device] = cancelData;
            }
-            this._baseApis.sendToDevice("m.secret.request", {
-                [this._baseApis.getUserId()]: toDevice,
+            this.baseApis.sendToDevice("m.secret.request", {
+                [this.baseApis.getUserId()]: toDevice,
            });

            // and reject the promise so that anyone waiting on it will be
            // notified
-            requestControl.reject(new Error(reason || "Cancelled"));
+            reject(new Error(reason || "Cancelled"));
        };

        // send request to devices
        const requestData = {
            name,
            action: "request",
-            requesting_device_id: this._baseApis.deviceId,
+            requesting_device_id: this.baseApis.deviceId,
            request_id: requestId,
        };
        const toDevice = {};
@@ -417,21 +430,21 @@ export class SecretStorage extends EventEmitter {
            toDevice[device] = requestData;
        }
        logger.info(`Request secret ${name} from ${devices}, id ${requestId}`);
-        this._baseApis.sendToDevice("m.secret.request", {
-            [this._baseApis.getUserId()]: toDevice,
+        this.baseApis.sendToDevice("m.secret.request", {
+            [this.baseApis.getUserId()]: toDevice,
        });

        return {
-            request_id: requestId,
+            requestId,
            promise,
            cancel,
        };
    }

-    async _onRequestReceived(event) {
+    public async onRequestReceived(event: MatrixEvent): Promise<void> {
        const sender = event.getSender();
        const content = event.getContent();
-        if (sender !== this._baseApis.getUserId()
+        if (sender !== this.baseApis.getUserId()
            || !(content.name && content.action
                 && content.requesting_device_id && content.request_id)) {
            // ignore requests from anyone else, for now
@@ -440,34 +453,45 @@ export class SecretStorage extends EventEmitter {
        const deviceId = content.requesting_device_id;
        // check if it's a cancel
        if (content.action === "request_cancellation") {
+            /*
+            Looks like we intended to emit events when we got cancelations, but
+            we never put anything in the _incomingRequests object, and the request
+            itself doesn't use events anyway so if we were to wire up cancellations,
+            they probably ought to use the same callback interface. I'm leaving them
+            disabled for now while converting this file to typescript.
            if (this._incomingRequests[deviceId]
                && this._incomingRequests[deviceId][content.request_id]) {
-                logger.info("received request cancellation for secret (" + sender
-                            + ", " + deviceId + ", " + content.request_id + ")");
-                this._baseApis.emit("crypto.secrets.requestCancelled", {
+                logger.info(
+                    "received request cancellation for secret (" + sender +
+                    ", " + deviceId + ", " + content.request_id + ")",
+                );
+                this.baseApis.emit("crypto.secrets.requestCancelled", {
                    user_id: sender,
                    device_id: deviceId,
                    request_id: content.request_id,
                });
            }
+            */
        } else if (content.action === "request") {
-            if (deviceId === this._baseApis.deviceId) {
+            if (deviceId === this.baseApis.deviceId) {
                // no point in trying to send ourself the secret
                return;
            }

            // check if we have the secret
-            logger.info("received request for secret (" + sender
-                        + ", " + deviceId + ", " + content.request_id + ")");
-            if (!this._cryptoCallbacks.onSecretRequested) {
+            logger.info(
+                "received request for secret (" + sender +
+                ", " + deviceId + ", " + content.request_id + ")",
+            );
+            if (!this.cryptoCallbacks.onSecretRequested) {
                return;
            }
-            const secret = await this._cryptoCallbacks.onSecretRequested(
+            const secret = await this.cryptoCallbacks.onSecretRequested(
                sender,
                deviceId,
                content.request_id,
                content.name,
-                this._baseApis.checkDeviceTrust(sender, deviceId),
+                this.baseApis.checkDeviceTrust(sender, deviceId),
            );
            if (secret) {
                logger.info(`Preparing ${content.name} secret for ${deviceId}`);
@@ -480,25 +504,25 @@ export class SecretStorage extends EventEmitter {
                };
                const encryptedContent = {
                    algorithm: olmlib.OLM_ALGORITHM,
-                    sender_key: this._baseApis.crypto._olmDevice.deviceCurve25519Key,
+                    sender_key: this.baseApis.crypto.olmDevice.deviceCurve25519Key,
                    ciphertext: {},
                };
                await olmlib.ensureOlmSessionsForDevices(
-                    this._baseApis.crypto._olmDevice,
-                    this._baseApis,
+                    this.baseApis.crypto.olmDevice,
+                    this.baseApis,
                    {
                        [sender]: [
-                            this._baseApis.getStoredDevice(sender, deviceId),
+                            this.baseApis.getStoredDevice(sender, deviceId),
                        ],
                    },
                );
                await olmlib.encryptMessageForDevice(
                    encryptedContent.ciphertext,
-                    this._baseApis.getUserId(),
-                    this._baseApis.deviceId,
-                    this._baseApis.crypto._olmDevice,
+                    this.baseApis.getUserId(),
+                    this.baseApis.deviceId,
+                    this.baseApis.crypto.olmDevice,
                    sender,
-                    this._baseApis.getStoredDevice(sender, deviceId),
+                    this.baseApis.getStoredDevice(sender, deviceId),
                    payload,
                );
                const contentMap = {
@@ -508,26 +532,26 @@ export class SecretStorage extends EventEmitter {
                };

                logger.info(`Sending ${content.name} secret for ${deviceId}`);
-                this._baseApis.sendToDevice("m.room.encrypted", contentMap);
+                this.baseApis.sendToDevice("m.room.encrypted", contentMap);
            } else {
                logger.info(`Request denied for ${content.name} secret for ${deviceId}`);
            }
        }
    }

-    _onSecretReceived(event) {
-        if (event.getSender() !== this._baseApis.getUserId()) {
+    public onSecretReceived(event: MatrixEvent): void {
+        if (event.getSender() !== this.baseApis.getUserId()) {
            // we shouldn't be receiving secrets from anyone else, so ignore
            // because someone could be trying to send us bogus data
            return;
        }
        const content = event.getContent();
        logger.log("got secret share for request", content.request_id);
-        const requestControl = this._requests[content.request_id];
+        const requestControl = this.requests.get(content.request_id);
        if (requestControl) {
            // make sure that the device that sent it is one of the devices that
            // we requested from
-            const deviceInfo = this._baseApis.crypto._deviceList.getDeviceByIdentityKey(
+            const deviceInfo = this.baseApis.crypto.deviceList.getDeviceByIdentityKey(
                olmlib.OLM_ALGORITHM,
                event.getSenderKey(),
            );
@@ -550,12 +574,15 @@ export class SecretStorage extends EventEmitter {
        }
    }

-    async _getSecretStorageKey(keys, name) {
-        if (!this._cryptoCallbacks.getSecretStorageKey) {
+    private async getSecretStorageKey(
+        keys: Record<string, ISecretStorageKeyInfo>,
+        name: string,
+    ): Promise<[string, IDecryptors]> {
+        if (!this.cryptoCallbacks.getSecretStorageKey) {
            throw new Error("No getSecretStorageKey callback supplied");
        }

-        const returned = await this._cryptoCallbacks.getSecretStorageKey({ keys }, name);
+        const returned = await this.cryptoCallbacks.getSecretStorageKey({ keys }, name);

        if (!returned) {
            throw new Error("getSecretStorageKey callback returned falsey");
@@ -571,10 +598,10 @@ export class SecretStorage extends EventEmitter {

        if (keys[keyId].algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) {
            const decryption = {
-                encrypt: async function(secret) {
+                encrypt: async function(secret: string): Promise<IEncryptedPayload> {
                    return await encryptAES(secret, privateKey, name);
                },
-                decrypt: async function(encInfo) {
+                decrypt: async function(encInfo: IEncryptedPayload): Promise<string> {
                    return await decryptAES(encInfo, privateKey, name);
                },
            };
@@ -1,5 +1,5 @@
 /*
-Copyright 2020 The Matrix.org Foundation C.I.C.
+Copyright 2020 - 2021 The Matrix.org Foundation C.I.C.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,6 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

+import type { BinaryLike } from "crypto";
 import { getCrypto } from '../utils';
 import { decodeBase64, encodeBase64 } from './olmlib';

@@ -21,7 +22,14 @@ const subtleCrypto = (typeof window !== "undefined" && window.crypto) ?
    (window.crypto.subtle || window.crypto.webkitSubtle) : null;

 // salt for HKDF, with 8 bytes of zeros
-const zerosalt = new Uint8Array(8);
+const zeroSalt = new Uint8Array(8);
+
+export interface IEncryptedPayload {
+    [key: string]: any; // extensible
+    iv?: string;
+    ciphertext?: string;
+    mac?: string;
+}

 /**
 * encrypt a string in Node.js
@@ -31,7 +39,7 @@ const zerosalt = new Uint8Array(8);
 * @param {string} name the name of the secret
 * @param {string} ivStr the initialization vector to use
 */
-async function encryptNode(data, key, name, ivStr) {
+async function encryptNode(data: string, key: Uint8Array, name: string, ivStr?: string): Promise<IEncryptedPayload> {
    const crypto = getCrypto();
    if (!crypto) {
        throw new Error("No usable crypto implementation");
@@ -42,25 +50,27 @@ async function encryptNode(data, key, name, ivStr) {
        iv = decodeBase64(ivStr);
    } else {
        iv = crypto.randomBytes(16);
-    }

-    // clear bit 63 of the IV to stop us hitting the 64-bit counter boundary
-    // (which would mean we wouldn't be able to decrypt on Android). The loss
-    // of a single bit of iv is a price we have to pay.
-    iv[8] &= 0x7f;
+        // clear bit 63 of the IV to stop us hitting the 64-bit counter boundary
+        // (which would mean we wouldn't be able to decrypt on Android). The loss
+        // of a single bit of iv is a price we have to pay.
+        iv[8] &= 0x7f;
+    }

    const [aesKey, hmacKey] = deriveKeysNode(key, name);

    const cipher = crypto.createCipheriv("aes-256-ctr", aesKey, iv);
-    const ciphertext = cipher.update(data, "utf-8", "base64")
-          + cipher.final("base64");
+    const ciphertext = Buffer.concat([
+        cipher.update(data, "utf8"),
+        cipher.final(),
+    ]);

    const hmac = crypto.createHmac("sha256", hmacKey)
-        .update(ciphertext, "base64").digest("base64");
+        .update(ciphertext).digest("base64");

    return {
        iv: encodeBase64(iv),
-        ciphertext: ciphertext,
+        ciphertext: ciphertext.toString("base64"),
        mac: hmac,
    };
 }
@@ -75,7 +85,7 @@ async function encryptNode(data, key, name, ivStr) {
 * @param {Uint8Array} key the encryption key to use
 * @param {string} name the name of the secret
 */
-async function decryptNode(data, key, name) {
+async function decryptNode(data: IEncryptedPayload, key: Uint8Array, name: string): Promise<string> {
    const crypto = getCrypto();
    if (!crypto) {
        throw new Error("No usable crypto implementation");
@@ -84,7 +94,8 @@ async function decryptNode(data, key, name) {
    const [aesKey, hmacKey] = deriveKeysNode(key, name);

    const hmac = crypto.createHmac("sha256", hmacKey)
-        .update(data.ciphertext, "base64").digest("base64").replace(/=+$/g, '');
+        .update(Buffer.from(data.ciphertext, "base64"))
+        .digest("base64").replace(/=+$/g, '');

    if (hmac !== data.mac.replace(/=+$/g, '')) {
        throw new Error(`Error decrypting secret ${name}: bad MAC`);
@@ -93,21 +104,20 @@ async function decryptNode(data, key, name) {
    const decipher = crypto.createDecipheriv(
        "aes-256-ctr", aesKey, decodeBase64(data.iv),
    );
-    return decipher.update(data.ciphertext, "base64", "utf-8")
-          + decipher.final("utf-8");
+    return decipher.update(data.ciphertext, "base64", "utf8")
+          + decipher.final("utf8");
 }

-function deriveKeysNode(key, name) {
+function deriveKeysNode(key: BinaryLike, name: string): [Buffer, Buffer] {
    const crypto = getCrypto();
-    const prk = crypto.createHmac("sha256", zerosalt)
-        .update(key).digest();
+    const prk = crypto.createHmac("sha256", zeroSalt).update(key).digest();

    const b = Buffer.alloc(1, 1);
    const aesKey = crypto.createHmac("sha256", prk)
-        .update(name, "utf-8").update(b).digest();
+        .update(name, "utf8").update(b).digest();
    b[0] = 2;
    const hmacKey = crypto.createHmac("sha256", prk)
-        .update(aesKey).update(name, "utf-8").update(b).digest();
+        .update(aesKey).update(name, "utf8").update(b).digest();

    return [aesKey, hmacKey];
 }
@@ -120,19 +130,19 @@ function deriveKeysNode(key, name) {
 * @param {string} name the name of the secret
 * @param {string} ivStr the initialization vector to use
 */
-async function encryptBrowser(data, key, name, ivStr) {
+async function encryptBrowser(data: string, key: Uint8Array, name: string, ivStr?: string): Promise<IEncryptedPayload> {
    let iv;
    if (ivStr) {
        iv = decodeBase64(ivStr);
    } else {
        iv = new Uint8Array(16);
        window.crypto.getRandomValues(iv);
-    }

-    // clear bit 63 of the IV to stop us hitting the 64-bit counter boundary
-    // (which would mean we wouldn't be able to decrypt on Android). The loss
-    // of a single bit of iv is a price we have to pay.
-    iv[8] &= 0x7f;
+        // clear bit 63 of the IV to stop us hitting the 64-bit counter boundary
+        // (which would mean we wouldn't be able to decrypt on Android). The loss
+        // of a single bit of iv is a price we have to pay.
+        iv[8] &= 0x7f;
+    }

    const [aesKey, hmacKey] = await deriveKeysBrowser(key, name);
    const encodedData = new TextEncoder().encode(data);
@@ -170,7 +180,7 @@ async function encryptBrowser(data, key, name, ivStr) {
 * @param {Uint8Array} key the encryption key to use
 * @param {string} name the name of the secret
 */
-async function decryptBrowser(data, key, name) {
+async function decryptBrowser(data: IEncryptedPayload, key: Uint8Array, name: string): Promise<string> {
    const [aesKey, hmacKey] = await deriveKeysBrowser(key, name);

    const ciphertext = decodeBase64(data.ciphertext);
@@ -197,7 +207,7 @@ async function decryptBrowser(data, key, name) {
    return new TextDecoder().decode(new Uint8Array(plaintext));
 }

-async function deriveKeysBrowser(key, name) {
+async function deriveKeysBrowser(key: Uint8Array, name: string): Promise<[CryptoKey, CryptoKey]> {
    const hkdfkey = await subtleCrypto.importKey(
        'raw',
        key,
@@ -208,7 +218,9 @@ async function deriveKeysBrowser(key, name) {
    const keybits = await subtleCrypto.deriveBits(
        {
            name: "HKDF",
-            salt: zerosalt,
+            salt: zeroSalt,
+            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+            // @ts-ignore: https://github.com/microsoft/TypeScript-DOM-lib-generator/pull/879
            info: (new TextEncoder().encode(name)),
            hash: "SHA-256",
        },
@@ -241,11 +253,24 @@ async function deriveKeysBrowser(key, name) {
    return await Promise.all([aesProm, hmacProm]);
 }

-export function encryptAES(...args) {
-    return subtleCrypto ? encryptBrowser(...args) : encryptNode(...args);
+export function encryptAES(data: string, key: Uint8Array, name: string, ivStr?: string): Promise<IEncryptedPayload> {
+    return subtleCrypto ? encryptBrowser(data, key, name, ivStr) : encryptNode(data, key, name, ivStr);
 }

-export function decryptAES(...args) {
-    return subtleCrypto ? decryptBrowser(...args) : decryptNode(...args);
+export function decryptAES(data: IEncryptedPayload, key: Uint8Array, name: string): Promise<string> {
+    return subtleCrypto ? decryptBrowser(data, key, name) : decryptNode(data, key, name);
 }

+// string of zeroes, for calculating the key check
+const ZERO_STR = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
+
+/** Calculate the MAC for checking the key.
+ *
+ * @param {Uint8Array} key the key to use
+ * @param {string} [iv] The initialization vector as a base64-encoded string.
+ *     If omitted, a random initialization vector will be created.
+ * @return {Promise<object>} An object that contains, `mac` and `iv` properties.
+ */
+export function calculateKeyCheck(key: Uint8Array, iv?: string): Promise<IEncryptedPayload> {
+    return encryptAES(ZERO_STR, key, "", iv);
+}
@@ -1,5 +1,5 @@
 /*
-Copyright 2016 OpenMarket Ltd
+Copyright 2016 - 2021 The Matrix.org Foundation C.I.C.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -20,13 +20,23 @@ limitations under the License.
 * @module
 */

+import { MatrixClient } from "../../client";
+import { Room } from "../../models/room";
+import { OlmDevice } from "../OlmDevice";
+import { MatrixEvent, RoomMember } from "../..";
+import { Crypto, IEventDecryptionResult, IMegolmSessionData, IncomingRoomKeyRequest } from "..";
+import { DeviceInfo } from "../deviceinfo";
+import { IRoomEncryption } from "../RoomList";
+
 /**
 * map of registered encryption algorithm classes. A map from string to {@link
 * module:crypto/algorithms/base.EncryptionAlgorithm|EncryptionAlgorithm} class
 *
 * @type {Object.<string, function(new: module:crypto/algorithms/base.EncryptionAlgorithm)>}
 */
-export const ENCRYPTION_CLASSES = {};
+export const ENCRYPTION_CLASSES: Record<string, new (params: IParams) => EncryptionAlgorithm> = {};
+
+type DecryptionClassParams = Omit<IParams, "deviceId" | "config">;

 /**
 * map of registered encryption algorithm classes. Map from string to {@link
@@ -34,7 +44,17 @@ export const ENCRYPTION_CLASSES = {};
 *
 * @type {Object.<string, function(new: module:crypto/algorithms/base.DecryptionAlgorithm)>}
 */
-export const DECRYPTION_CLASSES = {};
+export const DECRYPTION_CLASSES: Record<string, new (params: DecryptionClassParams) => DecryptionAlgorithm> = {};
+
+export interface IParams {
+    userId: string;
+    deviceId: string;
+    crypto: Crypto;
+    olmDevice: OlmDevice;
+    baseApis: MatrixClient;
+    roomId: string;
+    config: IRoomEncryption & object;
+}

 /**
 * base type for encryption implementations
@@ -50,14 +70,21 @@ export const DECRYPTION_CLASSES = {};
 * @param {string} params.roomId  The ID of the room we will be sending to
 * @param {object} params.config  The body of the m.room.encryption event
 */
-export class EncryptionAlgorithm {
-    constructor(params) {
-        this._userId = params.userId;
-        this._deviceId = params.deviceId;
-        this._crypto = params.crypto;
-        this._olmDevice = params.olmDevice;
-        this._baseApis = params.baseApis;
-        this._roomId = params.roomId;
+export abstract class EncryptionAlgorithm {
+    protected readonly userId: string;
+    protected readonly deviceId: string;
+    protected readonly crypto: Crypto;
+    protected readonly olmDevice: OlmDevice;
+    protected readonly baseApis: MatrixClient;
+    protected readonly roomId: string;
+
+    constructor(params: IParams) {
+        this.userId = params.userId;
+        this.deviceId = params.deviceId;
+        this.crypto = params.crypto;
+        this.olmDevice = params.olmDevice;
+        this.baseApis = params.baseApis;
+        this.roomId = params.roomId;
    }

    /**
@@ -66,21 +93,22 @@ export class EncryptionAlgorithm {
     *
     * @param {module:models/room} room the room the event is in
     */
-    prepareToEncrypt(room) {
-    }
+    public prepareToEncrypt(room: Room): void {}

    /**
     * Encrypt a message event
     *
     * @method module:crypto/algorithms/base.EncryptionAlgorithm.encryptMessage
+     * @public
     * @abstract
     *
     * @param {module:models/room} room
     * @param {string} eventType
-     * @param {object} plaintext event content
+     * @param {object} content event content
     *
     * @return {Promise} Promise which resolves to the new event body
     */
+    public abstract encryptMessage(room: Room, eventType: string, content: object): Promise<object>;

    /**
     * Called when the membership of a member of the room changes.
@@ -89,9 +117,18 @@ export class EncryptionAlgorithm {
     * @param {module:models/room-member} member  user whose membership changed
     * @param {string=} oldMembership  previous membership
     * @public
+     * @abstract
     */
-     onRoomMembership(event, member, oldMembership) {
-     }
+    public onRoomMembership(event: MatrixEvent, member: RoomMember, oldMembership?: string): void {}
+
+    public reshareKeyWithDevice?(
+        senderKey: string,
+        sessionId: string,
+        userId: string,
+        device: DeviceInfo,
+    ): Promise<void>;
+
+    public forceDiscardSession?(): void;
 }

 /**
@@ -106,13 +143,19 @@ export class EncryptionAlgorithm {
 * @param {string=} params.roomId The ID of the room we will be receiving
 *     from. Null for to-device events.
 */
-export class DecryptionAlgorithm {
-    constructor(params) {
-        this._userId = params.userId;
-        this._crypto = params.crypto;
-        this._olmDevice = params.olmDevice;
-        this._baseApis = params.baseApis;
-        this._roomId = params.roomId;
+export abstract class DecryptionAlgorithm {
+    protected readonly userId: string;
+    protected readonly crypto: Crypto;
+    protected readonly olmDevice: OlmDevice;
+    protected readonly baseApis: MatrixClient;
+    protected readonly roomId: string;
+
+    constructor(params: DecryptionClassParams) {
+        this.userId = params.userId;
+        this.crypto = params.crypto;
+        this.olmDevice = params.olmDevice;
+        this.baseApis = params.baseApis;
+        this.roomId = params.roomId;
    }

    /**
@@ -127,6 +170,7 @@ export class DecryptionAlgorithm {
     * resolves once we have finished decrypting. Rejects with an
     * `algorithms.DecryptionError` if there is a problem decrypting the event.
     */
+    public abstract decryptEvent(event: MatrixEvent): Promise<IEventDecryptionResult>;

    /**
     * Handle a key event
@@ -135,7 +179,7 @@ export class DecryptionAlgorithm {
     *
     * @param {module:models/event.MatrixEvent} params event key event
     */
-    onRoomKeyEvent(params) {
+    public onRoomKeyEvent(params: MatrixEvent): void {
        // ignore by default
    }

@@ -143,8 +187,9 @@ export class DecryptionAlgorithm {
     * Import a room key
     *
     * @param {module:crypto/OlmDevice.MegolmSessionData} session
+     * @param {object} opts object
     */
-    importRoomKey(session) {
+    public async importRoomKey(session: IMegolmSessionData, opts: object): Promise<void> {
        // ignore by default
    }

@@ -155,7 +200,7 @@ export class DecryptionAlgorithm {
     * @return {Promise<boolean>} true if we have the keys and could (theoretically) share
     *  them; else false.
     */
-    hasKeysForKeyRequest(keyRequest) {
+    public hasKeysForKeyRequest(keyRequest: IncomingRoomKeyRequest): Promise<boolean> {
        return Promise.resolve(false);
    }

@@ -164,7 +209,7 @@ export class DecryptionAlgorithm {
     *
     * @param {module:crypto~IncomingRoomKeyRequest} keyRequest
     */
-    shareKeysWithDevice(keyRequest) {
+    public shareKeysWithDevice(keyRequest: IncomingRoomKeyRequest): void {
        throw new Error("shareKeysWithDevice not supported for this DecryptionAlgorithm");
    }

@@ -174,9 +219,13 @@ export class DecryptionAlgorithm {
     *
     * @param {string} senderKey the sender's key
     */
-    async retryDecryptionFromSender(senderKey) {
+    public async retryDecryptionFromSender(senderKey: string): Promise<boolean> {
        // ignore by default
+        return false;
    }
+
+    public onRoomKeyWithheldEvent?(event: MatrixEvent): Promise<void>;
+    public sendSharedHistoryInboundSessions?(devicesByUser: Record<string, DeviceInfo[]>): Promise<void>;
 }

 /**
@@ -191,22 +240,21 @@ export class DecryptionAlgorithm {
 * @extends Error
 */
 export class DecryptionError extends Error {
-    constructor(code, msg, details) {
+    public readonly detailedString: string;
+
+    constructor(public readonly code: string, msg: string, details?: Record<string, string>) {
        super(msg);
        this.code = code;
        this.name = 'DecryptionError';
-        this.detailedString = _detailedStringForDecryptionError(this, details);
+        this.detailedString = detailedStringForDecryptionError(this, details);
    }
 }

-function _detailedStringForDecryptionError(err, details) {
+function detailedStringForDecryptionError(err: DecryptionError, details?: Record<string, string>): string {
    let result = err.name + '[msg: ' + err.message;

    if (details) {
-        result += ', ' +
-            Object.keys(details).map(
-                (k) => k + ': ' + details[k],
-            ).join(', ');
+        result += ', ' + Object.keys(details).map((k) => k + ': ' + details[k]).join(', ');
    }

    result += ']';
@@ -224,7 +272,7 @@ function _detailedStringForDecryptionError(err, details) {
 * @extends Error
 */
 export class UnknownDeviceError extends Error {
-    constructor(msg, devices) {
+    constructor(msg: string, public readonly devices: Record<string, Record<string, object>>) {
        super(msg);
        this.name = "UnknownDeviceError";
        this.devices = devices;
@@ -244,7 +292,11 @@ export class UnknownDeviceError extends Error {
 *     module:crypto/algorithms/base.DecryptionAlgorithm|DecryptionAlgorithm}
 *     implementation
 */
-export function registerAlgorithm(algorithm, encryptor, decryptor) {
+export function registerAlgorithm(
+    algorithm: string,
+    encryptor: new (params: IParams) => EncryptionAlgorithm,
+    decryptor: new (params: Omit<IParams, "deviceId">) => DecryptionAlgorithm,
+): void {
    ENCRYPTION_CLASSES[algorithm] = encryptor;
    DECRYPTION_CLASSES[algorithm] = decryptor;
 }
@@ -1,6 +1,5 @@
 /*
-Copyright 2016 OpenMarket Ltd
-Copyright 2019 The Matrix.org Foundation C.I.C.
+Copyright 2016 - 2021 The Matrix.org Foundation C.I.C.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -1,361 +0,0 @@
-/*
-Copyright 2016 OpenMarket Ltd
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-/**
- * Defines m.olm encryption/decryption
- *
- * @module crypto/algorithms/olm
- */
-
-import { logger } from '../../logger';
-import * as utils from "../../utils";
-import { polyfillSuper } from "../../utils";
-import * as olmlib from "../olmlib";
-import { DeviceInfo } from "../deviceinfo";
-import {
-    DecryptionAlgorithm,
-    DecryptionError,
-    EncryptionAlgorithm,
-    registerAlgorithm,
-} from "./base";
-
-const DeviceVerification = DeviceInfo.DeviceVerification;
-
-/**
- * Olm encryption implementation
- *
- * @constructor
- * @extends {module:crypto/algorithms/EncryptionAlgorithm}
- *
- * @param {object} params parameters, as per
- *     {@link module:crypto/algorithms/EncryptionAlgorithm}
- */
-function OlmEncryption(params) {
-    polyfillSuper(this, EncryptionAlgorithm, params);
-    this._sessionPrepared = false;
-    this._prepPromise = null;
-}
-utils.inherits(OlmEncryption, EncryptionAlgorithm);
-
-/**
- * @private
-
- * @param {string[]} roomMembers list of currently-joined users in the room
- * @return {Promise} Promise which resolves when setup is complete
- */
-OlmEncryption.prototype._ensureSession = function(roomMembers) {
-    if (this._prepPromise) {
-        // prep already in progress
-        return this._prepPromise;
-    }
-
-    if (this._sessionPrepared) {
-        // prep already done
-        return Promise.resolve();
-    }
-
-    const self = this;
-    this._prepPromise = self._crypto.downloadKeys(roomMembers).then(function(res) {
-        return self._crypto.ensureOlmSessionsForUsers(roomMembers);
-    }).then(function() {
-        self._sessionPrepared = true;
-    }).finally(function() {
-        self._prepPromise = null;
-    });
-    return this._prepPromise;
-};
-
-/**
- * @inheritdoc
- *
- * @param {module:models/room} room
- * @param {string} eventType
- * @param {object} content plaintext event content
- *
- * @return {Promise} Promise which resolves to the new event body
- */
-OlmEncryption.prototype.encryptMessage = async function(room, eventType, content) {
-    // pick the list of recipients based on the membership list.
-    //
-    // TODO: there is a race condition here! What if a new user turns up
-    // just as you are sending a secret message?
-
-    const members = await room.getEncryptionTargetMembers();
-
-    const users = members.map(function(u) {
-        return u.userId;
-    });
-
-    const self = this;
-    await this._ensureSession(users);
-
-    const payloadFields = {
-        room_id: room.roomId,
-        type: eventType,
-        content: content,
-    };
-
-    const encryptedContent = {
-        algorithm: olmlib.OLM_ALGORITHM,
-        sender_key: self._olmDevice.deviceCurve25519Key,
-        ciphertext: {},
-    };
-
-    const promises = [];
-
-    for (let i = 0; i < users.length; ++i) {
-        const userId = users[i];
-        const devices = self._crypto.getStoredDevicesForUser(userId);
-
-        for (let j = 0; j < devices.length; ++j) {
-            const deviceInfo = devices[j];
-            const key = deviceInfo.getIdentityKey();
-            if (key == self._olmDevice.deviceCurve25519Key) {
-                // don't bother sending to ourself
-                continue;
-            }
-            if (deviceInfo.verified == DeviceVerification.BLOCKED) {
-                // don't bother setting up sessions with blocked users
-                continue;
-            }
-
-            promises.push(
-                olmlib.encryptMessageForDevice(
-                    encryptedContent.ciphertext,
-                    self._userId, self._deviceId, self._olmDevice,
-                    userId, deviceInfo, payloadFields,
-                ),
-            );
-        }
-    }
-
-    return await Promise.all(promises).then(() => encryptedContent);
-};
-
-/**
- * Olm decryption implementation
- *
- * @constructor
- * @extends {module:crypto/algorithms/DecryptionAlgorithm}
- * @param {object} params parameters, as per
- *     {@link module:crypto/algorithms/DecryptionAlgorithm}
- */
-function OlmDecryption(params) {
-    polyfillSuper(this, DecryptionAlgorithm, params);
-}
-utils.inherits(OlmDecryption, DecryptionAlgorithm);
-
-/**
- * @inheritdoc
- *
- * @param {MatrixEvent} event
- *
- * returns a promise which resolves to a
- * {@link module:crypto~EventDecryptionResult} once we have finished
- * decrypting. Rejects with an `algorithms.DecryptionError` if there is a
- * problem decrypting the event.
- */
-OlmDecryption.prototype.decryptEvent = async function(event) {
-    const content = event.getWireContent();
-    const deviceKey = content.sender_key;
-    const ciphertext = content.ciphertext;
-
-    if (!ciphertext) {
-        throw new DecryptionError(
-            "OLM_MISSING_CIPHERTEXT",
-            "Missing ciphertext",
-        );
-    }
-
-    if (!(this._olmDevice.deviceCurve25519Key in ciphertext)) {
-        throw new DecryptionError(
-            "OLM_NOT_INCLUDED_IN_RECIPIENTS",
-            "Not included in recipients",
-        );
-    }
-    const message = ciphertext[this._olmDevice.deviceCurve25519Key];
-    let payloadString;
-
-    try {
-        payloadString = await this._decryptMessage(deviceKey, message);
-    } catch (e) {
-        throw new DecryptionError(
-            "OLM_BAD_ENCRYPTED_MESSAGE",
-            "Bad Encrypted Message", {
-                sender: deviceKey,
-                err: e,
-            },
-        );
-    }
-
-    const payload = JSON.parse(payloadString);
-
-    // check that we were the intended recipient, to avoid unknown-key attack
-    // https://github.com/vector-im/vector-web/issues/2483
-    if (payload.recipient != this._userId) {
-        throw new DecryptionError(
-            "OLM_BAD_RECIPIENT",
-            "Message was intented for " + payload.recipient,
-        );
-    }
-
-    if (payload.recipient_keys.ed25519 != this._olmDevice.deviceEd25519Key) {
-        throw new DecryptionError(
-            "OLM_BAD_RECIPIENT_KEY",
-            "Message not intended for this device", {
-                intended: payload.recipient_keys.ed25519,
-                our_key: this._olmDevice.deviceEd25519Key,
-            },
-        );
-    }
-
-    // check that the original sender matches what the homeserver told us, to
-    // avoid people masquerading as others.
-    // (this check is also provided via the sender's embedded ed25519 key,
-    // which is checked elsewhere).
-    if (payload.sender != event.getSender()) {
-        throw new DecryptionError(
-            "OLM_FORWARDED_MESSAGE",
-            "Message forwarded from " + payload.sender, {
-                reported_sender: event.getSender(),
-            },
-        );
-    }
-
-    // Olm events intended for a room have a room_id.
-    if (payload.room_id !== event.getRoomId()) {
-        throw new DecryptionError(
-            "OLM_BAD_ROOM",
-            "Message intended for room " + payload.room_id, {
-                reported_room: event.room_id,
-            },
-        );
-    }
-
-    const claimedKeys = payload.keys || {};
-
-    return {
-        clearEvent: payload,
-        senderCurve25519Key: deviceKey,
-        claimedEd25519Key: claimedKeys.ed25519 || null,
-    };
-};
-
-/**
- * Attempt to decrypt an Olm message
- *
- * @param {string} theirDeviceIdentityKey  Curve25519 identity key of the sender
- * @param {object} message  message object, with 'type' and 'body' fields
- *
- * @return {string} payload, if decrypted successfully.
- */
-OlmDecryption.prototype._decryptMessage = async function(
-    theirDeviceIdentityKey, message,
-) {
-    // This is a wrapper that serialises decryptions of prekey messages, because
-    // otherwise we race between deciding we have no active sessions for the message
-    // and creating a new one, which we can only do once because it removes the OTK.
-    if (message.type !== 0) {
-        // not a prekey message: we can safely just try & decrypt it
-        return this._reallyDecryptMessage(theirDeviceIdentityKey, message);
-    } else {
-        const myPromise = this._olmDevice._olmPrekeyPromise.then(() => {
-            return this._reallyDecryptMessage(theirDeviceIdentityKey, message);
-        });
-        // we want the error, but don't propagate it to the next decryption
-        this._olmDevice._olmPrekeyPromise = myPromise.catch(() => {});
-        return await myPromise;
-    }
-};
-
-OlmDecryption.prototype._reallyDecryptMessage = async function(
-    theirDeviceIdentityKey, message,
-) {
-    const sessionIds = await this._olmDevice.getSessionIdsForDevice(
-        theirDeviceIdentityKey,
-    );
-
-    // try each session in turn.
-    const decryptionErrors = {};
-    for (let i = 0; i < sessionIds.length; i++) {
-        const sessionId = sessionIds[i];
-        try {
-            const payload = await this._olmDevice.decryptMessage(
-                theirDeviceIdentityKey, sessionId, message.type, message.body,
-            );
-            logger.log(
-                "Decrypted Olm message from " + theirDeviceIdentityKey +
-                    " with session " + sessionId,
-            );
-            return payload;
-        } catch (e) {
-            const foundSession = await this._olmDevice.matchesSession(
-                theirDeviceIdentityKey, sessionId, message.type, message.body,
-            );
-
-            if (foundSession) {
-                // decryption failed, but it was a prekey message matching this
-                // session, so it should have worked.
-                throw new Error(
-                    "Error decrypting prekey message with existing session id " +
-                        sessionId + ": " + e.message,
-                );
-            }
-
-            // otherwise it's probably a message for another session; carry on, but
-            // keep a record of the error
-            decryptionErrors[sessionId] = e.message;
-        }
-    }
-
-    if (message.type !== 0) {
-        // not a prekey message, so it should have matched an existing session, but it
-        // didn't work.
-
-        if (sessionIds.length === 0) {
-            throw new Error("No existing sessions");
-        }
-
-        throw new Error(
-            "Error decrypting non-prekey message with existing sessions: " +
-                JSON.stringify(decryptionErrors),
-        );
-    }
-
-    // prekey message which doesn't match any existing sessions: make a new
-    // session.
-
-    let res;
-    try {
-        res = await this._olmDevice.createInboundSession(
-            theirDeviceIdentityKey, message.type, message.body,
-        );
-    } catch (e) {
-        decryptionErrors["(new)"] = e.message;
-        throw new Error(
-            "Error decrypting prekey message: " +
-                JSON.stringify(decryptionErrors),
-        );
-    }
-
-    logger.log(
-        "created new inbound Olm session ID " +
-            res.session_id + " with " + theirDeviceIdentityKey,
-    );
-    return res.payload;
-};
-
-registerAlgorithm(olmlib.OLM_ALGORITHM, OlmEncryption, OlmDecryption);
@@ -0,0 +1,355 @@
+/*
+Copyright 2016 - 2021 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+/**
+ * Defines m.olm encryption/decryption
+ *
+ * @module crypto/algorithms/olm
+ */
+
+import { logger } from '../../logger';
+import * as olmlib from "../olmlib";
+import { DeviceInfo } from "../deviceinfo";
+import {
+    DecryptionAlgorithm,
+    DecryptionError,
+    EncryptionAlgorithm,
+    registerAlgorithm,
+} from "./base";
+import { Room } from '../../models/room';
+import { MatrixEvent } from "../..";
+import { IEventDecryptionResult } from "../index";
+
+const DeviceVerification = DeviceInfo.DeviceVerification;
+
+interface IMessage {
+    type: number;
+    body: string;
+}
+
+/**
+ * Olm encryption implementation
+ *
+ * @constructor
+ * @extends {module:crypto/algorithms/EncryptionAlgorithm}
+ *
+ * @param {object} params parameters, as per
+ *     {@link module:crypto/algorithms/EncryptionAlgorithm}
+ */
+class OlmEncryption extends EncryptionAlgorithm {
+    private sessionPrepared = false;
+    private prepPromise: Promise<void> = null;
+
+    /**
+     * @private
+
+     * @param {string[]} roomMembers list of currently-joined users in the room
+     * @return {Promise} Promise which resolves when setup is complete
+     */
+    private ensureSession(roomMembers: string[]): Promise<void> {
+        if (this.prepPromise) {
+            // prep already in progress
+            return this.prepPromise;
+        }
+
+        if (this.sessionPrepared) {
+            // prep already done
+            return Promise.resolve();
+        }
+
+        this.prepPromise = this.crypto.downloadKeys(roomMembers).then((res) => {
+            return this.crypto.ensureOlmSessionsForUsers(roomMembers);
+        }).then(() => {
+            this.sessionPrepared = true;
+        }).finally(() => {
+            this.prepPromise = null;
+        });
+
+        return this.prepPromise;
+    }
+
+    /**
+     * @inheritdoc
+     *
+     * @param {module:models/room} room
+     * @param {string} eventType
+     * @param {object} content plaintext event content
+     *
+     * @return {Promise} Promise which resolves to the new event body
+     */
+    public async encryptMessage(room: Room, eventType: string, content: object): Promise<object> {
+        // pick the list of recipients based on the membership list.
+        //
+        // TODO: there is a race condition here! What if a new user turns up
+        // just as you are sending a secret message?
+
+        const members = await room.getEncryptionTargetMembers();
+
+        const users = members.map(function(u) {
+            return u.userId;
+        });
+
+        await this.ensureSession(users);
+
+        const payloadFields = {
+            room_id: room.roomId,
+            type: eventType,
+            content: content,
+        };
+
+        const encryptedContent = {
+            algorithm: olmlib.OLM_ALGORITHM,
+            sender_key: this.olmDevice.deviceCurve25519Key,
+            ciphertext: {},
+        };
+
+        const promises = [];
+
+        for (let i = 0; i < users.length; ++i) {
+            const userId = users[i];
+            const devices = this.crypto.getStoredDevicesForUser(userId);
+
+            for (let j = 0; j < devices.length; ++j) {
+                const deviceInfo = devices[j];
+                const key = deviceInfo.getIdentityKey();
+                if (key == this.olmDevice.deviceCurve25519Key) {
+                    // don't bother sending to ourself
+                    continue;
+                }
+                if (deviceInfo.verified == DeviceVerification.BLOCKED) {
+                    // don't bother setting up sessions with blocked users
+                    continue;
+                }
+
+                promises.push(
+                    olmlib.encryptMessageForDevice(
+                        encryptedContent.ciphertext,
+                        this.userId, this.deviceId, this.olmDevice,
+                        userId, deviceInfo, payloadFields,
+                    ),
+                );
+            }
+        }
+
+        return await Promise.all(promises).then(() => encryptedContent);
+    }
+}
+
+/**
+ * Olm decryption implementation
+ *
+ * @constructor
+ * @extends {module:crypto/algorithms/DecryptionAlgorithm}
+ * @param {object} params parameters, as per
+ *     {@link module:crypto/algorithms/DecryptionAlgorithm}
+ */
+class OlmDecryption extends DecryptionAlgorithm {
+    /**
+     * @inheritdoc
+     *
+     * @param {MatrixEvent} event
+     *
+     * returns a promise which resolves to a
+     * {@link module:crypto~EventDecryptionResult} once we have finished
+     * decrypting. Rejects with an `algorithms.DecryptionError` if there is a
+     * problem decrypting the event.
+     */
+    public async decryptEvent(event: MatrixEvent): Promise<IEventDecryptionResult> {
+        const content = event.getWireContent();
+        const deviceKey = content.sender_key;
+        const ciphertext = content.ciphertext;
+
+        if (!ciphertext) {
+            throw new DecryptionError(
+                "OLM_MISSING_CIPHERTEXT",
+                "Missing ciphertext",
+            );
+        }
+
+        if (!(this.olmDevice.deviceCurve25519Key in ciphertext)) {
+            throw new DecryptionError(
+                "OLM_NOT_INCLUDED_IN_RECIPIENTS",
+                "Not included in recipients",
+            );
+        }
+        const message = ciphertext[this.olmDevice.deviceCurve25519Key];
+        let payloadString;
+
+        try {
+            payloadString = await this.decryptMessage(deviceKey, message);
+        } catch (e) {
+            throw new DecryptionError(
+                "OLM_BAD_ENCRYPTED_MESSAGE",
+                "Bad Encrypted Message", {
+                    sender: deviceKey,
+                    err: e,
+                },
+            );
+        }
+
+        const payload = JSON.parse(payloadString);
+
+        // check that we were the intended recipient, to avoid unknown-key attack
+        // https://github.com/vector-im/vector-web/issues/2483
+        if (payload.recipient != this.userId) {
+            throw new DecryptionError(
+                "OLM_BAD_RECIPIENT",
+                "Message was intented for " + payload.recipient,
+            );
+        }
+
+        if (payload.recipient_keys.ed25519 != this.olmDevice.deviceEd25519Key) {
+            throw new DecryptionError(
+                "OLM_BAD_RECIPIENT_KEY",
+                "Message not intended for this device", {
+                    intended: payload.recipient_keys.ed25519,
+                    our_key: this.olmDevice.deviceEd25519Key,
+                },
+            );
+        }
+
+        // check that the original sender matches what the homeserver told us, to
+        // avoid people masquerading as others.
+        // (this check is also provided via the sender's embedded ed25519 key,
+        // which is checked elsewhere).
+        if (payload.sender != event.getSender()) {
+            throw new DecryptionError(
+                "OLM_FORWARDED_MESSAGE",
+                "Message forwarded from " + payload.sender, {
+                    reported_sender: event.getSender(),
+                },
+            );
+        }
+
+        // Olm events intended for a room have a room_id.
+        if (payload.room_id !== event.getRoomId()) {
+            throw new DecryptionError(
+                "OLM_BAD_ROOM",
+                "Message intended for room " + payload.room_id, {
+                    reported_room: event.getRoomId(),
+                },
+            );
+        }
+
+        const claimedKeys = payload.keys || {};
+
+        return {
+            clearEvent: payload,
+            senderCurve25519Key: deviceKey,
+            claimedEd25519Key: claimedKeys.ed25519 || null,
+        };
+    }
+
+    /**
+     * Attempt to decrypt an Olm message
+     *
+     * @param {string} theirDeviceIdentityKey  Curve25519 identity key of the sender
+     * @param {object} message  message object, with 'type' and 'body' fields
+     *
+     * @return {string} payload, if decrypted successfully.
+     */
+    private async decryptMessage(theirDeviceIdentityKey: string, message: IMessage): Promise<string> {
+        // This is a wrapper that serialises decryptions of prekey messages, because
+        // otherwise we race between deciding we have no active sessions for the message
+        // and creating a new one, which we can only do once because it removes the OTK.
+        if (message.type !== 0) {
+            // not a prekey message: we can safely just try & decrypt it
+            return this.reallyDecryptMessage(theirDeviceIdentityKey, message);
+        } else {
+            const myPromise = this.olmDevice.olmPrekeyPromise.then(() => {
+                return this.reallyDecryptMessage(theirDeviceIdentityKey, message);
+            });
+            // we want the error, but don't propagate it to the next decryption
+            this.olmDevice.olmPrekeyPromise = myPromise.catch(() => {});
+            return await myPromise;
+        }
+    }
+
+    private async reallyDecryptMessage(theirDeviceIdentityKey: string, message: IMessage): Promise<string> {
+        const sessionIds = await this.olmDevice.getSessionIdsForDevice(theirDeviceIdentityKey);
+
+        // try each session in turn.
+        const decryptionErrors: Record<string, string> = {};
+        for (let i = 0; i < sessionIds.length; i++) {
+            const sessionId = sessionIds[i];
+            try {
+                const payload = await this.olmDevice.decryptMessage(
+                    theirDeviceIdentityKey, sessionId, message.type, message.body,
+                );
+                logger.log(
+                    "Decrypted Olm message from " + theirDeviceIdentityKey +
+                    " with session " + sessionId,
+                );
+                return payload;
+            } catch (e) {
+                const foundSession = await this.olmDevice.matchesSession(
+                    theirDeviceIdentityKey, sessionId, message.type, message.body,
+                );
+
+                if (foundSession) {
+                    // decryption failed, but it was a prekey message matching this
+                    // session, so it should have worked.
+                    throw new Error(
+                        "Error decrypting prekey message with existing session id " +
+                        sessionId + ": " + e.message,
+                    );
+                }
+
+                // otherwise it's probably a message for another session; carry on, but
+                // keep a record of the error
+                decryptionErrors[sessionId] = e.message;
+            }
+        }
+
+        if (message.type !== 0) {
+            // not a prekey message, so it should have matched an existing session, but it
+            // didn't work.
+
+            if (sessionIds.length === 0) {
+                throw new Error("No existing sessions");
+            }
+
+            throw new Error(
+                "Error decrypting non-prekey message with existing sessions: " +
+                JSON.stringify(decryptionErrors),
+            );
+        }
+
+        // prekey message which doesn't match any existing sessions: make a new
+        // session.
+
+        let res;
+        try {
+            res = await this.olmDevice.createInboundSession(
+                theirDeviceIdentityKey, message.type, message.body,
+            );
+        } catch (e) {
+            decryptionErrors["(new)"] = e.message;
+            throw new Error(
+                "Error decrypting prekey message: " +
+                JSON.stringify(decryptionErrors),
+            );
+        }
+
+        logger.log(
+            "created new inbound Olm session ID " +
+            res.session_id + " with " + theirDeviceIdentityKey,
+        );
+        return res.payload;
+    }
+}
+
+registerAlgorithm(olmlib.OLM_ALGORITHM, OlmEncryption, OlmDecryption);
@@ -15,8 +15,7 @@ limitations under the License.
 */

 import { DeviceInfo } from "./deviceinfo";
-import { IKeyBackupVersion } from "./keybackup";
-import { ISecretStorageKeyInfo } from "../matrix";
+import { IKeyBackupInfo } from "./keybackup";

 // TODO: Merge this with crypto.js once converted

@@ -59,16 +58,9 @@ export interface IEncryptedEventInfo {
 }

 export interface IRecoveryKey {
-    keyInfo: {
-        pubkey: Uint8Array;
-        passphrase?: {
-            algorithm: string;
-            iterations: number;
-            salt: string;
-        };
-    };
+    keyInfo?: IAddSecretStorageKeyOpts;
    privateKey: Uint8Array;
-    encodedPrivateKey: string;
+    encodedPrivateKey?: string;
 }

 export interface ICreateSecretStorageOpts {
@@ -85,7 +77,7 @@ export interface ICreateSecretStorageOpts {
     * The current key backup object. If passed,
     * the passphrase and recovery key from this backup will be used.
     */
-    keyBackupInfo?: IKeyBackupVersion;
+    keyBackupInfo?: IKeyBackupInfo;

    /**
     * If true, a new key backup version will be
@@ -107,14 +99,33 @@ export interface ICreateSecretStorageOpts {
    getKeyBackupPassphrase?: () => Promise<Uint8Array>;
 }

+export interface ISecretStorageKeyInfo {
+    name: string;
+    algorithm: string;
+    // technically the below are specific to AES keys. If we ever introduce another type,
+    // we can split into separate interfaces.
+    iv: string;
+    mac: string;
+    passphrase: IPassphraseInfo;
+}
+
 export interface ISecretStorageKey {
    keyId: string;
    keyInfo: ISecretStorageKeyInfo;
 }

+export interface IPassphraseInfo {
+    algorithm: "m.pbkdf2";
+    iterations: number;
+    salt: string;
+    bits?: number;
+}
+
 export interface IAddSecretStorageKeyOpts {
-    // depends on algorithm
-    // TODO: Types
+    pubkey: string;
+    passphrase?: IPassphraseInfo;
+    name?: string;
+    key: Uint8Array;
 }

 export interface IImportOpts {
@@ -125,7 +136,7 @@ export interface IImportOpts {
 }

 export interface IImportRoomKeysOpts {
-    progressCallback: (stage: IImportOpts) => void;
+    progressCallback?: (stage: IImportOpts) => void;
    untrusted?: boolean;
    source?: string; // TODO: Enum
 }
@@ -26,36 +26,50 @@ import { MEGOLM_ALGORITHM, verifySignature } from "./olmlib";
 import { DeviceInfo } from "./deviceinfo";
 import { DeviceTrustLevel } from './CrossSigning';
 import { keyFromPassphrase } from './key_passphrase';
-import { sleep } from "../utils";
+import { getCrypto, sleep } from "../utils";
 import { IndexedDBCryptoStore } from './store/indexeddb-crypto-store';
 import { encodeRecoveryKey } from './recoverykey';
+import { calculateKeyCheck, decryptAES, encryptAES } from './aes';
+import { IAes256AuthData, ICurve25519AuthData, IKeyBackupInfo, IKeyBackupSession } from "./keybackup";
+import { UnstableValue } from "../NamespacedValue";
+import { CryptoEvent, IMegolmSessionData } from "./index";

 const KEY_BACKUP_KEYS_PER_REQUEST = 200;

-type AuthData = Record<string, any>;
-
-type BackupInfo = {
-    algorithm: string,
-    auth_data: AuthData, // eslint-disable-line camelcase
-    [properties: string]: any,
-};
+type AuthData = IKeyBackupInfo["auth_data"];

 type SigInfo = {
-    deviceId: string,
-    valid?: boolean | null, // true: valid, false: invalid, null: cannot attempt validation
-    device?: DeviceInfo | null,
-    crossSigningId?: boolean,
-    deviceTrust?: DeviceTrustLevel,
+    deviceId: string;
+    valid?: boolean | null; // true: valid, false: invalid, null: cannot attempt validation
+    device?: DeviceInfo | null;
+    crossSigningId?: boolean;
+    deviceTrust?: DeviceTrustLevel;
 };

-type TrustInfo = {
-    usable: boolean, // is the backup trusted, true iff there is a sig that is valid & from a trusted device
-    sigs: SigInfo[],
+export type TrustInfo = {
+    usable: boolean; // is the backup trusted, true iff there is a sig that is valid & from a trusted device
+    sigs: SigInfo[];
+    // eslint-disable-next-line camelcase
+    trusted_locally?: boolean;
 };

+export interface IKeyBackupCheck {
+    backupInfo: IKeyBackupInfo;
+    trustInfo: TrustInfo;
+}
+
+/* eslint-disable camelcase */
+export interface IPreparedKeyBackupVersion {
+    algorithm: string;
+    auth_data: AuthData;
+    recovery_key: string;
+    privateKey: Uint8Array;
+}
+/* eslint-enable camelcase */
+
 /** A function used to get the secret key for a backup.
 */
-type GetKey = () => Promise<Uint8Array>;
+type GetKey = () => Promise<ArrayLike<number>>;

 interface BackupAlgorithmClass {
    algorithmName: string;
@@ -66,22 +80,35 @@ interface BackupAlgorithmClass {
    prepare(
        key: string | Uint8Array | null,
    ): Promise<[Uint8Array, AuthData]>;
+
+    checkBackupVersion(info: IKeyBackupInfo): void;
 }

 interface BackupAlgorithm {
+    untrusted: boolean;
    encryptSession(data: Record<string, any>): Promise<any>;
-    decryptSessions(ciphertexts: Record<string, any>): Promise<Record<string, any>[]>;
+    decryptSessions(ciphertexts: Record<string, IKeyBackupSession>): Promise<IMegolmSessionData[]>;
    authData: AuthData;
-    keyMatches(key: Uint8Array): Promise<boolean>;
+    keyMatches(key: ArrayLike<number>): Promise<boolean>;
    free(): void;
 }

+export interface IKeyBackup {
+    rooms: {
+        [roomId: string]: {
+            sessions: {
+                [sessionId: string]: IKeyBackupSession;
+            };
+        };
+    };
+}
+
 /**
 * Manages the key backup.
 */
 export class BackupManager {
    private algorithm: BackupAlgorithm | undefined;
-    private backupInfo: BackupInfo | undefined; // The info dict from /room_keys/version
+    public backupInfo: IKeyBackupInfo | undefined; // The info dict from /room_keys/version
    public checkedForBackup: boolean; // Have we checked the server for a backup we can use?
    private sendingBackups: boolean; // Are we currently sending backups?
    constructor(private readonly baseApis: MatrixClient, public readonly getKey: GetKey) {
@@ -93,7 +120,25 @@ export class BackupManager {
        return this.backupInfo && this.backupInfo.version;
    }

-    public static async makeAlgorithm(info: BackupInfo, getKey: GetKey): Promise<BackupAlgorithm> {
+    /**
+     * Performs a quick check to ensure that the backup info looks sane.
+     *
+     * Throws an error if a problem is detected.
+     *
+     * @param {IKeyBackupInfo} info the key backup info
+     */
+    public static checkBackupVersion(info: IKeyBackupInfo): void {
+        const Algorithm = algorithmsByName[info.algorithm];
+        if (!Algorithm) {
+            throw new Error("Unknown backup algorithm: " + info.algorithm);
+        }
+        if (!(typeof info.auth_data === "object")) {
+            throw new Error("Invalid backup data returned");
+        }
+        return Algorithm.checkBackupVersion(info);
+    }
+
+    public static async makeAlgorithm(info: IKeyBackupInfo, getKey: GetKey): Promise<BackupAlgorithm> {
        const Algorithm = algorithmsByName[info.algorithm];
        if (!Algorithm) {
            throw new Error("Unknown backup algorithm");
@@ -101,7 +146,7 @@ export class BackupManager {
        return await Algorithm.init(info.auth_data, getKey);
    }

-    public async enableKeyBackup(info: BackupInfo): Promise<void> {
+    public async enableKeyBackup(info: IKeyBackupInfo): Promise<void> {
        this.backupInfo = info;
        if (this.algorithm) {
            this.algorithm.free();
@@ -109,7 +154,7 @@ export class BackupManager {

        this.algorithm = await BackupManager.makeAlgorithm(info, this.getKey);

-        this.baseApis.emit('crypto.keyBackupStatus', true);
+        this.baseApis.emit(CryptoEvent.KeyBackupStatus, true);

        // There may be keys left over from a partially completed backup, so
        // schedule a send to check.
@@ -127,7 +172,7 @@ export class BackupManager {

        this.backupInfo = undefined;

-        this.baseApis.emit('crypto.keyBackupStatus', false);
+        this.baseApis.emit(CryptoEvent.KeyBackupStatus, false);
    }

    public getKeyBackupEnabled(): boolean | null {
@@ -140,7 +185,7 @@ export class BackupManager {
    public async prepareKeyBackupVersion(
        key?: string | Uint8Array | null,
        algorithm?: string | undefined,
-    ): Promise<BackupInfo> {
+    ): Promise<IPreparedKeyBackupVersion> {
        const Algorithm = algorithm ? algorithmsByName[algorithm] : DefaultAlgorithm;
        if (!Algorithm) {
            throw new Error("Unknown backup algorithm");
@@ -156,7 +201,7 @@ export class BackupManager {
        };
    }

-    public async createKeyBackupVersion(info: BackupInfo): Promise<void> {
+    public async createKeyBackupVersion(info: IKeyBackupInfo): Promise<void> {
        this.algorithm = await BackupManager.makeAlgorithm(info, this.getKey);
    }

@@ -166,14 +211,14 @@ export class BackupManager {
     * one of the user's verified devices, start backing up
     * to it.
     */
-    public async checkAndStart(): Promise<{backupInfo: BackupInfo, trustInfo: TrustInfo}> {
+    public async checkAndStart(): Promise<IKeyBackupCheck> {
        logger.log("Checking key backup status...");
        if (this.baseApis.isGuest()) {
            logger.log("Skipping key backup check since user is guest");
            this.checkedForBackup = true;
            return null;
        }
-        let backupInfo: BackupInfo;
+        let backupInfo: IKeyBackupInfo;
        try {
            backupInfo = await this.baseApis.getKeyBackupVersion();
        } catch (e) {
@@ -232,7 +277,7 @@ export class BackupManager {
     *     trust information (as returned by isKeyBackupTrusted)
     *     in trustInfo.
     */
-    public async checkKeyBackup(): Promise<{backupInfo: BackupInfo, trustInfo: TrustInfo}> {
+    public async checkKeyBackup(): Promise<IKeyBackupCheck> {
        this.checkedForBackup = false;
        return this.checkAndStart();
    }
@@ -240,7 +285,7 @@ export class BackupManager {
    /**
     * Check if the given backup info is trusted.
     *
-     * @param {object} backupInfo key backup info dict from /room_keys/version
+     * @param {IKeyBackupInfo} backupInfo key backup info dict from /room_keys/version
     * @return {object} {
     *     usable: [bool], // is the backup trusted, true iff there is a sig that is valid & from a trusted device
     *     sigs: [
@@ -250,32 +295,44 @@ export class BackupManager {
     *     ]
     * }
     */
-    public async isKeyBackupTrusted(backupInfo: BackupInfo): Promise<TrustInfo> {
+    public async isKeyBackupTrusted(backupInfo: IKeyBackupInfo): Promise<TrustInfo> {
        const ret = {
            usable: false,
            trusted_locally: false,
-            sigs: [],
+            sigs: [] as SigInfo[],
        };

        if (
            !backupInfo ||
                !backupInfo.algorithm ||
                !backupInfo.auth_data ||
-                !backupInfo.auth_data.public_key ||
                !backupInfo.auth_data.signatures
        ) {
            logger.info("Key backup is absent or missing required data");
            return ret;
        }

-        const trustedPubkey = this.baseApis.crypto._sessionStore.getLocalTrustedBackupPubKey();
+        const privKey = await this.baseApis.crypto.getSessionBackupPrivateKey();
+        if (privKey) {
+            let algorithm;
+            try {
+                algorithm = await BackupManager.makeAlgorithm(backupInfo, async () => privKey);

-        if (backupInfo.auth_data.public_key === trustedPubkey) {
-            logger.info("Backup public key " + trustedPubkey + " is trusted locally");
-            ret.trusted_locally = true;
+                if (await algorithm.keyMatches(privKey)) {
+                    logger.info("Backup is trusted locally");
+                    ret.trusted_locally = true;
+                }
+            } catch {
+                // do nothing -- if we have an error, then we don't mark it as
+                // locally trusted
+            } finally {
+                if (algorithm) {
+                    algorithm.free();
+                }
+            }
        }

-        const mySigs = backupInfo.auth_data.signatures[this.baseApis.getUserId()] || [];
+        const mySigs = backupInfo.auth_data.signatures[this.baseApis.getUserId()] || {};

        for (const keyId of Object.keys(mySigs)) {
            const keyIdParts = keyId.split(':');
@@ -288,12 +345,12 @@ export class BackupManager {
            const sigInfo: SigInfo = { deviceId: keyIdParts[1] };

            // first check to see if it's from our cross-signing key
-            const crossSigningId = this.baseApis.crypto._crossSigningInfo.getId();
+            const crossSigningId = this.baseApis.crypto.crossSigningInfo.getId();
            if (crossSigningId === sigInfo.deviceId) {
                sigInfo.crossSigningId = true;
                try {
                    await verifySignature(
-                        this.baseApis.crypto._olmDevice,
+                        this.baseApis.crypto.olmDevice,
                        backupInfo.auth_data,
                        this.baseApis.getUserId(),
                        sigInfo.deviceId,
@@ -313,7 +370,7 @@ export class BackupManager {
            // Now look for a sig from a device
            // At some point this can probably go away and we'll just support
            // it being signed by the cross-signing master key
-            const device = this.baseApis.crypto._deviceList.getStoredDevice(
+            const device = this.baseApis.crypto.deviceList.getStoredDevice(
                this.baseApis.getUserId(), sigInfo.deviceId,
            );
            if (device) {
@@ -323,7 +380,7 @@ export class BackupManager {
                );
                try {
                    await verifySignature(
-                        this.baseApis.crypto._olmDevice,
+                        this.baseApis.crypto.olmDevice,
                        backupInfo.auth_data,
                        this.baseApis.getUserId(),
                        device.deviceId,
@@ -400,7 +457,7 @@ export class BackupManager {
                            await this.checkKeyBackup();
                            // Backup version has changed or this backup version
                            // has been deleted
-                            this.baseApis.crypto.emit("crypto.keyBackupFailed", err.data.errcode);
+                            this.baseApis.crypto.emit(CryptoEvent.KeyBackupFailed, err.data.errcode);
                            throw err;
                        }
                    }
@@ -422,23 +479,23 @@ export class BackupManager {
     * @param {integer} limit Maximum number of keys to back up
     * @returns {integer} Number of sessions backed up
     */
-    private async backupPendingKeys(limit: number): Promise<number> {
-        const sessions = await this.baseApis.crypto._cryptoStore.getSessionsNeedingBackup(limit);
+    public async backupPendingKeys(limit: number): Promise<number> {
+        const sessions = await this.baseApis.crypto.cryptoStore.getSessionsNeedingBackup(limit);
        if (!sessions.length) {
            return 0;
        }

-        let remaining = await this.baseApis.crypto._cryptoStore.countSessionsNeedingBackup();
-        this.baseApis.crypto.emit("crypto.keyBackupSessionsRemaining", remaining);
+        let remaining = await this.baseApis.crypto.cryptoStore.countSessionsNeedingBackup();
+        this.baseApis.crypto.emit(CryptoEvent.KeyBackupSessionsRemaining, remaining);

-        const data = {};
+        const rooms: IKeyBackup["rooms"] = {};
        for (const session of sessions) {
            const roomId = session.sessionData.room_id;
-            if (data[roomId] === undefined) {
-                data[roomId] = { sessions: {} };
+            if (rooms[roomId] === undefined) {
+                rooms[roomId] = { sessions: {} };
            }

-            const sessionData = await this.baseApis.crypto._olmDevice.exportInboundGroupSession(
+            const sessionData = await this.baseApis.crypto.olmDevice.exportInboundGroupSession(
                session.senderKey, session.sessionId, session.sessionData,
            );
            sessionData.algorithm = MEGOLM_ALGORITHM;
@@ -446,15 +503,15 @@ export class BackupManager {
            const forwardedCount =
                (sessionData.forwarding_curve25519_key_chain || []).length;

-            const userId = this.baseApis.crypto._deviceList.getUserByIdentityKey(
+            const userId = this.baseApis.crypto.deviceList.getUserByIdentityKey(
                MEGOLM_ALGORITHM, session.senderKey,
            );
-            const device = this.baseApis.crypto._deviceList.getDeviceByIdentityKey(
+            const device = this.baseApis.crypto.deviceList.getDeviceByIdentityKey(
                MEGOLM_ALGORITHM, session.senderKey,
            );
-            const verified = this.baseApis.crypto._checkDeviceInfoTrust(userId, device).isVerified();
+            const verified = this.baseApis.crypto.checkDeviceInfoTrust(userId, device).isVerified();

-            data[roomId]['sessions'][session.sessionId] = {
+            rooms[roomId]['sessions'][session.sessionId] = {
                first_message_index: sessionData.first_known_index,
                forwarded_count: forwardedCount,
                is_verified: verified,
@@ -462,14 +519,11 @@ export class BackupManager {
            };
        }

-        await this.baseApis.sendKeyBackup(
-            undefined, undefined, this.backupInfo.version,
-            { rooms: data },
-        );
+        await this.baseApis.sendKeyBackup(undefined, undefined, this.backupInfo.version, { rooms });

-        await this.baseApis.crypto._cryptoStore.unmarkSessionsNeedingBackup(sessions);
-        remaining = await this.baseApis.crypto._cryptoStore.countSessionsNeedingBackup();
-        this.baseApis.crypto.emit("crypto.keyBackupSessionsRemaining", remaining);
+        await this.baseApis.crypto.cryptoStore.unmarkSessionsNeedingBackup(sessions);
+        remaining = await this.baseApis.crypto.cryptoStore.countSessionsNeedingBackup();
+        this.baseApis.crypto.emit(CryptoEvent.KeyBackupSessionsRemaining, remaining);

        return sessions.length;
    }
@@ -477,7 +531,7 @@ export class BackupManager {
    public async backupGroupSession(
        senderKey: string, sessionId: string,
    ): Promise<void> {
-        await this.baseApis.crypto._cryptoStore.markSessionsNeedingBackup([{
+        await this.baseApis.crypto.cryptoStore.markSessionsNeedingBackup([{
            senderKey: senderKey,
            sessionId: sessionId,
        }]);
@@ -509,23 +563,23 @@ export class BackupManager {
     *     (which will be equal to the number of sessions in the store).
     */
    public async flagAllGroupSessionsForBackup(): Promise<number> {
-        await this.baseApis.crypto._cryptoStore.doTxn(
+        await this.baseApis.crypto.cryptoStore.doTxn(
            'readwrite',
            [
                IndexedDBCryptoStore.STORE_INBOUND_GROUP_SESSIONS,
                IndexedDBCryptoStore.STORE_BACKUP,
            ],
            (txn) => {
-                this.baseApis.crypto._cryptoStore.getAllEndToEndInboundGroupSessions(txn, (session) => {
+                this.baseApis.crypto.cryptoStore.getAllEndToEndInboundGroupSessions(txn, (session) => {
                    if (session !== null) {
-                        this.baseApis.crypto._cryptoStore.markSessionsNeedingBackup([session], txn);
+                        this.baseApis.crypto.cryptoStore.markSessionsNeedingBackup([session], txn);
                    }
                });
            },
        );

-        const remaining = await this.baseApis.crypto._cryptoStore.countSessionsNeedingBackup();
-        this.baseApis.emit("crypto.keyBackupSessionsRemaining", remaining);
+        const remaining = await this.baseApis.crypto.cryptoStore.countSessionsNeedingBackup();
+        this.baseApis.emit(CryptoEvent.KeyBackupSessionsRemaining, remaining);
        return remaining;
    }

@@ -534,7 +588,7 @@ export class BackupManager {
     * @returns {Promise<int>} Resolves to the number of sessions requiring backup
     */
    public countSessionsNeedingBackup(): Promise<number> {
-        return this.baseApis.crypto._cryptoStore.countSessionsNeedingBackup();
+        return this.baseApis.crypto.cryptoStore.countSessionsNeedingBackup();
    }
 }

@@ -542,7 +596,7 @@ export class Curve25519 implements BackupAlgorithm {
    public static algorithmName = "m.megolm_backup.v1.curve25519-aes-sha2";

    constructor(
-        public authData: AuthData,
+        public authData: ICurve25519AuthData,
        private publicKey: any, // FIXME: PkEncryption
        private getKey: () => Promise<Uint8Array>,
    ) {}
@@ -551,12 +605,12 @@ export class Curve25519 implements BackupAlgorithm {
        authData: AuthData,
        getKey: () => Promise<Uint8Array>,
    ): Promise<Curve25519> {
-        if (!authData || !authData.public_key) {
+        if (!authData || !("public_key" in authData)) {
            throw new Error("auth_data missing required information");
        }
        const publicKey = new global.Olm.PkEncryption();
        publicKey.set_recipient_key(authData.public_key);
-        return new Curve25519(authData, publicKey, getKey);
+        return new Curve25519(authData as ICurve25519AuthData, publicKey, getKey);
    }

    public static async prepare(
@@ -564,7 +618,7 @@ export class Curve25519 implements BackupAlgorithm {
    ): Promise<[Uint8Array, AuthData]> {
        const decryption = new global.Olm.PkDecryption();
        try {
-            const authData: AuthData = {};
+            const authData: Partial<ICurve25519AuthData> = {};
            if (!key) {
                authData.public_key = decryption.generate_key();
            } else if (key instanceof Uint8Array) {
@@ -580,13 +634,21 @@ export class Curve25519 implements BackupAlgorithm {

            return [
                decryption.get_private_key(),
-                authData,
+                authData as AuthData,
            ];
        } finally {
            decryption.free();
        }
    }

+    public static checkBackupVersion(info: IKeyBackupInfo): void {
+        if (!("public_key" in info.auth_data)) {
+            throw new Error("Invalid backup data returned");
+        }
+    }
+
+    public get untrusted() { return true; }
+
    public async encryptSession(data: Record<string, any>): Promise<any> {
        const plainText: Record<string, any> = Object.assign({}, data);
        delete plainText.session_id;
@@ -595,7 +657,7 @@ export class Curve25519 implements BackupAlgorithm {
        return this.publicKey.encrypt(JSON.stringify(plainText));
    }

-    public async decryptSessions(sessions: Record<string, Record<string, any>>): Promise<Record<string, any>[]> {
+    public async decryptSessions(sessions: Record<string, IKeyBackupSession>): Promise<IMegolmSessionData[]> {
        const privKey = await this.getKey();
        const decryption = new global.Olm.PkDecryption();
        try {
@@ -606,7 +668,7 @@ export class Curve25519 implements BackupAlgorithm {
                throw { errcode: MatrixClient.RESTORE_BACKUP_ERROR_BAD_KEY };
            }

-            const keys = [];
+            const keys: IMegolmSessionData[] = [];

            for (const [sessionId, sessionData] of Object.entries(sessions)) {
                try {
@@ -644,8 +706,120 @@ export class Curve25519 implements BackupAlgorithm {
    }
 }

+function randomBytes(size: number): Uint8Array {
+    const crypto: {randomBytes: (n: number) => Uint8Array} | undefined = getCrypto() as any;
+    if (crypto) {
+        // nodejs version
+        return crypto.randomBytes(size);
+    }
+    if (window?.crypto) {
+        // browser version
+        const buf = new Uint8Array(size);
+        window.crypto.getRandomValues(buf);
+        return buf;
+    }
+    throw new Error("No usable crypto implementation");
+}
+
+const UNSTABLE_MSC3270_NAME = new UnstableValue(null, "org.matrix.msc3270.v1.aes-hmac-sha2");
+
+export class Aes256 implements BackupAlgorithm {
+    public static algorithmName = UNSTABLE_MSC3270_NAME.name;
+
+    constructor(
+        public readonly authData: IAes256AuthData,
+        private readonly key: Uint8Array,
+    ) {}
+
+    public static async init(
+        authData: IAes256AuthData,
+        getKey: () => Promise<Uint8Array>,
+    ): Promise<Aes256> {
+        if (!authData) {
+            throw new Error("auth_data missing");
+        }
+        const key = await getKey();
+        if (authData.mac) {
+            const { mac } = await calculateKeyCheck(key, authData.iv);
+            if (authData.mac.replace(/=+$/g, '') !== mac.replace(/=+/g, '')) {
+                throw new Error("Key does not match");
+            }
+        }
+        return new Aes256(authData, key);
+    }
+
+    public static async prepare(
+        key: string | Uint8Array | null,
+    ): Promise<[Uint8Array, AuthData]> {
+        let outKey: Uint8Array;
+        const authData: Partial<IAes256AuthData> = {};
+        if (!key) {
+            outKey = randomBytes(32);
+        } else if (key instanceof Uint8Array) {
+            outKey = new Uint8Array(key);
+        } else {
+            const derivation = await keyFromPassphrase(key);
+            authData.private_key_salt = derivation.salt;
+            authData.private_key_iterations = derivation.iterations;
+            outKey = derivation.key;
+        }
+
+        const { iv, mac } = await calculateKeyCheck(outKey);
+        authData.iv = iv;
+        authData.mac = mac;
+
+        return [outKey, authData as AuthData];
+    }
+
+    public static checkBackupVersion(info: IKeyBackupInfo): void {
+        if (!("iv" in info.auth_data && "mac" in info.auth_data)) {
+            throw new Error("Invalid backup data returned");
+        }
+    }
+
+    public get untrusted() { return false; }
+
+    async encryptSession(data: Record<string, any>): Promise<any> {
+        const plainText: Record<string, any> = Object.assign({}, data);
+        delete plainText.session_id;
+        delete plainText.room_id;
+        delete plainText.first_known_index;
+        return await encryptAES(JSON.stringify(plainText), this.key, data.session_id);
+    }
+
+    async decryptSessions(sessions: Record<string, IKeyBackupSession>): Promise<IMegolmSessionData[]> {
+        const keys: IMegolmSessionData[] = [];
+
+        for (const [sessionId, sessionData] of Object.entries(sessions)) {
+            try {
+                const decrypted = JSON.parse(await decryptAES(sessionData.session_data, this.key, sessionId));
+                decrypted.session_id = sessionId;
+                keys.push(decrypted);
+            } catch (e) {
+                logger.log("Failed to decrypt megolm session from backup", e, sessionData);
+            }
+        }
+        return keys;
+    }
+
+    async keyMatches(key: Uint8Array): Promise<boolean> {
+        if (this.authData.mac) {
+            const { mac } = await calculateKeyCheck(key, this.authData.iv);
+            return this.authData.mac.replace(/=+$/g, '') === mac.replace(/=+/g, '');
+        } else {
+            // if we have no information, we have to assume the key is right
+            return true;
+        }
+    }
+
+    public free(): void {
+        this.key.fill(0);
+    }
+}
+
 export const algorithmsByName: Record<string, BackupAlgorithmClass> = {
    [Curve25519.algorithmName]: Curve25519,
+    [Aes256.algorithmName]: Aes256,
 };

 export const DefaultAlgorithm: BackupAlgorithmClass = Curve25519;
@@ -14,15 +14,16 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

+import anotherjson from "another-json";
+
 import { decodeBase64, encodeBase64 } from './olmlib';
 import { IndexedDBCryptoStore } from '../crypto/store/indexeddb-crypto-store';
 import { decryptAES, encryptAES } from './aes';
-import anotherjson from "another-json";
 import { logger } from '../logger';
-import { ISecretStorageKeyInfo } from "../matrix";
-
-// FIXME: these types should eventually go in a different file
-type Signatures = Record<string, Record<string, string>>;
+import { ISecretStorageKeyInfo } from "./api";
+import { Crypto } from "./index";
+import { Method } from "../http-api";
+import { ISignatures } from "../@types/signed";

 export interface IDehydratedDevice {
    device_id: string; // eslint-disable-line camelcase
@@ -36,18 +37,18 @@ export interface IDehydratedDeviceKeyInfo {
    passphrase?: string;
 }

-interface DeviceKeys {
+export interface IDeviceKeys {
    algorithms: Array<string>;
    device_id: string; // eslint-disable-line camelcase
    user_id: string; // eslint-disable-line camelcase
    keys: Record<string, string>;
-    signatures?: Signatures;
+    signatures?: ISignatures;
 }

-interface OneTimeKey {
+export interface IOneTimeKey {
    key: string;
    fallback?: boolean;
-    signatures?: Signatures;
+    signatures?: ISignatures;
 }

 export const DEHYDRATION_ALGORITHM = "org.matrix.msc2697.v1.olm.libolm_pickle";
@@ -60,20 +61,20 @@ export class DehydrationManager {
    private key: Uint8Array;
    private keyInfo: {[props: string]: any};
    private deviceDisplayName: string;
-    constructor(private crypto) {
+    constructor(private readonly crypto: Crypto) {
        this.getDehydrationKeyFromCache();
    }
    async getDehydrationKeyFromCache(): Promise<void> {
-        return await this.crypto._cryptoStore.doTxn(
+        return await this.crypto.cryptoStore.doTxn(
            'readonly',
            [IndexedDBCryptoStore.STORE_ACCOUNT],
            (txn) => {
-                this.crypto._cryptoStore.getSecretStorePrivateKey(
+                this.crypto.cryptoStore.getSecretStorePrivateKey(
                    txn,
                    async (result) => {
                        if (result) {
                            const { key, keyInfo, deviceDisplayName, time } = result;
-                            const pickleKey = Buffer.from(this.crypto._olmDevice._pickleKey);
+                            const pickleKey = Buffer.from(this.crypto.olmDevice.pickleKey);
                            const decrypted = await decryptAES(key, pickleKey, DEHYDRATION_ALGORITHM);
                            this.key = decodeBase64(decrypted);
                            this.keyInfo = keyInfo;
@@ -114,11 +115,11 @@ export class DehydrationManager {
                this.timeoutId = undefined;
            }
            // clear storage
-            await this.crypto._cryptoStore.doTxn(
+            await this.crypto.cryptoStore.doTxn(
                'readwrite',
                [IndexedDBCryptoStore.STORE_ACCOUNT],
                (txn) => {
-                    this.crypto._cryptoStore.storeSecretStorePrivateKey(
+                    this.crypto.cryptoStore.storeSecretStorePrivateKey(
                        txn, "dehydration", null,
                    );
                },
@@ -158,15 +159,15 @@ export class DehydrationManager {
            this.timeoutId = undefined;
        }
        try {
-            const pickleKey = Buffer.from(this.crypto._olmDevice._pickleKey);
+            const pickleKey = Buffer.from(this.crypto.olmDevice.pickleKey);

            // update the crypto store with the timestamp
            const key = await encryptAES(encodeBase64(this.key), pickleKey, DEHYDRATION_ALGORITHM);
-            await this.crypto._cryptoStore.doTxn(
+            await this.crypto.cryptoStore.doTxn(
                'readwrite',
                [IndexedDBCryptoStore.STORE_ACCOUNT],
                (txn) => {
-                    this.crypto._cryptoStore.storeSecretStorePrivateKey(
+                    this.crypto.cryptoStore.storeSecretStorePrivateKey(
                        txn, "dehydration",
                        {
                            keyInfo: this.keyInfo,
@@ -205,9 +206,10 @@ export class DehydrationManager {
            }

            logger.log("Uploading account to server");
-            const dehydrateResult = await this.crypto._baseApis.http.authedRequest(
+            // eslint-disable-next-line camelcase
+            const dehydrateResult = await this.crypto.baseApis.http.authedRequest<{ device_id: string }>(
                undefined,
-                "PUT",
+                Method.Put,
                "/dehydrated_device",
                undefined,
                {
@@ -222,10 +224,10 @@ export class DehydrationManager {
            // send the keys to the server
            const deviceId = dehydrateResult.device_id;
            logger.log("Preparing device keys", deviceId);
-            const deviceKeys: DeviceKeys = {
-                algorithms: this.crypto._supportedAlgorithms,
+            const deviceKeys: IDeviceKeys = {
+                algorithms: this.crypto.supportedAlgorithms,
                device_id: deviceId,
-                user_id: this.crypto._userId,
+                user_id: this.crypto.userId,
                keys: {
                    [`ed25519:${deviceId}`]: e2eKeys.ed25519,
                    [`curve25519:${deviceId}`]: e2eKeys.curve25519,
@@ -233,21 +235,21 @@ export class DehydrationManager {
            };
            const deviceSignature = account.sign(anotherjson.stringify(deviceKeys));
            deviceKeys.signatures = {
-                [this.crypto._userId]: {
+                [this.crypto.userId]: {
                    [`ed25519:${deviceId}`]: deviceSignature,
                },
            };
-            if (this.crypto._crossSigningInfo.getId("self_signing")) {
-                await this.crypto._crossSigningInfo.signObject(deviceKeys, "self_signing");
+            if (this.crypto.crossSigningInfo.getId("self_signing")) {
+                await this.crypto.crossSigningInfo.signObject(deviceKeys, "self_signing");
            }

            logger.log("Preparing one-time keys");
-            const oneTimeKeys = {};
+            const oneTimeKeys: Record<string, IOneTimeKey> = {};
            for (const [keyId, key] of Object.entries(otks.curve25519)) {
-                const k: OneTimeKey = { key };
+                const k: IOneTimeKey = { key };
                const signature = account.sign(anotherjson.stringify(k));
                k.signatures = {
-                    [this.crypto._userId]: {
+                    [this.crypto.userId]: {
                        [`ed25519:${deviceId}`]: signature,
                    },
                };
@@ -257,10 +259,10 @@ export class DehydrationManager {
            logger.log("Preparing fallback keys");
            const fallbackKeys = {};
            for (const [keyId, key] of Object.entries(fallbacks.curve25519)) {
-                const k: OneTimeKey = { key, fallback: true };
+                const k: IOneTimeKey = { key, fallback: true };
                const signature = account.sign(anotherjson.stringify(k));
                k.signatures = {
-                    [this.crypto._userId]: {
+                    [this.crypto.userId]: {
                        [`ed25519:${deviceId}`]: signature,
                    },
                };
@@ -268,9 +270,9 @@ export class DehydrationManager {
            }

            logger.log("Uploading keys to server");
-            await this.crypto._baseApis.http.authedRequest(
+            await this.crypto.baseApis.http.authedRequest(
                undefined,
-                "POST",
+                Method.Post,
                "/keys/upload/" + encodeURI(deviceId),
                undefined,
                {
@@ -292,7 +294,7 @@ export class DehydrationManager {
        }
    }

-    private stop() {
+    public stop() {
        if (this.timeoutId) {
            global.clearTimeout(this.timeoutId);
            this.timeoutId = undefined;
@@ -1,168 +0,0 @@
-/*
-Copyright 2016 OpenMarket Ltd
-Copyright 2019 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-/**
- * @module crypto/deviceinfo
- */
-
-/**
-  * Information about a user's device
-  *
-  * @constructor
-  * @alias module:crypto/deviceinfo
-  *
-  * @property {string} deviceId the ID of this device
-  *
-  * @property {string[]} algorithms list of algorithms supported by this device
-  *
-  * @property {Object.<string,string>} keys a map from
-  *      &lt;key type&gt;:&lt;id&gt; -> &lt;base64-encoded key&gt;>
-  *
-  * @property {module:crypto/deviceinfo.DeviceVerification} verified
-  *     whether the device has been verified/blocked by the user
-  *
-  * @property {boolean} known
-  *     whether the user knows of this device's existence (useful when warning
-  *     the user that a user has added new devices)
-  *
-  * @property {Object} unsigned  additional data from the homeserver
-  *
-  * @param {string} deviceId id of the device
-  */
-export function DeviceInfo(deviceId) {
-    // you can't change the deviceId
-    Object.defineProperty(this, 'deviceId', {
-        enumerable: true,
-        value: deviceId,
-    });
-
-    this.algorithms = [];
-    this.keys = {};
-    this.verified = DeviceVerification.UNVERIFIED;
-    this.known = false;
-    this.unsigned = {};
-    this.signatures = {};
-}
-
-/**
- * rehydrate a DeviceInfo from the session store
- *
- * @param {object} obj  raw object from session store
- * @param {string} deviceId id of the device
- *
- * @return {module:crypto~DeviceInfo} new DeviceInfo
- */
-DeviceInfo.fromStorage = function(obj, deviceId) {
-    const res = new DeviceInfo(deviceId);
-    for (const prop in obj) {
-        if (obj.hasOwnProperty(prop)) {
-            res[prop] = obj[prop];
-        }
-    }
-    return res;
-};
-
-/**
- * Prepare a DeviceInfo for JSON serialisation in the session store
- *
- * @return {object} deviceinfo with non-serialised members removed
- */
-DeviceInfo.prototype.toStorage = function() {
-    return {
-        algorithms: this.algorithms,
-        keys: this.keys,
-        verified: this.verified,
-        known: this.known,
-        unsigned: this.unsigned,
-        signatures: this.signatures,
-    };
-};
-
-/**
- * Get the fingerprint for this device (ie, the Ed25519 key)
- *
- * @return {string} base64-encoded fingerprint of this device
- */
-DeviceInfo.prototype.getFingerprint = function() {
-    return this.keys["ed25519:" + this.deviceId];
-};
-
-/**
- * Get the identity key for this device (ie, the Curve25519 key)
- *
- * @return {string} base64-encoded identity key of this device
- */
-DeviceInfo.prototype.getIdentityKey = function() {
-    return this.keys["curve25519:" + this.deviceId];
-};
-
-/**
- * Get the configured display name for this device, if any
- *
- * @return {string?} displayname
- */
-DeviceInfo.prototype.getDisplayName = function() {
-    return this.unsigned.device_display_name || null;
-};
-
-/**
- * Returns true if this device is blocked
- *
- * @return {Boolean} true if blocked
- */
-DeviceInfo.prototype.isBlocked = function() {
-    return this.verified == DeviceVerification.BLOCKED;
-};
-
-/**
- * Returns true if this device is verified
- *
- * @return {Boolean} true if verified
- */
-DeviceInfo.prototype.isVerified = function() {
-    return this.verified == DeviceVerification.VERIFIED;
-};
-
-/**
- * Returns true if this device is unverified
- *
- * @return {Boolean} true if unverified
- */
-DeviceInfo.prototype.isUnverified = function() {
-    return this.verified == DeviceVerification.UNVERIFIED;
-};
-
-/**
- * Returns true if the user knows about this device's existence
- *
- * @return {Boolean} true if known
- */
-DeviceInfo.prototype.isKnown = function() {
-    return this.known == true;
-};
-
-/**
- * @enum
- */
-DeviceInfo.DeviceVerification = {
-    VERIFIED: 1,
-    UNVERIFIED: 0,
-    BLOCKED: -1,
-};
-
-const DeviceVerification = DeviceInfo.DeviceVerification;
-
@@ -0,0 +1,177 @@
+/*
+Copyright 2016 - 2021 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { ISignatures } from "../@types/signed";
+
+/**
+ * @module crypto/deviceinfo
+ */
+
+export interface IDevice {
+    keys: Record<string, string>;
+    algorithms: string[];
+    verified: DeviceVerification;
+    known: boolean;
+    unsigned?: Record<string, any>;
+    signatures?: ISignatures;
+}
+
+enum DeviceVerification {
+    Blocked = -1,
+    Unverified = 0,
+    Verified = 1,
+}
+
+/**
+  * Information about a user's device
+  *
+  * @constructor
+  * @alias module:crypto/deviceinfo
+  *
+  * @property {string} deviceId the ID of this device
+  *
+  * @property {string[]} algorithms list of algorithms supported by this device
+  *
+  * @property {Object.<string,string>} keys a map from
+  *      &lt;key type&gt;:&lt;id&gt; -> &lt;base64-encoded key&gt;>
+  *
+  * @property {module:crypto/deviceinfo.DeviceVerification} verified
+  *     whether the device has been verified/blocked by the user
+  *
+  * @property {boolean} known
+  *     whether the user knows of this device's existence (useful when warning
+  *     the user that a user has added new devices)
+  *
+  * @property {Object} unsigned  additional data from the homeserver
+  *
+  * @param {string} deviceId id of the device
+  */
+export class DeviceInfo {
+    /**
+     * rehydrate a DeviceInfo from the session store
+     *
+     * @param {object} obj  raw object from session store
+     * @param {string} deviceId id of the device
+     *
+     * @return {module:crypto~DeviceInfo} new DeviceInfo
+     */
+    public static fromStorage(obj: Partial<IDevice>, deviceId: string): DeviceInfo {
+        const res = new DeviceInfo(deviceId);
+        for (const prop in obj) {
+            if (obj.hasOwnProperty(prop)) {
+                res[prop] = obj[prop];
+            }
+        }
+        return res;
+    }
+
+    /**
+     * @enum
+     */
+    public static DeviceVerification = {
+        VERIFIED: DeviceVerification.Verified,
+        UNVERIFIED: DeviceVerification.Unverified,
+        BLOCKED: DeviceVerification.Blocked,
+    };
+
+    public algorithms: string[];
+    public keys: Record<string, string> = {};
+    public verified = DeviceVerification.Unverified;
+    public known = false;
+    public unsigned: Record<string, any> = {};
+    public signatures: ISignatures = {};
+
+    constructor(public readonly deviceId: string) {}
+
+    /**
+     * Prepare a DeviceInfo for JSON serialisation in the session store
+     *
+     * @return {object} deviceinfo with non-serialised members removed
+     */
+    public toStorage(): IDevice {
+        return {
+            algorithms: this.algorithms,
+            keys: this.keys,
+            verified: this.verified,
+            known: this.known,
+            unsigned: this.unsigned,
+            signatures: this.signatures,
+        };
+    }
+
+    /**
+     * Get the fingerprint for this device (ie, the Ed25519 key)
+     *
+     * @return {string} base64-encoded fingerprint of this device
+     */
+    public getFingerprint(): string {
+        return this.keys["ed25519:" + this.deviceId];
+    }
+
+    /**
+     * Get the identity key for this device (ie, the Curve25519 key)
+     *
+     * @return {string} base64-encoded identity key of this device
+     */
+    public getIdentityKey(): string {
+        return this.keys["curve25519:" + this.deviceId];
+    }
+
+    /**
+     * Get the configured display name for this device, if any
+     *
+     * @return {string?} displayname
+     */
+    public getDisplayName(): string | null {
+        return this.unsigned.device_display_name || null;
+    }
+
+    /**
+     * Returns true if this device is blocked
+     *
+     * @return {Boolean} true if blocked
+     */
+    public isBlocked(): boolean {
+        return this.verified == DeviceVerification.Blocked;
+    }
+
+    /**
+     * Returns true if this device is verified
+     *
+     * @return {Boolean} true if verified
+     */
+    public isVerified(): boolean {
+        return this.verified == DeviceVerification.Verified;
+    }
+
+    /**
+     * Returns true if this device is unverified
+     *
+     * @return {Boolean} true if unverified
+     */
+    public isUnverified(): boolean {
+        return this.verified == DeviceVerification.Unverified;
+    }
+
+    /**
+     * Returns true if the user knows about this device's existence
+     *
+     * @return {Boolean} true if known
+     */
+    public isKnown(): boolean {
+        return this.known === true;
+    }
+}
--- a/Show More
+++ b/Show More